Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe

Overview

General Information

Sample Name:	SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe
Analysis ID:	800798
MD5:	97011b19f2683a918f1f07f7f4ec1998
SHA1:	4b486d0b67994fabe961787f5facdf9a0e3f6672
SHA256:	c1469167b9700aeca987573c023ec7f160dadf8309a7a4feb2cd1969ad66673e
Tags:	exe
Infos:

Detection

Score:	32
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

Multi AV Scanner detection for submitted file

Multi AV Scanner detection for dropped file

Machine Learning detection for sample

Machine Learning detection for dropped file

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Antivirus or Machine Learning detection for unpacked file

Contains functionality to shutdown / reboot the system

Detected potential crypto function

Stores files to the Windows start menu directory

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Creates a DirectInput object (often for capturing keystrokes)

Drops PE files

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a process in suspended mode (likely to inject code)

Contains functionality for read data from the clipboard

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

Sample searches for specific file, try point organization specific fake files to the analysis machine

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe (PID: 3500 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe MD5: 97011B19F2683A918F1F07F7F4EC1998)

ModSource UI Addon Pack.exe (PID: 5900 cmdline: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe MD5: DC0AEE7C1898F76B9D61CE023B91539C)

chrome.exe (PID: 3248 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Documentation\Readme ModSource UI Addon Pack.html MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 5844 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1832 --field-trial-handle=1800,i,4957897538365028636,534134650291675046,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

cleanup

HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 07 Feb 2023 18:59:16 GMTServer: ApacheX-Frame-Options: SAMEORIGINLast-Modified: Sun, 16 Aug 2009 06:01:33 GMTETag: "57074349-111d8d-4713c046be940"Accept-Ranges: bytesContent-Length: 1121677Connection: closeContent-Type: application/zipData Raw: 50 4b 03 04 14 00 02 00 08 00 7b 9d 0f 3b 51 b7 76 de f5 1c 11 00 87 83 11 00 1b 00 00 00 4d 6f 64 53 6f 75 72 63 65 20 55 49 20 41 64 64 6f 6e 20 50 61 63 6b 2e 65 78 65 ec fd 07 5c 53 49 d7 38 8e df 90 00 91 62 50 41 51 51 51 b1 62 dd d8 10 0b 28 c1 8a a0 48 62 c1 82 14 43 44 40 48 04 0b 02 06 04 8c 88 5d b1 2b b2 36 ec 0d 3b 58 00 15 15 1b d6 55 2c ab 17 51 17 57 4a a8 e7 7f 66 6e 50 77 d7 7d 9e e7 7d df e7 fb 7e bf bf ff e7 89 1e ee dc a9 67 ce 9c 39 65 66 ee bd 2e 93 56 30 7c 86 61 04 08 00 0c 93 ce 70 3f 07 e6 9f ff f2 10 ea b7 3a 53 9f 39 5e ef 66 eb 74 de e8 9b ad c7 cb fd 43 ad 83 43 82 66 86 78 cd b6 f6 f6 0a 0c 0c 52 5a cf f0 b5 0e 51 05 5a fb 07 5a 3b b9 ba 5b cf 0e f2 f1 ed 66 6a 6a 64 a3 ab e3 57 d5 c8 3d 3b cc 6d aa ea a0 bb d5 82 aa 14 1a 6e 57 d5 1f af 6d ac e6 55 1d c6 6b 69 5f f3 aa 3d 78 f5 6b d8 a6 6a 3b 5e c7 f9 7b cb 49 fe 3f e3 e4 26 61 98 d1 3c 7d a6 fb c5 4f c3 ea e2 0a 18 11 cf 98 67 c0 30 93 f0 e6 3e 8f 76 b6 dd 4f 18 36 43 08 d6 f5 96 84 f5 38 3a 30 cc b7 2b e3 26 f8 7a a3 47 ff 9a 71 79 bf 5e bf 5e e8 6f 57 28 c3 1c a7 c4 e1 33 2b c2 98 7f df 0f f1 5c a6 f7 f7 c9 dd 94 be e1 4a bc f6 9a a8 43 68 d2 f7 9d e0 7e d6 0c 33 bd 5b 88 8f 97 d2 8b 61 56 34 d0 f5 bd 21 c2 d4 3f e6 43 6a 38 74 e3 b2 31 1b 0e 21 bd 56 e8 ea 0a fe 4b be 8c 6e 81 ba 8c 2b 30 9f c3 8f 11 8c 22 f9 42 42 43 bc 49 b6 30 8e 36 4c 38 5e 95 7f 6d 97 f9 cf ef 7f f5 e7 a1 f9 a0 fe e0 a9 8e 30 11 29 6d f1 af b3 46 62 ae 32 55 0f b7 34 d3 98 ee 19 34 84 49 18 2e 70 03 95 19 a8 4c 40 25 04 8b e1 21 0e 4c e1 10 1c 69 77 a9 a6 f7 61 4c 4f 94 ec 92 b9 d1 a4 d1 98 a4 f6 2d 61 12 24 26 89 92 37 5c 9c 1b c6 69 22 8a d5 be c5 8c a6 85 53 30 96 45 56 60 44 27 9d c7 89 4e 4a a5 a2 43 1e ac e6 b6 ad 0b 2b 3a 94 c9 bf 94 e0 62 96 5c 0e e2 bb 4b 8b 31 7d 2c 46 89 4e 8e f1 10 1d 72 61 f9 99 9a eb 98 82 25 c6 93 12 4b 73 30 dd 4d 74 48 62 c6 bf 84 d1 99 2f 85 a2 93 19 c6 39 89 92 12 b7 04 17 2d a2 88 cd a8 25 c5 82 04 89 b9 1b 87 88 09 58 8c 47 44 40 65 0e f7 d4 12 56 60 17 c1 8a 96 85 01 80 7a d1 04 50 fa c2 dc 5e 88 3d 96 8a cd c0 32 4a 0f 4d 84 89 82 27 cb 96 bc 21 b3 28 5b c2 0a 89 64 b4 70 c3 0c 30 77 82 0c eb 0a a6 75 69 7a 4f c0 80 0c f2 b9 0e cb ad 31 9f 9b 02 e4 db fb 0c c1 58 8b 09 b4 45 13 4c a7 ed 22 9d 38 92 78 62 fc b4 a9 e2 8c c9 d7 2e 99 31 9a d1 36 82 1d 39 48 46 cd 1d 77 ff bb 96 38 c5 a4 32 cd 78 3d 61 d9 25 3d a5 6b e2 1c 9e 18 ec 7b e7 62 72 e8 10 cd 2d ff 6b 24 3d d1 89 27 d4 08 cb 32 f5 94 fc 61 45 2d cb 32 05 ca 7a 9a db ae b1 d7 94 d6 45 66 65 99 66 2a 63 cd 63 f1 13 f5 6b 9e f8 71 82 a5 b3 3e 29 c1 d5 10 72 7d da d4 c9 97 04 64 b8 c7 8e d5 78 08 71 fc 7e f7 2f 23 e9 9a 16 04 01 f1 35 fe 17 59 82 4b 35 92 50 e3 2c dc a3 a7 34 b6 73 31 51 1a d8 5c 18 92 e0 2c b4

Source: ModSource UI Addon Pack.exe, 00000001.00000002.422163287.0000000002BD2000.00000004.00000020.00020000.00000000.sdmp, nsa449D.tmp.1.dr	String found in binary or memory: http://modsource.org
Source: SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000002.346975161.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, ModSource UI Addon Pack.exe, 00000001.00000002.422163287.00000000026DC000.00000004.00000020.00020000.00000000.sdmp, ModSource UI Addon Pack.exe, 00000001.00000002.421708783.00000000006F1000.00000004.00000020.00020000.00000000.sdmp, nsa449D.tmp.1.dr	String found in binary or memory: http://modsource.org/Files/SWG/Mods/ModSource_UI_Addon_Pack.ver
Source: SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000002.346975161.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://modsource.org/Files/SWG/Mods/ModSource_UI_Addon_Pack.ver/TIMEOUT=30000download
Source: ModSource UI Addon Pack.exe, 00000001.00000002.422163287.00000000026DC000.00000004.00000020.00020000.00000000.sdmp, ModSource UI Addon Pack.exe, 00000001.00000002.421708783.00000000006F1000.00000004.00000020.00020000.00000000.sdmp, nsa449D.tmp.1.dr	String found in binary or memory: http://modsource.org/Files/SWG/Mods/ModSource_UI_Addon_Pack.ver/TIMEOUT=30000downloadhttp://users.on
Source: nsa449D.tmp.1.dr	String found in binary or memory: http://modsource.org/Files/SWG/Mods/ModSource_UI_Addon_Pack.zip
Source: SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000002.346975161.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, ModSource UI Addon Pack.exe, 00000001.00000002.422163287.00000000026DC000.00000004.00000020.00020000.00000000.sdmp, ModSource UI Addon Pack.exe, 00000001.00000002.421708783.00000000006F1000.00000004.00000020.00020000.00000000.sdmp, nsa449D.tmp.1.dr	String found in binary or memory: http://modsource.org/Files/SWG/Mods/ModSource_UI_Addon_Pack.ziphttp://users.on.net/~anach/Files/SWG/
Source: ModSource UI Addon Pack.exe, ModSource UI Addon Pack.exe, 00000001.00000000.345573605.0000000000409000.00000008.00000001.01000000.00000007.sdmp, ModSource UI Addon Pack.exe, 00000001.00000002.422163287.0000000002BD2000.00000004.00000020.00020000.00000000.sdmp, ModSource UI Addon Pack.exe, 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmp, ModSource UI Addon Pack.exe, 00000001.00000003.410469484.0000000000792000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, Uninstall the ModSource UI Addon Pack.exe.1.dr, ModSource UI Addon Pack.exe.0.dr, nsa449D.tmp.1.dr	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, Uninstall the ModSource UI Addon Pack.exe.1.dr, ModSource UI Addon Pack.exe.0.dr, nsa449D.tmp.1.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: ModSource UI Addon Pack.exe, 00000001.00000002.422163287.0000000002BD2000.00000004.00000020.00020000.00000000.sdmp, nsa449D.tmp.1.dr	String found in binary or memory: http://tassyp2p.optikal.net/viewtopic.php?f=45&t=837
Source: SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000002.346975161.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, ModSource UI Addon Pack.exe, 00000001.00000002.422163287.00000000026DC000.00000004.00000020.00020000.00000000.sdmp, ModSource UI Addon Pack.exe, 00000001.00000002.421708783.00000000006F1000.00000004.00000020.00020000.00000000.sdmp, nsa449D.tmp.1.dr	String found in binary or memory: http://unguilded.traumschmiede.com/Files/Mods/ModSource_UI_Addon_Pack.ver
Source: SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000002.346975161.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, ModSource UI Addon Pack.exe, 00000001.00000002.422163287.00000000026DC000.00000004.00000020.00020000.00000000.sdmp, ModSource UI Addon Pack.exe, 00000001.00000002.421708783.00000000006F1000.00000004.00000020.00020000.00000000.sdmp, nsa449D.tmp.1.dr	String found in binary or memory: http://unguilded.traumschmiede.com/Files/Mods/ModSource_UI_Addon_Pack.zip
Source: SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000002.346975161.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, ModSource UI Addon Pack.exe, 00000001.00000002.422163287.00000000026DC000.00000004.00000020.00020000.00000000.sdmp, ModSource UI Addon Pack.exe, 00000001.00000002.421708783.00000000006F1000.00000004.00000020.00020000.00000000.sdmp, nsa449D.tmp.1.dr	String found in binary or memory: http://users.on.net/~anach/Files/SWG/ModSource_UI_Addon_Pack.ver
Source: SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000002.346975161.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://users.on.net/~anach/Files/SWG/ModSource_UI_Addon_Pack.verhttp://unguilded.traumschmiede.com/F
Source: SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000002.346975161.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, ModSource UI Addon Pack.exe, 00000001.00000002.422163287.00000000026DC000.00000004.00000020.00020000.00000000.sdmp, ModSource UI Addon Pack.exe, 00000001.00000002.421708783.00000000006F1000.00000004.00000020.00020000.00000000.sdmp, nsa449D.tmp.1.dr	String found in binary or memory: http://users.on.net/~anach/Files/SWG/ModSource_UI_Addon_Pack.zip
Source: nsa449D.tmp.1.dr	String found in binary or memory: http://www.modsource.org
Source: ModSource UI Addon Pack.exe, 00000001.00000002.421708783.000000000073C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.modsource.org/
Source: Mod-Source - Your Source for SWG Modding Stuff.lnk.1.dr	String found in binary or memory: http://www.modsource.org/DC:
Source: ModSource UI Addon Pack.exe, 00000001.00000002.422163287.00000000026DC000.00000004.00000020.00020000.00000000.sdmp, ModSource UI Addon Pack.exe, 00000001.00000002.421708783.00000000006F1000.00000004.00000020.00020000.00000000.sdmp, nsa449D.tmp.1.dr	String found in binary or memory: http://www.modsource.orgopen
Source: ModSource UI Addon Pack.exe, 00000001.00000002.421708783.000000000073C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.modsource.orgw8
Source: SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332799089.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bplaced.net/
Source: SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332433511.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332819641.00000000006ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bplaced.net/apple-touch-icon.png
Source: SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332365541.00000000006F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332799089.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bplaced.net/contact
Source: SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332365541.00000000006F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332799089.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bplaced.net/datenschutz
Source: SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332433511.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332819641.00000000006ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bplaced.net/favicon-16x16.png
Source: SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332433511.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332819641.00000000006ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bplaced.net/favicon-32x32.png
Source: SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332433511.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332819641.00000000006ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bplaced.net/favicon.ico
Source: SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332799089.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bplaced.net/gfx/emblem_b_xs.png
Source: SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332365541.00000000006F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332799089.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bplaced.net/impressum
Source: SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332365541.00000000006F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332799089.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bplaced.net/privacy
Source: SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332433511.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332819641.00000000006ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bplaced.net/safari-pinned-tab.svg

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8

Source: unknown

DNS traffic detected: queries for: modsource.org

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-104.0.5112.81Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /Files/SWG/Mods/ModSource_UI_Addon_Pack.ver HTTP/1.0Host: modsource.orgUser-Agent: NSISDL/1.2 (Mozilla)Accept: /
Source: global traffic	HTTP traffic detected: GET /Files/SWG/Mods/ModSource_UI_Addon_Pack.ver HTTP/1.0Host: modsource.orgUser-Agent: NSISDL/1.2 (Mozilla)Accept: /
Source: global traffic	HTTP traffic detected: GET /~anach/Files/SWG/ModSource_UI_Addon_Pack.ver HTTP/1.0Host: users.on.netUser-Agent: NSISDL/1.2 (Mozilla)Accept: /
Source: global traffic	HTTP traffic detected: GET /Files/SWG/Mods/ModSource_UI_Addon_Pack.zip HTTP/1.0Host: modsource.orgUser-Agent: NSISDL/1.2 (Mozilla)Accept: /
Source: global traffic	HTTP traffic detected: GET /Files/SWG/Mods/ModSource_UI_Addon_Pack.zip HTTP/1.0Host: modsource.orgUser-Agent: NSISDL/1.2 (Mozilla)Accept: /
Source: global traffic	HTTP traffic detected: GET /~anach/Files/SWG/ModSource_UI_Addon_Pack.zip HTTP/1.0Host: users.on.netUser-Agent: NSISDL/1.2 (Mozilla)Accept: /

Source: ModSource UI Addon Pack.exe, 00000001.00000002.421708783.00000000006BA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe

Code function: 0_2_00404F1F GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00404F1F

Source: SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe	Code function: 0_2_00403225 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		0_2_00403225
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Code function: 1_2_00403225 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		1_2_00403225

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe	Code function: 0_2_0040600A	0_2_0040600A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe	Code function: 0_2_00404730	0_2_00404730
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Code function: 1_2_00404730	1_2_00404730
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Code function: 1_2_0040600A	1_2_0040600A

Source: SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe	ReversingLabs: Detection: 17%
Source: SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe	Virustotal: Detection: 19%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe

Jump to behavior

Source: SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe	Process created: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Documentation\Readme ModSource UI Addon Pack.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1832 --field-trial-handle=1800,i,4957897538365028636,534134650291675046,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe	Process created: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Documentation\Readme ModSource UI Addon Pack.html	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1832 --field-trial-handle=1800,i,4957897538365028636,534134650291675046,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: ModSource UI Addon Pack Silent Updater.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Updater\ModSource UI Addon Pack Auto Updater Silent.exe
Source: Uninstall the ModSource UI Addon Pack.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Uninstall the ModSource UI Addon Pack.exe
Source: ModSource UI Addon Pack Updater.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Updater\ModSource UI Addon Pack Auto Updater.exe
Source: Readme ModSource UI Addon Pack.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Documentation\Readme ModSource UI Addon Pack.html
Source: Pre-NGE UI Changelog.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Changelog_PreNGE_UI.txt

Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ModSource UI Addon Pack Silent Updater.lnk

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe

File created: C:\Users\user\AppData\Local\Temp\nsb13F7.tmp

Jump to behavior

Source: classification engine

Classification label: sus32.winEXE@29/101@12/8

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe

Code function: 0_2_00402012 CoCreateInstance,MultiByteToWideChar,

0_2_00402012

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe

Code function: 0_2_00404275 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_00404275

Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe

File created: C:\Program Files\StarWarsGalaxies

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Automated click: Next >

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\ModSource UI Addon Pack Uninstall.log	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Mods	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Backup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Backup\Ui	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Ui	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Ui\ui_ground_hud.inc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Ui\ui_ground_hud_chat_window_skinned.inc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Ui\ui_ground_hud_mfd_status_skinned.inc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Ui\ui_ground_hud_all_targets.inc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Ui\ui_ground_hud_targets_skinned.inc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Ui\ui_ground_hud_secondary_targets_skinned.inc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Ui\ui_ground_hud_pet.inc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Ui\ui_ground_hud_sml_group_window.inc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Ui\ui_ground_hud_radar_skinned.inc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Ui\ui_pda_location_display.inc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Ui\ui_pda_exp_mon_skinned.inc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Ui\ui_pda_collections.inc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Ui\ui_ground_hud_buttonbar_skinned.inc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Ui\ui_hud_space.inc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Ui\ui_hud_space_buttonbar.inc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Ui\ui_ground_hud_toolbar_skinned.inc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Ui\ui_hud_space_toolbar.inc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Ui\ui_styles.inc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Ui\ui_palette_ground.inc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Ui\ui_palette_space.inc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Ui\ui_pda_net_status.inc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Backup\Texture	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\heavyweapons_reticule.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Documentation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Documentation\reticle_readme.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_activate.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_attack.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_big.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_crafting.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_deactivate.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_death_blow.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_default.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_drag_bad.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_drag_scroll.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_drop.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_eat.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_equip.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_hourglass.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_intended_attack.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_mission_details.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_move.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_open.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_pickup.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_resize_hor.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_resize_se.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_resize_sw.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_resize_vert.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_stop_talk.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_talk.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_throw.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_trade_accepted.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_trade_start.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_unequip.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_use.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_target_inactive.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Texture\ui_background_arrow.dds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Documentation\readme_BattleBackground.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Backup\Sample	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Sample	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Sample\ui_incoming_mail.wav	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Sample\item_fusioncutter_end.wav	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Sample\ui_toggle_mouse_mode.wav	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Sample\ui_use_toolbar.wav	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Sample\ui_select_popup.wav	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Sample\ui_button_arrow_back.wav	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Sample\ui_button_arrow_forward.wav	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Sample\ui_button_confirm.wav	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Sample\ui_dialog_warning.wav	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Sample\ui_increment_big.wav	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Sample\ui_menu_close.wav	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Sample\ui_rollover.wav	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Sample\ui_select_info.wav	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Sample\ui_select_rotate.wav	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Sample\item_open_metal_can_cntner.wav	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Sample\item_close_metal_can_cntner.wav	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Sample\ui_negative.wav	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Updater	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Updater\ModSource UI Addon Pack Auto Updater Silent.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Documentation\Readme ModSource UI Addon Pack.html	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Documentation\Changelog_PreNGE_UI.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Documentation\Readme_Anachs_PreNGE_UI.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Updater\ModSource UI Addon Pack Auto Updater.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Icons	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Icons\Readme.ico	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Icons\Web.ico	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Icons\Update.ico	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Icons\Uninstall.ico	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Directory created: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Uninstall the ModSource UI Addon Pack.exe	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\GoogleUpdater	Jump to behavior

Source:

Binary string: q.pdB source: ModSource UI Addon Pack.exe.0.dr, ModSource UI Addon Pack.zip.0.dr

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe

Code function: 0_2_00405D61 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00405D61

Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	File created: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Updater\ModSource UI Addon Pack Auto Updater Silent.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	File created: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\StartMenu.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	File created: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe	File created: C:\Users\user\AppData\Local\Temp\nsb13F9.tmp\ZipDLL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	File created: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe	File created: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe	File created: C:\Users\user\AppData\Local\Temp\nsb13F9.tmp\NSISdl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	File created: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Updater\ModSource UI Addon Pack Auto Updater.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	File created: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Uninstall the ModSource UI Addon Pack.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	File created: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\NSISdl.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	File created: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Documentation\reticle_readme.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	File created: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Documentation\readme_BattleBackground.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	File created: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Documentation\Readme_Anachs_PreNGE_UI.txt	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe

File created: C:\Program Files\StarWarsGalaxies\ModSource UI Addon Pack Uninstall.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ModSource UI Addon Pack Silent Updater.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ModSource UI Addon Pack	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ModSource UI Addon Pack\Uninstall the ModSource UI Addon Pack.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ModSource UI Addon Pack\ModSource UI Addon Pack Updater.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ModSource UI Addon Pack\Readme ModSource UI Addon Pack.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ModSource UI Addon Pack\Mod-Source - Your Source for SWG Modding Stuff.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ModSource UI Addon Pack\Pre-NGE UI Changelog.lnk	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ModSource UI Addon Pack Silent Updater.lnk

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Dropped PE file which has not been started: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Updater\ModSource UI Addon Pack Auto Updater Silent.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Dropped PE file which has not been started: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Uninstall the ModSource UI Addon Pack.exe			Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe	Code function: 0_2_00405368 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_00405368
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe	Code function: 0_2_00405D3A FindFirstFileA,FindClose,	0_2_00405D3A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe	Code function: 0_2_00402630 FindFirstFileA,	0_2_00402630
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Code function: 1_2_00405368 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	1_2_00405368
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Code function: 1_2_00405D3A FindFirstFileA,FindClose,	1_2_00405D3A
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Code function: 1_2_00402630 FindFirstFileA,	1_2_00402630

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe	API call chain: ExitProcess graph end node			graph_0-3138
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	API call chain: ExitProcess graph end node			graph_1-3237

Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332433511.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.344668347.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332819641.00000000006ED000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe

Code function: 0_2_00405D61 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00405D61

Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Documentation\Readme ModSource UI Addon Pack.html

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe

Code function: 0_2_00405A65 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

0_2_00405A65

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	2 Registry Run Keys / Startup Folder	11 Process Injection	3 Masquerading	1 Input Capture	11 Security Software Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	2 Registry Run Keys / Startup Folder	11 Process Injection	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	4 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Clipboard Data	Automated Exfiltration	5 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	14 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	6 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Link
SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe	18%	ReversingLabs
SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe	19%	Virustotal	Browse
SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Updater\ModSource UI Addon Pack Auto Updater.exe	100%	Joe Sandbox ML
C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Updater\ModSource UI Addon Pack Auto Updater Silent.exe	100%	Joe Sandbox ML
C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Uninstall the ModSource UI Addon Pack.exe	5%	ReversingLabs
C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Updater\ModSource UI Addon Pack Auto Updater Silent.exe	23%	ReversingLabs
C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Updater\ModSource UI Addon Pack Auto Updater.exe	18%	ReversingLabs
C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	14%	ReversingLabs	Win32.Dropper.Scrop
C:\Users\user\AppData\Local\Temp\nsb13F9.tmp\NSISdl.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsb13F9.tmp\ZipDLL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\NSISdl.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\StartMenu.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\nsDialogs.dll	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
1.2.ModSource UI Addon Pack.exe.2c18226.6.unpack	100%	Avira	TR/Patched.Ren.Gen		Download File
1.2.ModSource UI Addon Pack.exe.2bed809.4.unpack	100%	Avira	TR/Patched.Ren.Gen		Download File

Domains

Source	Detection	Scanner	Label	Link
modsource.org	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://modsource.org	0%	Virustotal		Browse
http://modsource.org	0%	Avira URL Cloud	safe
http://modsource.org/Files/SWG/Mods/ModSource_UI_Addon_Pack.ver/TIMEOUT=30000downloadhttp://users.on	0%	Avira URL Cloud	safe
http://tassyp2p.optikal.net/viewtopic.php?f=45&t=837	0%	Avira URL Cloud	safe
http://www.modsource.org/DC:	0%	Avira URL Cloud	safe
http://modsource.org/Files/SWG/Mods/ModSource_UI_Addon_Pack.ver	0%	Avira URL Cloud	safe
http://modsource.org/Files/SWG/Mods/ModSource_UI_Addon_Pack.zip	0%	Avira URL Cloud	safe
http://www.modsource.orgw8	0%	Avira URL Cloud	safe
http://unguilded.traumschmiede.com/Files/Mods/ModSource_UI_Addon_Pack.ver	0%	Avira URL Cloud	safe
http://unguilded.traumschmiede.com/Files/Mods/ModSource_UI_Addon_Pack.zip	0%	Avira URL Cloud	safe
http://modsource.org/Files/SWG/Mods/ModSource_UI_Addon_Pack.ver/TIMEOUT=30000download	0%	Avira URL Cloud	safe
http://www.modsource.org/	0%	Avira URL Cloud	safe
http://www.modsource.orgopen	0%	Avira URL Cloud	safe
http://modsource.org/Files/SWG/Mods/ModSource_UI_Addon_Pack.ziphttp://users.on.net/~anach/Files/SWG/	0%	Avira URL Cloud	safe
http://www.modsource.org	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
users.on.net	203.16.214.120	true	false		high
accounts.google.com	216.58.209.45	true	false		high
modsource.org	162.55.0.134	true	false	0%, Virustotal, Browse	unknown
www.google.com	142.250.180.132	true	false		high
clients.l.google.com	142.250.180.174	true	false		high
clients2.google.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
file:///C:/Program%20Files/StarWarsGalaxies/Mods/ModSource%20UI%20Addon%20Pack/Documentation/Readme%20ModSource%20UI%20Addon%20Pack.html	false		low
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
http://users.on.net/~anach/Files/SWG/ModSource_UI_Addon_Pack.ver	false		high
http://users.on.net/~anach/Files/SWG/ModSource_UI_Addon_Pack.zip	false		high
http://modsource.org/Files/SWG/Mods/ModSource_UI_Addon_Pack.ver	false	Avira URL Cloud: safe	unknown
http://modsource.org/Files/SWG/Mods/ModSource_UI_Addon_Pack.zip	false	Avira URL Cloud: safe	unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://modsource.org	ModSource UI Addon Pack.exe, 00000001.00000002.422163287.0000000002BD2000.00000004.00000020.00020000.00000000.sdmp, nsa449D.tmp.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://modsource.org/Files/SWG/Mods/ModSource_UI_Addon_Pack.ver/TIMEOUT=30000downloadhttp://users.on	ModSource UI Addon Pack.exe, 00000001.00000002.422163287.00000000026DC000.00000004.00000020.00020000.00000000.sdmp, ModSource UI Addon Pack.exe, 00000001.00000002.421708783.00000000006F1000.00000004.00000020.00020000.00000000.sdmp, nsa449D.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://www.modsource.org/DC:	Mod-Source - Your Source for SWG Modding Stuff.lnk.1.dr	false	Avira URL Cloud: safe	unknown
http://tassyp2p.optikal.net/viewtopic.php?f=45&t=837	ModSource UI Addon Pack.exe, 00000001.00000002.422163287.0000000002BD2000.00000004.00000020.00020000.00000000.sdmp, nsa449D.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, Uninstall the ModSource UI Addon Pack.exe.1.dr, ModSource UI Addon Pack.exe.0.dr, nsa449D.tmp.1.dr	false		high
http://www.modsource.orgw8	ModSource UI Addon Pack.exe, 00000001.00000002.421708783.000000000073C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://modsource.org/Files/SWG/Mods/ModSource_UI_Addon_Pack.ver/TIMEOUT=30000download	SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000002.346975161.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.bplaced.net/apple-touch-icon.png	SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332433511.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332819641.00000000006ED000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.modsource.org/	ModSource UI Addon Pack.exe, 00000001.00000002.421708783.000000000073C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://unguilded.traumschmiede.com/Files/Mods/ModSource_UI_Addon_Pack.ver	SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000002.346975161.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, ModSource UI Addon Pack.exe, 00000001.00000002.422163287.00000000026DC000.00000004.00000020.00020000.00000000.sdmp, ModSource UI Addon Pack.exe, 00000001.00000002.421708783.00000000006F1000.00000004.00000020.00020000.00000000.sdmp, nsa449D.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://unguilded.traumschmiede.com/Files/Mods/ModSource_UI_Addon_Pack.zip	SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000002.346975161.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, ModSource UI Addon Pack.exe, 00000001.00000002.422163287.00000000026DC000.00000004.00000020.00020000.00000000.sdmp, ModSource UI Addon Pack.exe, 00000001.00000002.421708783.00000000006F1000.00000004.00000020.00020000.00000000.sdmp, nsa449D.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_Error	ModSource UI Addon Pack.exe, ModSource UI Addon Pack.exe, 00000001.00000000.345573605.0000000000409000.00000008.00000001.01000000.00000007.sdmp, ModSource UI Addon Pack.exe, 00000001.00000002.422163287.0000000002BD2000.00000004.00000020.00020000.00000000.sdmp, ModSource UI Addon Pack.exe, 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmp, ModSource UI Addon Pack.exe, 00000001.00000003.410469484.0000000000792000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, Uninstall the ModSource UI Addon Pack.exe.1.dr, ModSource UI Addon Pack.exe.0.dr, nsa449D.tmp.1.dr	false		high
http://users.on.net/~anach/Files/SWG/ModSource_UI_Addon_Pack.verhttp://unguilded.traumschmiede.com/F	SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000002.346975161.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.bplaced.net/favicon-16x16.png	SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332433511.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332819641.00000000006ED000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.modsource.org	nsa449D.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://www.modsource.orgopen	ModSource UI Addon Pack.exe, 00000001.00000002.422163287.00000000026DC000.00000004.00000020.00020000.00000000.sdmp, ModSource UI Addon Pack.exe, 00000001.00000002.421708783.00000000006F1000.00000004.00000020.00020000.00000000.sdmp, nsa449D.tmp.1.dr	false	Avira URL Cloud: safe	unknown
https://www.bplaced.net/safari-pinned-tab.svg	SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332433511.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332819641.00000000006ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.bplaced.net/impressum	SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332365541.00000000006F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332799089.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.bplaced.net/gfx/emblem_b_xs.png	SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332799089.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.bplaced.net/datenschutz	SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332365541.00000000006F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332799089.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.bplaced.net/contact	SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332365541.00000000006F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332799089.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.bplaced.net/privacy	SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332365541.00000000006F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332799089.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.bplaced.net/favicon-32x32.png	SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332433511.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332819641.00000000006ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.bplaced.net/favicon.ico	SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332433511.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332819641.00000000006ED000.00000004.00000020.00020000.00000000.sdmp	false		high
http://modsource.org/Files/SWG/Mods/ModSource_UI_Addon_Pack.ziphttp://users.on.net/~anach/Files/SWG/	SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000002.346975161.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, ModSource UI Addon Pack.exe, 00000001.00000002.422163287.00000000026DC000.00000004.00000020.00020000.00000000.sdmp, ModSource UI Addon Pack.exe, 00000001.00000002.421708783.00000000006F1000.00000004.00000020.00020000.00000000.sdmp, nsa449D.tmp.1.dr	false	Avira URL Cloud: safe	unknown
https://www.bplaced.net/	SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, 00000000.00000003.332799089.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.55.0.134	modsource.org	United States	35893	ACPCA	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
203.16.214.120	users.on.net	Australia	4739	INTERNODE-ASInternodePtyLtdAU	false
216.58.209.45	accounts.google.com	United States	15169	GOOGLEUS	false
142.250.180.174	clients.l.google.com	United States	15169	GOOGLEUS	false
142.250.180.132	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	800798
Start date and time:	2023-02-07 19:58:07 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe
Detection:	SUS
Classification:	sus32.winEXE@29/101@12/8
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 97% (good quality ratio 93.7%) Quality average: 85% Quality standard deviation: 25%
HCA Information:	Successful, ratio: 99% Number of executed functions: 93 Number of non-executed functions: 48
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, rundll32.exe, WMIADAP.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.184.99, 34.104.35.123, 142.250.180.163
Excluded domains from analysis (whitelisted): edgedl.me.gvt1.com, update.googleapis.com, clientservices.googleapis.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:59:46	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ModSource UI Addon Pack Silent Updater.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
239.255.255.250	https://tracker.club-os.com/campaign/click?msgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=http://ar.obcd2.robmars.us%3A%2F%2F%23aHR0cHM6Ly9jYXBlbWF5dGhjLmNvbS9hdXRoL25ldy9DbmEvZG9uYWxkLmpvaG5zb25AY25hLmNvbQ==	Get hash	malicious	Browse
	https://tracker.club-os.com/campaign/click?msgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=http://ar.obcd2.robmars.us%3A%2F%2F%23aHR0cHM6Ly9jYXBlbWF5dGhjLmNvbS9hdXRoL25ldy9DbmEvZG9uYWxkLmpvaG5zb25AY25hLmNvbQ==	Get hash	malicious	Browse
	PL9878787ID mainstreetcbf.com.html	Get hash	malicious	Browse
	https://tracker.club-os.com/campaign/click?msgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=http://jr.tr0aq.robmars.us%3A%2F%2F%23aHR0cHM6Ly9jYXBlbWF5dGhjLmNvbS9hdXRoL25ldy9DbmEvZG9uYWxkLmpvaG5zb25AY25hLmNvbQ==	Get hash	malicious	Browse
	http://wallbuilderslive.com	Get hash	malicious	Browse
	Payment Advice.shtml	Get hash	malicious	Browse
	phish_alert_sp2_2.0.0.0.msg	Get hash	malicious	Browse
	Benefit_Enrollment.html	Get hash	malicious	Browse
	https://sites.google.com/view/southeasternchestercountyrefus/home	Get hash	malicious	Browse
	Remittance.htm	Get hash	malicious	Browse
	Remittance.htm	Get hash	malicious	Browse
	ACH_Electronic_Deposit.shtml	Get hash	malicious	Browse
	https://app.box.com/s/e25h4kyxp2a0bapw0cw6hszdjtzocatp	Get hash	malicious	Browse
	https://www.officence.com/eur/10338048-193a-4298-abea-3596ae88b05e/1a171cec-0677-4339-8b78-23047ae0e10f/5969c1e4-7c21-456d-b689-0d0415f7943c/login?id=bWZPd2hEbkZINlFsMDRxMTVWZmdBeEd4WVFacjBoQnlMYkhlajdINCsxKzZBRk1qQ1g5TDdybnI2dnB6Q2pCb0xuclFtb2VCSENjdW5ORGdiaEZmbnhoc1FaUkE5ZWpUNU9Ha2pqREh4cmQxWGNMQjRraUJxMU93RjEzTXFhR3pxL3U0M3Rvd0JHSmNsSGNEa1Erc29CSS94RDdBYmwxRXBKQVZmOXY5ZXZwT3BMcGlzTURJdnorWlc3b2R3MlFHV256MDAwVmNocWNEMnVxVFN2enNjYTh6cE5pSldEY2FhaGJVRHBoOFlJaWV5cGx5ZE1JSUhZMVlSWmtqYjc5N3ljSUJpL3RyYXZnY2gyejdBSTQzZk9NL1oxTWIxZFlSNzQvSXc0T2lWSFpmMS85YUtURlA0NG1nZTloQWhJVWZRTXMraHVjTkpWcUduNHR6UDh6aERQQzdyeWhVNXpLS0dYQyt6Y2RyaU1PTk8xUlcyVzBGV1NsRmNvcFQraFN4Um9LYUg0Tm5QS05YSUI2d3ZOZEovdEhYeExiWVBFN09vbWV2azdOMEhBRT0	Get hash	malicious	Browse
	http://www.derp7.cf/	Get hash	malicious	Browse
	http://yandexmailserv.com	Get hash	malicious	Browse
	http://anxmalls.com	Get hash	malicious	Browse
	Hilcorp Bonus Settlement.eml (5.22 KB).msg	Get hash	malicious	Browse
	https://www.canva.com/design/DAFZ4mIuTRk/xh916WsoV133Oxh-V4YbYw/view?utm_content=DAFZ4mIuTRk&utm_campaign=designshare&utm_medium=link&utm_source=publishsharelink	Get hash	malicious	Browse
	elementrv Remittance.html	Get hash	malicious	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ACPCA	file.exe	Get hash	malicious	Browse	162.0.217.254
	Rg7BWLbTVs.exe	Get hash	malicious	Browse	162.0.217.254
	xakJ7het39.exe	Get hash	malicious	Browse	162.0.217.254
	Bg3roWYlzp.elf	Get hash	malicious	Browse	162.36.86.172
	Misterium.exe	Get hash	malicious	Browse	162.55.188.117
	hFRJJRqNqO.exe	Get hash	malicious	Browse	162.55.60.2
	ePaQLI5RyP.exe	Get hash	malicious	Browse	162.0.217.254
	z3tYlqYItl.exe	Get hash	malicious	Browse	162.0.217.254
	jGQGty5EA2.exe	Get hash	malicious	Browse	162.0.217.254
	Lmu3E4BALX.exe	Get hash	malicious	Browse	162.55.60.2
	shipping document.exe	Get hash	malicious	Browse	162.0.216.254
	D34tl48TpG.exe	Get hash	malicious	Browse	162.55.188.246
	FB-108N & FB-108NK #U8a62#U50f9 - #U7530#U52e4.exe	Get hash	malicious	Browse	162.55.60.2
	EMaFJUwENa.exe	Get hash	malicious	Browse	162.55.60.2
	twaFb066dM.dll	Get hash	malicious	Browse	162.55.188.246
	file.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\nsb13F9.tmp\ZipDLL.dll	Eq3yEhQkwE.exe	Get hash	malicious	Browse
	WiseConvert.exe	Get hash	malicious	Browse
	jpmm-desktop-external-installer.exe	Get hash	malicious	Browse
	$RL282BX.jse	Get hash	malicious	Browse
	$RL282BX.jse	Get hash	malicious	Browse

Created / dropped Files

C:\Program Files\StarWarsGalaxies\ModSource UI Addon Pack Uninstall.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4835
Entropy (8bit):	4.788538130984319
Encrypted:	false
SSDEEP:	48:o3rddddeSddddG8B+GD9Yz3XqXj/YzYz4XqXiN7ZzCLEbXqXxLXnXoTLEqXS7R2Z:ozziHyj/iiYykNzdyhXaf
MD5:	5465527B0C899413743C22ABA3ECFE4C
SHA1:	3347100AE9776581D1CABF2F5E2FA5CB970DF20C
SHA-256:	91D4E5644587E47E6F9793228A153676DD990B6F57477550D1BBE0607BC62560
SHA-512:	F1DC77BD8B03CD5DC12B52EA148FEA824997C498A491F15A0B0235F7FEABB77BEE26DACE86D8833CCAF34410565BBC83E138E58AC378FC1505A0EE373B347CF9
Malicious:	false
Reputation:	low
Preview:	C:\Program Files\StarWarsGalaxies\Ui..C:\Program Files\StarWarsGalaxies\Ui\*.inc..C:\Program Files\StarWarsGalaxies\Ui..C:\Program Files\StarWarsGalaxies\Ui..C:\Program Files\StarWarsGalaxies\Ui..C:\Program Files\StarWarsGalaxies\Ui..C:\Program Files\StarWarsGalaxies\Ui..C:\Program Files\StarWarsGalaxies\Ui\ui_ground_hud_sml_group_window.inc..C:\Program Files\StarWarsGalaxies\Ui..C:\Program Files\StarWarsGalaxies\Ui..C:\Program Files\StarWarsGalaxies\Ui..C:\Program Files\StarWarsGalaxies\Ui..C:\Program Files\StarWarsGalaxies\Ui..C:\Program Files\StarWarsGalaxies\Ui\ui_ground_hud_buttonbar_skinned.inc..C:\Program Files\StarWarsGalaxies\Ui..C:\Program Files\StarWarsGalaxies\Ui\ui_hud_space_buttonbar.inc..C:\Program Files\StarWarsGalaxies\Ui..C:\Program Files\StarWarsGalaxies\Ui\ui_ground_hud_toolbar_skinned.inc..C:\Program Files\StarWarsGalaxies\Ui..C:\Program Files\StarWarsGalaxies\Ui\ui_hud_space_toolbar.inc..C:\Program Files\StarWarsGalaxies\Ui..C:\Program Files\StarWarsGalaxies\Ui\ui

C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Documentation\Changelog_PreNGE_UI.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	18477
Entropy (8bit):	5.005418808930813
Encrypted:	false
SSDEEP:	192:1lHIgEX4BGfUvlr72gu3HeZ9bkNLx7K1p71+Q023rPWGdsgybdC484uV:7ogAPUvK39NLx7K191PF3rPjKJ8h
MD5:	EE69358078BA7D070B8A56418DDE86D5
SHA1:	8A80B5F998B3F08DE16DBFA6B72FAA608247FB64
SHA-256:	921F7281DC7FA7453604DC74E8FD992C16F60AAB8258ECBFA4C0C253E1A31978
SHA-512:	1226446D706123E588E19311A20DF5B3B2F72245F3A2CA40600EA48B99615E5D76829313FFCB52200785FC8178F48FD5A97463F610209A30396E151A2785C139
Malicious:	false
Reputation:	low
Preview:	VERSION HISTORY......................................(IMPORTANT: remove old version before installing the new version)....16.0.1200 11/08/09......................................MISC..+ Mod taken over by Caveman..+ Merged with ModSource UI Addon Pack..- Abandoned standalone installer and integrated into ModSource UI Addon Pack.. installer..+ updated ui_styles.inc with new chapter artwork..+ Added Caveman's Custom Color Palettes..+ Updated Caveman's Custom Color Palettes to work with the NGE UI as well..+ moved pre-NGE Jedi color palettes from ui_styles.inc to ui_palette_ground.inc.. and ui_palette_space.inc respectively..+ Split standard files for a potential individual installation..- Removed custom ui_options.inc..- Removed examine window with Badges....15.1.1106.1000 04/06/09......................................MISC..+ Updated ui_styles.inc with new chapter artwork..+ Anach discontinues Pre-NGE UI mod....15.1.1106.0900 01/05/09......................................MISC..+ Updated

C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Documentation\Readme ModSource UI Addon Pack.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	HTML document, ASCII text, with very long lines (542), with CRLF line terminators
Category:	dropped
Size (bytes):	24877
Entropy (8bit):	5.021926173627186
Encrypted:	false
SSDEEP:	768:h+g9kAGDFgp+wgNjazpiYOdpnWGoC3IfxSCBFVnarTX2oHBjB:zGNW4rTXf
MD5:	A6E066C16AEA71CC530E03861836E309
SHA1:	B22074915A54AC6423F9B94CB7C83F8DE0E03009
SHA-256:	5D7BAA5BB870E0B8CA7FF4056FED7148B34B4428F22216DCD50089031EE46569
SHA-512:	DD1BC75D7F0CC2B86C80FAC62C2C610C50352268EBD62879CD49CCBE1CEAE9BBCEE01692190D730A182BC338D72BA32C01C897B662B3A522B0D2357C3E37D2BE
Malicious:	false
Reputation:	low
Preview:	<style type="text/css">.. ...style1 {...font-family: Verdana, Arial, Helvetica, sans-serif;...font-size: 12px;..}...style10 {font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10px; }...style12 {font-size: 12px}...style13 {...font-family: Verdana, Arial, Helvetica, sans-serif;...font-style: italic;..}..-->..</style>..<title>ModSource UI Addon Pack Readme</title>..<p class="style1"><strong><a href="http://www.modsource.org" target="_blank">ModSource</a> UI Addon Pack 2.0<br />.. Modification for SWG (tested with Game Update 12 and later*)<br />.. created by many, compiled by Caveman</strong><br />.. <a href="http://www.modsource.org" target="_blank">ModSource</a> @ <a href="http://www.modsource.org" target="_blank">http://www.modsource.org</a><br />.. ------------------------------------<br />.. <strong>TABLE OF CONTENTS</strong><br />.. I. INTRODUCTION<br />.. II. LATEST VERSION<br />.. III. INSTALLATION<br />.. IV. UNINSTALLATION<br />.. V. FEATURES<br />..

C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Documentation\Readme_Anachs_PreNGE_UI.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	15093
Entropy (8bit):	4.833413616773268
Encrypted:	false
SSDEEP:	192:gJUHacwVsnne3sm12zMn7GbOYRq2nw+o23EBrHJyk+S3IDbye1MLwUNFd3L:gzVsnn6shzztRq2nw19Jp+DbL1mDNP3L
MD5:	4FDCD2D0C042A1B08EE169BDCCB67CAA
SHA1:	8CA66593DA4E086A599B05DC6C26086F2EDF005B
SHA-256:	87F137541314EBFD448F362B94E319404E06D1CC5B0A3838662EAE33EE1CC466
SHA-512:	BD2B4DCDE259CA735B4D0CA57F3EC40BC5344413695806850F820062AAED3656F407DF2068622752A318CE8A91E9DAB37CB9E5A551DDC896635A90388CE582FE
Malicious:	false
Reputation:	low
Preview:	Pre-NGE UI..Modification for SWG..by Anach..Web http //www.anach.tk..Readme Updated: 28th January 2009..------------------------------------------------------------------------....TABLE OF CONTENTS.....................I. INTRODUCTION..II. INSTALLATION..III. UNINSTALLATION..IV. VERSION HISTORY..V. KNOWN ISSUES..VI. MISCELLANEOUS..VII. TROUBLESHOOTING..VIII. Credits....========================================================================..I. INTRODUCTION..========================================================================....The intention of this mod is to bring restore and improve upon the..Pre-NGE style GUI to SWG-NGE.....FEATURES............+ PreNGE Changeable ui Themes on all windows...+ PreNGE Jedi Colour Schemes for ui...+ PreNGE HAM bars...+ PreNGE Movable & Resizable group window...+ PreNGE Resizable & Movable experience monitor...+ PreNGE Style Resizable Toolbar for ground & Space...+ PreNGE style Cursors & Crosshairs...+ PreNGE Style Pet Toolbar & HA(M)..+ PreNGE Style

C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Documentation\readme_BattleBackground.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2358
Entropy (8bit):	4.855445631550476
Encrypted:	false
SSDEEP:	48:fKapXHntlkUjS3w9Xp7hpKKeJBDTOTz5xiLWEJfH:fKap4iS3Sh+JBPO/CqCfH
MD5:	7296220F0D7B945A8BF32DDAAF62E174
SHA1:	B8EFB0EC87C433D1DA5FE1F1075D841C77AC0188
SHA-256:	FBF32A9A578B9790EAD0F9E1D19BC4BABA06374F6B2024D7246DD011E7734C08
SHA-512:	E805E5BEE273870118A7862109EB2ED3A74205F141914D2732F1DB4FCA0FEDAEA102288B858C8988C1709C6E536ED554A63672941B2A7E61FFBB9F805CB1A429
Malicious:	false
Reputation:	low
Preview:	Battle Background..Modification for SWG..by ukmic..------------------------------------..TABLE OF CONTENTS..I. INTRODUCTION..II. INSTALLATION..III. UNINSTALLATION..IV. VERSION HISTORY..V. INCLUDED FILES..VI. KNOWN ISSUES..VII. MISCELLANEOUS..VIII. CREDITS..------------------------------------..I. INTRODUCTION..This mod changes the background you see at the character selection screen, nothing else...------------------------------------..II. INSTALLATION..To install this mod, use an archiving utility such as Winzip, ExtractNow! ..or WinRAR to extract the files in this ZIP archive to your main SWG ..directory (usually C:\Program Files\Star Wars Galaxies). ..Make sure to uninstall any old or incompatible versions of mods first ..(see the next section of this readme for instructions on how to do it)...Start the game and enjoy!....Note: This mod will put folders with some files in the game directory ..that will be used instead of the files in the game. No actual SWG game ..files will be over

C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Documentation\reticle_readme.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	449
Entropy (8bit):	4.560170761045268
Encrypted:	false
SSDEEP:	12:ff95Hec4SAVhbW1+ZN7etiwlKWQFu7aTLyb7jU9mN5:ff9AvSAVhbWno9F2qLujY05
MD5:	540F643FDD28298E2D8BF0D7BD047260
SHA1:	09A9344F13F2A78425BE370292F893D379712665
SHA-256:	EAA3D90D17A702DE8A68E793FBF2687B341AACCE329896032B7969127485496A
SHA-512:	267AD5FB8F07817920297E4C7EFCCB5B8EB2DCD4002D8A6B628BDD55BD696C98603B37DE834E582F76E9ED5B75831A513D4AA554B25029E8808B55592EBE0A43
Malicious:	false
Preview:	New improved heavy weapon reticle..by Cowboy....- a colorful and new design change..- works for all heavy weapons....installation notes..------------------..just unrar to the main StarWarsGalaxies directory....Uninstallation..--------------..To uninstal just delete the heavyweapons_reticle.dds from the texture folder.....Disclaimer..------------..I accept no responsibility for anything that may go wrong with the file(s). Use at your own risk...

C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Icons\Readme.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	MS Windows icon resource - 4 icons, 32x32, 32 bits/pixel, 32x32, 8 bits/pixel
Category:	dropped
Size (bytes):	9062
Entropy (8bit):	5.9543535915933115
Encrypted:	false
SSDEEP:	192:/2msIiiJsF2Cq0TSbnb4irrJwgUvWr2vKiJmtmJgQ53GzW8NjH7:/2lIusCfeb4wHUvWoKiJD1REjH7
MD5:	39994C8CF3BED782A03D79C33D6F4F5E
SHA1:	1EFF6936F09C94C2E3ED6078292C7518A8249CBC
SHA-256:	AACF63B1E5A9EFE2EC0264BB70B201AD1B22D8C858FAA94EF6D03ADE672BE60B
SHA-512:	ED0BC3AC72C86A922F454BF1F7E9BEDB869D33CCD462EFE1DC3758D10DE2D22005DB31B2CC1E5A0F0E009F06E5555E5B1F300EED6CA84B883A140A0D39407C8A
Malicious:	false
Preview:	...... .... .....F... .................... .h...............h.......(... ...@..... ...... ........................o...........o...o...o.....Sil.(W\..U\..x.......................................Yb.(W\.Sil...............o...................o...........o.......o.^mo./Z_..]f..........................................................fr./Z_._mo...........................o...........o.....Ecg..OV..r...........................iw..T\..T\..m\|..............................RZ.Ecg...o...........o...o.......o.........?be..U]..t...............{...QX..TY.<ad.........zzu2.........TY..RZ......................`k.?be.............................?be..U]..r...\|.......t...OV.Xkk.............fff.............m.m.qqq.{{s.Xkk..RX..................cn.?be.................w{w<9_c..RY..hv..s...v...\e.Ukk.....................Lggq!VZ..OT.>bb.................www Ukk..fr..............\e.9_c.zzq.........<ad..U\..co..ly..m}..W].mtq.....................?bb..PU..........\|..!VX.Jget................mtq..]c..............ju.Bb

C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Icons\Uninstall.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	MS Windows icon resource - 4 icons, 32x32, 32 bits/pixel, 32x32, 8 bits/pixel
Category:	dropped
Size (bytes):	9062
Entropy (8bit):	5.314917610194853
Encrypted:	false
SSDEEP:	192:46BlL6F2wQr4OdUoOOWc7dxvUvsOoDeetK:4C6F32EydxestDi
MD5:	2808D11AF5EFC388ABAC9A782D72431C
SHA1:	75D9E6F392DFCFA3131C3947795487AB0AA2F0C7
SHA-256:	2B476C22B0F0D2117CDC4FCC0931A231DF5BE55C08FFA0F6D203A37A0111B577
SHA-512:	665D1E53AB468E94BC291CB289D9357D81882C14680D271C2B798D332057DA593A74B9BBE1F2174887C2B8D57484577D95EBC6B5049DF7EEC5A3AD782A35E495
Malicious:	false
Preview:	...... .... .....F... .................... .h...............h.......(... ...@..... ...... ..................................................@F_S..I...G...{.......................................L...I.@F_S........................................................JRbA.$L...U...........................................................d..$K.KSc@........................................rrr.06Wt..C...............................c...F...F...g.................. ............G.06Wt................................rrr.(2S...P.......................C...C.&/R.KSc@ixx.ixx.OSc@&.S...C...E.............. ........d.(2S.............................(2S...U...................A.-8X.jjs.................................fnn.-8X...B.......... ........p.(2S.................ixx.!+P...O...............o...G._cl;................................................agl/&2U...k......!........b.!+P.xxx.........&/R...a.............. ...6.../....a.>Ja{....................................................8B[z..T......!...!......-5

C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Icons\Update.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	MS Windows icon resource - 4 icons, 32x32, 32 bits/pixel, 32x32, 8 bits/pixel
Category:	dropped
Size (bytes):	9062
Entropy (8bit):	5.275793838471656
Encrypted:	false
SSDEEP:	192:ep66sbQ9sXPHkJ1dZXN1iKvcB54ELVlg8yBRm3EcCyDzp:e06ofXPEJ9iKE9LVlgdLm0cDp
MD5:	953BA127FC153B27071B8AE2A21A1651
SHA1:	25F71C633032A808F1058886FDEA2AA5B963E289
SHA-256:	274038CE497A521BB1B4EEFBD0092AB26E2764BE73D8A4C2F2BD16B11AF326C8
SHA-512:	1DBD978B4C565C2008C8FFA48D6E223B6F609EE0814C1636303A85BEA38B477179AB9E35C4BCE86CA6074D3E293259C24F8A61CA73D434F50BEB4A2FBC63D75D
Malicious:	false
Preview:	...... .... .....F... .................... .h...............h.......(... ...@..... ...... ..................................................qqOShh..jk..\|...................................\|...jk..hh..qqOS........................................................rrNUjg..qz..........................................................qz..li(.ssW@............................................mk4.kn..............................\|...mq..ih..s}..............................ii..pm?t................................ssh.nl3.}...........................................~...lo..nk5.id..hg......................s}..nl9.............................nl6.........................................................{...ge..uug%mm8.gd..................w...nl9.................rrf.nl2.{...............w...eb..hf..km..qy..................................lo......wwa/mk0.u...............t}..nl2.xxi.........nl5.................nr..nn;}....sss.zze.uu[2qoEgij..y...........................ns..........nn>zmq..................om

C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Icons\Web.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	MS Windows icon resource - 4 icons, 32x32, 32 bits/pixel, 32x32, 8 bits/pixel
Category:	dropped
Size (bytes):	9062
Entropy (8bit):	4.676347464145239
Encrypted:	false
SSDEEP:	96:tdX/3FzOySYgNGruThYtWWTtJXpico9wFa9rRl6Yetv/jybshGz7h3uytw2SX:tdXgyaBThYt3k7s8RoJljjhGz7h+c2
MD5:	348B93CB5304CB0EEE0A54DD42904DBD
SHA1:	FDF5DCCF9C1E0A0D3514F060ECF548434C5949F4
SHA-256:	B3E465452872A6C9661EFCBC9D16AE2265564B8C3CF8D7765763A899520D6C6E
SHA-512:	E01365B9CEC62FD265EACC6CAD7A74AD83888FB36FF45DB24D4BDF6E0F59C535F3FB7700CD1E4234BE0FC2535D0FC1F7AA8D992992DFB954E7CC6E847268CE10
Malicious:	false
Preview:	...... .... .....F... .................... .h...............h.......(... ...@..... ...... ...................................................O*`.(...!...U...................................g...#...(..O-`.........................................................Y;M.2...6...........................................................>...4...[=K.............................................G.z.'...............................=..."...!...?...............................)...I.z.....................................B...5...................}...!...'...........................(...!.......................@...B...............................@...9...................#...K...........N...g1{.........g3{.O.......p^+.M...#...................E...B..................zpe..9.../...............1...E...oS@.....j5x.U.......W...........Y.......V...j5x.....qP?.G...9...............8...<..zpe..........<...L...............)...X)..........h5x.Y...........Z...........Y...........Z...j5x.........Y)..,...............b...D

C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Uninstall the ModSource UI Addon Pack.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	65915
Entropy (8bit):	6.251902342242401
Encrypted:	false
SSDEEP:	1536:cUeHiWRgkkjH8nyWmJ+Zl18zH8Un+75RVbWL5R51H75RbmMzxbwSZ:cd/vyWmJol18zH8jdyLhV73Ks
MD5:	6D3886C1E65F7D0D56188AA27AA9342E
SHA1:	ADF0DE2A3F7EC904865C7FA5A09FD86F8E49FA3C
SHA-256:	D837AF580D3F2F19886D48F04F9AF0F7F2F0C206CA3B6BA812C0B586C50B4944
SHA-512:	A285D61C921269CE1E24CE8FE1B2200B5F7BF95EC878CC3B2FE640B95033FB57EEE6D882097E9FE4A89E06735ECCAF42DACD7FCBFDC0C9E402B8458BE9321090
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........uJ...$...$...$./.{...$...%.:.$.".y...$..7....$.f."...$.Rich..$.................PE..L.../..G.................Z..........%2.......p....@..........................P...............................................s...........w...........................................................................p...............................text...4Y.......Z.................. ..`.rdata.......p.......^..............@..@.data................p..............@....ndata.......@...........................rsrc....w.......x...t..............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Updater\ModSource UI Addon Pack Auto Updater Silent.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	116158
Entropy (8bit):	7.763228047293167
Encrypted:	false
SSDEEP:	1536:MUeHiWRgkkjH8nyWmJgTFRP6mKeCIHQJbmj+d7DuDtKNR07ePEj6hjrlIkukhLmJ:Md/vyWmJgTF05e7wJ6E/K7ePRhjxjuEe
MD5:	6A7B1A1A041BFE75FD88F1AC5010C63F
SHA1:	47746D829B0C113792E6F1ACEFE8EC8B7F7CDD03
SHA-256:	95907DC57674AA31E1A86F3BF1FEB2997072F2CD9DF58EAE3069275619968118
SHA-512:	AB9680C01A4EEAF7B0693A66B7AC268D559E348A7E865161FC9207198DCA167088066AE3D127C11382E2EBC5605F8428631F2DEBD610CF645F90173DB88E997F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 23%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........uJ...$...$...$./.{...$...%.:.$.".y...$..7....$.f."...$.Rich..$.................PE..L.../..G.................Z..........%2.......p....@..........................................................................s.......................................................................................p...............................text...4Y.......Z.................. ..`.rdata.......p.......^..............@..@.data................p..............@....ndata.......@...........................rsrc................t..............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Updater\ModSource UI Addon Pack Auto Updater.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	116184
Entropy (8bit):	7.762292817147485
Encrypted:	false
SSDEEP:	3072:Md/vyWmJgsn5f630mFNCwivNDd+r7Ncxnpjw9:MXiY0IMfZ0N0npC
MD5:	97011B19F2683A918F1F07F7F4EC1998
SHA1:	4B486D0B67994FABE961787F5FACDF9A0E3F6672
SHA-256:	C1469167B9700AECA987573C023EC7F160DADF8309A7A4FEB2CD1969AD66673E
SHA-512:	FD7FFE3CCF0A46D06D936C946F50B6FDDE195F684CF10B23450809457FBBB7D281F45582667FF5EC1E1968283295426BA05D156063D9C45BCE931F8A45529DD1
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 18%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........uJ...$...$...$./.{...$...%.:.$.".y...$..7....$.f."...$.Rich..$.................PE..L.../..G.................Z..........%2.......p....@..........................................................................s.......................................................................................p...............................text...4Y.......Z.................. ..`.rdata.......p.......^..............@..@.data................p..............@....ndata.......@...........................rsrc................t..............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\StarWarsGalaxies\Sample\item_close_metal_can_cntner.wav

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Category:	dropped
Size (bytes):	31810
Entropy (8bit):	2.262176965055877
Encrypted:	false
SSDEEP:	384:nmMdGhCFa2ttREhZUfPbNxBHH0twN9qk72mEexRXYVW/Ly123v6FVRtE:P/
MD5:	0680773BF646E7A9780A013AEDE5C804
SHA1:	0994740633B7B5BCDF27023E2D22712AA979216A
SHA-256:	72CFEC0A3D43DE264F1BF42D5D57B27B402541A8DF9D5F7E7EF4028FEBA1C80E
SHA-512:	5162484F7DFE3AD60E9ADA5BACF7277BB8DF4EF6E80071BF205EC3746A133D846CF2103F2A282024320A02B9D299A200B329C99B3E8AE039BB76D3E0B2B07DEE
Malicious:	false
Preview:	RIFF:\|..WAVEfmt ........D.............fact........data.\|................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\StarWarsGalaxies\Sample\item_fusioncutter_end.wav

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Category:	dropped
Size (bytes):	31810
Entropy (8bit):	2.262176965055877
Encrypted:	false
SSDEEP:	384:nmMdGhCFa2ttREhZUfPbNxBHH0twN9qk72mEexRXYVW/Ly123v6FVRtE:P/
MD5:	0680773BF646E7A9780A013AEDE5C804
SHA1:	0994740633B7B5BCDF27023E2D22712AA979216A
SHA-256:	72CFEC0A3D43DE264F1BF42D5D57B27B402541A8DF9D5F7E7EF4028FEBA1C80E
SHA-512:	5162484F7DFE3AD60E9ADA5BACF7277BB8DF4EF6E80071BF205EC3746A133D846CF2103F2A282024320A02B9D299A200B329C99B3E8AE039BB76D3E0B2B07DEE
Malicious:	false
Preview:	RIFF:\|..WAVEfmt ........D.............fact........data.\|................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\StarWarsGalaxies\Sample\item_open_metal_can_cntner.wav

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Category:	dropped
Size (bytes):	31810
Entropy (8bit):	2.262176965055877
Encrypted:	false
SSDEEP:	384:nmMdGhCFa2ttREhZUfPbNxBHH0twN9qk72mEexRXYVW/Ly123v6FVRtE:P/
MD5:	0680773BF646E7A9780A013AEDE5C804
SHA1:	0994740633B7B5BCDF27023E2D22712AA979216A
SHA-256:	72CFEC0A3D43DE264F1BF42D5D57B27B402541A8DF9D5F7E7EF4028FEBA1C80E
SHA-512:	5162484F7DFE3AD60E9ADA5BACF7277BB8DF4EF6E80071BF205EC3746A133D846CF2103F2A282024320A02B9D299A200B329C99B3E8AE039BB76D3E0B2B07DEE
Malicious:	false
Preview:	RIFF:\|..WAVEfmt ........D.............fact........data.\|................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\StarWarsGalaxies\Sample\ui_button_arrow_back.wav

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Category:	dropped
Size (bytes):	31810
Entropy (8bit):	2.262176965055877
Encrypted:	false
SSDEEP:	384:nmMdGhCFa2ttREhZUfPbNxBHH0twN9qk72mEexRXYVW/Ly123v6FVRtE:P/
MD5:	0680773BF646E7A9780A013AEDE5C804
SHA1:	0994740633B7B5BCDF27023E2D22712AA979216A
SHA-256:	72CFEC0A3D43DE264F1BF42D5D57B27B402541A8DF9D5F7E7EF4028FEBA1C80E
SHA-512:	5162484F7DFE3AD60E9ADA5BACF7277BB8DF4EF6E80071BF205EC3746A133D846CF2103F2A282024320A02B9D299A200B329C99B3E8AE039BB76D3E0B2B07DEE
Malicious:	false
Preview:	RIFF:\|..WAVEfmt ........D.............fact........data.\|................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\StarWarsGalaxies\Sample\ui_button_arrow_forward.wav

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Category:	dropped
Size (bytes):	31810
Entropy (8bit):	2.262176965055877
Encrypted:	false
SSDEEP:	384:nmMdGhCFa2ttREhZUfPbNxBHH0twN9qk72mEexRXYVW/Ly123v6FVRtE:P/
MD5:	0680773BF646E7A9780A013AEDE5C804
SHA1:	0994740633B7B5BCDF27023E2D22712AA979216A
SHA-256:	72CFEC0A3D43DE264F1BF42D5D57B27B402541A8DF9D5F7E7EF4028FEBA1C80E
SHA-512:	5162484F7DFE3AD60E9ADA5BACF7277BB8DF4EF6E80071BF205EC3746A133D846CF2103F2A282024320A02B9D299A200B329C99B3E8AE039BB76D3E0B2B07DEE
Malicious:	false
Preview:	RIFF:\|..WAVEfmt ........D.............fact........data.\|................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\StarWarsGalaxies\Sample\ui_button_confirm.wav

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Category:	dropped
Size (bytes):	31810
Entropy (8bit):	2.262176965055877
Encrypted:	false
SSDEEP:	384:nmMdGhCFa2ttREhZUfPbNxBHH0twN9qk72mEexRXYVW/Ly123v6FVRtE:P/
MD5:	0680773BF646E7A9780A013AEDE5C804
SHA1:	0994740633B7B5BCDF27023E2D22712AA979216A
SHA-256:	72CFEC0A3D43DE264F1BF42D5D57B27B402541A8DF9D5F7E7EF4028FEBA1C80E
SHA-512:	5162484F7DFE3AD60E9ADA5BACF7277BB8DF4EF6E80071BF205EC3746A133D846CF2103F2A282024320A02B9D299A200B329C99B3E8AE039BB76D3E0B2B07DEE
Malicious:	false
Preview:	RIFF:\|..WAVEfmt ........D.............fact........data.\|................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\StarWarsGalaxies\Sample\ui_dialog_warning.wav

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Category:	dropped
Size (bytes):	31810
Entropy (8bit):	2.262176965055877
Encrypted:	false
SSDEEP:	384:nmMdGhCFa2ttREhZUfPbNxBHH0twN9qk72mEexRXYVW/Ly123v6FVRtE:P/
MD5:	0680773BF646E7A9780A013AEDE5C804
SHA1:	0994740633B7B5BCDF27023E2D22712AA979216A
SHA-256:	72CFEC0A3D43DE264F1BF42D5D57B27B402541A8DF9D5F7E7EF4028FEBA1C80E
SHA-512:	5162484F7DFE3AD60E9ADA5BACF7277BB8DF4EF6E80071BF205EC3746A133D846CF2103F2A282024320A02B9D299A200B329C99B3E8AE039BB76D3E0B2B07DEE
Malicious:	false
Preview:	RIFF:\|..WAVEfmt ........D.............fact........data.\|................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\StarWarsGalaxies\Sample\ui_incoming_mail.wav

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 22050 Hz
Category:	dropped
Size (bytes):	120890
Entropy (8bit):	5.682815203179758
Encrypted:	false
SSDEEP:	1536:+C2EXrTncsUfA5nsbChVp2KKs+sjsnYJS/wcUThodvF1yhmbNmdfEXku:+CvrTnIqswKs+wawcoOvCmiu
MD5:	6DF0CEA7C588CD28B884355FDAFDDF20
SHA1:	09A004B41C7CFB9F6B92F92D87CA51C7018B2DDF
SHA-256:	652453B104AA243296ACC1307E1E81557C9A26B53244E139380F650416F6A026
SHA-512:	C9B949527B57161EEFB026E46E9D016A7B4D1814B7EDE6FC768D1FC01B99063B8310807901230E8D1923114D742F0A471270DF8E277FED61FB1942D3CC94DE2B
Malicious:	false
Preview:	RIFF2...WAVEfmt ........"V..D.........fact........data..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\StarWarsGalaxies\Sample\ui_increment_big.wav

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Category:	dropped
Size (bytes):	31810
Entropy (8bit):	2.262176965055877
Encrypted:	false
SSDEEP:	384:nmMdGhCFa2ttREhZUfPbNxBHH0twN9qk72mEexRXYVW/Ly123v6FVRtE:P/
MD5:	0680773BF646E7A9780A013AEDE5C804
SHA1:	0994740633B7B5BCDF27023E2D22712AA979216A
SHA-256:	72CFEC0A3D43DE264F1BF42D5D57B27B402541A8DF9D5F7E7EF4028FEBA1C80E
SHA-512:	5162484F7DFE3AD60E9ADA5BACF7277BB8DF4EF6E80071BF205EC3746A133D846CF2103F2A282024320A02B9D299A200B329C99B3E8AE039BB76D3E0B2B07DEE
Malicious:	false
Preview:	RIFF:\|..WAVEfmt ........D.............fact........data.\|................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\StarWarsGalaxies\Sample\ui_menu_close.wav

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Category:	dropped
Size (bytes):	31810
Entropy (8bit):	2.262176965055877
Encrypted:	false
SSDEEP:	384:nmMdGhCFa2ttREhZUfPbNxBHH0twN9qk72mEexRXYVW/Ly123v6FVRtE:P/
MD5:	0680773BF646E7A9780A013AEDE5C804
SHA1:	0994740633B7B5BCDF27023E2D22712AA979216A
SHA-256:	72CFEC0A3D43DE264F1BF42D5D57B27B402541A8DF9D5F7E7EF4028FEBA1C80E
SHA-512:	5162484F7DFE3AD60E9ADA5BACF7277BB8DF4EF6E80071BF205EC3746A133D846CF2103F2A282024320A02B9D299A200B329C99B3E8AE039BB76D3E0B2B07DEE
Malicious:	false
Preview:	RIFF:\|..WAVEfmt ........D.............fact........data.\|................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\StarWarsGalaxies\Sample\ui_negative.wav

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Category:	dropped
Size (bytes):	31810
Entropy (8bit):	2.262176965055877
Encrypted:	false
SSDEEP:	384:nmMdGhCFa2ttREhZUfPbNxBHH0twN9qk72mEexRXYVW/Ly123v6FVRtE:P/
MD5:	0680773BF646E7A9780A013AEDE5C804
SHA1:	0994740633B7B5BCDF27023E2D22712AA979216A
SHA-256:	72CFEC0A3D43DE264F1BF42D5D57B27B402541A8DF9D5F7E7EF4028FEBA1C80E
SHA-512:	5162484F7DFE3AD60E9ADA5BACF7277BB8DF4EF6E80071BF205EC3746A133D846CF2103F2A282024320A02B9D299A200B329C99B3E8AE039BB76D3E0B2B07DEE
Malicious:	false
Preview:	RIFF:\|..WAVEfmt ........D.............fact........data.\|................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\StarWarsGalaxies\Sample\ui_rollover.wav

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Category:	dropped
Size (bytes):	31810
Entropy (8bit):	2.262176965055877
Encrypted:	false
SSDEEP:	384:nmMdGhCFa2ttREhZUfPbNxBHH0twN9qk72mEexRXYVW/Ly123v6FVRtE:P/
MD5:	0680773BF646E7A9780A013AEDE5C804
SHA1:	0994740633B7B5BCDF27023E2D22712AA979216A
SHA-256:	72CFEC0A3D43DE264F1BF42D5D57B27B402541A8DF9D5F7E7EF4028FEBA1C80E
SHA-512:	5162484F7DFE3AD60E9ADA5BACF7277BB8DF4EF6E80071BF205EC3746A133D846CF2103F2A282024320A02B9D299A200B329C99B3E8AE039BB76D3E0B2B07DEE
Malicious:	false
Preview:	RIFF:\|..WAVEfmt ........D.............fact........data.\|................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\StarWarsGalaxies\Sample\ui_select_info.wav

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Category:	dropped
Size (bytes):	31810
Entropy (8bit):	2.262176965055877
Encrypted:	false
SSDEEP:	384:nmMdGhCFa2ttREhZUfPbNxBHH0twN9qk72mEexRXYVW/Ly123v6FVRtE:P/
MD5:	0680773BF646E7A9780A013AEDE5C804
SHA1:	0994740633B7B5BCDF27023E2D22712AA979216A
SHA-256:	72CFEC0A3D43DE264F1BF42D5D57B27B402541A8DF9D5F7E7EF4028FEBA1C80E
SHA-512:	5162484F7DFE3AD60E9ADA5BACF7277BB8DF4EF6E80071BF205EC3746A133D846CF2103F2A282024320A02B9D299A200B329C99B3E8AE039BB76D3E0B2B07DEE
Malicious:	false
Preview:	RIFF:\|..WAVEfmt ........D.............fact........data.\|................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\StarWarsGalaxies\Sample\ui_select_popup.wav

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Category:	dropped
Size (bytes):	31810
Entropy (8bit):	2.262176965055877
Encrypted:	false
SSDEEP:	384:nmMdGhCFa2ttREhZUfPbNxBHH0twN9qk72mEexRXYVW/Ly123v6FVRtE:P/
MD5:	0680773BF646E7A9780A013AEDE5C804
SHA1:	0994740633B7B5BCDF27023E2D22712AA979216A
SHA-256:	72CFEC0A3D43DE264F1BF42D5D57B27B402541A8DF9D5F7E7EF4028FEBA1C80E
SHA-512:	5162484F7DFE3AD60E9ADA5BACF7277BB8DF4EF6E80071BF205EC3746A133D846CF2103F2A282024320A02B9D299A200B329C99B3E8AE039BB76D3E0B2B07DEE
Malicious:	false
Preview:	RIFF:\|..WAVEfmt ........D.............fact........data.\|................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\StarWarsGalaxies\Sample\ui_select_rotate.wav

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Category:	dropped
Size (bytes):	31810
Entropy (8bit):	2.262176965055877
Encrypted:	false
SSDEEP:	384:nmMdGhCFa2ttREhZUfPbNxBHH0twN9qk72mEexRXYVW/Ly123v6FVRtE:P/
MD5:	0680773BF646E7A9780A013AEDE5C804
SHA1:	0994740633B7B5BCDF27023E2D22712AA979216A
SHA-256:	72CFEC0A3D43DE264F1BF42D5D57B27B402541A8DF9D5F7E7EF4028FEBA1C80E
SHA-512:	5162484F7DFE3AD60E9ADA5BACF7277BB8DF4EF6E80071BF205EC3746A133D846CF2103F2A282024320A02B9D299A200B329C99B3E8AE039BB76D3E0B2B07DEE
Malicious:	false
Preview:	RIFF:\|..WAVEfmt ........D.............fact........data.\|................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\StarWarsGalaxies\Sample\ui_toggle_mouse_mode.wav

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Category:	dropped
Size (bytes):	31810
Entropy (8bit):	2.262176965055877
Encrypted:	false
SSDEEP:	384:nmMdGhCFa2ttREhZUfPbNxBHH0twN9qk72mEexRXYVW/Ly123v6FVRtE:P/
MD5:	0680773BF646E7A9780A013AEDE5C804
SHA1:	0994740633B7B5BCDF27023E2D22712AA979216A
SHA-256:	72CFEC0A3D43DE264F1BF42D5D57B27B402541A8DF9D5F7E7EF4028FEBA1C80E
SHA-512:	5162484F7DFE3AD60E9ADA5BACF7277BB8DF4EF6E80071BF205EC3746A133D846CF2103F2A282024320A02B9D299A200B329C99B3E8AE039BB76D3E0B2B07DEE
Malicious:	false
Preview:	RIFF:\|..WAVEfmt ........D.............fact........data.\|................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\StarWarsGalaxies\Sample\ui_use_toolbar.wav

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Category:	dropped
Size (bytes):	31810
Entropy (8bit):	2.262176965055877
Encrypted:	false
SSDEEP:	384:nmMdGhCFa2ttREhZUfPbNxBHH0twN9qk72mEexRXYVW/Ly123v6FVRtE:P/
MD5:	0680773BF646E7A9780A013AEDE5C804
SHA1:	0994740633B7B5BCDF27023E2D22712AA979216A
SHA-256:	72CFEC0A3D43DE264F1BF42D5D57B27B402541A8DF9D5F7E7EF4028FEBA1C80E
SHA-512:	5162484F7DFE3AD60E9ADA5BACF7277BB8DF4EF6E80071BF205EC3746A133D846CF2103F2A282024320A02B9D299A200B329C99B3E8AE039BB76D3E0B2B07DEE
Malicious:	false
Preview:	RIFF:\|..WAVEfmt ........D.............fact........data.\|................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\StarWarsGalaxies\Texture\heavyweapons_reticule.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 256 x 256, 256-bit color, compressed using DXT3
Category:	dropped
Size (bytes):	87536
Entropy (8bit):	2.6387193502959483
Encrypted:	false
SSDEEP:	768:QiCjtDHisL5yvbwG48IgMF1ssKQQQwwliw3EIoreq:QBi8kwA
MD5:	C6D1B43C7BDC5209E8220CBCB10F0346
SHA1:	19F016B333BA01654F2A20C33340CF42F5418D17
SHA-256:	413E231CE9A3B3D83A8D1BDC1B2D3075E2B6CB9EA35B572EF6F1B21D8FA13B09
SHA-512:	3C40FD6750D2B4ABBA7820482DBF418DF025A7CB07EB7CCB0F9ACEDBD7192EE87BEF97502A918FEF824A70BB16BB840A7FEC051C92DCA3470E6B877D69D45DED
Malicious:	false
Preview:	DDS \|....................................................................... .......DXT3......................@.............................UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU........

C:\Program Files\StarWarsGalaxies\Texture\ui_background_arrow.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 1024 x 1024, compressed using DXT3
Category:	dropped
Size (bytes):	1398256
Entropy (8bit):	4.3331594639385544
Encrypted:	false
SSDEEP:	24576:Jv3QNLHJuv+aWbs+glyu5wdn56bKJITr6Y4xcw3MbHPCbfr:J/QLHJuv+aWbklyQwdn56bMIuxci6HPc
MD5:	26A59F0EFF0CB71C35D002449C2EF03C
SHA1:	E0CBBF8FAFF1647088BD664A4C732A5AB1302272
SHA-256:	823AD3A093E57C9F5BF6A2EE914C09B12093CBACFB19AF123433FE73B240C05C
SHA-512:	1F001BF13B9686F592D69C2F3CC949E612D439C43D32623AD99285E5776958CA4E1E5DF4B46FE221106DF86C5A45ECCBD19518E68225FD4ECF386AB1CE72B54E
Malicious:	false
Preview:	DDS \|....................................................................... .......DXT3......................@.............................UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU............UUUU........

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_activate.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	5.342248582277052
Encrypted:	false
SSDEEP:	48:GZTKtUw23UoZQH+UEA0ozKMGUf8n2GujMxg4wektLYrdc3vXrRfIoxBwPY/:GZTp3UkpUVz2NUTjMxgXN26v71I2
MD5:	3B532D932C88A7B8CA06CDD64BAC9155
SHA1:	F565AAA508D69FEA01234E84B2A3BDE93CBE0662
SHA-256:	B036C4C8083630371C67B628FC7036D85F9780BC69060323ECE0DAC2E737DEC9
SHA-512:	B412C56BFA7DFE2039FBB843509BB77B0F090E4C9D1943883B92BA6A7F0616C02E4C88F243AEA9FC81CD3F579D06F5751D6F45F6D7A89398B69CFCA58C5CB3CE
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.\|\|y.{xw!aj\.9g-."{..,...+...6x'.sqp)sqp#6x'.+...,..."{..9g-.aj\.{xw!\|\|y.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.}\|y.lph_Bc9.$...&...0...4...0...)...tmp#smn!(...1...4...0...&...$...Bc9.lph_}\|y.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.}\|z.gpam-d......,.......&.......(...RnJ.`q`<htg+ZqR.%.......'.......,.......-d..gpam}\|z.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.~\|z.gpbo,g................>i3.]cXl=[=..f!..o...l..&d.WbT[de_[<i2........*.......,g..

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_attack.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	5.3818079937827
Encrypted:	false
SSDEEP:	48:GZsnVg+xV9EplTPy2x0nfyMhDIYdIim5j4YQloT4FW7HFi2eRSkh:GZygw7YlHZ4tloTIW7mSkh
MD5:	FB53385DD997E4906D6A920AAC362B4E
SHA1:	38D2F863EDAB96AF7D9E9D6B326DE6D3138DB699
SHA-256:	4E9A5CF310A0FC2E9F4707A8AA76061503D5397EF37BC9F2B4156EF50E518034
SHA-512:	C456685E84DDA2452A11AF98EA1CAA99C25E0A51FAF702100AFF393EB38DFAFCA461DDDF56705CDB874D91A564F0CC3D739224E1C46038C6A5C2AFDAA5434ADA
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.z{u...u.uxs.XcoE'<t.........HWpe.~u..~u.HWpe........(<v.XcmEuxs...u.z{u.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.zzu..~u.^gq;'=q.................7It.{\|t.{\|s.7Ht.................'=s.^gl<..u.z{u.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu...u.CTlr.&y.............$<..FRzmhor$}}u.}}u.lqr .A{..4...............!..DSps.~u.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.zzu..~u.<Nq.......... ..EY}mdom:rwq...s.{\|u.xzu.xzu.}}u.wys.mtp.ZikA A... ..........;Mp.

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_big.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	4.268386261889427
Encrypted:	false
SSDEEP:	48:GZhws0Sc66rpgDN3p6n4a+ggaTNWgqMD6QkV4nR4r:GZhws0ScBODhp6nB+vmoVTV4nR4r
MD5:	15F0E7A98C462BF4A92079B6E7226076
SHA1:	7EE7A38F6EC6A6F0315879FDA65A85904552831C
SHA-256:	404F3DB9DA7FD719D4E096D8056A351E89B85F7D315F429784E74F74D608AC52
SHA-512:	A4367898B6900553A8B01DF334C77B69A154F10BB92215D0EC13581A55ABBEDB5EDD32D17E3ECDD57B1B1715944261C48676E357E2CADF73701294026D40C8D3
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .........................................?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...<...<...<...<...>...33../P..>...>...<...<...<...<...<...<...<...<...<...<...<...<...<...<...<...<...<...?...?...?...?...?...?...<...<...<...<...>.../^.r"...,g..>...>...<...<...<...<...<...<...<...<...<...<...<...<...<...<...<...<...?...?...?...?...?...?...<...<...<...<...>....L..8...8..z(x..>...<...<...<...<...<...<...<...<...<...<...<...<...<...<...<...<...?...?...?...?...?...?...<...<...<...<...>...-J..>..g...7..w&...>...>...<...<...<...<...<...<...<...<...<...<...<.

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_crafting.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	5.813284121588687
Encrypted:	false
SSDEEP:	48:GZOz3r9CEavXsNo7WFWCVwF5aZI2DP6IYnFZ9URM8phx6cXGiY:GZs5Baf7tCVwQI2DPjYf0MoacWH
MD5:	93BF698A2CAB4B058DCD65A82E11BC8C
SHA1:	CB4CC3E85E52F81E7523381B3C7B16649D415B8E
SHA-256:	5C1431F215E094BEC6ACC3140813DCA8461B46902E7680577D96B2A82782E91F
SHA-512:	C5572839B9BB02CF339FD09FBCCEF230B9C11655502D2EECB228476839D8E9931A952FD2F42607B9361197C4D7224564773FE6DA716326785D2199A5F57B08D0
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.{~v.wzt.i^h<g,g.y.y.........w'w.ptm.ptm.w'w.........y.y.g,g.i^h<wzt.{~v.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.{.v.ojm.`5a.........................joi.joi.........................`5a.ojm!{.v.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.{.v.ndm1c.e.........................oPm_x}t.x\|t.oOma........................c.e.ndm1{.v.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.{.v.odm2e.h................h1i.aZaBdc`2tmm.unr.zzu.xzs.efd.`Y_Dh3i.................e.h.

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_deactivate.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	5.560037885594381
Encrypted:	false
SSDEEP:	96:GZzvz3Ai5sQhNwDzSDzalemOkehULPyJ8Tw:Di5sQOszJKGyw
MD5:	43F549AFAB6C63E86EE8FE034243E711
SHA1:	AF8382AA6B5B1CE8466B5F00B6516964E3F84861
SHA-256:	59216753864D4D4C9E8EB8B793821CF2444D4DAF12E181AEC3B58CC821F6F838
SHA-512:	DADFF7C07F3B647BC28CA24C4ED57C51DBA50AD27A2CD1E421B5103D678945CDA55D12C308CE4A05AA71469F141559B6661F79AE04FCD7FD1D469CFB6B4C6081
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.\|~w.z\|t!a_g.>,h.0.{.Z...[...B'y.rtm)rtm#B'y.[...Z...0.{.>,h.a_g.z\|t!\|~w.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.}.v.kkm_E9b.6...J...g...n...e...:...loh+loh':...e...n...g...J...6...E9b.kkm_}.v.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.}.v.gdmm4.e.8...X...c...O...8...7...ZPo.z\|t.z\|t.ZPo.7...8...O...c...X...8...4.e.gdmm}.v.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.}.v.gdmo3.h.>...V...O...2...C2i.]^`gefd:z\|t.\|~w.\|~w.z\|t.efd:]^`eC2i.2...O...V...>...3.h.

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_death_blow.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	5.417899047826122
Encrypted:	false
SSDEEP:	48:GZjP4KdBaL3Y6fRQpgcCT5JViDb805scjlCG4vGWb2Q+QdWD+A8V:GZDBMY6fROgcaV3cE9CiV
MD5:	16DA0165E5F770121EE74E4337342526
SHA1:	5EB0218742D0461312A34F43D38256BD409601F4
SHA-256:	9A5D1FFF584CFD2C50FD71BD94F8006137392C1E5C3C7E14B2C27A8607F72FA7
SHA-512:	AAECF5A5CA8826E3ACCAC30E38BF63B98DD225CC0E511A4C73467784BA022F605EB0F9D8F877B98E519162C892656928C33C8F118B9AE71AAEC3E83A89083C8B
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.}~w.xyq.TW]<.$[...q.........."o.pqi.pqi.."n...........o..$Y.TW]<xyq.~.w.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu...x.ikh.'/V..........&...&...!....x.klc.kld...w.. ...%...#..........'/R.aee!..x.xzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu...x.[^e1. X......$...%..............AGhaz{s.z{s.AGha..\|..........#... ........X.Z^d1..x.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu...x.Y]d2..b......".......... ^.UWWFab]/wxr.{\|v.{\|v.wxr.ac]/UWWG.].........."........_.

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_default.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	5.327721970289106
Encrypted:	false
SSDEEP:	96:GZ7pTLhlN59QDMrA09e1pElKdZaQtO9saLRQ:WpLhlN5P8Ylqpka
MD5:	8167EDDF0241AB99D71FEC51E0E0BD6E
SHA1:	14C053BBE8B98B6B1EB554091AF8EE5418CA32A5
SHA-256:	CF43DBAA5DA1818644DC9E09FA85DCAAC39C664C871DFF493666FBB01E206276
SHA-512:	BF00DCC66B441A21114DA763691EB1EC45737080EA9D24224851B469FBE18AC47405305877CB9AF44E4CC2F3822388E84CA865F37385FC144D2768BD6503FADC
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.zzv..{{.vws.\qZE0u/.........JqIe.z{..z{.KqIe........0y..\qZEvws..{{.zzv.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.zzv..\|{.ar_;,o,.................<x;.\|xx.\|wx.=y;.................+s,.`n^<.{{.zzv.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.~{z.FiEr.l..............#.".2y1.krh }{y.}{y.krh 2{1.$.!.................GnFs~zz.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.zzv.~{z.>j<.............&t&.[kZAprm.{wv.~{z.yzu.yzu.~{z.zvv.pqm.[jZB'x&.............>k=.

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_drag_bad.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	4.703591308214489
Encrypted:	false
SSDEEP:	48:GZNBLOtn+60HZBBqRZOThn2bvwv+6mWH733x:GZ4nFeTEVq7x
MD5:	9E6EBDE5875E38522F7E486D6177EEB7
SHA1:	5CFFCE881E83102C9910A0FFB7242DEF7ABB2CEC
SHA-256:	2533CA6C8B742F817DE5661731E460AAA258E30F6527DE4B1CE39016954040E3
SHA-512:	3802A281CAD9EBD289CCCF5804423EF58DA416B876FEAA84EEF1D578C5F5BD9F472BB90477E30D8415D2BB4D0CFCD63C3ECA5D1402F8F34B60DB763049ABC878
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzv.z{v.z{v.z{v.z{v.yzv.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.{{v.\|\|v.\|{t.}{t.}{t.}{t.}{t.\|{t.\|\|v.{{v.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.yzu.yzu.yzu.{\|v...x.srm.SWW.DMO.BLM.BLM.DMO.SWW.srm...x.{\|v.yzu.yzu.yzu.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.yzu.z{u..}u.mmj.AX_..]x;.......................]x;AW_.mmj..}u.z{u.yzu.yzu.

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_drag_scroll.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	4.659931682509392
Encrypted:	false
SSDEEP:	48:GZ9Fv5NfUXwviihEm5rbErTo8YNmT2kzRry+/0xvo8:GZ9FRNcfi+mirXY8TNzK
MD5:	7C58E8ECEC58E6BCE500C0391C376654
SHA1:	428B03AA4C735DF39CA541E04C0114F477E44D5B
SHA-256:	9B793D48E381BEBCE414DCCE9F4702E0D37020429C3A238DF82594B9174DDA58
SHA-512:	BA9426B8F05017F2E679B253F8E2E483F9EC8F55A792685BE57DED0883942BFEE9750ADE2A33D31FE2C4FF267B52683911598F3712397A64BC70948E5AE515BC
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.\|yr.vzu.\|yr.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.{ys.T..I....W..E}xr.yzu.yzu.\|yr..wo.zzt.yzu.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.}yr.}xr.yzu..xp......... ..\|xp.zyu.{ys.g..#O..Qs\|y.zzs.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.yzu.yzu.yzu.{yt.Q..NK..Xwzu..xp."...........q{x.}xr.t{x.$.......[..>.wo.yzu.

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_drop.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	5.399052738747898
Encrypted:	false
SSDEEP:	48:GZ2uTYaSSv+v5ekiZCnNxAAZpYJ/wiu+k+tQjagjZe0NQ7EVFJm6JgflDYyiyM5:GZO0IPXY7uDygjZer7kFJzgy5
MD5:	1FB7852C040CE40A201BC862546D446C
SHA1:	7FDC174B163B4D7D27773661A07CC39BB9CA7172
SHA-256:	BD3C8EC167A56950ADE24C6918A772EBF91FA5D8CC0EDAFC16540764FEE49566
SHA-512:	D861FBBD3881F71E057EC05F5241F7B18C4B23818E05A505C24E59467941C63377E7A2DB443436B87DB861B9A044289C22BE087E3D00E79FBC5C69DE50E59575
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.\|\|w.yys.V\\<.JW..Pa..........Tn.pnh.poh..Tn..........Oa..JW.V\\<yys.~}w.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu..}x.pql.+IQ..e{..................ex.vme.tke.._s..................cy.+FO.ekg!.}x.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu..}w.]jh1.DQ..{..................Z..\*GX.2CK.?QTvgns2 w...w...................BP.]ih1.}w.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu..~x.]ih2.FT..............cz.&O^.IGK_,BO..m...k...q..)}...=H.JFHX%O]..bx..............FT.

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_eat.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	5.52116038446375
Encrypted:	false
SSDEEP:	96:GZTbgqrJH1T2Aj4X8fr4RUzZY7zujzKifgfC:Gn1PfirfujzLfgfC
MD5:	127BDE47286479C23170BB476C46D5D5
SHA1:	3534304C5F56C272DA2BDA5071C9E2D2017A3381
SHA-256:	270DFA7CCD66D4C2046CE836EB2CEF313B4AAEE3626C6181D7C7D9B99CE02A28
SHA-512:	6AE478C4B33EBD8F8376C7732E12EC0529367AAA7A78F66A29C5DF8D19A3FB9711D2A0CF4AE0ECDB9D6EE21315DEDD2F2CF4C6B03DE3517D5F6AD6A0F2528D1F
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.\|\|x.yxv.dj\<Kg-.F{..q...u...Qx'.sqp.sqp.Qx'.u...q...F{..Kg-.dj\<yxv.\|\|x.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.\|\|z.mpg.Ma5.K...d...............M...nlk.nlk.M..............d...K...Ma5.mpg!\|\|z.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.\|\|z.jpa1Cd..P...q...z...g...P...L...`pMayxw.yxw.`pMaL...P...g...z...q...P...Cd..jpa1\|\|z.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.\|\|z.jpb2Eg..T...m...i...H...Oi2.`bXDhfd-vvt.z{w.z{w.xxu.ggc/`cXEPi3.I...h...m...T...Eg..

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_equip.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	5.5492457820545855
Encrypted:	false
SSDEEP:	48:GZtwdV0TQSuxA976MDn5C0mJ7XNmx6Xd4pOZ/B1infwhtQeLOfG5hLyHWGRp8jD2:GZS0TE6p1YJ7sxvg/L0IhtiG5hGH22
MD5:	613652F2C3C2895F7134CC9809AC680D
SHA1:	E8CE360139071FBB02C74C4376A44B03EF9D3EF8
SHA-256:	2CD73EAAB91364C954AAC9207740C5546A9DA978BD51A1E2AB37D100051BE185
SHA-512:	5A1CB3910E75F71DC54C2B68DD12A1649FF9ACB493F4D002FB622EBE8A324A62A261673F1209DB091D81D1BAADDB057F17DCF0F935F301D66B0E2CAEC5ACEAD9
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.}\|x.{xv!^j_.-g<..{+...N...P.'x>.sqn)sqn#'x>...P...N..{+.-g<.^j_.{xv!}\|x.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.~\|y.jpi_9cB...1...A...[...a...Y...4.nli+nli'..4...Y...a...[...A...1.9cB.jpi_~\|y.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.~\|y.dpdm.d1...0...N...W...F...1...2.OpW.{yv.{yv.OpW...2...1...F...W...N...0..d1.dpdm~\|y.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.~\|y.dpdo.g0...6...L...G...,.2i@.^c\ded`:yut.{xu.{xu.yut.ed`:^c\b2i@...,...G...L...6..g0.

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_hourglass.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	5.223760439021373
Encrypted:	false
SSDEEP:	48:GZuSU9LfUfItLHgPiTUGFx+oIbRKkMIhvCc8js/gCRX6rX3I68NH3Oz02:GZuSU9ws/+h9KktphyXYfxO02
MD5:	F1848BA4F1B9EEF460D82DB14E0E3512
SHA1:	8A556BBD8259F7B3A5AC85F79755305E6AA13C92
SHA-256:	283327594E2A04C56AF2F55F7D0F4712D17BB8715D9B16FDF01495DCDFDEA3B7
SHA-512:	2ECBFB7B9DA1037E66D3AA3F367114CCD6D0CF74CD07EA4D77E6B3E32125A5329310F599A0C57D7B4D2C8FC2F8CC5E4F186E9BE698B9BC7C56C11D088F7CFAD3
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.y}y.vxr..WK<.8...>...........B..wnj.wnj..C...........@...8...WK<uxr.w~z.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzt.v.\|.tl_..; ..C..................H..zff.zff..I...................G..9 .}fZ!w.\|.yzt.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzt.w.\|..bQ1.2...Q...............a...L...Q6avzv.vzv..Q6a.M...d...............`.../..aQ1w.\|.yzt.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.w.\|..bQ2.0...f.........E...;...PSB.]])zxu.{\|z.{\|z.zxu..]]).OSC.;...G...........o...1..

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_intended_attack.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	5.629909889470673
Encrypted:	false
SSDEEP:	48:GZbNNbPpy9W+UERlWXWiCPgBn9q0LA+BKbVd2xn9CJMXofhUKtm/OEh:GZr7py9WZiUXCPCLAkKbmCJuofXtNEh
MD5:	1DA71D204EA3BA3628245C1221E149F9
SHA1:	83BE5551B64C1C19E8757470324EE09688FB39DE
SHA-256:	0CE43DF475EF5A4C42812626C451AFED7B7A9C4A7ADA731271FDA6BD83B718B6
SHA-512:	88EAA7995E86E1FA37DD0335EF489F08E1CAFC07155F6DAF17F4F8808EC45CFA004C3AB21714929757004C6E4E7EBBC7E1A53747749E3F53CD235CC9D2F9B4C1
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{\|w.z{v.z{v.z{v.v{y.}~z...j..-E.\|...........%U{zy.zxv..%U.........\|...-E..j.}~z.v{y.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.z{v.yzu.tyy...r..{B;.....................R.iR..jX...S....................{B<..q.tzy.z{u.z{v.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.tzz...f..w!r......................}/q.n...o...2[.....................w!s..f.v\|{.z{v.yzu.{{~.{{~.{{~.{{~.{{~.{{~.z{v.uzz...f..v..................7?.ob.{nc..e...........j..unj..n`...7@...............v..

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_mission_details.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	5.194855740694334
Encrypted:	false
SSDEEP:	48:GZvLiWLxHjN5ZXvchVbHojd07Oc3wlrK7Z7H3Cwm7zUUlY956agh:GZvOwL5VvqI2OmwJKg9X7GH6aO
MD5:	8DA364118AB8CB3198D6855F77FFF819
SHA1:	5F0ECD13298A247403C1C4B80E4F5D382922AC89
SHA-256:	D59561F800F2EE17BD8C06F019F54F280901525FFF97D13651F8A95F88E800A8
SHA-512:	AED804AD504E1370D47BA8541FE09FD8C5560789F0D6DF8CFD022DA2172868C6710AF4D572485750B858BE655ABF317D4FFF890862FD316A9D8F2D269D9A8052
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.~\|y.xwt.SaT<.Y'..s....F...F..o.pnk.pnk..o...F...F..s...Y'.SaT<xwt.~\|y.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.xzu..}{.bjb.&R,..y....3...T...\...R..\| .jhe.jhe..\| ...R...\...T...3..y..&R,.bjb!.}{.xzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu..}z.Zi\1.U........D...Q...9.........?gIazxv.zxv.?gIa..........9...Q...D......U..Zi\1.}z.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu..}{.Zj\2.Z....$...@...9..\|...\,.TZMF`a[/wwt.{{w.{{w.wwt.`b[/TYMG.\,..\|....9...@...$..Z..

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_move.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	4.296972007320701
Encrypted:	false
SSDEEP:	48:GZA049b2q23EoykL8xj+KUT5OtudaegbL022W+bA:GZANhuEoL0j+KUIudaegbN+E
MD5:	7827D8ABCB871DC4713147C3422F078D
SHA1:	0BEB57EF42FBE58E265603799D7BE1C1628B356C
SHA-256:	A7C6E9DF48566074C9DA6E383C6EDE61E2694B2F156B1EAEAED1FB20C83F5A60
SHA-512:	8658715AC7C226671DBF4CC6EE6DAE3F32E1E6AFF90238CC065679B1D3146C3486DAEA1B047D35FDB45D543F0B8F9D35B2C6FF5FC1EB8CD6E99502FBB34B303E
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.zzt.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.xzv.~wp.}wp.xzv.yzu.xzv.\|xr.{yr.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu..vm._..7^..8}wq.yzu..un.J..da..2}xq.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.\|xq.m.. ....G..h.uk.yzu..sh.,......t}z.{ys.yzu.yzu.yzu.yzu.

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_open.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	5.183371752672667
Encrypted:	false
SSDEEP:	48:GZbe4BB3qqMq1Znhc+zwuSuA1t/b0un50k33KmwQs7jvb7aGqtl9v4P:GZbe03x36+PXA0un5pKOsfHAtlV4P
MD5:	049BA32B7EBD08209E60C460EF9E7F1B
SHA1:	759DE2AB206AAB95CC968ED2E35CDDC20770B40F
SHA-256:	CE51509AAD1B601E55AABAC9489F1253BD7C7E34BE9C48D34FBE611B5FE38776
SHA-512:	8C00CD4708EC2F7AFDD58F46550A77077211A0189D1B1BEECB906DADF9AC788E486736FFC396F8E03388F1C20FF1D76B47207C03FB5FB9EF26D9E74820613851
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.w}y.wwr..WHA.<...D...........J...nj..nj..K...........F...=...XIAxxr.u~z.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzt.t.\|.uh^..@...U...................W..fe..fe..W...................[...?...fY$t.\|.yzt.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzt.u.\|..bQ2.6...k...............o...]...[6`wzv.wzv..\6`._...s...................;..bQ2u.\|.yzt.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.u.\|..aP4.9...............\...F...UY8.\Z.yxt.v\|x.v\|x.yxt..\Z..TY8.H...]...............<..

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_pickup.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	5.471996516767089
Encrypted:	false
SSDEEP:	48:GZnjQmnRhMknEEchfFZzEmES61y+g7qj4o2Yawbw3LUPcNTlATx42lJqGr2l9Xkl:GZn5EfZFSmG+qshYal3Se6iHGylyDlX
MD5:	FEFC43B49B558C4064DB3C587B79C38E
SHA1:	B6BDA53BCF4D64AF4823771B01A40B9D77108015
SHA-256:	C0777ACBDB0A92C0245C9D31E0ED0B076BB68BD8B4DEE611BCFBA23108EA4A03
SHA-512:	C907C71E8C4D092817C8B89CC793A03738258B26DDBFB0AF0FD7F049179981DF9509A1359C6CCB7108F70FE0B373F5F6E6C502D67D667BF3E53D7F413011AF17
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.y{x.vyw.tkZA.f&..q...........y .sro.sqo..z ..........s...f&.tkZAvyw.y\|y.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.y\|{.ssl.ya1..y..................~..qmj.qmj.....................{..w_1.tpf'y\|{.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.y\|z.up`7.].......................)..uRLwyu.wxv..vOU..'.....................^..tp_8y\|z.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.y\|{.tp_:.^...............p@bnjh.nnq.vyz.x{x.y{w.wyw.nmp.nhc..sHC...............^..

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_resize_hor.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	3.6421781997450164
Encrypted:	false
SSDEEP:	24:GZ7qRtuyQUjZVnMhZXpV3dNUYRfx9OK3A8Q38:GZiuqyhd3jU6LQ38
MD5:	B5426A46BE98706BD05B955C75AC3718
SHA1:	60B7A36E41886AAA21D20C8D08A5995FDF61FC89
SHA-256:	528077D43AFD0EE73190A2F9887EE89318575F6709F2D0051A3FA362E5F84B58
SHA-512:	65ABA8EDE7A3F3820A1954085352FE072D4238E395887EBEF9B8B5624C9747B033937B92D7B32EE62AE29A0C9196F436E17C6D3295D639EE9FCACCF53E5759C9
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_resize_se.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	3.8465599956781023
Encrypted:	false
SSDEEP:	24:GZ7qBpVFoT/lc+Ffxi8+87i9YDOwMvo99SanbKI9jw:GZApOc+Ffxi85iuUgSanbRc
MD5:	7CA6E3C1AA2C84C1B5FFD80313C8F69E
SHA1:	0331D453BA90DBA8408A11A7C56246D7B53F8C36
SHA-256:	73AD38866CDA4636B00D224114321C4857506AD79F7752D19E3288272D1DB95D
SHA-512:	D6D6055C212F395B65F7A854535F0F0716F3DD797B3E0ACF610665D0775136450C92C40E2B135269EBF039DF09049D0A72772B762A35802673B62DCE34860C7C
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.x{v.xzv.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzv.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.xzv.x{v.yzv.xzu.\|xq..vn..vn.}wp.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.{ys.r.}.-..........F..l{xr.zyt.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_resize_sw.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	3.8465599956781023
Encrypted:	false
SSDEEP:	24:GZ7qvpNjWw3ml1JYoHlBjSc/5hfdMndChhWZ/iPhZtKcRKZUTlccO:GZipIw3oZJSuNAXK1KcRK0M
MD5:	9E8FBB1138451FBED28BB3126BF1BDA1
SHA1:	E741FA6E41055225EBFC66DFF119A29B7CEE4DEB
SHA-256:	BD92D6ABC57A237A62C335E3DCEB56908C9C66D399906A2D4AC0E1A4572EB418
SHA-512:	9FCEF6B9B54E82A52D4B63EE9142F4164188D2B71359953285B9B4037AA5E2BF253505A8D68D7020DE59BA232AA0259540E21BB4DD70EF0DDA0AEDA1F7E9BE7D
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.xzv.x{v.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzv.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.}wp..vn..vn.\|xq.xzu.yzv.x{v.xzv.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.zyt.{xr.F..l........-..r.}.{ys.

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_resize_vert.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	3.6499245007283827
Encrypted:	false
SSDEEP:	24:GZ7qqPXpnc+lym+VMKvAUQcmDNo79774c5U2KvAm+1c+wDo:GZxYbMTTzDeZYOvTh
MD5:	E793690F6F436941879E59A1C01E2B1F
SHA1:	E1C357B81FBE59B823DDEB590136FAF2288334FE
SHA-256:	169577659D7E0E7E8E74C0CEBA6C170285BBAFE449C0F8757AAD2FC2462103F0
SHA-512:	7299A736E908B8C635645BA81497615CB8910C93567C9756AD025CCEC116627A579570D40F4F663BF983700B432261BBFAB121C1C82DFB722FC1C5FF569D8181
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.xzv.}xp.{ys.xzv.\|xr.\|xq.xzv.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.yzu.zzt..ul.F...g..,.um.X..OS.._.ul.yzu.yzu.yzu.yzu.yzu.yzu.

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_stop_talk.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	5.280542882530181
Encrypted:	false
SSDEEP:	48:GZE3dQpJKTb0+3//aFkjgiLBciXYudx3UvROYFYV8pMAX7or4JDFYR:GZEteKTw+3//aJaREwYFYVZAX7kcDFI
MD5:	4715735C5C513431FD4A9D8322FBAADA
SHA1:	E085986DA5D71049CE9D3A17636568CE947B3DC8
SHA-256:	5C7B8F7814D351FA5CA5D75C13D614DAFFC30C0A3335DD3EEFFA345E73E3B1AD
SHA-512:	5DF7406EFAAD1A6CE5DB1DAB4DC3C6AC36AA6FA332D0098C0D3782A0EED592FDA8AFB7951AD36639E1E4F2E0FE99F3E27A5E382DA32C71DC75255FC943898C8A
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.}~w.{\|t.^_g<1,h...{.&...$...,'y.stm.stm.,'y.$...&.....{.1,h.^_g<{\|t.}~w.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.~.v.jkm.;9b.........+...-...&.......moh.moh.....&...-...+...........;9b.jkm!~.v.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.~.v.cdm1#.e.....$..................QPoa{\|t.{\|t.QPoa...............$.......#.e.cdm1~.v.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.~.v.ddm2 .h.....#... .......62i.^_`Cfhd){\|t.{\|v.{\|v.{\|t.fhd*^_`D62i..... ...#....... .h.

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_talk.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	5.447992228479555
Encrypted:	false
SSDEEP:	96:GZwctzA26JeZ8B5YBDrgWyz17hz82/kAZ:nc9n6Jz7hoIbZ
MD5:	391A6104ED9167D31E475BEA63B23E4D
SHA1:	2EB0E27E91FAC6679488E91683CFA15E8E015B9F
SHA-256:	6D3251D9F00688858025E4424996D4D2CECE4913A3EE3054B0633F39A9363851
SHA-512:	324C98B8972B679129FB8918997D376F7E19DBC0BDD39346B8B95172DE9A25F6F1636DD548FD3E6702A744ED65C0F32487B6764D04C1B84C03EEDD38B8C19CDC
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.{{x.wxv.`j[<?h+.9{..Y...\...By%.qqo.qqo.By%.\...Y...9{..?h+.`j[<wxv.\|\|y.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.~\|{.osl.Ca4.:...O...d...l...h...<...mlj.mlj.<...h...l...d...O...:...Ca4.iqf!~\|z.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.}\|z.epa1?g&.?...Y..._...P...?...;...WpKayxw.yxw.WpKa;...?...P..._...Y...?...7d..ep`1}\|z.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.~\|z.ep`28g..A...V...R...9...Ci0.\bWFfgb/wxt.z{w.z{w.wxt.fgb/\aVGCi/.9...R...V...B...8g..

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_throw.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	5.629909889470673
Encrypted:	false
SSDEEP:	48:GZbNNbPpy9W+UERlWXWiCPgBn9q0LA+BKbVd2xn9CJMXofhUKtm/OEh:GZr7py9WZiUXCPCLAkKbmCJuofXtNEh
MD5:	1DA71D204EA3BA3628245C1221E149F9
SHA1:	83BE5551B64C1C19E8757470324EE09688FB39DE
SHA-256:	0CE43DF475EF5A4C42812626C451AFED7B7A9C4A7ADA731271FDA6BD83B718B6
SHA-512:	88EAA7995E86E1FA37DD0335EF489F08E1CAFC07155F6DAF17F4F8808EC45CFA004C3AB21714929757004C6E4E7EBBC7E1A53747749E3F53CD235CC9D2F9B4C1
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{\|w.z{v.z{v.z{v.v{y.}~z...j..-E.\|...........%U{zy.zxv..%U.........\|...-E..j.}~z.v{y.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.z{v.yzu.tyy...r..{B;.....................R.iR..jX...S....................{B<..q.tzy.z{u.z{v.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.tzz...f..w!r......................}/q.n...o...2[.....................w!s..f.v\|{.z{v.yzu.{{~.{{~.{{~.{{~.{{~.{{~.z{v.uzz...f..v..................7?.ob.{nc..e...........j..unj..n`...7@...............v..

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_trade_accepted.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	5.650392256763191
Encrypted:	false
SSDEEP:	48:GZ0EpZylSJeXwQ7udLrXlcxgD0GkCHucmeCMVu0T0RwQwIBVQ6yG6Y:GZ0EpeSJehunwQ+epV3T0+xIBVFR
MD5:	A365FCE097EBE054984D6B6318548B56
SHA1:	1D8CC11C3D32977DCC56C1739D46D3F9344F040E
SHA-256:	5EE46EB794A484B74F6594C465313278D3C8C343027BE197895F4DCAC7A82716
SHA-512:	0CD23A4430E5FE5453DE858275E111F2497E6B6F993506770A83F13C4F7F6CAA3540CC32DABB1DFE16D5F3096DF35918B1AD41B8F6599D4A0BDFC811914C044D
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.{\|v.z{s.`bi<27h...s. !.......2o.sup.tvp.04o..... !....s.27h.`bi<z{s.\|}v.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.~.v.rup.:?f..!}.....&&..'&.. ..."t.uwn.rtl...p.%$..'&..&&.......!~.:>c.jlm!~.v.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.~~v.fhm104g.....&&..((............z.Y[oOJNgs6:j...i...y..... "..('..%%......',j.egm1~~v.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.~.v.egm2&p.....''..$$......7:i.[^fEiki.EHe...u.........DH_.)/V...`...}.%%..)(......&q.

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_trade_start.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	5.221089284867142
Encrypted:	false
SSDEEP:	96:GZbeyfGi5HLS/E5KcwaVPtv0M32utDqZ8b2:xALS/a3Pp2sqOC
MD5:	710BAC28117AD7662F3FC86D37B089B7
SHA1:	05EF8FBA3671978C1DD189BCC85777A0E84004A8
SHA-256:	004208FD3098FB272055FE0582FA7177AE7EBF60DD8E9F6CB805864125ED8DED
SHA-512:	54B758C410F1CD6961EE7D45CCE18DC2A2D24E800C0AAFF1C49D4E172F5E9E1DD7B3625381D47CA12CA070FEC09A8922AAA368FA7F34C42E470AE1C90EA67F4F
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.z{w.xxv.roY<no&.s}..........rx..vup.wut.rx!.........s}..no&.qnX?xws.z{y.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.z{{.vuo.nn0.z.................u...tqo.oj\7rz..................{...mk&.ro`.y{z.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.z{z.ts`1np!.................~...y...qqCnnl5.u..............................u...rpZ9z{w.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.z{{.tr_2sy.............z...qq,.ojZ<ia3.qw.........................................x...

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_unequip.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	5.56852051666819
Encrypted:	false
SSDEEP:	96:GZ93UeU7+wNkNmaTReynp8sgfupRgsTlc7:teU1NamaTLmYusRc7
MD5:	DC30869DF3BFD39473FCB48BBA773630
SHA1:	84464CAC9196FD35208F2C306BB6D7E8B47B3F4D
SHA-256:	1336AAA7087E4F337DC21DC54006435E37597941CB43EE7D78C8321B7F481936
SHA-512:	094855BACA0CA5DA447FB61D3DAE4C5582EDE37DB23CB22BE5E2BA0F59515C19F0BC6F726A401065018E9BBCF4BE114B4A8D2C901290B4C69B0CD53FC8A0E3B0
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.}~w.{\|t!__g.2,h...{.,...+...0'y.rtm)rtm#0'y.+...,.....{.2,h.__g.{\|t!}~w.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.}.v.jkm_<9b.....#...3...7...0...!...loh+loh'!...0...7...3...#.......<9b.jkm_}.v.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.~.v.ddmm%.e.....,...2...&...........RPo.z\|t.{\|t.RPo.........&...2...,.......%.e.ddmm~.v.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.~.v.edmo#.h........&.......72i.\^`gced<z{t.z\|u.y{t.z{t.ced<\^`e72i.....&..........#.h.

C:\Program Files\StarWarsGalaxies\Texture\ui_cursor_use.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	5.503647264245049
Encrypted:	false
SSDEEP:	48:GZsa3iHw8PTmI2whGr90lZv2T98T/T9kHbJo5uflwKnm42i/S+DnwMGcJDaAHgJh:GZ1IMmGr90r2p8T7SBl5LS+RJGD
MD5:	1D0125177E9725B4AAEBB598C8D68549
SHA1:	03A519BB30305814FC2E89C59A5D39276E82314A
SHA-256:	5D7127AC7A58C490744B611AEC4483E54AF8167D0E38328DEB4AC9E9932DFBEA
SHA-512:	E1F5CB6165BACFDFEE7C3B5D5BEF49974349D3E1EFEFA3A79B504BE1D351AE0D7DE76BF91A893ABC2B10CB68B70F6105DC5160EFB00F33B3E6DD48D03E46797C
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.yzu.z\|y.wxv.piZ<~d!..n...........u..ppn.ppn..u...........n..~d!.piZ<wxv.z\|y.yzu.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.yzu.z\|{.roe.r[/..x..................y..lkg.lkg..z..................y..r[/.roe.z\|{.yzu.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.yzu.y\|z.so]1y].....................\|...qI[x\|~.x\|~..rH\.~....................y]..so]1y\|z.yzu.yzu.{{~.{{~.{{~.{{~.{{~.{{~.yzu.z\|{.to]2._..............t..}a!ilQ&.he_0tgOIsY(.tZ(.sjX7iP&.mG..}c&V.t.............._..

C:\Program Files\StarWarsGalaxies\Texture\ui_target_inactive.dds

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	Microsoft DirectDraw Surface (DDS): 32 x 32, 32-bit color, ARGB8888
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	5.390087864972489
Encrypted:	false
SSDEEP:	48:GZxPluCYn0ZAkwVjlp+Sj1D0CSq7GKOt+i5bJF9TGPQYerRVhFRfngTH:GZ3uUGxH+Qp0xMZM+iFZTGYYeRVhAr
MD5:	CF138548E51178BF43DC884970DF0BB8
SHA1:	AF97AB476DAFB0C20087B24AED515ECBF316329F
SHA-256:	4135FB56CA099580F7A49DC9EDDC8EE71FC81FF4CACA3027003A3A574B3121D9
SHA-512:	BFC9DCF3DAE2887477869C8FBD04A7B540ACAF3C150269038506B4AC158360C01A298127BFD8B01D9FFA9D5ED71BC21DB1F9101570C8A5AE740CE18D74699C8C
Malicious:	false
Preview:	DDS \|....... ... ........................................................... ...A....... .......................................{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.z{~..}\|..}\|......yi..oLGud@.}mP.kbS.ri[g.~x..~v.wgRi{n^..ua.s`J..pPG.wc...~...z...z.z{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.z{~..}\|..~~..sc<yiM..mI...g...\|..vo.kbQ..{u..{r.rbJ..vm..u..`..~Y.f]G.tn[<..{...z.z{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.{{~.z{~.z{~.y{~.....{fGo.kK.u]...m.{hC.{lO.\|rim.uk".~x..~u..vi.zjV.tcN.}W..c...q.ffW.ojWn..~.yz~.z{~.z{~.{{~.{{~.{{~.{{~.{{~.{{~..\|\|..}}.....ybO}.kK..t[..gM..lSn~kV:.sd..\|~..{\|.}yz.~yy..\|\|.{ww..vj..pbH.]=..lQ...x..lQ.sbW~

C:\Program Files\StarWarsGalaxies\Ui\ui_ground_hud.inc

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35368
Entropy (8bit):	5.141532971586811
Encrypted:	false
SSDEEP:	384:xhOfHmWShJ+ZwbKjEZbwd2oqqjiQFhesoNy8ysy0y0yn+HmEp/yVy3yMyFy7uCgP:bwXtaH+JuOKZwHl
MD5:	FB7D96935C40962C9719F2CEF75A043E
SHA1:	9728103813508E8C75B299A574ED21F742B500C6
SHA-256:	E461077DABDA11CF0F84E3685495578FF99750039BBEEC7791335148EF7B4E27
SHA-512:	D343638BDEC173821EF8F8963BF1531C1316676AB27E399A1C6D8BFF61803D062A505A0885E231E2F5528E16D08E658547C3F9F75890695E62FC71939EB1C0BE
Malicious:	false
Preview:	.<Page....BackgroundColor='#FFFFFF'....BackgroundTint='#888080'....debuginfopage.location='0,132'....DragAccepts='ChatWindowTab'....Name='GroundHUD'....PackSize='1,1'....ScrollExtent='1024,768'....Selectable='true'....Size='1024,768'....systemmessage.visible='true'....Visible='false'....VisualEditLock='true'...>...<include>ui_ground_hud_pet.inc</include>....<Page.....AbsorbsInput='false'.....BackgroundColor='#00F000'.....eq2usescomwndcontrols='false'.....GetsInput='false'.....MaximumSize='16834,16834'.....MinimumSize='1,1'.....Name='Highlight'.....PackLocation='left,top'.....PackSize='1,1'.....ScrollExtent='1024,768'.....Size='1024,768'....>.....<Data......Name='CodeData'......sample='sample'...../>.....<Page......AbsorbsInput='false'......BackgroundColor='#00F000'......eq2usescomwndcontrols='false'......GetsInput='false'......MaximumSize='1024,1024'......MinimumSize='1,1'......Name='sample'......OnShowEffector='rotate'......Rotation='0.76'......ScrollExtent='99,88'......Size='99,88'..

C:\Program Files\StarWarsGalaxies\Ui\ui_ground_hud_all_targets.inc

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	22842
Entropy (8bit):	4.807972791169685
Encrypted:	false
SSDEEP:	384:+C7n0pOtvquf0y428ZvX97I81EqwRu8BorcUVGSMfVCZ5w11EDnUEdcUVG3MlVqb:QpOzAoyuqo1xcWcb6dfd5bRhyh3b+
MD5:	91CE0FDA64177357AEE4CA65830793BB
SHA1:	FE319BF7DDCB293F8B03764FEB98CA8EB8DD6CDF
SHA-256:	6840114E37A0375A2C6CBA38A166774F3D2E128BC7B2ADBB0887543D1D41A1DC
SHA-512:	B68921FA7C50772D4F2A77D9DB66A59BE2934405A953E71D3333D317515356DC31FE166473A7B4FFA653CFB2A72D0A71CE0895A2F27145D66DCD177BACE0ADAA
Malicious:	false
Preview:	.<Page....GetsInput='false'....MinimumSize='1024,768'....Name='AllTargets'....OpacityRelativeMin='1.00'....PackSize='1,1'....ScrollExtent='1024,768'....Size='1024,768'....TextOpacityRelativeApply='true'....TextOpacityRelativeMin='0.80'...>....<ColorEffector.....Cycling='true'.....Name='outOfRangeEffector'.....RestoreColor='true'.....Speed='32.00'.....TargetColor2='#FF0000'..../>....<Data.....Name='CodeData'.....SampleArrow='SampleArrow'.....SampleReticle='SampleReticle'.....SampleStatus='SampleStatus'.....sampleWaypointArrow='sampleWaypointArrow'.....textDamageSample='textDamageSample'..../>....<Page.....Location='117,240'.....MinimumSize='320,93'.....Name='sampleStatus'.....OnEnableEffector='/Effectors.Fadefull'.....PackLocation='nfn,nfn'.....PackSize='a,a'.....ScrollExtent='590,183'.....ShrinkWrap='true'.....Size='590,183'.....TextOpacityRelativeApply='true'.....TextOpacityRelativeMin='0.80'....>.....<Data......conEven='info.ham.cons.con_even'......conHigher='info.ham.cons.con_higher

C:\Program Files\StarWarsGalaxies\Ui\ui_ground_hud_buttonbar_skinned.inc

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29638
Entropy (8bit):	5.006889160665546
Encrypted:	false
SSDEEP:	384:+CFDPaBoGnY0nz5AnqI7QmCvB7toMSOv+if6tj9XFNOo+jUa2ptr2WO3+jUD2oty:XDPaLjCDoWh75
MD5:	3C38F195E75874B7F405281A47C9C429
SHA1:	94AE2B05B2DF74F4E9C80F1A18FE74BC796B0570
SHA-256:	23D47D828F2428B1B9556B7A854E02EF0318B648522EC6A4E7DAE32D08269AD1
SHA-512:	CC0528222BC01D01D31B5C398B83C54D044641B539B5626B2BE19BCA261749980DCDB4AE45FEB945209D1E46C383B98B8D7C72FD426176C9F265647F07564CBF
Malicious:	false
Preview:	.<Page....AllowLookAtTargetSelection='true'....ContextCapable='true'....Location='617,734'....MaximumSize='390,390'....MinimumSize='30,30'....Name='ButtonBar'....OnDisable='corner_tl.enabled=enabled'....OnDisableEffector='/effectors.fadethreequarter'....OnEnable='corner_tl.enabled=enabled'....OnEnableEffector='/Effectors.FadeFull'....OnShowEffector='/Effectors.FadeFull'....PackLocation='fff,fff'....RStyleDefault='rs_default'....ScrollExtent='390,30'....Size='390,30'....TextOpacityRelativeApply='true'....TextOpacityRelativeMin='0.80'....UserMovable='true'....UserResizable='true'....VisualEditLock='true'...>....<Data.....bigMenuButton='bigMenuPage.bigMenu'.....bigMenuPage='bigMenuPage'.....buttonAppearance='buttonsComposite.buttonAppearance.appearance'.....buttonCharacter='buttonsComposite.buttonCharacterComposite.character'.....buttonCommands='buttonsComposite.buttonCommandsComposite.commands'.....buttoncommunity='buttonsComposite.buttonCommunityComposite.community'.....buttonDatapad='b

C:\Program Files\StarWarsGalaxies\Ui\ui_ground_hud_chat_window_skinned.inc

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	ASCII text, with very long lines (908), with CRLF line terminators
Category:	dropped
Size (bytes):	13745
Entropy (8bit):	5.195614989046594
Encrypted:	false
SSDEEP:	384:+DdcqZcAGnD5NWopJujLCJH+jfAwM+5G7y2gywfPLM9LR33QwhN8v+DiOtcgTvkS:NtGmtHd7N
MD5:	347D3CA5B5FE129CF841F12AD0F285A3
SHA1:	05D9B8EEDB065D4C2186243A24F04C4C0BA8A841
SHA-256:	675706308D1268BDEAF2D09CE57D4C0C94109EC37E6A6563A890C5F0D46FF87A
SHA-512:	31753150D846DAE365950D72DDD3B9CE45A2BE237BB2E781B91A32F5056A6A6AAEC0D41B1AD5E289246CB2DC13B52113B76F7CDE76154129CCEC13215D5D36AA
Malicious:	false
Preview:	.<Page....AllowLookAtTargetSelection='true'....BackgroundColor='#22FF22'....buttons.enabled='true'....ChatOnHoverIn='collapsing.output.body.scroll.EffectorCancel=\"/Effectors.FadeOut\"..collapsing.output.body.scroll.EffectorExecute=\"/Effectors.FadeFull\"..collapsing.scroll.EffectorCancel=\"/Effectors.FadeOut\"..collapsing.scroll.EffectorExecute=\"/Effectors.FadeFull\"..collapsing.tabs.EffectorCancel=\"/Effectors.FadeOut\"..collapsing.tabs.EffectorExecute=\"/Effectors.FadeFull\"..collapsing.mmc.EffectorCancel=\"/Effectors.FadeOut\"..collapsing.mmc.EffectorExecute=\"/Effectors.FadeFull\"..collapsing.corner_TL.EffectorCancel=\"/Effectors.FadeOut\"..collapsing.corner_TL.EffectorExecute=\"/Effectors.FadeFull\"..collapsing.output.background1.EffectorCancel=\"/Effectors.FadeOut\"..collapsing.output.background1.EffectorExecute=\"/Effectors.FadeFull\"..collapsing.output.background2.EffectorCancel=\"/Effectors.FadeOut\"..collapsing.output.background2.EffectorExecute=\"/Effectors.FadeFull\"'....

C:\Program Files\StarWarsGalaxies\Ui\ui_ground_hud_mfd_status_skinned.inc

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	43338
Entropy (8bit):	4.950516416557051
Encrypted:	false
SSDEEP:	384:+YLeMGT6pQmlVa71XNKju6I+5DS43L3G8pfO9fBt5nj3L3G8XvGdBlGU7V0uCWPX:da7tZKSa7tZKo
MD5:	6665DCC54B3A05E8C91839BBC0B31AC4
SHA1:	DE88387EFA2CA3C3959D1EB3625D56BB4845F82B
SHA-256:	B80836A853C5BDF0F98A1035697408FCD122757F60C9C8CA2329CC1C466CF537
SHA-512:	2A0BAEED53AC72B9F9E075B3D72B83EB4C36B5E6901C47E4F059D0F52EA384C1C3BD12E2A20B41DD7CC286101C3CBFEC3A7407B1F216A9486BBFF42B40EA9A8E
Malicious:	false
Preview:	.<Page....AllowLookAtTargetSelection='true'....BackgroundColor='#0000FF'....ContextCapable='true'....DoNotPackChildren='true'....Location='10,6'....MaximumSize='287,64'....MinimumSize='287,64'....Name='MFDStatus'....PackSize='f,f'....RStyleDefault='/Styles.window.chat.tiny_frame.rs_default'....ScrollExtent='287,64'....Size='287,64'....TextOpacityRelativeApply='true'....TextOpacityRelativeMin='0.80'....UserMovable='true'....UserResizable='false'...>....<Page.....ContextToParent='true'.....GetsInput='false'.....Location='264,-1'.....MaximumSize='100,100'.....MinimumSize='4,4'.....Name='sampleIconPage'.....ScrollExtent='22,22'.....Size='22,22'.....Visible='false'....>.....<Text......Font='bold_11'......LocalText='1'......Location='0,12'......MaximumSize='1683,1683'......MaxLines='1'......Name='textStack'......PackLocation='fff,fff'......PackSize='f,f'......PalText='text1'......ScrollExtent='22,10'......Size='22,10'......TextAlignment='Right'......TextAlignmentVertical='Center'......TextCo

C:\Program Files\StarWarsGalaxies\Ui\ui_ground_hud_pet.inc

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20916
Entropy (8bit):	4.958735432432777
Encrypted:	false
SSDEEP:	384:+YLEEGT+IElaEUraahRcuM1szXEW2F2PCm1Pp/Y/zEGWIeX2bxmZPp/8Fz0GWYDy:faE0zHz
MD5:	7D23827C085E75AFE025BB9173AA5E24
SHA1:	53D5D39BB52494C3900F158DB25EBA4DD6BA57B1
SHA-256:	3F604A0F256FBA40DB31C77435C9664E83731E170D381B3119B5DA18EFAC63F0
SHA-512:	998394336D6E87741362C022D15CF547BCC33DD821E301705F7C9C3D89C3043C31A71B70EAE2A4D8E78D5DF6B371AD0C89F44BD4D3BEEFB9BC88DD9BE549A705
Malicious:	false
Preview:	.<Page....AllowLookAtTargetSelection='true'....BackgroundColor='#0000FF'....ContextCapable='true'....DoNotPackChildren='true'....Location='727,447'....MaximumSize='220,50'....MinimumSize='220,50'....Name='Pet'....PackSize='f,f'....RStyleDefault='/Styles.window.chat.tiny_frame.rs_default'....ScrollExtent='220,50'....Size='220,50'....TextOpacityRelativeApply='true'....TextOpacityRelativeMin='0.80'....UserMovable='true'....UserResizable='false'...>....<Page.....ContextToParent='true'.....GetsInput='false'.....Location='196,-1'.....MaximumSize='100,100'.....MinimumSize='4,4'.....Name='sampleIconPage'.....ScrollExtent='16,16'.....Size='16,16'.....Visible='false'....>.....<Text......Font='bold_11'......LocalText='1'......Location='0,6'......MaximumSize='1683,1683'......MaxLines='1'......Name='textStack'......PackLocation='fff,fff'......PackSize='f,f'......PalText='text1'......ScrollExtent='16,10'......Size='16,10'......TextAlignment='Right'......TextAlignmentVertical='Center'......TextColor=

C:\Program Files\StarWarsGalaxies\Ui\ui_ground_hud_radar_skinned.inc

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	19694
Entropy (8bit):	5.159801602706544
Encrypted:	false
SSDEEP:	384:+SvzNFlbV2MphGntUWTHPnnmwXn8OLGnGIGOTKeX+I4c9ppBZT5dNGjOpjAYsjWk:HTtyS6eFIfb
MD5:	3A284F4EF8C007085680E32B056B8E70
SHA1:	04922B20CC6949C089213FE7AB824E0839C11F56
SHA-256:	A31E3EB9A20511C8DD7716D6A858844F62893A301DB8351C7959F1A87B690F3C
SHA-512:	62C3316EA4DC7E68792E2A306193F9A4601B1BDD5538A050DAB06DB35C4E23AEBD3881BF997C1DE8FFAF33B560559492B28F35870A38B178722670E13F9E1B7E
Malicious:	false
Preview:	.<Page....AllowLookAtTargetSelection='true'....altRadarBg.enabled='true'....background.enabled='false'....compass.enabled='false'....DropToParent='true'....Location='870,20'....LockDiagonal='true'....MaximumSize='1024,1024'....MinimumSize='128,128'....Name='radar'....OnActivate='Sizex = Sizey # Keep it diagonal..altRadarFg.ZoomTop.LocationX = Sizey * 0.82..altRadarFg.ZoomTop.LocationY = Sizey * 0.82..altRadarFg.ZoomBottom.LocationX = Sizey * 0.82..altRadarFg.ZoomBottom.LocationY = Sizey * 0.82..altRadarFg.ConModeBox.opacity=0..altRadarFg.corner_BR.opacity=0..altRadarFg.corner_BL.opacity=0..altRadarFg.corner_TR.opacity=0..inner.square.Range.opacity=0..inner.square.Region.opacity=0'....OnDisable='compass.enabled=true........altRadarFg.enabled=false........radarwidget.enabled=false'....OnEnable='compass.enabled=false........altRadarFg.enabled=true........radarwidget.enabled=true'....OnHoverIn='altRadarFg.ConModeBox.EffectorCancel=\"/Effectors.FadeOut\"....altRadarFg.corner_BR.EffectorCan

C:\Program Files\StarWarsGalaxies\Ui\ui_ground_hud_secondary_targets_skinned.inc

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	22826
Entropy (8bit):	4.968167579263187
Encrypted:	false
SSDEEP:	384:+B4MGT6pEosIyaI+5DSVdvO9fBt5nj3L3GXCNGdBlGU7V0uC+vLr0TaF2jsmrPfJ:6WiOY
MD5:	20565FDF41245FDE4E36B023375D560C
SHA1:	CB71EFE4A184041D24717F86BC6AADF53F1F9FC9
SHA-256:	9A44C04E2A8F47EB765E792D6B0FA16EEBA69900669E41DF6355AA7E36ADC5D1
SHA-512:	1B3F003A28AA94FDF14456C601C188DC33A66B5E7405115A3A7C1FB291372389C3345C0D9C280B989E77809A824FDC124B56D03ED4F9B6080BCE0DBED1A82032
Malicious:	false
Preview:	.<Page....AllowLookAtTargetSelection='true'....BackgroundColor='#0000FF'....DoNotPackChildren='true'....Location='588,6'....MaximumSize='287,64'....MinimumSize='287,64'....Name='SecondaryTarget'....PackSize='f,f'....RStyleDefault='/Styles.window.chat.tiny_frame.rs_default'....ScrollExtent='287,64'....Size='287,64'....TextOpacityRelativeApply='true'....TextOpacityRelativeMin='0.80'....UserMovable='true'....UserResizable='false'...>....<Page.....ContextToParent='true'.....GetsInput='false'.....Location='264,-1'.....MaximumSize='100,100'.....MinimumSize='4,4'.....Name='sampleIconPage'.....ScrollExtent='22,22'.....Size='22,22'.....Visible='false'....>.....<Text......Font='bold_11'......LocalText='1'......Location='0,12'......MaximumSize='1683,1683'......MaxLines='1'......Name='textStack'......PackLocation='fff,fff'......PackSize='f,f'......PalText='text1'......ScrollExtent='22,10'......Size='22,10'......TextAlignment='Right'......TextAlignmentVertical='Center'......TextColor='#96F4FC'.....

C:\Program Files\StarWarsGalaxies\Ui\ui_ground_hud_sml_group_window.inc

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24001
Entropy (8bit):	4.9057642511109245
Encrypted:	false
SSDEEP:	384:+q6JnZ9uEf1g5lvcm4HcmVHp5t/p8pX4Onoag/ZTN7KBzI5R00EOncTgnZTN3KBf:MHptr5Yyk7DrdB
MD5:	0F0C74DDC38A67DA2F41576CD81D7632
SHA1:	3C107AA6A33DFB059036A225E1319A126B5DAEC9
SHA-256:	62173B3A0724A2B34555A0AF0EBB9A619B7571FCF2A60B356BD758A2DAB0FE84
SHA-512:	3ACFA730CE7C027EA96908CE41FE13E8A0D97D122D5E757F10C6508124A5B16138F0FADC0458561030E718FD2F7EB4E82B02A2BC232D644019D3AB1D2276281F
Malicious:	false
Preview:	.<Page....AllowLookAtTargetSelection='true'....BackgroundColor='#FFFFFF'....Location='0,125'....MaximumSize='220,16384'....MinimumSize='220,50'....Name='smlgroupwin'....OnDisableEffector='/effectors.opacity.bg.fadeout'....OnEnableEffector='/effectors.opacity.bg.fadethreequarter'....RStyleDefault='/Styles.window.mfd.mfd3.rs_default'....ScrollExtent='220,50'....Size='220,50'....SizeIncrement='1,50'....TextOpacityRelativeApply='true'....TextOpacityRelativeMin='1.00'....UserMovable='true'....UserResizable='true'...>....<Data.....Name='CodeData'.....sample='sample'.....timerbar='countdownTimerBar.bar.value'.....timerpage='countdownTimerBar'.....timertext='countdownTimerBar.text'..../>....<Page.....MaximumSize='16384,50'.....MinimumSize='0,24'.....Name='countdownTimerBar'.....RStyleDefault='rs_default'.....ScrollExtent='218,50'.....Size='218,50'....>.....<Text......ColorSelection='#FFFFFF'......Font='bold_11'......LocalText='xxx countdown time: 666'......MinimumSize='0,24'......Name='text'..

C:\Program Files\StarWarsGalaxies\Ui\ui_ground_hud_targets_skinned.inc

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	22838
Entropy (8bit):	4.967710651593647
Encrypted:	false
SSDEEP:	384:+BlMGT6pRosIyaI+5DSVdvO9fBt5nj3L3GXCNGdBlGU7V0uC+vLr0TaF2jsmrPfJ:uWiOY
MD5:	718DB9361D3A81C9156B060F7A161289
SHA1:	C5A0EB1EF8CECF1F358779F6F41F2E9F0836279D
SHA-256:	A9A1B5B39BD18D9F4204A7040945AFD0DFD02C23D5CE6B4366FEA511DC1864AD
SHA-512:	B21662D30D025551A8A7128F63699DBFFD73539F83715C0A692A39F1C6F7C9E97BEEF5D50055837ACB910AEE81E2E9122F701CC312CCFC951964C8853CB496CE
Malicious:	false
Preview:	.<Page....AllowLookAtTargetSelection='true'....BackgroundColor='#0000FF'....DoNotPackChildren='true'....Location='298,6'....MaximumSize='287,64'....MinimumSize='287,64'....Name='Target'....PackSize='a,f'....RStyleDefault='/Styles.window.chat.tiny_frame.rs_default'....ScrollExtent='287,64'....Size='287,64'....TextOpacityRelativeApply='true'....TextOpacityRelativeMin='0.80'....UserMovable='true'....UserResizable='false'...>....<Page.....ContextToParent='true'.....GetsInput='false'.....Location='264,-1'.....MaximumSize='100,100'.....MinimumSize='4,4'.....Name='sampleIconPage'.....ScrollExtent='22,22'.....Size='22,22'.....Visible='false'....>.....<Text......Font='bold_11'......LocalText='1'......Location='0,12'......MaximumSize='1683,1683'......MaxLines='1'......Name='textStack'......PackLocation='fff,fff'......PackSize='f,f'......PalText='text1'......ScrollExtent='22,10'......Size='22,10'......TextAlignment='Right'......TextAlignmentVertical='Center'......TextColor='#96F4FC'......Visible=

C:\Program Files\StarWarsGalaxies\Ui\ui_ground_hud_toolbar_skinned.inc

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	146728
Entropy (8bit):	4.959920803700288
Encrypted:	false
SSDEEP:	768:+47f+RqTklgas4uRYtQxgXGVUrqJHQhibEF2/II/a5soCzgu7f+RqTklgtktPRYl:7RYUlMRYwad
MD5:	80FF1175BB31DEF8734812AA94666347
SHA1:	C269A5579189092383FF69F058DE18AC51A47081
SHA-256:	945B7664C4B642F508AEE26D58C35A0457DA796807DC1177C413B1E203FAA4A3
SHA-512:	F6CFA0E7E1B6C83F0CE64311354716797A8ECBC6C6B9FDFA97402448E92F5ABC5DB93FA6E219F88C8F657B2207817DB15317E3B184F7732B9906968BBF2E4736
Malicious:	false
Preview:	.<Page....AbsorbsInput='false'....BackgroundColor='#0000FF'....buttonactive.style='/Styles.buttons.smallest_boxes.style'....MaximumSize='1024,768'....MinimumSize='1024,768'....Name='Toolbar'....PackSize='p,p'....ParentSize='true'....ScrollExtent='1024,768'....Size='1024,768'....TextOpacityRelativeApply='true'....TextOpacityRelativeMin='0.80'...>....<Page.....Location='472,585'.....Name='PetToolbar'.....PackLocation='fff,fff'.....ScrollExtent='358,55'.....Size='358,55'.....UserMovable='true'....>.....<Page......AbsorbsInput='false'......BackgroundColor='#FFFFFF'......BackgroundOpacity='1.00'......ContextCapable='true'......GetsInput='false'......LocalTooltip='[@ui:tooltip_defaultaction]'......Location='197,18'......MaximumSize='21,21'......MinimumSize='21,21'......Name='defaultaction'......OpacityRelativeMin='1.00'......PackLocation='fff,fff'......RStyleDefault='/Styles.UIv2.toolbar.action.rs_default'......ScrollExtent='21,21'......Size='21,21'......Tooltip='@ui:tooltip_defaultaction'..

C:\Program Files\StarWarsGalaxies\Ui\ui_hud_space.inc

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	132581
Entropy (8bit):	4.87264374142919
Encrypted:	false
SSDEEP:	768:rHccnpdHVlQaCtgfSxCHWgyt0787X07+waaehIqqWcHDtUUnxsBGFH+L4/jmmiaN:LlMTIpUUnqBGUrHu/f
MD5:	977F36A08F5E6D9957BCFBE96C30D8C3
SHA1:	34ABAAFDAF130E44F87F34B985F0D2CD8DCA2503
SHA-256:	7C6E3208EC4515DE1B87928D5253D81FBE44570CD3C40A8C23E6D5CE112068C1
SHA-512:	8671703D995CD5B740A65FA0DDAA3E5317372DDA06BA5584265A372EC76F400B91F6FF9E7BA3AF6A6FFE0291495824DBC33E6736DD4589203B2F34211F42C64B
Malicious:	false
Preview:	.<Page...BackgroundColor='#888080'...debuginfopage.location='0,132'...DragAccepts='ChatWindowTab'...Name='HudSpace'...PackSize='1,1'...ScrollExtent='1024,768'...Selectable='true'...Size='1024,768'...speedOverdrive='inner.square.Gauges.SpeedGauge.arcs.overdrive'...systemmessage.visible='true'...Visible='false'...VisualEditLock='true'..>...<Page....AbsorbsInput='false'....BackgroundColor='#00F000'....eq2usescomwndcontrols='false'....GetsInput='false'....MinimumSize='1,1'....Name='Highlight'....PackLocation='left,top'....PackSize='1,1'....ScrollExtent='1024,768'....Size='1024,768'...>....<Data.....Name='CodeData'.....sample='sample'..../>....<Page.....AbsorbsInput='false'.....BackgroundColor='#00F000'.....eq2usescomwndcontrols='false'.....GetsInput='false'.....Location='925,0'.....MaximumSize='1024,1024'.....MinimumSize='1,1'.....Name='sample'.....OnShowEffector='rotate'.....Rotation='0.11'.....ScrollExtent='99,88'.....Size='99,88'.....Visible='false'....>.....<RotationEffector......Name=

C:\Program Files\StarWarsGalaxies\Ui\ui_hud_space_buttonbar.inc

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	33458
Entropy (8bit):	5.0102646823161345
Encrypted:	false
SSDEEP:	384:BZWsPBaGnY4KTZHnI5AnQIR7phlBNgK2qO/+ituAMWOp+ifcO2WO3+jUD2QX9XFo:PWsPnf327SDQXPX
MD5:	32EBA9AE30919779C7702639FF0362C0
SHA1:	84ED7D3B1817D453181F35FE12A339715D173763
SHA-256:	5893E29A35555C7B43383930F4FE9B99FBF8CB12C5A9C02A1B409473582DA4BB
SHA-512:	AE08917D46F8576E9CFBB5A1070F1B47873AEBD98EAB42E7393F6BCBDECBD83765CD3F7E0C364DA5F197BE2DEFC7FECC26E5B279A7EAD58F9F955C7286162C6F
Malicious:	false
Preview:	.<Page....ContextCapable='true'....Location='583,734'....MaximumSize='438,414'....MinimumSize='30,30'....Name='ButtonBar'....OnDisable='visible=enabled,corner_tl.enabled=enabled'....OnDisableEffector='/Effectors.FadeOut'....OnEnable='visible=enabled,corner_tl.enabled=enabled'....OnEnableEffector='/Effectors.FadeFull'....PackLocation='fff,fff'....RStyleDefault='rs_default'....ScrollExtent='438,30'....Size='438,30'....TextOpacityRelativeApply='true'....TextOpacityRelativeMin='0.80'....UserMovable='true'....UserResizable='true'....VisualEditLock='true'...>....<Data.....bigMenuButton='bigMenuPage.bigMenu'.....bigMenuPage='bigMenuPage'.....buttonAppearance='buttonsComposite.buttonAppearanceComposite.appearance'.....buttonCharacter='buttonsComposite.buttonCharacterComposite.character'.....buttonCommands='buttonsComposite.buttonCommandsComposite.commands'.....buttoncommunity='buttonsComposite.buttonCommunityComposite.community'.....buttonDatapad='buttonsComposite.buttonDatapadComposite.datapa

C:\Program Files\StarWarsGalaxies\Ui\ui_hud_space_toolbar.inc

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	60295
Entropy (8bit):	5.083648081215621
Encrypted:	false
SSDEEP:	384:lbYnENLlqHCOjTj0/YDwrRKmE0ZBuUHseMzmpzuiSKzGuuKzC0uKzxJuKzMAKzkl:lXg1mbVXriP1mbbZR1
MD5:	F62BF54C8A3B6316CD45C1D5C2596ED8
SHA1:	EC4156844D1914A370B71C6F6F6366AFCD7F8801
SHA-256:	AC057DA6016721CC07F79FE97F487C959B4571C5622CF72181F9530ADEC4B176
SHA-512:	0FF25C0A23B5B77352694AA4A23E97B839141747209F0F4234CB0B3B437FF6DDABFB0B5628102AC8E7DE07EF64EB5E46A47013FB5E3947E079267B68164680D2
Malicious:	false
Preview:	.<Page....BackgroundColor='#0000FF'....buttonactive.style='/Styles.buttons.smallest_boxes.style'....Location='274,1'....MaximumSize='412,84'....MinimumSize='412,52'....Name='Toolbar'....PackLocation='cfc,nfn'....PackSize='f,a'....ScrollExtent='412,84'....Size='412,84'....SizeIncrement='0,32'....TextOpacityRelativeMin='0.80'....UserMovable='true'....UserResizable='true'...>....<Data.....buttonPaneNext='cornerTL.buttonPaneNext'.....buttonPanePrev='cornerTL.buttonPanePrev'.....currentaction='currentaction'.....defaultaction='defaultaction'.....effectorBlink='effectorBlink'.....effectorCurrent='effectorCurrent'.....failedaction='failedaction'.....iconFlashColor='contrast1'.....IconMargin='1,2,2,2'.....mouseover='mouseover'.....Name='CodeData'.....nextaction='nextaction'.....sampleItemButton='sampleItemButton'.....sampleItemPage='sampleItemPage'.....sampleSeparatorWidget='sampleSeparatorWidget'.....tabs='tabs'.....textPane='cornerTL.textPane'.....volumeKeyBindings='volumeKeyBindings'.....Vo

C:\Program Files\StarWarsGalaxies\Ui\ui_palette_ground.inc

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	134508
Entropy (8bit):	5.100034692610621
Encrypted:	false
SSDEEP:	3072:Md4Ux4Y97W1O4nEh9r4GwekrIiBRkrFv4/v4cv4I4hkrMkr3w5cEQEHxv4P:M6Uu4i1nET0zeuIGRuFQ/QcQBhuMuA5s
MD5:	67D9C1E1FAE603E84D04B26690239C27
SHA1:	E63610555F14ACCBA013950C188918F79C5DED34
SHA-256:	0224D36EDBF6C565158A4DD58D10F61D3C7BFBBCC395DE8A00F4E91889F3E3B4
SHA-512:	27491F932CB1FFC6A57341499473BAFB1E126B2A80D66601E452440FDC46B49DD7E53FAEB86076198C83F355E74B4940D76D8DFE175C6EB5EC347A9615E4417E
Malicious:	false
Preview:	#-----------------------------------------------------------------------..# Custom Ground UI Palettes...#-----------------------------------------------------------------------..# ..# Just paste the new palettes below the dotted line...# Please check the custom_palettes.txt for further instructions...#..#-----------------------------------------------------------------------..# Pre-NGE Jedi Palettes Start..#-----------------------------------------------------------------------.....<Palette......AccentDark='#028E2D'......AccentLight='#87D84B'......Activated='#FFC109'......anim='#E8B900'......arrowActivated='#E7B301'......arrowdefault='#E7B301'......arrowDisabled='#7D5202'......arrowHover='#FFBF2B'......arrowSelected='#E7B301'......back1='#CE9213'......back2='#E4A001'......back3='#917000'......back4='#917000'......back5='#917000'......backDrop='#DD9102'......BaseDark='#175B00'......BaseLight='#61C100'......bottomBar='#191919'......box1='#1CAC

C:\Program Files\StarWarsGalaxies\Ui\ui_palette_space.inc

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	153168
Entropy (8bit):	5.020030611130244
Encrypted:	false
SSDEEP:	3072:KRbqd8xJ/7bCqn0CgRZf0qLnkgEt/kmP84P8TP8K0IkEkiLdvgdyliB8s:kqux1PF0Pncckg0sm040T0vlZkdoMw6s
MD5:	F5AE920CD31EF3945A7453FD76AB96EB
SHA1:	D4D41CF7A77EB395411DA6B2A6AF86C54C525723
SHA-256:	1CF56178462D040954A4F702E1EF74B0F128D9871BF4D0A3837C5C01B85DF10E
SHA-512:	15B1E1B10598730A1AC0C0130DA43FBE2F4DBB131F1640E2569BDAFF79AA10E4A9F19E815899F252629B6DE34D24F84AC2F84EBABADA90DCBA0E7FAEF4E6BB65
Malicious:	false
Preview:	#-----------------------------------------------------------------------..# Custom Space UI Palettes...#-----------------------------------------------------------------------..# ..# Just paste the new palettes below the dotted line...# Please check the custom_palettes.txt for further instructions...#..#-----------------------------------------------------------------------..# Pre-NGE Jedi Palettes Start..#-----------------------------------------------------------------------.....<Palette.......AccentDark='#1E2D2B'.......AccentLight='#FFFFFF'.......Activated='#4E8B92'.......anim='#9AD6CE'.......arrowActivated='#77CECE'.......arrowdefault='#80BBBA'.......arrowDisabled='#000000'.......arrowHover='#FFFFFF'.......arrowSelected='#91AEAE'.......back1='#417A7E'.......back2='#214041'.......back3='#224142'.......back4='#356262'.......back5='#1D4540'.......backDrop='#38696D'.......BaseDark='#2B403F'.......BaseLight='#B6C9C7'.......bottomBar='#417A7E'

C:\Program Files\StarWarsGalaxies\Ui\ui_pda_collections.inc

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	50894
Entropy (8bit):	4.832939489943909
Encrypted:	false
SSDEEP:	384:AtBnb2u3+tTEcbgAy7x5J4mx/wQPmpQ4TetKUxCzlUNy+neTPFaCTPF9xTPFYYT0:yst10rxNBaURAUdou
MD5:	79845F1005FBB38FA0BB2F888C1117D6
SHA1:	459AEAAF0B6027A19569850F1885643346489FB5
SHA-256:	F1468A5E51932E01346F66A6EFD0395D492FA5215EBF3E92C92E627F8EE37564
SHA-512:	6CA0B66D8EBF36BBDCB9959E5EE776962626CEDF123E9B9C0934629C82267390EBC2BE26A51EA684788E3FD013AE2A2098FE837F793B3BD05A641A0FE4634DD6
Malicious:	false
Preview:	.<Page....Location='104,62'....MaximumSize='1380,1224'....MinimumSize='690,306'....Name='Collections'....ScrollExtent='690,612'....Selectable='true'....Size='690,612'....UserMovable='true'....UserResizable='true'...>....<Data.....bookNameText='Book.bookNameText'.....books='Books.BookImages'.....buttonclose='bg.mmc.close'.....captionText='bg.caption.text'.....focusGlow='true'.....imageStyleMissing='/Styles.collection.icon.missing'.....imageStyleMissingGray='/Styles.collection.icon.missing_gray'.....imageStyleNamespace='/Styles.collection.icon'.....imageStyleUnknown='/Styles.collection.icon.unknown'.....Name='CodeData'.....pages='Book.Pages'.....sampleCollection='Book.Pages.SamplePage.SampleCollection'.....sampleIcon='Book.Pages.SamplePage.SampleCollection.icons.sampleIcon'.....samplePage='Book.Pages.SamplePage'.....showCompleted='showCompleted'..../>....<Scrollbar.....Control='Books.BookImages'.....Location='20,97'.....Name='scrollbar'.....PackLocation='fff,nfn'.....PackSize='a,f'.....S

C:\Program Files\StarWarsGalaxies\Ui\ui_pda_exp_mon_skinned.inc

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5499
Entropy (8bit):	4.8313290768098085
Encrypted:	false
SSDEEP:	96:NOdw3MPI5ikFcCACh0qQvCFal4cACEt0C1M83SQK7v1Kdm+TKCeSx6mS6iS/0SQy:Niw3MPI5ZcCACOCF64XCq0C1M83SQK7A
MD5:	4B949D48DFD7A0D7A61AE7FFA5D53B84
SHA1:	07624DAB264B794737CDD62A397C37BBAFEDBC36
SHA-256:	62FF8EF63675EC02956DEE11FEFFBCBF21165FBD93B73692DEA0B0B7F4458BEB
SHA-512:	1455D340B40AA2357D58E8D09910A09AB651D7DFE5711EB33B22BFC0BB95819BD9FB42A275912CAB5F0B193E04B8FDD4886FCD06F91E6D7DD8A58A74F64C76BB
Malicious:	false
Preview:	..<Page....AllowLookAtTargetSelection='true'....BackgroundColor='#FFFFFF'....BackgroundOpacity='1.00'....BackgroundTint='#00D6FB'....Location='5,750'....MaximumSize='16384,20'....MinimumSize='128,10'....Name='expMon'....OnDisable='bg.enabled=enabled....mmc.enabled=enabled'....OnEnable='bg.enabled=enabled....mmc.enabled=enabled'....UserMovable='true'....UserResizable='true'....PackLocation='cfc,fff'....PackSize='a,f'....PalBgTint='back1'....RStyleDefault='/Styles.New.tool.tool_TL_in.rs_default'....ScrollExtent='1014,14'....Size='1014,14'....UserMovable='true'....UserResizable='true'...>....<Page.....BackgroundColor='#FFFFFF'.....Name='bg'.....OnDisableEffector='/effectors.opacity.slow.fadeout'.....OnEnableEffector='/effectors.opacity.fast.fadefull'.....PackLocation='nfn,nfn'.....PackSize='a,a'.....ScrollExtent='1014,14'.....Size='1014,14'..../>....<Data.....buttonclose='mmc.close'.....Name='CodeData'.....pageBar='barParent.pageBar'.....workingSkill='textSkill'..../>....<Text.....Font='b

C:\Program Files\StarWarsGalaxies\Ui\ui_pda_location_display.inc

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3548
Entropy (8bit):	5.097915290432383
Encrypted:	false
SSDEEP:	96:+EUex2TgkaPmE9vblmL916epj2bfkaPmmSm9vblbpkaPmmSm9vblbpkaPmmSm9vc:+EUexlkaeCvbAj6epj2jkaempvblVkaa
MD5:	EBB827DE756A9B90C349CD372127B5E6
SHA1:	8B526FF3F270FAC17883B8F40060E67282ED624A
SHA-256:	D7C5B9D42E51114882F51169C6CA8AAA29BDBB5F3CD4661FDCCF983D151484E6
SHA-512:	79BB2C816EE7803C08B0B22D090A78D18432D1E0242DB610C8F1F5A9E25B03042B462BE79F9BDF19BFD75A820947229FDCD1753351AD72BCEC134E92DA457CC6
Malicious:	false
Preview:	.<Page....AllowLookAtTargetSelection='true'....Location='983,133'....Name='KillMeter'....PackLocation='fff,nnn'....ScrollExtent='40,40'....Size='40,40'....UserMovable='true'...>....<Data.....kills='kills.text'.....Name='CodeData'..../>....<Page.....BackgroundColor='#FFFFFF'.....BackgroundTint='#00D6FB'.....Name='kills'.....OpacityRelativeMin='0.50'.....PackLocation='nfn,nfn'.....PackSize='a,f'.....PalBgTint='back1'.....RStyleDefault='/Styles.New.tool.tool_TL_in.rs_default'.....ScrollExtent='40,40'.....Size='40,40'....>.....<Text......Font='starwars_20'......LocalText='5'......Name='text'......PackLocation='nfn,cfc'......PackSize='f,f'......PalText='text1'......ScrollExtent='40,40'......Size='40,40'......TextAlignment='Center'......TextAlignmentVertical='Center'......TextColor='#96F4FC'.....>5</Text>....</Page>....<Image.....MaximumSize='40,40'.....MinimumSize='40,40'.....Name='New Image'.....ScrollExtent='40,40'.....Size='40,40'.....SourceRect='161,161,208,208'.....SourceResource='ui_n

C:\Program Files\StarWarsGalaxies\Ui\ui_pda_net_status.inc

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3700
Entropy (8bit):	5.038079276755719
Encrypted:	false
SSDEEP:	96:MUKb4nYjXimoGimn+imsGimlim2GimAsim54GimApimbGimj:M5b4nYL3oG3+3sG3l32G3X3GG3q3bG3j
MD5:	A8D03E85C545052401C9D590EAC63D58
SHA1:	2BEB067CD279DB451B7A497030EFF070E7D4299F
SHA-256:	E0BA0C04ECA09EBD8DD56540F5647CF5EDA1E0DC57CCADC1B0A8A13E7E479785
SHA-512:	F06BA964995C360F78C85483165565E48DBF52A4C8D040EB7FAD586BBADD0F90C8A29ABDAFDB0292263C9A11E5600259EDE7525557C4E482CE1717B8A8E9650A
Malicious:	false
Preview:	.<Page....BackgroundOpacity='1.00'....BackgroundTint='#00D6FB'....Location='897,588'....MaximumSize='185,64'....MinimumSize='185,16'....Name='netStatus'....PackLocation='fff,fff'....PalBgTint='back1'....RStyleDefault='/Styles.New.tool.tool_TL_in.rs_default'....ScrollExtent='185,64'....Size='185,64'....SizeIncrement='0,16'....UserMovable='true'....UserResizable='true'....VisualEditLock='true'...>....<Data.....Name='CodeData'.....textActivity='areaactivitytext'.....textBandwidth='bandwidthtext'.....textFps='fpstext'.....textPacketLoss='packetLosstext'.....textPing='pingtext'..../>....<Text.....Font='bold_12'.....LocalText='Ping (ms):'.....Location='0,0'.....MaxLines='1'.....Name='pinglabel'.....PackSize='f,f'.....PalText='text1'.....ScrollExtent='65,16'.....Size='65,16'.....TextAlignment='Right'.....TextAlignmentVertical='Center'.....TextColor='#96F4FC'....>Ping (ms):</Text>....<Text.....Font='bold_13'.....LocalText='35000'.....Location='70,0'.....MaxLines='1'.....Name='pingtext'.....Pac

C:\Program Files\StarWarsGalaxies\Ui\ui_styles.inc

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1679285
Entropy (8bit):	4.803823604902352
Encrypted:	false
SSDEEP:	6144:+h8JJcK946hu/PunXQ6JPZ9E2LduqHUHH3wquu1eglB6f1VNraX+qXeBE:TJJcKOE/X9BbjUHHZlt4b7BE
MD5:	4552DBC415EF4CA0A883759B1E3ECB52
SHA1:	2769B7543436DE4B892748F76AEED5F3E0328E26
SHA-256:	AD953841D36FD04FD59C6213D92F0AC19F3F6D22D98788084A507890A0F7C7C4
SHA-512:	E0C241606ABF6E498E527BBB6A139CB12AA8DD6382245234AA2BFC20B7DAD40C857679BDDB0FCE7B787A9EC54B6A40F7ED840AE477EDCB042C4D36DF000CC0D0
Malicious:	false
Preview:	.<Namespace....Name='Styles'....Size='128,64'...>....<include>ui_styles_collection.inc</include>....<Namespace.....Name='Expertise'....>.....<Namespace......Name='background'.....>......<ImageStyle.......Name='left_entertainer'.......Source='ui_expertise_background_left_entertainer'.......SourceRect='0,0,512,512'....../>......<ImageStyle.......Name='left_beastmaster'.......Source='ui_expertise_background_left_beastmaster'.......SourceRect='0,0,512,512'....../>......<ImageStyle.......Name='left_trader'.......Source='ui_expertise_background_left_trader'.......SourceRect='0,0,512,512'....../>......<ImageStyle.......Name='left_smuggler'.......Source='ui_expertise_background_left_smuggler'.......SourceRect='0,0,512,512'....../>......<ImageStyle.......Name='left_officer'.......Source='ui_expertise_background_left_officer'.......SourceRect='0,0,512,512'....../>......<ImageStyle.......Name='left_spy'.......Source='ui_expertise_background_left_spy'.......SourceRect='0,0,512,512'....../>......<I

C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack.zip

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1121677
Entropy (8bit):	7.999807181487946
Encrypted:	true
SSDEEP:	24576:O5f3Wmsj2/TEB1nT+y6a9Q6lxjioySg0woACijh:O5f3WKUniywMDngHbV
MD5:	4D5E04B6CE80B7C05A22BFB47F24F4C6
SHA1:	75E11BDDB66A7880EE32142A255175B988ACD76E
SHA-256:	6C590620385614A5D549D8760C064A2FDB0B8181A47D3394726B01D09881FF82
SHA-512:	42AAEC990D7D798CE5300A777DC69B7824A1821DFC2430820762570844666795A7EFF697C5C559B19848265E3F5ED4B6E4AD4D105E1E9B55F7B89DE9B051C7A5
Malicious:	false
Preview:	PK........{..;Q.v.............ModSource UI Addon Pack.exe...\SI.8....bPAQQQ.b....(...Hb...CD@H.......].+.6..;X.....U,..Q.WJ...fnPw.}..}...~.......g.9ef...V0\|.a......p?......:S.9^.f.t.....C..C.f.x......RZ...Q.Z..Z;..[.....fjjd...W..=;.m......nW...m..U..ki_.=x.k.j;^..{.I.?..&a..<}...O.......g.0...>.v..O.6C......8:0.+.&.z.G..qy.^.^.oW(.....3+.....\.......J....Ch....~..3.[....aV4...!..?.Cj8t.1..!.V....K..n...+0....".BBC.I.0.6L8^..m...........0.)m.Fb.2U..4...4.I..p....L@%...!.L...iw...aLO......-a.$&..7\...i".....S0.EV`D'..NJ..C....+:....b.\..K.1},F.N....ra....%..Ks0.MtHb.../.....9......-...%........X.GD@e....V`.......z..P...^.=....2J.M...'..!.([...d.p..0w.....uizO......1........X...E.L..".8.xb........1..6..9HF..w...8.2.x=a.%=.k.....{.br...-.k$=.'...2...aE-.2..z.....Efe.f*c.c...k..q...>)...r}....d...x.q.~./#.....5..Y.K5.P.,..4.s1Q..\...,...H8i..gP$.Z....4"....7.MEj.[..cY......L.R..Ex...'5h.B.3..k...:..Q~QGh...z...f.0.e.../a....W.

C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1147783
Entropy (8bit):	7.977012386354449
Encrypted:	false
SSDEEP:	24576:SKN5LWSqjS/vOB1TTmO6aN86Fx/iAyC8iyUSCij5:SKN5LWy+TSOYaRJ8JXN
MD5:	DC0AEE7C1898F76B9D61CE023B91539C
SHA1:	320B203FAEC0555BA0565AB4C9A4DC5CCBA20BFD
SHA-256:	BA9BD9929813326D744A0512A428D5010C7FB0FBB5F2F0F97002191770FE5DA1
SHA-512:	C57FA5951B04CD47F7BEE7C8B33E5887B676989C2E17B4F7E92FD1B7C91F8D05729E1DCA43B98BD150EA4D4839A6F52A8B87A41A4176DB906828C1A5495E7021
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 14%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........uJ...$...$...$./.{...$...%.:.$.".y...$..7....$.f."...$.Rich..$.................PE..L.../..G.................Z..........%2.......p....@..........................P...............................................s...........w...........................................................................p...............................text...4Y.......Z.................. ..`.rdata.......p.......^..............@..@.data................p..............@....ndata.......@...........................rsrc....w.......x...t..............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ModSource_UI_Addon_Pack.ver

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:xn:x
MD5:	D1BD83A33F1A841AB7FDA32449746CC4
SHA1:	70142F66475AE2FB33722D8D4750F386ECFEFE7B
SHA-256:	D84BDB34D4EEEF4034D77E5403F850E35BC4A51B1143E3A83510E1AAAD839748
SHA-512:	62B4DA4ABC10466431DDC1B0D91AAEB4F4D7EC4A28EE892096742178963D208DBC8C430CF45FEB53D9F254986B3591066D73228736F63900D4BA91B4C7F5A46A
Malicious:	false
Preview:	2.0

C:\Users\user\AppData\Local\Temp\nsa449D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	data
Category:	dropped
Size (bytes):	5952977
Entropy (8bit):	5.910937148184729
Encrypted:	false
SSDEEP:	98304:+7W/eHUv+aWbkltw9EbMIuxcioPCbj/U+LaFB:+Y+9Rj7bDUlH
MD5:	61D7EE74FB7201ADDF1A50CB5D7C4C95
SHA1:	C6B56ACF07EA4F11708912EA6000F259C2181C8E
SHA-256:	A8D2BF472FBB18C5A8801443818D252BEB7C26F9C4D2C2981C90A8B5F0BF2DB1
SHA-512:	F6686DCEA5CAFBAB6D7D5786E9B77AE9B097F5D6D7D4CA3F8512F7D59F9509A8C276B475706D205822208FDE354BA5BF0EAA7D057C42D150DED145185ABEDF26
Malicious:	false
Preview:	........,.......,...]............n..............q...........................d...................................................................}.......................................................................................................................................s...B...S...........O.......................................p...r.......................f...........................q.......p...r.......................h...........................q.......p...r...o...n...m.......l...g...........................q.......p...r...k...j...i...h...................................q...g...f...r.......................j...........................q.......p...r.......e...d...................................c...q.......p...r...................................................q...b.......r...............................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsb13F8.tmp

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe
File Type:	data
Category:	dropped
Size (bytes):	189481
Entropy (8bit):	6.135358388869015
Encrypted:	false
SSDEEP:	3072:xRdACkSJJ30k1pn2T4ISnUGN+E8KnCOxA17jxLmRtWHyPDQFllOdJiSg:xXRkSJy+c30UxbKnA1hLKWSVdk
MD5:	33E9CEB08AC8C6BB13EACD0D1EDF16CB
SHA1:	60BFDD27095FE505BF40B8FE52D833215AAAD3C6
SHA-256:	952ACCB665179174003F303D578A2675704897A3E2E675C679D3FC712D7F8341
SHA-512:	755F2CB395B6FFC47A603DD7FB09FAF05FFDD681EB452A8BA4400CBC1B72B7EAB48078F33057EF9DE43CE18A027C75DC8AD66F20B21C3B755020C2F265F70926
Malicious:	false
Preview:	........,...............................W.......................................................................................................................................................................................................................................................................j...............................................................................................................................B.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsb13F9.tmp\NSISdl.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	6.0431386061925245
Encrypted:	false
SSDEEP:	192:o4lsN55M8r67wmsvJI5a299sfoG8I+WhPB3RY+h/G3DNl/qYcVp/12QgszA:oysdM80dCI5a2LsQ5IlPNRY00AlAsU
MD5:	F716C100F551AC57E862C7B72DFE2B87
SHA1:	A6FB358FD268507535178A8827943F1905F2606B
SHA-256:	D92B88C3096A5D09C1F9744B62668D588CC8B1992FD88FA5C88C4636121C9F44
SHA-512:	3D841154199D59D0F9CBF15EC4146DE1E967D4292F3A78DB8764AFAB5A9A242F38E1F0E1BF3943D06E5BE5018A35CF7C441744A8CF542CB4001AE6B375F244CC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............H...H...Ht..H...H...H...Ht.H...H...H...H...H...HRich...H........................PE..L......G...........!.....&...p.......".......@.......................................................................D.._....@..d....................................................................................@...............................text....$.......&.................. ..`.rdata.......@.......*..............@..@.data....d...P.......0..............@....reloc..,............6..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsb13F9.tmp\ZipDLL.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	167424
Entropy (8bit):	6.217182053553636
Encrypted:	false
SSDEEP:	3072:8CkSJJ30k1pn2T4ISnUGN+E8KnCOxA17jxLmRtWHyPDQFllOdJiSg:tkSJy+c30UxbKnA1hLKWSVdk
MD5:	2DC35DDCABCB2B24919B9AFAE4EC3091
SHA1:	9EEED33C3ABC656353A7EBD1C66AF38CCCADD939
SHA-256:	6BBEB39747F1526752980D4DBEC2FE2C7347F3CC983A79C92561B92FE472E7A1
SHA-512:	0CCAC336924F684DA1F73DB2DD230A0C932C5B4115AE1FA0E708B9DB5E39D2A07DC54DAC8D95881A42069CBB2C2886E880CDAD715DEDA83C0DE38757A0F6A901
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Eq3yEhQkwE.exe, Detection: malicious, Browse Filename: WiseConvert.exe, Detection: malicious, Browse Filename: jpmm-desktop-external-installer.exe, Detection: malicious, Browse Filename: $RL282BX.jse, Detection: malicious, Browse Filename: $RL282BX.jse, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........i...:...:...:..:...:...:...:...:...:...:...:...:...:...:...:...:..:...:...:h..:...:Rich...:........................PE..L....CU>...........!................................................................................................@...^.......<...............................(....................................................................................text...X........................... ..`.rdata...G.......H..................@..@.data...Dm... ...V..................@....reloc..R1.......2...\..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\NSISdl.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	6.0431386061925245
Encrypted:	false
SSDEEP:	192:o4lsN55M8r67wmsvJI5a299sfoG8I+WhPB3RY+h/G3DNl/qYcVp/12QgszA:oysdM80dCI5a2LsQ5IlPNRY00AlAsU
MD5:	F716C100F551AC57E862C7B72DFE2B87
SHA1:	A6FB358FD268507535178A8827943F1905F2606B
SHA-256:	D92B88C3096A5D09C1F9744B62668D588CC8B1992FD88FA5C88C4636121C9F44
SHA-512:	3D841154199D59D0F9CBF15EC4146DE1E967D4292F3A78DB8764AFAB5A9A242F38E1F0E1BF3943D06E5BE5018A35CF7C441744A8CF542CB4001AE6B375F244CC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............H...H...Ht..H...H...H...Ht.H...H...H...H...H...HRich...H........................PE..L......G...........!.....&...p.......".......@.......................................................................D.._....@..d....................................................................................@...............................text....$.......&.................. ..`.rdata.......@.......*..............@..@.data....d...P.......0..............@....reloc..,............6..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\StartMenu.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	4.750647312346698
Encrypted:	false
SSDEEP:	96:Z+LBC0x22epxPEvC4FkWE+in1/FMvsCGRfRFqCB5t/GhEl5VN:Z+lepxPE1r8/FtmCDt+g5v
MD5:	80A55B35582678D845CCCA04F52CADA3
SHA1:	82D1236218C95A34425B8831EF1627C0C5919DFA
SHA-256:	E66DD544C167C9EBB3D8ED18622276C350E5C97C076C7C81B514BAB6446A3CA5
SHA-512:	C683793D4F264A76FFA5AAB33BE2A1ACA154757F09A984E22B4281AF19E9DEAAC5297A80EE9C92B8195E15DB5B8B33F7D110707C05BF9C928C6E5561DA559A62
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........i&W..uW..uW..uW..u}..u..Zu\..u..7uV..u...uV..u...uV..uRichW..u........PE..L......G...........!......... ............... ...............................p.......................................$..e.... ..x....P..(....................`..\.................................................... ...............................text............................... ..`.rdata..E.... ......................@..@.data........0......................@....rsrc...(....P......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\System.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	5.852039417299798
Encrypted:	false
SSDEEP:	192:CO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1argMO:XKAFERdlxhGRYUzqZar
MD5:	4FBB4A2CD711FC1FE84F3DC30C491DC9
SHA1:	888E01AE6E64E7326F88DF9A30587F699EAB154A
SHA-256:	C3B05F4FAF5E8903D5B4CB4A8CE4BBF2E8144725B98D8787D51C117B6EFA9BC2
SHA-512:	92DCF99672A5935065DF6492E27ABB653679F1DB6DCDDFDE87CD14260C94A870327826B23CC2F338381B3EB53D07C1A3867806F6FF94533DB5195B895A856847
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.............................S...........Rich...........PE..L......G...........!.................(.......0...............................`......................................p2......t0..P............................P.......................................................0..X............................text...?........................... ..`.rdata.......0....... ..............@..@.data...\....@.......$..............@....reloc.......P.......&..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\modern-wizard.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	PC bitmap, Windows 3.x format, 164 x 314 x 4, image size 26376, resolution 2834 x 2834 px/m, cbSize 26494, bits offset 118
Category:	dropped
Size (bytes):	26494
Entropy (8bit):	1.9568109962493656
Encrypted:	false
SSDEEP:	24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5:	CBE40FD2B1EC96DAEDC65DA172D90022
SHA1:	366C216220AA4329DFF6C485FD0E9B0F4F0A7944
SHA-256:	3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
SHA-512:	62990CB16E37B6B4EFF6AB03571C3A82DCAA21A1D393C3CB01D81F62287777FB0B4B27F8852B5FA71BC975FEAB5BAA486D33F2C58660210E115DE7E2BD34EA63
Malicious:	false
Preview:	BM~g......v...(.......:............g..................................................................................DDD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@..DDD....DDDDDD........................................DDDDDDDDDD....DDDDDDDDD........DD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDD@@@@DDDDDDDDDD@@@@@@D..DD....DDDDDDD......................................DDDDDDDDDD....DDDDDDDDDD......D..D@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@DDD..D.....DDDDDD......................................DDDDDDDDD.....DDDDDDDDD......DDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@@DDDD.......DDDDDD.....................................DDDDDDDDDD....DDDDDDDDDD.....DDDDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@DDDDDD.......DDDDDD....................................DDDDDDDDD....DDDDDDDDDD......DDDDDD..@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\nsDialogs.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	5.196807044892378
Encrypted:	false
SSDEEP:	96:rZ5RwaB9dE0/PvQMuql/ODzN3ZOyGE1xiR0r2HpYkUdiw4:rZL7/AMzUz5ZOtEW0r2JxUdi
MD5:	6E5D67DE86BBE1424C948EC22490E16E
SHA1:	EB472A706F5B28F3151C14741926E1107B5BFAFD
SHA-256:	D337A4FB3A455B847696AC70A6C070272E108E094D2B4395E3BDC1C76B86B8AE
SHA-512:	0ED74440E8A2F7AF0D8412410D36A160DDBB362A2DD762297029F7997B2040E27AA0CA1BDDB918197956B3280E036FCFC7EBAB7ADF665D93828479F1D5FE2314
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|/..8Nx.8Nx.8Nx.8Ny..Nx..F%.5Nx.lmH.=Nx..H~.9Nx..n\|.9Nx.Rich8Nx.........PE..L......G...........!................x........ ...............................`.......................................%..A.... .......@.......................P..<.................................................... ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ModSource UI Addon Pack\Mod-Source - Your Source for SWG Modding Stuff.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	MS Windows shortcut, Item id list present, Has Working directory, Icon number=0, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Category:	dropped
Size (bytes):	1246
Entropy (8bit):	2.472815175420269
Encrypted:	false
SSDEEP:	12:8oECcNCeC0bdpZIWRcUEcbdpZIWRcUEJklyfeQoLlpbdpZIWRcUEJ:8oTuCKdHvJdHvvwoLfdHv
MD5:	4E67D7931E065A97BBB0597DDF09DAC7
SHA1:	D8435F8FF13ED6724A3DE511D54CB49132A819D9
SHA-256:	770CD0418162C05877262F6D45085E1CDF69945CCCC9FB53B2CCBB8C1394A572
SHA-512:	A2CB17BEFD998F2A6CA838FD6AC2F0F146CE2E4023487F7B761E7B86AB8A23621025635960B1CB8430DAD67F614CA863E8A80A32C5098D4C7A86E8E66A053BA5
Malicious:	false
Preview:	L..................F.@......................................................T....h.S...Bi.....+00.>.a.....h.t.t.p.:././.w.w.w...m.o.d.s.o.u.r.c.e...o.r.g./.......D.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.S.t.a.r.W.a.r.s.G.a.l.a.x.i.e.s.\.M.o.d.s.\.M.o.d.S.o.u.r.c.e. .U.I. .A.d.d.o.n. .P.a.c.k.\.I.c.o.n.s.L.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.S.t.a.r.W.a.r.s.G.a.l.a.x.i.e.s.\.M.o.d.s.\.M.o.d.S.o.u.r.c.e. .U.I. .A.d.d.o.n. .P.a.c.k.\.I.c.o.n.s.\.W.e.b...i.c.o.........%SystemDrive%\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Icons\Web.ico.............................................................................................................................................................................%.S.y.s.t.e.m.D.r.i.v.e.%.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.S.t.a.r.W.a.r.s.G.a.l.a.x.i.e.s.\.M.o.d.s.\.M.o.d.S.o.u.r.c.e. .U.I. .A.d.d.o.n. .P.a.c.k.\.I.c.o.n.s.\.W.e.b...i.c.o.........................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ModSource UI Addon Pack\ModSource UI Addon Pack Updater.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Sat Aug 15 16:43:06 2009, mtime=Tue Feb 7 17:59:46 2023, atime=Sat Aug 15 16:43:06 2009, length=116184, window=hide
Category:	dropped
Size (bytes):	2498
Entropy (8bit):	3.7153189986768433
Encrypted:	false
SSDEEP:	48:8Id57rEG2oWbQrEg+dHvoXdHvm7dHvewRdHvjDu:8I7rEG2oWpvolvmvBvjD
MD5:	361DBCC8D111AC0E78AC788F44885691
SHA1:	AE99FD92EE440682E70FD3BBBD2F85E2125C3733
SHA-256:	C9A27E2F7DE3C9AC2D54D6DA8DD4DD80F0DABB368FD54EE5D12C074D15EF9A6E
SHA-512:	5A542998A6C0F20272806093AA325037C8C622A50CE5CE003C557A3C88ABCDA374012BAA3D8486499D8A8DFC7AAA5DE2E4A8D6452CF1FCAA2CD5480BA9D65545
Malicious:	false
Preview:	L..................F.@.. .....m........X&;....m..................................P.O. .:i.....+00.../C:\.....................1.....GVu...PROGRA~1..t......L.GVu.....E...............J.....S...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....j.1.....GVv...STARWA~1..R......GVu.GVv..... .....................].M.S.t.a.r.W.a.r.s.G.a.l.a.x.i.e.s.....N.1.....GVu...Mods..:......GVu.GVu.....:.....................S...M.o.d.s.....x.1.....GVx...MODSOU~1..`......GVu.GVx.....;.....................8...M.o.d.S.o.u.r.c.e. .U.I. .A.d.d.o.n. .P.a.c.k.....V.1.....GVx...Updater.@......GVw.GVx............................V..U.p.d.a.t.e.r.......2......;c. .MODSOU~2.EXE..........;c.GVx...............................M.o.d.S.o.u.r.c.e. .U.I. .A.d.d.o.n. .P.a.c.k. .A.u.t.o. .U.p.d.a.t.e.r...e.x.e.......................-...........................C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Updater\ModSource UI Addon Pack Auto Updater.exe........\.....\.....\.....\....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ModSource UI Addon Pack\Pre-NGE UI Changelog.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Icon number=0, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Category:	dropped
Size (bytes):	2001
Entropy (8bit):	2.7407127421648387
Encrypted:	false
SSDEEP:	24:84mHdyKRhK3HoCW7dHvXCWudHvm7dHvTlwW5fdHvT:83HdyOwHofdHvXqdHvm7dHvRwmdHv
MD5:	B48B77E2570F74E39EDC4B59164783F8
SHA1:	53D15FD868DFC85FDFA9933BE770F09961AB5EA1
SHA-256:	8081CB36AAA0FAA3F3A7424349A008374207417332E6C1CB9B475E518C4DCB0D
SHA-512:	77C65BB1A73D092710AD48979E1F631C071F9577790DB5D2369BACEAF911E3D67CEA7A344DC6F14811135E4AE21EF2192DF7066CA1D36BE8ADDEBE1ABF644D8A
Malicious:	false
Preview:	L..................F.@......................................................c....P.O. .:i.....+00.../C:\...................h.1...........Program Files.L............................................P.r.o.g.r.a.m. .F.i.l.e.s.....r.1...........StarWarsGalaxies..R............................................S.t.a.r.W.a.r.s.G.a.l.a.x.i.e.s... .N.1...........Mods..:............................................M.o.d.s.......1...........ModSource UI Addon Pack.`............................................M.o.d.S.o.u.r.c.e. .U.I. .A.d.d.o.n. .P.a.c.k...&...2...........Changelog_PreNGE_UI.txt.`............................................C.h.a.n.g.e.l.o.g._.P.r.e.N.G.E._.U.I...t.x.t...&...n.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.S.t.a.r.W.a.r.s.G.a.l.a.x.i.e.s.\.M.o.d.s.\.M.o.d.S.o.u.r.c.e. .U.I. .A.d.d.o.n. .P.a.c.k.\.C.h.a.n.g.e.l.o.g._.P.r.e.N.G.E._.U.I...t.x.t.D.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.S.t.a.r.W.a.r.s.G.a.l.a.x.i.e.s.\.M.o.d.s.\.M.o.d.S.o

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ModSource UI Addon Pack\Readme ModSource UI Addon Pack.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Sat Aug 15 16:19:08 2009, mtime=Tue Feb 7 17:59:46 2023, atime=Sat Aug 15 16:19:08 2009, length=24877, window=hide
Category:	dropped
Size (bytes):	2505
Entropy (8bit):	3.7134451009881526
Encrypted:	false
SSDEEP:	48:81Nd57rEG2O/mpxVHrXx3dHvfpxUxdHvm7dHvRwmdHvPwu:8T7rEG2OOpxJ3vfpxUzvmv9vPw
MD5:	D0B32E06A1DF118829D040481574648F
SHA1:	E698663B3726EA47488BB4BC95ABC210DBD37419
SHA-256:	21CC083D58D656C50FDC53C25A07661BBF52132B3F488FA09003816D072440E8
SHA-512:	B633F21E27007ECF00EB2F6D92A12215A9B8E07147C5142DD5E3E29D15D11B78F57837AC888EBA4AC5BDA7B1A042DE6312DC9699B449DC191529D82BEAFC8E2B
Malicious:	false
Preview:	L..................F.@.. .....P......;.X&;....P.....-a...........................P.O. .:i.....+00.../C:\.....................1.....GVu...PROGRA~1..t......L.GVu.....E...............J.....S...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....j.1.....GVv...STARWA~1..R......GVu.GVv..... .....................].M.S.t.a.r.W.a.r.s.G.a.l.a.x.i.e.s.....N.1.....GVu...Mods..:......GVu.GVu.....:.....................S...M.o.d.s.....x.1.....GVx...MODSOU~1..`......GVu.GVx.....;.....................8...M.o.d.S.o.u.r.c.e. .U.I. .A.d.d.o.n. .P.a.c.k.....d.1.....GVx...DOCUME~1..L......GVv.GVx...........................}..D.o.c.u.m.e.n.t.a.t.i.o.n.......2.-a...;d. .README~1.HTM..x.......;d.GVx...............................R.e.a.d.m.e. .M.o.d.S.o.u.r.c.e. .U.I. .A.d.d.o.n. .P.a.c.k...h.t.m.l.......................-...........................C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Documentation\Readme ModSource UI Addon Pack.html........\.....\.....\.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ModSource UI Addon Pack\Uninstall the ModSource UI Addon Pack.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Icon number=0, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Category:	dropped
Size (bytes):	2097
Entropy (8bit):	2.7908999285930345
Encrypted:	false
SSDEEP:	48:8VHdyOwHkeZpmdHvOhZprdHvndHvyhMwAdHvyh:8VkOG5ZpivOhZphv1vyhAvyh
MD5:	CEC4BAA324A2A081883F4C04D0C98B58
SHA1:	99F551213E4BFEE326A129D71855B0265BC9BDE0
SHA-256:	FE671D6FE585574CCFBFA625B76DFD3D908498A2F3920569E9E5016216804096
SHA-512:	D1D3465BA224DF7B0C32A503436906801238269CFB57799C7CF987DE49D69323CB60C5C6D579EE0B88CA45C58C77532B3C2724AF4EE956A18CA01DC9CB5B6755
Malicious:	false
Preview:	L..................F.@...........................................................P.O. .:i.....+00.../C:\...................h.1...........Program Files.L............................................P.r.o.g.r.a.m. .F.i.l.e.s.....r.1...........StarWarsGalaxies..R............................................S.t.a.r.W.a.r.s.G.a.l.a.x.i.e.s... .N.1...........Mods..:............................................M.o.d.s.......1...........ModSource UI Addon Pack.`............................................M.o.d.S.o.u.r.c.e. .U.I. .A.d.d.o.n. .P.a.c.k...&...2...........Uninstall the ModSource UI Addon Pack.exe..............................................U.n.i.n.s.t.a.l.l. .t.h.e. .M.o.d.S.o.u.r.c.e. .U.I. .A.d.d.o.n. .P.a.c.k...e.x.e...8.........\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.S.t.a.r.W.a.r.s.G.a.l.a.x.i.e.s.\.M.o.d.s.\.M.o.d.S.o.u.r.c.e. .U.I. .A.d.d.o.n. .P.a.c.k.\.U.n.i.n.s.t.a.l.l. .t.h.e. .M.o.d.S.o.u.r.c.e. .U.I. .A.d.d.o.n. .P.a.c.k...e.x.e

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ModSource UI Addon Pack Silent Updater.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Sat Aug 15 16:43:04 2009, mtime=Tue Feb 7 17:59:44 2023, atime=Sat Aug 15 16:43:04 2009, length=116158, window=hide
Category:	dropped
Size (bytes):	2537
Entropy (8bit):	3.7333411166843127
Encrypted:	false
SSDEEP:	48:88FSd57rEvLJib0mdrExdHvo0FdHvN7dHvewRdHvSyu:88o7rEvFe0tvo0PvDvBvSy
MD5:	127592BB9D24A15579AECA73F6835640
SHA1:	390020875DFC9C6AE586AD798B22515B8838F7FA
SHA-256:	C76DF73B55C058B1B9B52267170328AD339F330C10F5F7330C1BB2AFBA2C94EA
SHA-512:	0308351B7A6A47EE6D6EF914BE6CFDB2B18835858BA69380F9544C8BB502DB6D45F508F7FB019DAEE4764CBB75D59574590533B93D580CD956D5A508DF6347B8
Malicious:	false
Preview:	L..................F.@.. .....<........W&;....<..................................P.O. .:i.....+00.../C:\.....................1.....GVu...PROGRA~1..t......L.GVu.....E...............J.....S...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....j.1.....GVv...STARWA~1..R......GVu.GVv..... .....................].M.S.t.a.r.W.a.r.s.G.a.l.a.x.i.e.s.....N.1.....GVu...Mods..:......GVu.GVu.....:.....................S...M.o.d.s.....x.1.....GVv...MODSOU~1..`......GVu.GVv.....;.....................{.!.M.o.d.S.o.u.r.c.e. .U.I. .A.d.d.o.n. .P.a.c.k.....V.1.....GVw...Updater.@......GVw.GVw............................~..U.p.d.a.t.e.r.......2......;b. .MODSOU~1.EXE..........;b.GVw...............................M.o.d.S.o.u.r.c.e. .U.I. .A.d.d.o.n. .P.a.c.k. .A.u.t.o. .U.p.d.a.t.e.r. .S.i.l.e.n.t...e.x.e.......................-...........................C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Updater\ModSource UI Addon Pack Auto Updater Silent.exe........\.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.762292817147485
TrID:	Win32 Executable (generic) a (10002005/4) 92.16% NSIS - Nullsoft Scriptable Install System (846627/2) 7.80% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe
File size:	116184
MD5:	97011b19f2683a918f1f07f7f4ec1998
SHA1:	4b486d0b67994fabe961787f5facdf9a0e3f6672
SHA256:	c1469167b9700aeca987573c023ec7f160dadf8309a7a4feb2cd1969ad66673e
SHA512:	fd7ffe3ccf0a46d06d936c946f50b6fdde195f684cf10b23450809457fbbb7d281f45582667ff5ec1e1968283295426ba05d156063d9c45bce931f8a45529dd1
SSDEEP:	3072:Md/vyWmJgsn5f630mFNCwivNDd+r7Ncxnpjw9:MXiY0IMfZ0N0npC
TLSH:	14B3021F79C5C89BCE6529B0167B837792B9771605210F8F27B04FFF983509A9B0A18B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........uJ...$...$...$./.{...$...%.:.$.".y...$..7....$.f."...$.Rich..$.................PE..L.../..G.................Z..........%2.....

File Icon


Icon Hash:	b2a88c96b2ca6a72

Static PE Info

General

Entrypoint:	0x403225
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x47EEBF2F [Sat Mar 29 22:14:07 2008 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	099c0646ea7282d232219f8807883be0

Entrypoint Preview

Instruction
sub esp, 00000180h
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409128h
xor esi, esi
mov byte ptr [esp+14h], 00000020h
call dword ptr [00407030h]
push 00008001h
call dword ptr [004070B4h]
push ebx
call dword ptr [0040727Ch]
push 00000008h
mov dword ptr [00423F58h], eax
call 00007F8850B3A40Eh
mov dword ptr [00423EA4h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 00000160h
push eax
push ebx
push 0041F450h
call dword ptr [00407158h]
push 004091B0h
push 004236A0h
call 00007F8850B3A0C5h
call dword ptr [004070B0h]
mov edi, 00429000h
push eax
push edi
call 00007F8850B3A0B3h
push ebx
call dword ptr [0040710Ch]
cmp byte ptr [00429000h], 00000022h
mov dword ptr [00423EA0h], eax
mov eax, edi
jne 00007F8850B3791Ch
mov byte ptr [esp+14h], 00000022h
mov eax, 00429001h
push dword ptr [esp+14h]
push eax
call 00007F8850B39BA6h
push eax
call dword ptr [0040721Ch]
mov dword ptr [esp+1Ch], eax
jmp 00007F8850B37975h
cmp cl, 00000020h
jne 00007F8850B37918h
inc eax
cmp byte ptr [eax], 00000020h
je 00007F8850B3790Ch
cmp byte ptr [eax], 00000022h
mov byte ptr [eax+eax+00h], 00000000h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x73a4	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2f000	0x908	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x28c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5934	0x5a00	False	0.6665364583333333	data	6.4568655778614685	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1190	0x1200	False	0.4448784722222222	data	5.177968128705381	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x1af98	0x400	False	0.552734375	data	4.702501941692098	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x24000	0xb000	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2f000	0x908	0xa00	False	0.4109375	data	3.9664836133461354	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x2f190	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States
RT_DIALOG	0x2f478	0x100	data	English	United States
RT_DIALOG	0x2f578	0x11c	data	English	United States
RT_DIALOG	0x2f698	0x60	data	English	United States
RT_GROUP_ICON	0x2f6f8	0x14	data	English	United States
RT_MANIFEST	0x2f710	0x1f6	XML 1.0 document, ASCII text, with very long lines (502), with no line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	CompareFileTime, SearchPathA, GetShortPathNameA, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, GetLastError, CreateDirectoryA, SetFileAttributesA, Sleep, GetTickCount, CreateFileA, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, SetFileTime, GetTempPathA, GetCommandLineA, SetErrorMode, LoadLibraryA, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, CreateProcessA, RemoveDirectoryA, GetTempFileNameA, lstrlenA, lstrcatA, GetSystemDirectoryA, GetVersion, CloseHandle, lstrcmpiA, lstrcmpA, ExpandEnvironmentStringsA, GlobalFree, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GetModuleHandleA, LoadLibraryExA, GetProcAddress, FreeLibrary, MultiByteToWideChar, WritePrivateProfileStringA, GetPrivateProfileStringA, WriteFile, ReadFile, MulDiv, SetFilePointer, FindClose, FindNextFileA, FindFirstFileA, DeleteFileA, GetWindowsDirectoryA
USER32.dll	EndDialog, ScreenToClient, GetWindowRect, EnableMenuItem, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, RegisterClassA, TrackPopupMenu, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, DestroyWindow, CreateDialogParamA, SetTimer, SetWindowTextA, PostQuitMessage, SetForegroundWindow, wsprintfA, SendMessageTimeoutA, FindWindowExA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, OpenClipboard, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongA, LoadImageA, GetDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndPaint, ShowWindow
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectA, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA, SHGetSpecialFolderLocation
ADVAPI32.dll	RegQueryValueExA, RegSetValueExA, RegEnumKeyA, RegEnumValueA, RegOpenKeyExA, RegDeleteKeyA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 7, 2023 19:59:09.999867916 CET	49695	80	192.168.2.4	162.55.0.134
Feb 7, 2023 19:59:10.024344921 CET	80	49695	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:10.024516106 CET	49695	80	192.168.2.4	162.55.0.134
Feb 7, 2023 19:59:10.031176090 CET	49695	80	192.168.2.4	162.55.0.134
Feb 7, 2023 19:59:10.055288076 CET	80	49695	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:10.060662031 CET	80	49695	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:10.060699940 CET	80	49695	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:10.060720921 CET	80	49695	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:10.060744047 CET	80	49695	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:10.060765028 CET	80	49695	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:10.060786009 CET	80	49695	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:10.060816050 CET	49695	80	192.168.2.4	162.55.0.134
Feb 7, 2023 19:59:10.060888052 CET	49695	80	192.168.2.4	162.55.0.134
Feb 7, 2023 19:59:10.063277960 CET	49695	80	192.168.2.4	162.55.0.134
Feb 7, 2023 19:59:10.130839109 CET	80	49695	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:10.141086102 CET	80	49695	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:10.141182899 CET	49695	80	192.168.2.4	162.55.0.134
Feb 7, 2023 19:59:10.329230070 CET	49696	80	192.168.2.4	162.55.0.134
Feb 7, 2023 19:59:10.353476048 CET	80	49696	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:10.353574038 CET	49696	80	192.168.2.4	162.55.0.134
Feb 7, 2023 19:59:10.376364946 CET	49696	80	192.168.2.4	162.55.0.134
Feb 7, 2023 19:59:10.400569916 CET	80	49696	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:10.406291008 CET	80	49696	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:10.406332970 CET	80	49696	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:10.406387091 CET	80	49696	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:10.406415939 CET	80	49696	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:10.406444073 CET	80	49696	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:10.406766891 CET	80	49696	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:10.407351017 CET	49696	80	192.168.2.4	162.55.0.134
Feb 7, 2023 19:59:10.447982073 CET	49696	80	192.168.2.4	162.55.0.134
Feb 7, 2023 19:59:10.486756086 CET	80	49696	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:10.486902952 CET	49696	80	192.168.2.4	162.55.0.134
Feb 7, 2023 19:59:10.690042973 CET	49697	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:11.011236906 CET	80	49697	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:11.011480093 CET	49697	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:11.017126083 CET	49697	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:11.339237928 CET	80	49697	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:11.342822075 CET	80	49697	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:11.342885017 CET	80	49697	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:11.342998981 CET	49697	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:11.344343901 CET	49697	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:11.543103933 CET	80	49697	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:11.543184996 CET	49697	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:11.664391041 CET	80	49697	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:15.637778997 CET	49698	80	192.168.2.4	162.55.0.134
Feb 7, 2023 19:59:15.661902905 CET	80	49698	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:15.662056923 CET	49698	80	192.168.2.4	162.55.0.134
Feb 7, 2023 19:59:15.673615932 CET	49698	80	192.168.2.4	162.55.0.134
Feb 7, 2023 19:59:15.697168112 CET	80	49698	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:15.703309059 CET	80	49698	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:15.703341961 CET	80	49698	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:15.703362942 CET	80	49698	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:15.703386068 CET	80	49698	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:15.703406096 CET	80	49698	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:15.703449965 CET	49698	80	192.168.2.4	162.55.0.134
Feb 7, 2023 19:59:15.703507900 CET	49698	80	192.168.2.4	162.55.0.134
Feb 7, 2023 19:59:15.706346035 CET	80	49698	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:15.706469059 CET	49698	80	192.168.2.4	162.55.0.134
Feb 7, 2023 19:59:15.706535101 CET	49698	80	192.168.2.4	162.55.0.134
Feb 7, 2023 19:59:15.848922014 CET	49699	80	192.168.2.4	162.55.0.134
Feb 7, 2023 19:59:15.873218060 CET	80	49699	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:15.873454094 CET	49699	80	192.168.2.4	162.55.0.134
Feb 7, 2023 19:59:15.877010107 CET	49699	80	192.168.2.4	162.55.0.134
Feb 7, 2023 19:59:15.900964975 CET	80	49699	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:15.905997992 CET	80	49699	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:15.906028032 CET	80	49699	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:15.906049013 CET	80	49699	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:15.906069994 CET	80	49699	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:15.906085014 CET	80	49699	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:15.906102896 CET	80	49699	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:15.906183958 CET	49699	80	192.168.2.4	162.55.0.134
Feb 7, 2023 19:59:15.906245947 CET	49699	80	192.168.2.4	162.55.0.134
Feb 7, 2023 19:59:15.909384966 CET	49699	80	192.168.2.4	162.55.0.134
Feb 7, 2023 19:59:15.974669933 CET	80	49699	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:15.986478090 CET	80	49699	162.55.0.134	192.168.2.4
Feb 7, 2023 19:59:15.986731052 CET	49699	80	192.168.2.4	162.55.0.134
Feb 7, 2023 19:59:16.314790010 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:16.632805109 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:16.632946014 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:16.641328096 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:16.959192991 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:16.961148977 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:16.961299896 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:16.961321115 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:16.961339951 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:16.961415052 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:16.961467028 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:17.279333115 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.279367924 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.279387951 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.279499054 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.279535055 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.279562950 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:17.279563904 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:17.279576063 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.279639006 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:17.597465992 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.597495079 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.597513914 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.597533941 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.597552061 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.597563982 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:17.597573042 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.597594023 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.597614050 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.597615957 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:17.597635031 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:17.597635031 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.597661018 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:17.641011000 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:17.915472984 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.915499926 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.915518999 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.915540934 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.915563107 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.915568113 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:17.915582895 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.915604115 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.915613890 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:17.915625095 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:17.915627003 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.915647030 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.915667057 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.915668011 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:17.915687084 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.915707111 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.915712118 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:17.915750027 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:17.958781958 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.958802938 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:17.958882093 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.233535051 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.233557940 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.233577013 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.233589888 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.233609915 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.233628988 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.233650923 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.233671904 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.233690977 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.233705044 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.233711958 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.233733892 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.233755112 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.233774900 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.233777046 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.233795881 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.233810902 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.233817101 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.233838081 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.233840942 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.233859062 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.233880043 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.233905077 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.233939886 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.276640892 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.276663065 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.276684999 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.276781082 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.328615904 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.551768064 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.551810026 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.551840067 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.551892042 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.551918983 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.551947117 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.551948071 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.551976919 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.552005053 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.552007914 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.552038908 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.552067041 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.552073002 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.552095890 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.552118063 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.552126884 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.552155972 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.552170038 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.552186012 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.552215099 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.552227974 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.552243948 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.552273035 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.552285910 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.552301884 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.552329063 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.552350044 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.552370071 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.552391052 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.552417040 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.552437067 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.552447081 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.552499056 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.595199108 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.595232010 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.595257044 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.595347881 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.646558046 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.646761894 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.646760941 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.688086033 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.870503902 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.870532036 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.870551109 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.870570898 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.870589972 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.870610952 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.870631933 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.870652914 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.870672941 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.870702028 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.870722055 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.870743990 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.870757103 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.870769978 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.870779037 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.870790958 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.870811939 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.870831966 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.870851040 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.870867014 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.870872974 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.870906115 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.870924950 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.870942116 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.870944977 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.870992899 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.871012926 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.871021032 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.871026993 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.871038914 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.871048927 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.871069908 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.871078014 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.871092081 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.871100903 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.871114016 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.871134043 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.871155024 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.871171951 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.871175051 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.871196985 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.871218920 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.871237993 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.913286924 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.913338900 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.913372993 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.913407087 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.913471937 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.913472891 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:18.964610100 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.964654922 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:18.964809895 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.006036043 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.006067038 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.006217003 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.192967892 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193006992 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193033934 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193078041 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193104029 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193128109 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193152905 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193176031 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.193181038 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193207026 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193229914 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.193232059 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193258047 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193259001 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.193284035 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193294048 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.193310022 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193335056 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.193335056 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193362951 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193387985 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193409920 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.193413973 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193439007 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193447113 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.193464994 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193490982 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193494081 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.193517923 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193536997 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.193543911 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193569899 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193591118 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.193594933 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193620920 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193643093 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.193648100 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193674088 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193698883 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193702936 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.193723917 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193747997 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.193748951 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193775892 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193792105 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.193799973 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193825960 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193845987 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.193851948 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193878889 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193897009 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.193906069 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193931103 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193945885 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.193957090 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.193983078 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.194008112 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.194034100 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.194035053 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.194055080 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.231524944 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.231620073 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.231693029 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.231760025 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.231759071 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.231812000 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.231827021 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.231894970 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.231904030 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.282638073 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.282723904 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.282759905 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.282855988 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.324228048 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.324315071 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.324383974 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.512178898 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.512259007 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.512311935 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.512361050 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.512408972 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.512461901 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.512479067 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.512480021 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.512511015 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.512538910 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.512558937 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.512608051 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.512624025 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.512658119 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.512706995 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.512712002 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.512757063 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.512804985 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.512813091 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.512855053 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.512902975 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.512914896 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.512952089 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.513000965 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.513015032 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.513050079 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.513098001 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.513113022 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.513148069 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.513195038 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.513210058 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.513248920 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.513295889 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.513314962 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.513345003 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.513392925 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.513411045 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.513441086 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.513489008 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.513503075 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.513578892 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.513626099 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.513629913 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.513673067 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.513717890 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.513720036 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.513767958 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.513811111 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.513814926 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.513861895 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.513910055 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.513916969 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.513957024 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.514007092 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.514010906 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.514055014 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.514101982 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.514111042 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.514153004 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.514204025 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.549896955 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.549967051 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.550019026 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.550065041 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.550113916 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.550160885 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.550178051 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.550178051 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.550271988 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.600807905 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.600889921 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.600953102 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.601126909 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.642410040 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.642452955 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.642595053 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.832144022 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832192898 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832212925 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832233906 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832253933 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832273960 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832292080 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.832295895 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832318068 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832340002 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832344055 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.832361937 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832381964 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832401991 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832408905 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.832408905 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.832425117 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832442045 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.832443953 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832465887 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832480907 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.832488060 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832509041 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832528114 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.832529068 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832551003 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832570076 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832570076 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.832590103 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832608938 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832611084 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.832629919 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832645893 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.832652092 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832674026 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832690001 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.832695961 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832716942 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832732916 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.832737923 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832757950 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832777977 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832777977 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.832798958 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832812071 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832832098 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832847118 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.832853079 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832874060 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832876921 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.832894087 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832896948 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.832915068 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832935095 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832937002 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.832957029 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.832973003 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.832977057 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.833017111 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.868210077 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.868259907 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.868294001 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.868326902 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.868357897 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.868393898 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.868393898 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.868448019 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.868448019 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.919475079 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.919517040 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.919540882 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.919567108 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.919593096 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.919620991 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.919646978 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.919677973 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.919723988 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.960632086 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.960684061 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.960707903 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:19.960824013 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:19.960884094 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.150918961 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.150949955 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.150969982 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.150990009 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151005030 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.151011944 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151034117 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151047945 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.151057005 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151077986 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151086092 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.151099920 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151113987 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151125908 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151139021 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151150942 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151164055 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151182890 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151195049 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151209116 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151227951 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.151227951 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151249886 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151271105 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151284933 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.151292086 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151313066 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151313066 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.151333094 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151354074 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151362896 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.151366949 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151381016 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151393890 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151407957 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151420116 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151439905 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151478052 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.151519060 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151525974 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.151540041 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151591063 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.151621103 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151648998 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151674032 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151698112 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.151701927 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151729107 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151747942 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.151756048 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151783943 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151801109 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.151812077 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151835918 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151859999 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151865959 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.151887894 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151911974 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151920080 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.151940107 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151957035 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.151971102 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.151998043 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.152014971 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.152031898 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.152066946 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.152076960 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.152101994 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.152137041 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.152157068 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.152175903 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.152195930 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.152219057 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.152240992 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.152261972 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.152295113 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.152326107 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.152327061 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.152367115 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.162146091 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.186369896 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.186450958 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.186490059 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.186549902 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.186583042 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.186615944 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.186635971 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.186659098 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.186670065 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.186717033 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.186757088 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.186779976 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.186814070 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.186861992 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.238312006 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.238373995 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.238399982 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.238425970 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.238451958 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.238481045 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.238477945 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.238508940 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.238537073 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.238542080 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.238565922 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.238595009 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.278837919 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.278888941 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.278923035 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.278927088 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.278963089 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.278979063 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.278999090 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.279052019 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.470408916 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.470449924 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.470475912 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.470545053 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.470571995 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.470598936 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.470623970 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.470804930 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.470897913 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.470938921 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.470964909 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.470974922 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.471045971 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.471117973 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.471183062 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.471210003 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.471235037 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.471260071 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.471286058 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.471328974 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.471383095 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.471434116 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.471499920 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.471623898 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.471632957 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.471671104 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.471715927 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.471745014 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.471788883 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.471833944 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.471878052 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.471910000 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.471921921 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.471982002 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.473500013 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.473618031 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.473695040 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.473776102 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.473823071 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.473866940 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.473881006 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.473969936 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.474013090 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.474019051 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.474056959 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.474097967 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.474100113 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.474140882 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.474183083 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.474188089 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.474224091 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.474265099 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.474271059 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.474312067 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.474355936 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.474360943 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.474399090 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.474442005 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.474447012 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.474503040 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.474546909 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.474555016 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.474591970 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.474633932 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.474636078 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.474679947 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.474742889 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.474750042 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.474786997 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.474831104 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.474833965 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.474874973 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.474920034 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.474931002 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.474981070 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.475024939 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.475038052 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.475070000 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.475115061 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.475138903 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.475158930 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.475203037 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.475204945 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.475248098 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.475291967 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.475296021 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.475337982 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.475380898 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.475390911 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.475426912 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.475470066 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.475476980 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.475528955 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.475572109 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.475580931 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.475615978 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.475657940 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.475672007 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.475704908 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.475754976 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.475795031 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.475796938 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.475841045 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.475860119 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.475883007 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.475925922 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.475945950 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.475970030 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.476011992 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.476049900 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.476057053 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.476113081 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.480829954 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.480866909 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.480933905 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.487853050 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.505593061 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.505650997 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.505693913 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.505733013 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.505757093 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.505770922 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.505800009 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.505810022 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.505847931 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.505857944 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.505886078 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.505925894 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.505925894 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.505973101 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.506012917 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.506022930 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.506084919 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.506127119 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.506131887 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.506167889 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.506217003 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.557391882 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.557430983 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.557482004 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.557507992 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.557534933 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.557554960 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.557568073 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.557578087 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.557600975 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.557631016 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.557637930 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.557658911 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.557660103 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.557687044 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.557709932 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.597810984 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.597856045 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.597898960 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.598026037 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.598056078 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.598083973 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.598109961 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.598136902 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.598165035 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.598193884 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.598560095 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.790118933 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.790173054 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.790209055 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.790242910 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.790241957 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.790277958 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.790291071 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.790313959 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.790349960 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.790357113 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.790385962 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.790422916 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.790436983 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.790460110 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.790504932 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.791794062 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.791815996 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.791830063 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.791845083 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.791857958 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.791872025 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.791883945 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.791897058 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.791909933 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.791924000 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.791938066 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.791950941 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.791963100 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.791975975 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.791987896 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.792001009 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.792013884 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.792026997 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.792040110 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.792155027 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.792169094 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.792181969 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.792195082 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.792309999 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.793437004 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.794003010 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.794027090 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.794049025 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.794087887 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.796031952 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796056032 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796075106 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796094894 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.796096087 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796118975 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796133041 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.796140909 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796168089 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796176910 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.796191931 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796212912 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796222925 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.796236038 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796256065 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796263933 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.796278954 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796299934 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796308994 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.796323061 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796349049 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796354055 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.796371937 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796386003 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796408892 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796423912 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.796430111 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796452999 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796473980 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796485901 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.796495914 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796504974 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.796519041 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796545029 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796552896 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.796566963 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796581030 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796595097 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796607971 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796611071 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.796622992 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796636105 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796649933 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796663046 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796674967 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796688080 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796700954 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796714067 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796725988 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796741962 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796755075 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796767950 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796787024 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796798944 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796813011 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796839952 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796868086 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796876907 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.796890020 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796912909 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.796914101 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796937943 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796943903 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.796961069 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.796973944 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.796983957 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.797003984 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.797025919 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.797035933 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.797049999 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.797064066 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.797080994 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.797106981 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.797110081 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.797128916 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.797151089 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.797163010 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.797173977 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.797194958 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.797199011 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.797218084 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.797247887 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.797255039 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.797282934 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.797305107 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.797308922 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.797327995 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.797349930 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.797354937 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.797372103 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.797396898 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.797403097 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.797430992 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.797451019 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.797456026 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.797472954 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.797494888 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.797513962 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.797528982 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.797537088 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.797568083 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.797581911 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.797646999 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.797662973 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.800884962 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.800909996 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.800929070 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.801023960 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.802229881 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.825659990 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.825691938 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.825716972 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.825737000 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.825788021 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.825870991 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.825895071 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.825918913 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.825937033 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.825943947 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.825969934 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.825980902 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.825995922 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.826031923 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.826138020 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.826163054 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.826186895 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.826211929 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.826236010 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.826236963 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.826261997 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.826284885 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.826311111 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.826370001 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.826394081 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.826440096 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.826654911 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.826678038 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.826729059 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.826756001 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.826773882 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.826797009 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.877183914 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.877244949 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.877290964 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.877312899 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.877338886 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.877381086 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.877388954 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.877521992 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.877571106 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.877571106 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.877619982 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.877662897 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.877667904 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.877717018 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.877759933 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.877764940 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.877830982 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.877873898 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.877878904 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.877926111 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.877973080 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.915939093 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.915975094 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.915998936 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.916048050 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.916374922 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.916395903 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.916414022 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.916429043 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.916435003 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.916457891 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.916600943 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.916623116 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.916642904 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.916662931 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:20.916667938 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.916687965 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:20.969424009 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.108354092 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.108395100 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.108422041 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.108442068 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.108462095 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.108460903 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.108488083 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.108500957 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.108515024 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.108521938 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.108536959 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.108556986 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.108577013 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.108580112 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.108611107 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.111913919 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.111943007 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.111969948 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.111991882 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.112020016 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.112031937 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.112046003 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.112071037 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.112073898 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.112095118 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.112103939 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.112132072 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.112139940 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.112160921 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.112188101 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.112199068 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.112229109 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.112252951 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.112277985 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.112278938 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.112308979 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.112315893 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.112332106 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.112368107 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.112371922 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.112390995 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.112411022 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.112431049 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.112432957 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.112452030 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.112472057 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.112472057 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.112493038 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.112513065 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.112513065 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.112534046 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.112554073 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.112555981 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.112596035 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.115447998 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.115483999 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.115504980 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.115550995 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.115555048 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.115578890 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.115590096 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.115688086 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.115715027 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.115729094 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.115736008 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.115757942 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.115781069 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.115781069 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.115806103 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.115818977 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.115828037 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.115849972 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.115864992 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.115953922 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.115984917 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.115993023 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.116018057 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116039038 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116061926 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.116067886 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116091013 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116113901 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.116121054 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116152048 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116173983 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116175890 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.116194963 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116214037 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116220951 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.116240978 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116261005 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.116267920 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116295099 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116302967 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.116321087 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116344929 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116354942 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.116374969 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116400003 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116422892 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116425037 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.116451025 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116461039 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.116481066 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116506100 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116518974 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.116530895 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116558075 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116569996 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.116583109 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116607904 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116621971 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.116632938 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116657019 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116679907 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116683960 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.116703987 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116728067 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.116734028 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116769075 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116776943 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.116800070 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116821051 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116844893 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.116846085 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116878033 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116887093 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.116905928 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116931915 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116944075 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.116955996 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.116978884 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.117006063 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.117024899 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.117027044 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.117046118 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.117053986 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.117074966 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.117090940 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.117096901 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.117124081 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.117136002 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.117146969 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.117175102 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.117182970 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.117202044 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.117227077 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.117240906 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.117249012 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.117270947 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.117292881 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.117296934 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.117315054 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.117335081 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.117342949 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.117363930 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.117379904 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.117386103 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.117404938 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.117425919 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.117429972 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.117440939 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.117461920 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.117471933 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.117484093 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.117501974 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.117505074 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.117543936 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.118886948 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.118911028 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.119008064 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.120711088 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.130115986 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.143881083 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.143923044 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.143949986 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.143976927 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.143984079 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.144006014 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.144022942 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.144057989 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.144078970 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.144099951 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.144171953 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.144201040 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.144232988 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.144259930 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.144260883 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.144282103 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.144320011 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.144354105 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.144382954 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.144442081 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.144495964 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.144532919 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.144539118 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.144606113 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.144632101 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.144651890 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.144681931 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.144682884 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.144715071 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.145540953 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.145618916 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.195668936 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.195808887 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.195858955 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.195889950 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.195921898 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.195950031 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.195977926 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.196010113 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.196017981 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.196017981 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.196017981 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.196044922 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.196079016 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.196106911 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.196125031 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.196125031 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.196139097 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.196165085 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.196182966 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.196191072 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.196260929 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.234002113 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.234044075 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.234133959 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.234355927 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.234385014 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.234411955 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.234437943 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.234440088 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.234509945 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.234549046 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.234577894 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.234605074 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.234622002 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.234771967 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.234822989 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.289999008 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.344547987 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.426475048 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.426520109 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.426548958 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.426578999 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.426605940 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.426635981 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.426635027 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.426662922 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.426703930 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.426707983 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.426736116 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.426752090 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.430152893 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.430269957 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.430396080 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.430427074 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.430455923 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.430475950 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.430488110 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.430516005 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.430529118 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.430546999 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.430576086 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.430587053 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.430607080 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.430635929 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.430646896 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.430665970 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.430707932 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.430711031 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.430737972 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.430768013 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.430778027 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.430797100 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.430825949 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.430835962 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.430855989 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.430883884 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.430896997 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.430912971 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.430943966 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.430958033 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.430973053 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.431001902 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.431014061 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.431030989 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.431060076 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.431070089 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.431092024 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.431121111 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.431132078 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.431152105 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.431190968 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.433438063 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.433481932 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.433509111 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.433552980 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.433561087 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.433590889 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.433608055 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.433619022 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.433646917 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.433660984 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.433675051 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.433701038 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.433717966 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.435324907 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.435362101 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.435390949 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.435411930 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.435420036 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.435446024 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.435451031 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.435482025 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.435513973 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.435524940 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.435559034 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.435573101 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.435591936 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.435623884 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.435633898 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.435657978 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.435689926 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.435699940 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.435723066 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.435755014 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.435767889 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.435792923 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.435827971 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.435832024 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.435900927 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.435934067 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.435945034 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.435966015 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.435996056 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.436005116 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.436027050 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.436058998 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.436067104 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.436090946 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.436121941 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.436131001 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.436163902 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.436189890 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.436208010 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.436228991 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.436259985 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.436269045 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.436291933 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.436321020 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.436331034 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.436353922 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.436387062 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.436393976 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.436419010 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.436446905 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.436458111 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.436476946 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.436499119 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.436523914 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.436542034 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.437422991 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 19:59:21.437513113 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.438834906 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.440573931 CET	49700	80	192.168.2.4	203.16.214.120
Feb 7, 2023 19:59:21.758733034 CET	80	49700	203.16.214.120	192.168.2.4
Feb 7, 2023 20:00:00.748970032 CET	49702	443	192.168.2.4	142.250.180.174
Feb 7, 2023 20:00:00.749015093 CET	443	49702	142.250.180.174	192.168.2.4
Feb 7, 2023 20:00:00.749093056 CET	49702	443	192.168.2.4	142.250.180.174
Feb 7, 2023 20:00:00.749697924 CET	49703	443	192.168.2.4	216.58.209.45
Feb 7, 2023 20:00:00.749752998 CET	443	49703	216.58.209.45	192.168.2.4
Feb 7, 2023 20:00:00.749820948 CET	49703	443	192.168.2.4	216.58.209.45
Feb 7, 2023 20:00:00.750721931 CET	49705	443	192.168.2.4	142.250.180.174
Feb 7, 2023 20:00:00.750750065 CET	443	49705	142.250.180.174	192.168.2.4
Feb 7, 2023 20:00:00.750828981 CET	49705	443	192.168.2.4	142.250.180.174
Feb 7, 2023 20:00:00.751173973 CET	49706	443	192.168.2.4	216.58.209.45
Feb 7, 2023 20:00:00.751199961 CET	443	49706	216.58.209.45	192.168.2.4
Feb 7, 2023 20:00:00.751311064 CET	49706	443	192.168.2.4	216.58.209.45
Feb 7, 2023 20:00:00.752482891 CET	49702	443	192.168.2.4	142.250.180.174
Feb 7, 2023 20:00:00.752522945 CET	443	49702	142.250.180.174	192.168.2.4
Feb 7, 2023 20:00:00.752824068 CET	49703	443	192.168.2.4	216.58.209.45
Feb 7, 2023 20:00:00.752862930 CET	443	49703	216.58.209.45	192.168.2.4
Feb 7, 2023 20:00:00.753391027 CET	49705	443	192.168.2.4	142.250.180.174
Feb 7, 2023 20:00:00.753412962 CET	443	49705	142.250.180.174	192.168.2.4
Feb 7, 2023 20:00:00.753648043 CET	49706	443	192.168.2.4	216.58.209.45
Feb 7, 2023 20:00:00.753663063 CET	443	49706	216.58.209.45	192.168.2.4
Feb 7, 2023 20:00:00.843482971 CET	443	49703	216.58.209.45	192.168.2.4
Feb 7, 2023 20:00:00.843930960 CET	49703	443	192.168.2.4	216.58.209.45
Feb 7, 2023 20:00:00.843959093 CET	443	49703	216.58.209.45	192.168.2.4
Feb 7, 2023 20:00:00.845731020 CET	443	49703	216.58.209.45	192.168.2.4
Feb 7, 2023 20:00:00.845813036 CET	49703	443	192.168.2.4	216.58.209.45
Feb 7, 2023 20:00:00.861851931 CET	443	49706	216.58.209.45	192.168.2.4
Feb 7, 2023 20:00:00.870043993 CET	49706	443	192.168.2.4	216.58.209.45
Feb 7, 2023 20:00:00.870069027 CET	443	49706	216.58.209.45	192.168.2.4
Feb 7, 2023 20:00:00.873356104 CET	443	49706	216.58.209.45	192.168.2.4
Feb 7, 2023 20:00:00.873461962 CET	49706	443	192.168.2.4	216.58.209.45
Feb 7, 2023 20:00:00.945210934 CET	443	49702	142.250.180.174	192.168.2.4
Feb 7, 2023 20:00:00.949779987 CET	443	49705	142.250.180.174	192.168.2.4
Feb 7, 2023 20:00:00.977453947 CET	49705	443	192.168.2.4	142.250.180.174
Feb 7, 2023 20:00:00.977490902 CET	443	49705	142.250.180.174	192.168.2.4
Feb 7, 2023 20:00:00.977648020 CET	49702	443	192.168.2.4	142.250.180.174
Feb 7, 2023 20:00:00.977689981 CET	443	49702	142.250.180.174	192.168.2.4
Feb 7, 2023 20:00:00.978583097 CET	443	49705	142.250.180.174	192.168.2.4
Feb 7, 2023 20:00:00.978662014 CET	49705	443	192.168.2.4	142.250.180.174
Feb 7, 2023 20:00:00.978712082 CET	443	49702	142.250.180.174	192.168.2.4
Feb 7, 2023 20:00:00.978789091 CET	49702	443	192.168.2.4	142.250.180.174
Feb 7, 2023 20:00:00.980218887 CET	443	49705	142.250.180.174	192.168.2.4
Feb 7, 2023 20:00:00.980299950 CET	49705	443	192.168.2.4	142.250.180.174
Feb 7, 2023 20:00:00.980330944 CET	443	49702	142.250.180.174	192.168.2.4
Feb 7, 2023 20:00:00.980412960 CET	49702	443	192.168.2.4	142.250.180.174
Feb 7, 2023 20:00:01.149630070 CET	49705	443	192.168.2.4	142.250.180.174
Feb 7, 2023 20:00:01.149676085 CET	443	49705	142.250.180.174	192.168.2.4
Feb 7, 2023 20:00:01.149739981 CET	49702	443	192.168.2.4	142.250.180.174
Feb 7, 2023 20:00:01.149780035 CET	443	49702	142.250.180.174	192.168.2.4
Feb 7, 2023 20:00:01.150124073 CET	443	49702	142.250.180.174	192.168.2.4
Feb 7, 2023 20:00:01.150178909 CET	443	49705	142.250.180.174	192.168.2.4
Feb 7, 2023 20:00:01.150285006 CET	49703	443	192.168.2.4	216.58.209.45
Feb 7, 2023 20:00:01.150336981 CET	443	49703	216.58.209.45	192.168.2.4
Feb 7, 2023 20:00:01.150342941 CET	49706	443	192.168.2.4	216.58.209.45
Feb 7, 2023 20:00:01.150372028 CET	443	49706	216.58.209.45	192.168.2.4
Feb 7, 2023 20:00:01.150544882 CET	443	49706	216.58.209.45	192.168.2.4
Feb 7, 2023 20:00:01.150548935 CET	49705	443	192.168.2.4	142.250.180.174
Feb 7, 2023 20:00:01.150582075 CET	443	49705	142.250.180.174	192.168.2.4
Feb 7, 2023 20:00:01.150768042 CET	49703	443	192.168.2.4	216.58.209.45
Feb 7, 2023 20:00:01.150805950 CET	443	49703	216.58.209.45	192.168.2.4
Feb 7, 2023 20:00:01.151988983 CET	443	49703	216.58.209.45	192.168.2.4
Feb 7, 2023 20:00:01.193278074 CET	443	49705	142.250.180.174	192.168.2.4
Feb 7, 2023 20:00:01.193367004 CET	49705	443	192.168.2.4	142.250.180.174
Feb 7, 2023 20:00:01.193386078 CET	443	49705	142.250.180.174	192.168.2.4
Feb 7, 2023 20:00:01.193404913 CET	443	49705	142.250.180.174	192.168.2.4
Feb 7, 2023 20:00:01.193491936 CET	49705	443	192.168.2.4	142.250.180.174
Feb 7, 2023 20:00:01.195148945 CET	49705	443	192.168.2.4	142.250.180.174
Feb 7, 2023 20:00:01.195171118 CET	443	49705	142.250.180.174	192.168.2.4
Feb 7, 2023 20:00:01.243278027 CET	443	49703	216.58.209.45	192.168.2.4
Feb 7, 2023 20:00:01.243417025 CET	49703	443	192.168.2.4	216.58.209.45
Feb 7, 2023 20:00:01.243455887 CET	443	49703	216.58.209.45	192.168.2.4
Feb 7, 2023 20:00:01.243566036 CET	443	49703	216.58.209.45	192.168.2.4
Feb 7, 2023 20:00:01.243638992 CET	49703	443	192.168.2.4	216.58.209.45
Feb 7, 2023 20:00:01.254177094 CET	49703	443	192.168.2.4	216.58.209.45
Feb 7, 2023 20:00:01.254235029 CET	443	49703	216.58.209.45	192.168.2.4
Feb 7, 2023 20:00:01.347831964 CET	49702	443	192.168.2.4	142.250.180.174
Feb 7, 2023 20:00:01.347831964 CET	49706	443	192.168.2.4	216.58.209.45
Feb 7, 2023 20:00:01.347850084 CET	443	49702	142.250.180.174	192.168.2.4
Feb 7, 2023 20:00:01.347853899 CET	443	49706	216.58.209.45	192.168.2.4
Feb 7, 2023 20:00:01.539370060 CET	49706	443	192.168.2.4	216.58.209.45
Feb 7, 2023 20:00:01.539391041 CET	49702	443	192.168.2.4	142.250.180.174
Feb 7, 2023 20:00:04.594979048 CET	49712	443	192.168.2.4	142.250.180.132
Feb 7, 2023 20:00:04.595046043 CET	443	49712	142.250.180.132	192.168.2.4
Feb 7, 2023 20:00:04.595160007 CET	49712	443	192.168.2.4	142.250.180.132
Feb 7, 2023 20:00:04.596550941 CET	49712	443	192.168.2.4	142.250.180.132
Feb 7, 2023 20:00:04.596586943 CET	443	49712	142.250.180.132	192.168.2.4
Feb 7, 2023 20:00:04.671755075 CET	443	49712	142.250.180.132	192.168.2.4
Feb 7, 2023 20:00:04.680007935 CET	49712	443	192.168.2.4	142.250.180.132
Feb 7, 2023 20:00:04.680044889 CET	443	49712	142.250.180.132	192.168.2.4
Feb 7, 2023 20:00:04.682235956 CET	443	49712	142.250.180.132	192.168.2.4
Feb 7, 2023 20:00:04.682379961 CET	49712	443	192.168.2.4	142.250.180.132
Feb 7, 2023 20:00:04.689448118 CET	49712	443	192.168.2.4	142.250.180.132
Feb 7, 2023 20:00:04.689469099 CET	443	49712	142.250.180.132	192.168.2.4
Feb 7, 2023 20:00:04.689749956 CET	443	49712	142.250.180.132	192.168.2.4
Feb 7, 2023 20:00:04.739111900 CET	49712	443	192.168.2.4	142.250.180.132
Feb 7, 2023 20:00:04.739156961 CET	443	49712	142.250.180.132	192.168.2.4
Feb 7, 2023 20:00:04.839150906 CET	49712	443	192.168.2.4	142.250.180.132
Feb 7, 2023 20:00:14.651060104 CET	443	49712	142.250.180.132	192.168.2.4
Feb 7, 2023 20:00:14.651176929 CET	443	49712	142.250.180.132	192.168.2.4
Feb 7, 2023 20:00:14.651359081 CET	49712	443	192.168.2.4	142.250.180.132
Feb 7, 2023 20:00:15.476516008 CET	49712	443	192.168.2.4	142.250.180.132
Feb 7, 2023 20:00:15.476562023 CET	443	49712	142.250.180.132	192.168.2.4
Feb 7, 2023 20:00:46.462635040 CET	49702	443	192.168.2.4	142.250.180.174
Feb 7, 2023 20:00:46.462640047 CET	49706	443	192.168.2.4	216.58.209.45
Feb 7, 2023 20:00:46.462671041 CET	443	49702	142.250.180.174	192.168.2.4
Feb 7, 2023 20:00:46.462672949 CET	443	49706	216.58.209.45	192.168.2.4
Feb 7, 2023 20:01:06.000761986 CET	49706	443	192.168.2.4	216.58.209.45
Feb 7, 2023 20:01:06.000794888 CET	49702	443	192.168.2.4	142.250.180.174
Feb 7, 2023 20:01:06.000919104 CET	443	49706	216.58.209.45	192.168.2.4
Feb 7, 2023 20:01:06.001019001 CET	443	49702	142.250.180.174	192.168.2.4
Feb 7, 2023 20:01:06.001225948 CET	443	49706	216.58.209.45	192.168.2.4
Feb 7, 2023 20:01:06.001511097 CET	443	49702	142.250.180.174	192.168.2.4
Feb 7, 2023 20:01:06.003987074 CET	49706	443	192.168.2.4	216.58.209.45
Feb 7, 2023 20:01:06.004026890 CET	49702	443	192.168.2.4	142.250.180.174
Feb 7, 2023 20:01:06.004026890 CET	49702	443	192.168.2.4	142.250.180.174
Feb 7, 2023 20:01:06.004031897 CET	49706	443	192.168.2.4	216.58.209.45
Feb 7, 2023 20:01:06.044190884 CET	49726	443	192.168.2.4	142.250.180.132
Feb 7, 2023 20:01:06.044240952 CET	443	49726	142.250.180.132	192.168.2.4
Feb 7, 2023 20:01:06.044894934 CET	49726	443	192.168.2.4	142.250.180.132
Feb 7, 2023 20:01:06.049802065 CET	49726	443	192.168.2.4	142.250.180.132
Feb 7, 2023 20:01:06.049833059 CET	443	49726	142.250.180.132	192.168.2.4
Feb 7, 2023 20:01:06.129518032 CET	443	49726	142.250.180.132	192.168.2.4
Feb 7, 2023 20:01:06.148319006 CET	49726	443	192.168.2.4	142.250.180.132
Feb 7, 2023 20:01:06.148340940 CET	443	49726	142.250.180.132	192.168.2.4
Feb 7, 2023 20:01:06.149514914 CET	443	49726	142.250.180.132	192.168.2.4
Feb 7, 2023 20:01:06.178050041 CET	49726	443	192.168.2.4	142.250.180.132
Feb 7, 2023 20:01:06.178086042 CET	443	49726	142.250.180.132	192.168.2.4
Feb 7, 2023 20:01:06.178493977 CET	443	49726	142.250.180.132	192.168.2.4
Feb 7, 2023 20:01:06.308974028 CET	49726	443	192.168.2.4	142.250.180.132
Feb 7, 2023 20:01:16.111238003 CET	443	49726	142.250.180.132	192.168.2.4
Feb 7, 2023 20:01:16.111345053 CET	443	49726	142.250.180.132	192.168.2.4
Feb 7, 2023 20:01:16.111542940 CET	49726	443	192.168.2.4	142.250.180.132
Feb 7, 2023 20:02:01.151513100 CET	49726	443	192.168.2.4	142.250.180.132
Feb 7, 2023 20:02:01.151556969 CET	443	49726	142.250.180.132	192.168.2.4
Feb 7, 2023 20:02:46.203181028 CET	49726	443	192.168.2.4	142.250.180.132
Feb 7, 2023 20:02:46.203254938 CET	443	49726	142.250.180.132	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 7, 2023 19:59:09.772711992 CET	56572	53	192.168.2.4	8.8.8.8
Feb 7, 2023 19:59:09.962383986 CET	53	56572	8.8.8.8	192.168.2.4
Feb 7, 2023 19:59:10.131247997 CET	50911	53	192.168.2.4	8.8.8.8
Feb 7, 2023 19:59:10.250767946 CET	53	50911	8.8.8.8	192.168.2.4
Feb 7, 2023 19:59:10.557708979 CET	59683	53	192.168.2.4	8.8.8.8
Feb 7, 2023 19:59:10.577409983 CET	53	59683	8.8.8.8	192.168.2.4
Feb 7, 2023 19:59:15.601710081 CET	64167	53	192.168.2.4	8.8.8.8
Feb 7, 2023 19:59:15.622859001 CET	53	64167	8.8.8.8	192.168.2.4
Feb 7, 2023 19:59:15.787257910 CET	58565	53	192.168.2.4	8.8.8.8
Feb 7, 2023 19:59:15.809245110 CET	53	58565	8.8.8.8	192.168.2.4
Feb 7, 2023 19:59:15.979074955 CET	52239	53	192.168.2.4	8.8.8.8
Feb 7, 2023 19:59:16.300218105 CET	53	52239	8.8.8.8	192.168.2.4
Feb 7, 2023 20:00:00.583838940 CET	60686	53	192.168.2.4	8.8.8.8
Feb 7, 2023 20:00:00.584105015 CET	61124	53	192.168.2.4	8.8.8.8
Feb 7, 2023 20:00:00.604007006 CET	53	61124	8.8.8.8	192.168.2.4
Feb 7, 2023 20:00:00.609865904 CET	53	60686	8.8.8.8	192.168.2.4
Feb 7, 2023 20:00:03.329857111 CET	50861	53	192.168.2.4	8.8.8.8
Feb 7, 2023 20:00:03.349862099 CET	53	50861	8.8.8.8	192.168.2.4
Feb 7, 2023 20:00:03.642433882 CET	61088	53	192.168.2.4	8.8.8.8
Feb 7, 2023 20:00:03.683633089 CET	53	61088	8.8.8.8	192.168.2.4
Feb 7, 2023 20:01:05.888470888 CET	51419	53	192.168.2.4	8.8.8.8
Feb 7, 2023 20:01:05.906919003 CET	53	51419	8.8.8.8	192.168.2.4
Feb 7, 2023 20:01:06.002398014 CET	51054	53	192.168.2.4	8.8.8.8
Feb 7, 2023 20:01:06.022260904 CET	53	51054	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 7, 2023 19:59:09.772711992 CET	192.168.2.4	8.8.8.8	0x9892	Standard query (0)	modsource.org	A (IP address)	IN (0x0001)	false
Feb 7, 2023 19:59:10.131247997 CET	192.168.2.4	8.8.8.8	0xabeb	Standard query (0)	modsource.org	A (IP address)	IN (0x0001)	false
Feb 7, 2023 19:59:10.557708979 CET	192.168.2.4	8.8.8.8	0x53a4	Standard query (0)	users.on.net	A (IP address)	IN (0x0001)	false
Feb 7, 2023 19:59:15.601710081 CET	192.168.2.4	8.8.8.8	0x9017	Standard query (0)	modsource.org	A (IP address)	IN (0x0001)	false
Feb 7, 2023 19:59:15.787257910 CET	192.168.2.4	8.8.8.8	0x600e	Standard query (0)	modsource.org	A (IP address)	IN (0x0001)	false
Feb 7, 2023 19:59:15.979074955 CET	192.168.2.4	8.8.8.8	0x9cc2	Standard query (0)	users.on.net	A (IP address)	IN (0x0001)	false
Feb 7, 2023 20:00:00.583838940 CET	192.168.2.4	8.8.8.8	0xe83a	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Feb 7, 2023 20:00:00.584105015 CET	192.168.2.4	8.8.8.8	0x8320	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Feb 7, 2023 20:00:03.329857111 CET	192.168.2.4	8.8.8.8	0x148d	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 7, 2023 20:00:03.642433882 CET	192.168.2.4	8.8.8.8	0xe7d2	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 7, 2023 20:01:05.888470888 CET	192.168.2.4	8.8.8.8	0x4f2b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 7, 2023 20:01:06.002398014 CET	192.168.2.4	8.8.8.8	0x7fa9	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 7, 2023 19:59:09.962383986 CET	8.8.8.8	192.168.2.4	0x9892	No error (0)	modsource.org		162.55.0.134	A (IP address)	IN (0x0001)	false
Feb 7, 2023 19:59:10.250767946 CET	8.8.8.8	192.168.2.4	0xabeb	No error (0)	modsource.org		162.55.0.134	A (IP address)	IN (0x0001)	false
Feb 7, 2023 19:59:10.577409983 CET	8.8.8.8	192.168.2.4	0x53a4	No error (0)	users.on.net		203.16.214.120	A (IP address)	IN (0x0001)	false
Feb 7, 2023 19:59:15.622859001 CET	8.8.8.8	192.168.2.4	0x9017	No error (0)	modsource.org		162.55.0.134	A (IP address)	IN (0x0001)	false
Feb 7, 2023 19:59:15.809245110 CET	8.8.8.8	192.168.2.4	0x600e	No error (0)	modsource.org		162.55.0.134	A (IP address)	IN (0x0001)	false
Feb 7, 2023 19:59:16.300218105 CET	8.8.8.8	192.168.2.4	0x9cc2	No error (0)	users.on.net		203.16.214.120	A (IP address)	IN (0x0001)	false
Feb 7, 2023 20:00:00.604007006 CET	8.8.8.8	192.168.2.4	0x8320	No error (0)	accounts.google.com		216.58.209.45	A (IP address)	IN (0x0001)	false
Feb 7, 2023 20:00:00.609865904 CET	8.8.8.8	192.168.2.4	0xe83a	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 7, 2023 20:00:00.609865904 CET	8.8.8.8	192.168.2.4	0xe83a	No error (0)	clients.l.google.com		142.250.180.174	A (IP address)	IN (0x0001)	false
Feb 7, 2023 20:00:03.349862099 CET	8.8.8.8	192.168.2.4	0x148d	No error (0)	www.google.com		142.250.180.132	A (IP address)	IN (0x0001)	false
Feb 7, 2023 20:00:03.683633089 CET	8.8.8.8	192.168.2.4	0xe7d2	No error (0)	www.google.com		142.250.180.132	A (IP address)	IN (0x0001)	false
Feb 7, 2023 20:01:05.906919003 CET	8.8.8.8	192.168.2.4	0x4f2b	No error (0)	www.google.com		142.250.180.132	A (IP address)	IN (0x0001)	false
Feb 7, 2023 20:01:06.022260904 CET	8.8.8.8	192.168.2.4	0x7fa9	No error (0)	www.google.com		142.250.180.132	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

clients2.google.com

accounts.google.com

modsource.org

users.on.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49705	142.250.180.174	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49703	216.58.209.45	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49695	162.55.0.134	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 19:59:10.031176090 CET	91	OUT	GET /Files/SWG/Mods/ModSource_UI_Addon_Pack.ver HTTP/1.0 Host: modsource.org User-Agent: NSISDL/1.2 (Mozilla) Accept: /
Feb 7, 2023 19:59:10.060662031 CET	92	IN	HTTP/1.1 404 Not Found Date: Tue, 07 Feb 2023 18:59:10 GMT Server: Apache X-BP-NSA-REQID: (null) n.12UID=1146 X-Content-Type-Options: nosniff Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 29 May 2018 23:27:39 GMT ETag: "1b63-56d60947c10c0" Accept-Ranges: bytes Content-Length: 7011 Vary: Accept-Encoding Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 2d 68 6f 72 22 20 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 6d 69 72 6f 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 76 69 73 69 74 2d 61 66 74 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 33 20 64 61 79 73 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 20 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 4e 4f 49 4e 44 45 58 2c 20 46 4f 4c 4c 4f 57 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 68 65 69 67 68 74 3d 64 65 76 69 63 65 2d 68 65 69 67 68 74 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 38 30 78 31 38 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2e 70 6e 67 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 66 61 76 69 63 6f 6e 2d 33 32 78 33 32 2e 70 6e 67 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 66 61 76 69 63 6f 6e 2d 31 36 78 31 36 2e 70 6e 67 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b Data Ascii: <!DOCTYPE html><html dir="ltr"> <head> <meta charset="utf-8" /> <meta http-equiv="content-type" content="text/html; charset=utf-8" /> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" /> <meta name="aut-hor" content="miro" /> <meta name="revisit-after" content="3 days" /> <meta name="robots" content="NOINDEX, FOLLOW" /> <meta name="viewport" content="width=device-width, height=device-height, initial-scale=1, minimum-scale=1.0, maximum-scale=1.0, user-scalable=no" /> <title>404</title> <link rel="apple-touch-icon" sizes="180x180" href="https://www.bplaced.net/apple-touch-icon.png" /> <link rel="icon" type="image/png" href="https://www.bplaced.net/favicon-32x32.png" sizes="32x32" /> <link rel="icon" type="image/png" href="https://www.bplaced.net/favicon-16x16.png" sizes="16x16" /> <link
Feb 7, 2023 19:59:10.060699940 CET	93	IN	Data Raw: 20 72 65 6c 3d 22 6d 61 73 6b 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 73 61 66 61 72 69 2d 70 69 6e 6e 65 64 2d 74 61 62 2e 73 76 67 22 20 63 6f 6c 6f 72 3d 22 23 30 62 35 66 Data Ascii: rel="mask-icon" href="https://www.bplaced.net/safari-pinned-tab.svg" color="#0b5fb4" /> <link rel="shortcut icon" type="image/x-icon" href="https://www.bplaced.net/favicon.ico"> <link rel="stylesheet" type="text/css" href="htt
Feb 7, 2023 19:59:10.060720921 CET	95	IN	Data Raw: 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 65 20 69 6e 69 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 3a 20 33 32 25 20 31 65 6d 20 Data Ascii: <div class="de init"> <div style="padding: 32% 1em 0 1%;"> Die gewnschte Seite ist nicht auffindbar. </div> <div style="padding: 1em 1
Feb 7, 2023 19:59:10.060744047 CET	96	IN	Data Raw: 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 64 61 74 65 6e 73 63 68 75 74 7a 22 3e 44 61 74 65 6e 73 63 68 75 74 7a 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <a href="https://www.bplaced.net/datenschutz">Datenschutz</a> <a href="https://www.bplaced.net/impressum">Impressum</a> <a href="/" onclick="javascript:mufzSet('en'); return false;">Engl
Feb 7, 2023 19:59:10.060765028 CET	97	IN	Data Raw: 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 53 6f 72 72 79 2c 20 77 65 20 63 61 6e 26 6c 73 71 75 6f 3b 74 20 66 69 6e 64 20 74 68 61 74 20 70 61 67 65 2e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: v> Sorry, we can‘t find that page. </div> <div style="padding: 1em 1em 4em 0;"> You may want to take a look at the <a href="/">homepa
Feb 7, 2023 19:59:10.060786009 CET	98	IN	Data Raw: 29 29 7b 66 6f 72 28 69 3d 20 30 3b 69 3c 20 77 69 6e 64 6f 77 5b 5f 30 78 64 63 36 30 5b 36 5d 5d 5b 5f 30 78 64 63 36 30 5b 35 5d 5d 5b 5f 30 78 64 63 36 30 5b 38 5d 5d 3b 69 2b 2b 29 7b 6c 61 6e 67 75 61 67 65 3d 20 77 69 6e 64 6f 77 5b 5f 30 Data Ascii: )){for(i= 0;i< window[_0xdc60[6]][_0xdc60[5]][_0xdc60[8]];i++){language= window[_0xdc60[6]][_0xdc60[5]][i];if(language&& language[_0xdc60[8]]){mufz= language;break}}};for(i= 0;i< props[_0xdc60[8]];i++){language= window[_0xdc60[6]][props[i]];if

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49696	162.55.0.134	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 19:59:10.376364946 CET	99	OUT	GET /Files/SWG/Mods/ModSource_UI_Addon_Pack.ver HTTP/1.0 Host: modsource.org User-Agent: NSISDL/1.2 (Mozilla) Accept: /
Feb 7, 2023 19:59:10.406291008 CET	100	IN	HTTP/1.1 404 Not Found Date: Tue, 07 Feb 2023 18:59:10 GMT Server: Apache X-BP-NSA-REQID: (null) n.12UID=1562 X-Content-Type-Options: nosniff Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 29 May 2018 23:27:39 GMT ETag: "1b63-56d60947c10c0" Accept-Ranges: bytes Content-Length: 7011 Vary: Accept-Encoding Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 2d 68 6f 72 22 20 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 6d 69 72 6f 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 76 69 73 69 74 2d 61 66 74 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 33 20 64 61 79 73 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 20 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 4e 4f 49 4e 44 45 58 2c 20 46 4f 4c 4c 4f 57 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 68 65 69 67 68 74 3d 64 65 76 69 63 65 2d 68 65 69 67 68 74 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 38 30 78 31 38 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2e 70 6e 67 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 66 61 76 69 63 6f 6e 2d 33 32 78 33 32 2e 70 6e 67 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 66 61 76 69 63 6f 6e 2d 31 36 78 31 36 2e 70 6e 67 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b Data Ascii: <!DOCTYPE html><html dir="ltr"> <head> <meta charset="utf-8" /> <meta http-equiv="content-type" content="text/html; charset=utf-8" /> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" /> <meta name="aut-hor" content="miro" /> <meta name="revisit-after" content="3 days" /> <meta name="robots" content="NOINDEX, FOLLOW" /> <meta name="viewport" content="width=device-width, height=device-height, initial-scale=1, minimum-scale=1.0, maximum-scale=1.0, user-scalable=no" /> <title>404</title> <link rel="apple-touch-icon" sizes="180x180" href="https://www.bplaced.net/apple-touch-icon.png" /> <link rel="icon" type="image/png" href="https://www.bplaced.net/favicon-32x32.png" sizes="32x32" /> <link rel="icon" type="image/png" href="https://www.bplaced.net/favicon-16x16.png" sizes="16x16" /> <link
Feb 7, 2023 19:59:10.406332970 CET	102	IN	Data Raw: 20 72 65 6c 3d 22 6d 61 73 6b 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 73 61 66 61 72 69 2d 70 69 6e 6e 65 64 2d 74 61 62 2e 73 76 67 22 20 63 6f 6c 6f 72 3d 22 23 30 62 35 66 Data Ascii: rel="mask-icon" href="https://www.bplaced.net/safari-pinned-tab.svg" color="#0b5fb4" /> <link rel="shortcut icon" type="image/x-icon" href="https://www.bplaced.net/favicon.ico"> <link rel="stylesheet" type="text/css" href="htt
Feb 7, 2023 19:59:10.406387091 CET	103	IN	Data Raw: 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 65 20 69 6e 69 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 3a 20 33 32 25 20 31 65 6d 20 Data Ascii: <div class="de init"> <div style="padding: 32% 1em 0 1%;"> Die gewnschte Seite ist nicht auffindbar. </div> <div style="padding: 1em 1
Feb 7, 2023 19:59:10.406415939 CET	104	IN	Data Raw: 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 64 61 74 65 6e 73 63 68 75 74 7a 22 3e 44 61 74 65 6e 73 63 68 75 74 7a 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <a href="https://www.bplaced.net/datenschutz">Datenschutz</a> <a href="https://www.bplaced.net/impressum">Impressum</a> <a href="/" onclick="javascript:mufzSet('en'); return false;">Engl
Feb 7, 2023 19:59:10.406444073 CET	106	IN	Data Raw: 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 53 6f 72 72 79 2c 20 77 65 20 63 61 6e 26 6c 73 71 75 6f 3b 74 20 66 69 6e 64 20 74 68 61 74 20 70 61 67 65 2e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: v> Sorry, we can‘t find that page. </div> <div style="padding: 1em 1em 4em 0;"> You may want to take a look at the <a href="/">homepa
Feb 7, 2023 19:59:10.406766891 CET	107	IN	Data Raw: 29 29 7b 66 6f 72 28 69 3d 20 30 3b 69 3c 20 77 69 6e 64 6f 77 5b 5f 30 78 64 63 36 30 5b 36 5d 5d 5b 5f 30 78 64 63 36 30 5b 35 5d 5d 5b 5f 30 78 64 63 36 30 5b 38 5d 5d 3b 69 2b 2b 29 7b 6c 61 6e 67 75 61 67 65 3d 20 77 69 6e 64 6f 77 5b 5f 30 Data Ascii: )){for(i= 0;i< window[_0xdc60[6]][_0xdc60[5]][_0xdc60[8]];i++){language= window[_0xdc60[6]][_0xdc60[5]][i];if(language&& language[_0xdc60[8]]){mufz= language;break}}};for(i= 0;i< props[_0xdc60[8]];i++){language= window[_0xdc60[6]][props[i]];if

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49697	203.16.214.120	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 19:59:11.017126083 CET	107	OUT	GET /~anach/Files/SWG/ModSource_UI_Addon_Pack.ver HTTP/1.0 Host: users.on.net User-Agent: NSISDL/1.2 (Mozilla) Accept: /
Feb 7, 2023 19:59:11.342822075 CET	108	IN	HTTP/1.1 200 OK Date: Tue, 07 Feb 2023 18:59:11 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Thu, 13 Aug 2009 16:10:28 GMT ETag: "57074348-3-471082c8da500" Accept-Ranges: bytes Content-Length: 3 Connection: close Content-Type: text/plain Data Raw: 32 2e 30 Data Ascii: 2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49698	162.55.0.134	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 19:59:15.673615932 CET	109	OUT	GET /Files/SWG/Mods/ModSource_UI_Addon_Pack.zip HTTP/1.0 Host: modsource.org User-Agent: NSISDL/1.2 (Mozilla) Accept: /
Feb 7, 2023 19:59:15.703309059 CET	110	IN	HTTP/1.1 404 Not Found Date: Tue, 07 Feb 2023 18:59:15 GMT Server: Apache X-BP-NSA-REQID: (null) n.12UID=1888 X-Content-Type-Options: nosniff Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 29 May 2018 23:27:39 GMT ETag: "1b63-56d60947c10c0" Accept-Ranges: bytes Content-Length: 7011 Vary: Accept-Encoding Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 2d 68 6f 72 22 20 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 6d 69 72 6f 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 76 69 73 69 74 2d 61 66 74 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 33 20 64 61 79 73 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 20 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 4e 4f 49 4e 44 45 58 2c 20 46 4f 4c 4c 4f 57 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 68 65 69 67 68 74 3d 64 65 76 69 63 65 2d 68 65 69 67 68 74 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 38 30 78 31 38 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2e 70 6e 67 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 66 61 76 69 63 6f 6e 2d 33 32 78 33 32 2e 70 6e 67 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 66 61 76 69 63 6f 6e 2d 31 36 78 31 36 2e 70 6e 67 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b Data Ascii: <!DOCTYPE html><html dir="ltr"> <head> <meta charset="utf-8" /> <meta http-equiv="content-type" content="text/html; charset=utf-8" /> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" /> <meta name="aut-hor" content="miro" /> <meta name="revisit-after" content="3 days" /> <meta name="robots" content="NOINDEX, FOLLOW" /> <meta name="viewport" content="width=device-width, height=device-height, initial-scale=1, minimum-scale=1.0, maximum-scale=1.0, user-scalable=no" /> <title>404</title> <link rel="apple-touch-icon" sizes="180x180" href="https://www.bplaced.net/apple-touch-icon.png" /> <link rel="icon" type="image/png" href="https://www.bplaced.net/favicon-32x32.png" sizes="32x32" /> <link rel="icon" type="image/png" href="https://www.bplaced.net/favicon-16x16.png" sizes="16x16" /> <link
Feb 7, 2023 19:59:15.703341961 CET	111	IN	Data Raw: 20 72 65 6c 3d 22 6d 61 73 6b 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 73 61 66 61 72 69 2d 70 69 6e 6e 65 64 2d 74 61 62 2e 73 76 67 22 20 63 6f 6c 6f 72 3d 22 23 30 62 35 66 Data Ascii: rel="mask-icon" href="https://www.bplaced.net/safari-pinned-tab.svg" color="#0b5fb4" /> <link rel="shortcut icon" type="image/x-icon" href="https://www.bplaced.net/favicon.ico"> <link rel="stylesheet" type="text/css" href="htt
Feb 7, 2023 19:59:15.703362942 CET	113	IN	Data Raw: 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 65 20 69 6e 69 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 3a 20 33 32 25 20 31 65 6d 20 Data Ascii: <div class="de init"> <div style="padding: 32% 1em 0 1%;"> Die gewnschte Seite ist nicht auffindbar. </div> <div style="padding: 1em 1
Feb 7, 2023 19:59:15.703386068 CET	114	IN	Data Raw: 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 64 61 74 65 6e 73 63 68 75 74 7a 22 3e 44 61 74 65 6e 73 63 68 75 74 7a 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <a href="https://www.bplaced.net/datenschutz">Datenschutz</a> <a href="https://www.bplaced.net/impressum">Impressum</a> <a href="/" onclick="javascript:mufzSet('en'); return false;">Engl
Feb 7, 2023 19:59:15.703406096 CET	115	IN	Data Raw: 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 53 6f 72 72 79 2c 20 77 65 20 63 61 6e 26 6c 73 71 75 6f 3b 74 20 66 69 6e 64 20 74 68 61 74 20 70 61 67 65 2e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: v> Sorry, we can‘t find that page. </div> <div style="padding: 1em 1em 4em 0;"> You may want to take a look at the <a href="/">homepa
Feb 7, 2023 19:59:15.706346035 CET	116	IN	Data Raw: 29 29 7b 66 6f 72 28 69 3d 20 30 3b 69 3c 20 77 69 6e 64 6f 77 5b 5f 30 78 64 63 36 30 5b 36 5d 5d 5b 5f 30 78 64 63 36 30 5b 35 5d 5d 5b 5f 30 78 64 63 36 30 5b 38 5d 5d 3b 69 2b 2b 29 7b 6c 61 6e 67 75 61 67 65 3d 20 77 69 6e 64 6f 77 5b 5f 30 Data Ascii: )){for(i= 0;i< window[_0xdc60[6]][_0xdc60[5]][_0xdc60[8]];i++){language= window[_0xdc60[6]][_0xdc60[5]][i];if(language&& language[_0xdc60[8]]){mufz= language;break}}};for(i= 0;i< props[_0xdc60[8]];i++){language= window[_0xdc60[6]][props[i]];if

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49699	162.55.0.134	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 19:59:15.877010107 CET	117	OUT	GET /Files/SWG/Mods/ModSource_UI_Addon_Pack.zip HTTP/1.0 Host: modsource.org User-Agent: NSISDL/1.2 (Mozilla) Accept: /
Feb 7, 2023 19:59:15.905997992 CET	118	IN	HTTP/1.1 404 Not Found Date: Tue, 07 Feb 2023 18:59:15 GMT Server: Apache X-BP-NSA-REQID: (null) n.12UID=827 X-Content-Type-Options: nosniff Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 29 May 2018 23:27:39 GMT ETag: "1b63-56d60947c10c0" Accept-Ranges: bytes Content-Length: 7011 Vary: Accept-Encoding Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 2d 68 6f 72 22 20 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 6d 69 72 6f 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 76 69 73 69 74 2d 61 66 74 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 33 20 64 61 79 73 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 20 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 4e 4f 49 4e 44 45 58 2c 20 46 4f 4c 4c 4f 57 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 68 65 69 67 68 74 3d 64 65 76 69 63 65 2d 68 65 69 67 68 74 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 38 30 78 31 38 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2e 70 6e 67 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 66 61 76 69 63 6f 6e 2d 33 32 78 33 32 2e 70 6e 67 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 66 61 76 69 63 6f 6e 2d 31 36 78 31 36 2e 70 6e 67 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 Data Ascii: <!DOCTYPE html><html dir="ltr"> <head> <meta charset="utf-8" /> <meta http-equiv="content-type" content="text/html; charset=utf-8" /> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" /> <meta name="aut-hor" content="miro" /> <meta name="revisit-after" content="3 days" /> <meta name="robots" content="NOINDEX, FOLLOW" /> <meta name="viewport" content="width=device-width, height=device-height, initial-scale=1, minimum-scale=1.0, maximum-scale=1.0, user-scalable=no" /> <title>404</title> <link rel="apple-touch-icon" sizes="180x180" href="https://www.bplaced.net/apple-touch-icon.png" /> <link rel="icon" type="image/png" href="https://www.bplaced.net/favicon-32x32.png" sizes="32x32" /> <link rel="icon" type="image/png" href="https://www.bplaced.net/favicon-16x16.png" sizes="16x16" /> <link
Feb 7, 2023 19:59:15.906028032 CET	120	IN	Data Raw: 72 65 6c 3d 22 6d 61 73 6b 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 73 61 66 61 72 69 2d 70 69 6e 6e 65 64 2d 74 61 62 2e 73 76 67 22 20 63 6f 6c 6f 72 3d 22 23 30 62 35 66 62 Data Ascii: rel="mask-icon" href="https://www.bplaced.net/safari-pinned-tab.svg" color="#0b5fb4" /> <link rel="shortcut icon" type="image/x-icon" href="https://www.bplaced.net/favicon.ico"> <link rel="stylesheet" type="text/css" href="http
Feb 7, 2023 19:59:15.906049013 CET	121	IN	Data Raw: 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 65 20 69 6e 69 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 3a 20 33 32 25 20 31 65 6d 20 30 Data Ascii: <div class="de init"> <div style="padding: 32% 1em 0 1%;"> Die gewnschte Seite ist nicht auffindbar. </div> <div style="padding: 1em 1e
Feb 7, 2023 19:59:15.906069994 CET	122	IN	Data Raw: 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 64 61 74 65 6e 73 63 68 75 74 7a 22 3e 44 61 74 65 6e 73 63 68 75 74 7a 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <a href="https://www.bplaced.net/datenschutz">Datenschutz</a> <a href="https://www.bplaced.net/impressum">Impressum</a> <a href="/" onclick="javascript:mufzSet('en'); return false;">Engli
Feb 7, 2023 19:59:15.906085014 CET	124	IN	Data Raw: 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 53 6f 72 72 79 2c 20 77 65 20 63 61 6e 26 6c 73 71 75 6f 3b 74 20 66 69 6e 64 20 74 68 61 74 20 70 61 67 65 2e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: > Sorry, we can‘t find that page. </div> <div style="padding: 1em 1em 4em 0;"> You may want to take a look at the <a href="/">homepag
Feb 7, 2023 19:59:15.906102896 CET	125	IN	Data Raw: 29 7b 66 6f 72 28 69 3d 20 30 3b 69 3c 20 77 69 6e 64 6f 77 5b 5f 30 78 64 63 36 30 5b 36 5d 5d 5b 5f 30 78 64 63 36 30 5b 35 5d 5d 5b 5f 30 78 64 63 36 30 5b 38 5d 5d 3b 69 2b 2b 29 7b 6c 61 6e 67 75 61 67 65 3d 20 77 69 6e 64 6f 77 5b 5f 30 78 Data Ascii: ){for(i= 0;i< window[_0xdc60[6]][_0xdc60[5]][_0xdc60[8]];i++){language= window[_0xdc60[6]][_0xdc60[5]][i];if(language&& language[_0xdc60[8]]){mufz= language;break}}};for(i= 0;i< props[_0xdc60[8]];i++){language= window[_0xdc60[6]][props[i]];if(

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49700	203.16.214.120	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 19:59:16.641328096 CET	125	OUT	GET /~anach/Files/SWG/ModSource_UI_Addon_Pack.zip HTTP/1.0 Host: users.on.net User-Agent: NSISDL/1.2 (Mozilla) Accept: /
Feb 7, 2023 19:59:16.961148977 CET	127	IN	HTTP/1.1 200 OK Date: Tue, 07 Feb 2023 18:59:16 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Sun, 16 Aug 2009 06:01:33 GMT ETag: "57074349-111d8d-4713c046be940" Accept-Ranges: bytes Content-Length: 1121677 Connection: close Content-Type: application/zip Data Raw: 50 4b 03 04 14 00 02 00 08 00 7b 9d 0f 3b 51 b7 76 de f5 1c 11 00 87 83 11 00 1b 00 00 00 4d 6f 64 53 6f 75 72 63 65 20 55 49 20 41 64 64 6f 6e 20 50 61 63 6b 2e 65 78 65 ec fd 07 5c 53 49 d7 38 8e df 90 00 91 62 50 41 51 51 51 b1 62 dd d8 10 0b 28 c1 8a a0 48 62 c1 82 14 43 44 40 48 04 0b 02 06 04 8c 88 5d b1 2b b2 36 ec 0d 3b 58 00 15 15 1b d6 55 2c ab 17 51 17 57 4a a8 e7 7f 66 6e 50 77 d7 7d 9e e7 7d df e7 fb 7e bf bf ff e7 89 1e ee dc a9 67 ce 9c 39 65 66 ee bd 2e 93 56 30 7c 86 61 04 08 00 0c 93 ce 70 3f 07 e6 9f ff f2 10 ea b7 3a 53 9f 39 5e ef 66 eb 74 de e8 9b ad c7 cb fd 43 ad 83 43 82 66 86 78 cd b6 f6 f6 0a 0c 0c 52 5a cf f0 b5 0e 51 05 5a fb 07 5a 3b b9 ba 5b cf 0e f2 f1 ed 66 6a 6a 64 a3 ab e3 57 d5 c8 3d 3b cc 6d aa ea a0 bb d5 82 aa 14 1a 6e 57 d5 1f af 6d ac e6 55 1d c6 6b 69 5f f3 aa 3d 78 f5 6b d8 a6 6a 3b 5e c7 f9 7b cb 49 fe 3f e3 e4 26 61 98 d1 3c 7d a6 fb c5 4f c3 ea e2 0a 18 11 cf 98 67 c0 30 93 f0 e6 3e 8f 76 b6 dd 4f 18 36 43 08 d6 f5 96 84 f5 38 3a 30 cc b7 2b e3 26 f8 7a a3 47 ff 9a 71 79 bf 5e bf 5e e8 6f 57 28 c3 1c a7 c4 e1 33 2b c2 98 7f df 0f f1 5c a6 f7 f7 c9 dd 94 be e1 4a bc f6 9a a8 43 68 d2 f7 9d e0 7e d6 0c 33 bd 5b 88 8f 97 d2 8b 61 56 34 d0 f5 bd 21 c2 d4 3f e6 43 6a 38 74 e3 b2 31 1b 0e 21 bd 56 e8 ea 0a fe 4b be 8c 6e 81 ba 8c 2b 30 9f c3 8f 11 8c 22 f9 42 42 43 bc 49 b6 30 8e 36 4c 38 5e 95 7f 6d 97 f9 cf ef 7f f5 e7 a1 f9 a0 fe e0 a9 8e 30 11 29 6d f1 af b3 46 62 ae 32 55 0f b7 34 d3 98 ee 19 34 84 49 18 2e 70 03 95 19 a8 4c 40 25 04 8b e1 21 0e 4c e1 10 1c 69 77 a9 a6 f7 61 4c 4f 94 ec 92 b9 d1 a4 d1 98 a4 f6 2d 61 12 24 26 89 92 37 5c 9c 1b c6 69 22 8a d5 be c5 8c a6 85 53 30 96 45 56 60 44 27 9d c7 89 4e 4a a5 a2 43 1e ac e6 b6 ad 0b 2b 3a 94 c9 bf 94 e0 62 96 5c 0e e2 bb 4b 8b 31 7d 2c 46 89 4e 8e f1 10 1d 72 61 f9 99 9a eb 98 82 25 c6 93 12 4b 73 30 dd 4d 74 48 62 c6 bf 84 d1 99 2f 85 a2 93 19 c6 39 89 92 12 b7 04 17 2d a2 88 cd a8 25 c5 82 04 89 b9 1b 87 88 09 58 8c 47 44 40 65 0e f7 d4 12 56 60 17 c1 8a 96 85 01 80 7a d1 04 50 fa c2 dc 5e 88 3d 96 8a cd c0 32 4a 0f 4d 84 89 82 27 cb 96 bc 21 b3 28 5b c2 0a 89 64 b4 70 c3 0c 30 77 82 0c eb 0a a6 75 69 7a 4f c0 80 0c f2 b9 0e cb ad 31 9f 9b 02 e4 db fb 0c c1 58 8b 09 b4 45 13 4c a7 ed 22 9d 38 92 78 62 fc b4 a9 e2 8c c9 d7 2e 99 31 9a d1 36 82 1d 39 48 46 cd 1d 77 ff bb 96 38 c5 a4 32 cd 78 3d 61 d9 25 3d a5 6b e2 1c 9e 18 ec 7b e7 62 72 e8 10 cd 2d ff 6b 24 3d d1 89 27 d4 08 cb 32 f5 94 fc 61 45 2d cb 32 05 ca 7a 9a db ae b1 d7 94 d6 45 66 65 99 66 2a 63 cd 63 f1 13 f5 6b 9e f8 71 82 a5 b3 3e 29 c1 d5 10 72 7d da d4 c9 97 04 64 b8 c7 8e d5 78 08 71 fc 7e f7 2f 23 e9 9a 16 04 01 f1 35 fe 17 59 82 4b 35 92 50 e3 2c dc a3 a7 34 b6 73 31 51 1a d8 5c 18 92 e0 2c b4 b7 a0 48 38 69 2e f9 67 50 24 16 5a 0a 13 87 f0 34 22 82 87 91 82 37 8e 4d 45 6a 92 5b 81 aa 63 59 a6 83 92 0f 92 ea b2 4c 9e 52 1f af 45 78 a3 b5 d7 27 35 68 f2 42 ce 89 33 10 91 6b 97 84 8c 3a a2 9a 51 7e 51 47 68 19 a5 81 7a 8c d0 a1 e8 9d 66 8c 30 ea 65 a4 fa Data Ascii: PK{;QvModSource UI Addon Pack.exe\SI8bPAQQQb(HbCD@H]+6;XU,QWJfnPw}}~g9ef.V0\|ap?:S9^ftCCfxRZQZZ;[fjjdW=;mnWmUki_=xkj;^{I?&a<}Og0>vO6C8:0+&zGqy^^oW(3+\JCh~3[aV4!?Cj8t1!VKn+0"BBCI06L8^m0)mFb2U44I.pL@%!LiwaLO-a$&7\i"S0EV`D'NJC+:b\K1},FNra%Ks0MtHb/9-%XGD@eV`zP^=2JM'!([dp0wuizO1XEL"8xb.169HFw82x=a%=k{br-k$='2aE-2zEfef*cckq>)r}dxq~/#5YK5P,4s1Q\,H8i.gP$Z4"7MEj[cYLREx'5hB3k:Q~QGhzf0e
Feb 7, 2023 19:59:16.961299896 CET	128	IN	Data Raw: 1a 2f 61 8c b0 e8 f1 57 da 48 c5 65 ea 0a eb d0 5e 76 b4 23 73 bb 24 ba 09 65 1a bd 3d 06 aa 86 62 18 76 ef 5d ec fc 6a a5 c0 84 57 a4 67 53 9b a0 e7 1c 7d e9 bb 3e 3f 9e 36 95 eb b2 fa 83 c9 0e c2 ad 6a df 6a e4 5c fd 35 38 a2 32 cd 40 92 27 41 Data Ascii: /aWHe^v#s$e=bv]jWgS}>?6jj\582@'AHvQ/B%IuPF"@l`5.+9LxhtmEH)[-!4jgqfD4p88a2lsH!2~<TzP
Feb 7, 2023 19:59:16.961321115 CET	129	IN	Data Raw: cd b8 79 c7 8e c2 12 85 93 49 24 8f bd 68 46 86 ad 33 b6 50 38 17 f9 5f a1 c7 ae 20 f3 90 4f 46 7d 09 09 f1 90 df 37 9a 51 e6 4e 90 dc 8f 6f a9 ac 87 44 17 c5 58 89 48 b9 df 91 6f ec ab 70 90 b5 a2 78 23 8c b1 d7 2e d2 d3 a0 da b9 cf cf 46 ae ba Data Ascii: yI$hF3P8_ OF}7QNoDXHopx#.F@p>Dl&F5U@xV}sff{\|kK&U5bnp*W-%S5GaFZ'%\yj![BY}2QJ`{DbxpB-.H>O@`
Feb 7, 2023 19:59:16.961339951 CET	131	IN	Data Raw: f7 60 48 9a 20 39 c7 4e ea 4d e8 a3 32 54 b4 66 d7 60 1c b1 da e4 ca 50 07 ec b2 bb 3c 26 94 b0 76 0c 37 c7 96 3d 61 08 e5 84 89 1e b9 e3 e4 6b 30 45 23 74 83 06 a4 c7 a2 65 47 b9 24 a9 9b 46 08 63 dd 88 82 14 52 56 a5 f7 36 1a 97 0f 17 80 e4 c8 Data Ascii: `H 9NM2Tf`P<&v7=ak0E#teG$FcRV6f)M5.B0n&a3LzCaCn@68]h[W-~anvTewQBj@qYri5o` YR;Ph33@Hi'dOS+*X.80q
Feb 7, 2023 19:59:17.279333115 CET	132	IN	Data Raw: 16 b0 14 49 c3 2d 87 92 2e a9 af 23 71 c8 42 c2 1b 6e 35 96 4f d7 1f ed 2f 2f 6c a2 31 59 a2 12 a9 b3 2c a5 32 76 13 4e 83 42 b2 d9 36 b6 48 a9 be 06 b6 39 09 2e 6f 94 26 38 09 8c f4 48 f3 05 45 66 a0 fa 90 e8 6c e9 c6 ae c6 9c 51 63 ea f1 88 3f Data Ascii: I-.#qBn5O//l1Y,2vNB6H9.o&8HEflQc?R`&Rge#TG9%rcc#}Z4Dj$KCY!$/[LRskp<"t9:ms}IltPjWnUXwt`V;0N!\GG(FiE8Sq
Feb 7, 2023 19:59:17.279367924 CET	133	IN	Data Raw: 34 4c 9f 80 95 16 39 96 49 9e f1 12 e8 1e b4 c6 20 25 9d b0 ae 01 e8 9f 23 9b 57 c2 44 67 a7 89 6a 56 c8 eb 31 42 a5 dd 31 00 0b a3 9d e0 3c 40 9d 25 90 ca 33 30 03 fb 9a 4e 2a 9d c6 e1 76 44 25 e8 7e cb d0 e9 c9 5e 68 a5 31 d5 62 26 19 3f 53 e6 Data Ascii: 4L9I %#WDgjV1B1<@%30N*vD%~^h1b&?SBCoRJRIh[ZX272#DL/7=I Z0ScBEr"!_kVV%vQ-[9.\(VD'mD--BFbR-K
Feb 7, 2023 19:59:17.279387951 CET	135	IN	Data Raw: a8 bf a7 48 91 86 90 27 3a 85 c6 26 9d e9 6b 70 f6 17 8d bc b8 41 80 d3 54 e6 2e 7f 13 42 66 34 72 39 8e 0a 26 f7 08 47 06 ad 44 4a f5 6b 41 72 a8 1a bb cb e4 7a a1 98 e5 1c c9 87 fc 1c c5 3e 6b 43 b7 90 49 5d 06 36 98 db 0e bb b9 83 28 e6 f3 64 Data Ascii: H':&kpAT.Bf4r9&GDJkArz>kCI]6(d)<3rF:z#ysNl<D?Jtomdl*a]Wm=JjvAN:Pz1SCiI<AulCj<rr(<:lR/r$
Feb 7, 2023 19:59:17.279499054 CET	136	IN	Data Raw: 8d 81 1f 5f 9f 88 11 19 51 99 df 2f 77 d8 5f a5 13 4d 14 b3 8a f4 6e 6e 17 85 81 1b fb 0b 43 a5 bb 99 9b bc 92 db f5 e8 c2 1d 21 50 92 f5 1d 12 8f 51 c1 84 f9 2c 3c 3c 90 20 d6 04 3c ea 10 89 e7 3a 64 c2 16 3e a8 e3 03 95 a7 42 58 97 4c 06 47 ae Data Ascii: _Q/w_MnnC!PQ,<< <:d>BXLGOx8EzLl"K]B]WMHa$'d]3m*%u r!p:(ABhBq!c,dc];b8Du$.IFS/#nx+8j2gs=
Feb 7, 2023 19:59:17.279535055 CET	137	IN	Data Raw: 8f da 50 82 92 1e f5 c9 88 d0 14 97 d9 cd 31 53 da ba 29 aa e8 41 13 b6 80 2e c7 6a 95 c6 32 45 b5 3b 7b 97 e8 ce fa 74 11 8a 12 23 df 94 5b 01 cf 4a 71 22 fe 92 11 8e ff 87 5b 68 b9 92 c3 12 05 b1 13 cc 95 fc 04 55 35 8a 19 55 35 ca 4c 37 b6 65 Data Ascii: P1S)A.j2E;{t#[Jq"[hU5U5L7efU7!J=@o?:G:fEm<2NQOUWb4tO"tO7f292cLS<j0e2`P}s1XJA$vP+\^/N(^Qw7v j
Feb 7, 2023 19:59:17.279576063 CET	139	IN	Data Raw: ba 57 22 5a 4e 76 80 13 27 08 e9 21 a2 12 8d 20 1e d1 56 6a 8c 13 24 19 65 57 79 d9 92 73 e4 81 58 65 83 c4 a1 66 18 ae 47 e7 63 6e 94 37 af 96 70 87 be 82 3f a1 a8 be 26 13 2d 6b e4 16 33 25 5f 9d c1 d7 dc 01 55 46 66 81 b1 fa 95 d0 f8 92 e6 4e Data Ascii: W"ZNv'! Vj$eWysXefGcn7p?&-k3%_UFfNf>?CZg\|mr)E^_%2e;2%Z6$"GvUon4G;(XdnzsSv!J[s&,k2Nkwz'w9E"Zj0VEc{}&Q\|U-ii3<+&
Feb 7, 2023 19:59:17.597465992 CET	140	IN	Data Raw: 10 72 30 26 c2 00 85 d9 53 a5 a9 dc 61 35 59 1c 58 4a 1e f8 30 90 b1 db c9 e6 ed 60 46 55 2f 6a 20 c9 e8 a9 32 a6 8f 33 c9 58 7f fa 8c c2 14 f2 7c e3 a3 c4 d8 74 7a 38 9b ff e2 eb 41 6e 7a d0 9a ec 1c 26 c6 be 21 cf 3a 0f 76 4b 3c 41 02 ac 98 54 Data Ascii: r0&Sa5YXJ0`FU/j 23X\|tz8Anz&!:vK<ATm(4kD5Rg^LR> j*ug#j3?r"``l]q9w%P6)>sPd=Q\$)~g{bc4uQ8 OgDydt.c"Wu%>2=\6P

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49705	142.250.180.174	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-02-07 19:00:01 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-104.0.5112.81 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2023-02-07 19:00:01 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-a3orZQpsDsLl1uF3mQV-Eg' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 07 Feb 2023 19:00:01 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5881 X-Daystart: 39601 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-02-07 19:00:01 UTC	1	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 38 38 31 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 33 39 36 30 31 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5881" elapsed_seconds="39601"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-02-07 19:00:01 UTC	2	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-02-07 19:00:01 UTC	2	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49703	216.58.209.45	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-02-07 19:00:01 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2023-02-07 19:00:01 UTC	1	OUT	Data Raw: 20 Data Ascii:
2023-02-07 19:00:01 UTC	2	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 07 Feb 2023 19:00:01 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-YM5ZaL_zWMBiQwgsuUtBkg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-platform=, ch-ua-platform-version= Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-02-07 19:00:01 UTC	4	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-02-07 19:00:01 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exePID: 3500, Parent PID: 3528

General

Target ID:	0
Start time:	19:59:08
Start date:	07/02/2023
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe
Imagebase:	0x400000
File size:	116184 bytes
MD5 hash:	97011B19F2683A918F1F07F7F4EC1998
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: ModSource UI Addon Pack.exePID: 5900, Parent PID: 3500

General

Target ID:	1
Start time:	19:59:21
Start date:	07/02/2023
Path:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
Imagebase:	0x400000
File size:	1147783 bytes
MD5 hash:	DC0AEE7C1898F76B9D61CE023B91539C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 14%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 3248, Parent PID: 5900

General

Target ID:	4
Start time:	19:59:54
Start date:	07/02/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Documentation\Readme ModSource UI Addon Pack.html
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 5844, Parent PID: 3248

General

Target ID:	6
Start time:	19:59:56
Start date:	07/02/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1832 --field-trial-handle=1800,i,4957897538365028636,534134650291675046,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exePID: 3500, Parent PID: 3528COMMON

Execution Graph

Execution Coverage:	16.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	23%
Total number of Nodes:	1244
Total number of Limit Nodes:	26

Executed Functions

Function 00403225 Relevance: 72.0, APIs: 24, Strings: 17, Instructions: 270
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			_entry_() {
				struct _SHFILEINFOA _v360;
				struct _SECURITY_ATTRIBUTES* _v376;
				char _v380;
				CHAR* _v384;
				char _v392;
				int _v396;
				int _v400;
				signed int _v404;
				CHAR* _v408;
				int _v412;
				struct _SECURITY_ATTRIBUTES* _v416;
				struct _SECURITY_ATTRIBUTES* _v424;
				void* _v432;
				int _t34;
				CHAR* _t39;
				char* _t42;
				signed int _t44;
				void* _t48;
				int _t50;
				signed int _t51;
				signed int _t54;
				int _t55;
				signed int _t59;
				intOrPtr _t70;
				intOrPtr _t76;
				void* _t78;
				void* _t88;
				void* _t90;
				char* _t95;
				signed int _t96;
				void* _t97;
				signed int _t98;
				signed int _t99;
				signed int _t102;
				CHAR* _t104;
				signed int _t105;
				intOrPtr _t112;
				intOrPtr _t119;

				_v376 = 0;
				_v384 = "Error writing temporary file. Make sure your temp folder is valid.";
				_t98 = 0;
				_v380 = 0x20;
				__imp__#17();
				_t34 = SetErrorMode(0x8001); // executed
				__imp__OleInitialize(0); // executed
				 *0x423f58 = _t34;
				 *0x423ea4 = E00405D61(8);
				SHGetFileInfoA(0x41f450, 0,  &_v360, 0x160, 0); // executed
				E00405A43("ModSource UI Addon Pack Setup", "NSIS Error");
				_t39 = GetCommandLineA();
				_t95 = "\"C:\\Users\\jones\\Desktop\\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe\"";
				E00405A43(_t95, _t39);
				 *0x423ea0 = GetModuleHandleA(0);
				_t42 = _t95;
				if("\"C:\\Users\\jones\\Desktop\\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe\"" == 0x22) {
					_v404 = 0x22;
					_t42 =  &M00429001;
				}
				_t44 = CharNextA(E00405561(_t42, _v404));
				_v404 = _t44;
				while(1) {
					_t90 =  *_t44;
					_t108 = _t90;
					if(_t90 == 0) {
						break;
					}
					__eflags = _t90 - 0x20;
					if(_t90 != 0x20) {
						L5:
						__eflags =  *_t44 - 0x22;
						_v404 = 0x20;
						if( *_t44 == 0x22) {
							_t44 = _t44 + 1;
							__eflags = _t44;
							_v404 = 0x22;
						}
						__eflags =  *_t44 - 0x2f;
						if( *_t44 != 0x2f) {
							L15:
							_t44 = E00405561(_t44, _v404);
							__eflags =  *_t44 - 0x22;
							if(__eflags == 0) {
								_t44 = _t44 + 1;
								__eflags = _t44;
							}
							continue;
						} else {
							_t44 = _t44 + 1;
							__eflags =  *_t44 - 0x53;
							if( *_t44 == 0x53) {
								__eflags = ( *(_t44 + 1) | 0x00000020) - 0x20;
								if(( *(_t44 + 1) | 0x00000020) == 0x20) {
									_t98 = _t98 | 0x00000002;
									__eflags = _t98;
								}
							}
							__eflags =  *_t44 - 0x4352434e;
							if( *_t44 == 0x4352434e) {
								__eflags = ( *(_t44 + 4) | 0x00000020) - 0x20;
								if(( *(_t44 + 4) | 0x00000020) == 0x20) {
									_t98 = _t98 | 0x00000004;
									__eflags = _t98;
								}
							}
							__eflags =  *((intOrPtr*)(_t44 - 2)) - 0x3d442f20;
							if( *((intOrPtr*)(_t44 - 2)) == 0x3d442f20) {
								 *((intOrPtr*)(_t44 - 2)) = 0;
								_t45 = _t44 + 2;
								__eflags = _t44 + 2;
								E00405A43(0x429400, _t45);
								L20:
								_t104 = "C:\\Users\\jones\\AppData\\Local\\Temp\\";
								GetTempPathA(0x400, _t104);
								_t48 = E004031F1(_t108);
								_t109 = _t48;
								if(_t48 != 0) {
									L22:
									DeleteFileA("1033"); // executed
									_t50 = E00402C5B(_t110, _t98); // executed
									_v412 = _t50;
									if(_t50 != 0) {
										L32:
										ExitProcess(); // executed
										__imp__OleUninitialize(); // executed
										if(_v404 == 0) {
											__eflags =  *0x423f34; // 0x0
											if(__eflags != 0) {
												_t105 = E00405D61(3);
												_t99 = E00405D61(4);
												_t54 = E00405D61(5);
												__eflags = _t105;
												_t96 = _t54;
												if(_t105 != 0) {
													__eflags = _t99;
													if(_t99 != 0) {
														__eflags = _t96;
														if(_t96 != 0) {
															_t59 =  *_t105(GetCurrentProcess(), 0x28,  &_v392);
															__eflags = _t59;
															if(_t59 != 0) {
																 *_t99(0, "SeShutdownPrivilege",  &_v396);
																_v412 = 1;
																_v400 = 2;
																 *_t96(_v416, 0,  &_v412, 0, 0, 0);
															}
														}
													}
												}
												_t55 = ExitWindowsEx(2, 0);
												__eflags = _t55;
												if(_t55 == 0) {
													E0040140B(9);
												}
											}
											_t51 =  *0x423f4c; // 0xffffffff
											__eflags = _t51 - 0xffffffff;
											if(_t51 != 0xffffffff) {
												_v396 = _t51;
											}
											ExitProcess(_v396);
										}
										E00405304(_v404, 0x200010);
										ExitProcess(2);
									}
									_t112 =  *0x423ebc; // 0x0
									if(_t112 == 0) {
										L31:
										 *0x423f4c =  *0x423f4c | 0xffffffff;
										_v400 = E004035E3();
										goto L32;
									}
									_t102 = E00405561(_t95, 0);
									while(_t102 >= _t95) {
										__eflags =  *_t102 - 0x3d3f5f20;
										if(__eflags == 0) {
											break;
										}
										_t102 = _t102 - 1;
										__eflags = _t102;
									}
									_t114 = _t102 - _t95;
									_v408 = "Error launching installer";
									if(_t102 < _t95) {
										lstrcatA(_t104, "~nsu.tmp");
										_t100 = "C:\\Users\\jones\\Desktop";
										if(lstrcmpiA(_t104, "C:\\Users\\jones\\Desktop") == 0) {
											goto L32;
										}
										CreateDirectoryA(_t104, 0);
										SetCurrentDirectoryA(_t104);
										_t119 =  *0x429400; // 0x0
										if(_t119 == 0) {
											E00405A43(0x429400, _t100);
										}
										E00405A43("616", _v396);
										 *0x424400 = 0x41;
										_t97 = 0x1a;
										do {
											_t70 =  *0x423eb0; // 0x6acdd0
											E00405A65(0, _t97, 0x41f050, 0x41f050,  *((intOrPtr*)(_t70 + 0x120)));
											DeleteFileA(0x41f050);
											if(_v416 != 0 && CopyFileA("C:\\Users\\jones\\Desktop\\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe", 0x41f050, 1) != 0) {
												_push(0);
												_push(0x41f050);
												E00405791();
												_t76 =  *0x423eb0; // 0x6acdd0
												E00405A65(0, _t97, 0x41f050, 0x41f050,  *((intOrPtr*)(_t76 + 0x124)));
												_t78 = E004052A3(0x41f050);
												if(_t78 != 0) {
													CloseHandle(_t78);
													_v416 = 0;
												}
											}
											 *0x424400 =  *0x424400 + 1;
											_t97 = _t97 - 1;
										} while (_t97 != 0);
										_push(0);
										_push(_t104);
										E00405791();
										goto L32;
									}
									 *_t102 = 0;
									_t103 = _t102 + 4;
									if(E00405617(_t114, _t102 + 4) == 0) {
										goto L32;
									}
									E00405A43(0x429400, _t103);
									E00405A43(0x429800, _t103);
									_v424 = 0;
									goto L31;
								}
								GetWindowsDirectoryA(_t104, 0x3fb);
								lstrcatA(_t104, "\\Temp");
								_t88 = E004031F1(_t109);
								_t110 = _t88;
								if(_t88 == 0) {
									goto L32;
								}
								goto L22;
							}
							goto L15;
						}
					} else {
						goto L4;
					}
					do {
						L4:
						_t44 = _t44 + 1;
						__eflags =  *_t44 - 0x20;
					} while ( *_t44 == 0x20);
					goto L5;
				}
				goto L20;
			}

0x00403231
0x00403235
0x0040323d
0x0040323f
0x00403244
0x0040324f
0x00403256
0x0040325e
0x00403268
0x0040327e
0x0040328e
0x00403293
0x00403299
0x004032a0
0x004032b3
0x004032b8
0x004032ba
0x004032bc
0x004032c1
0x004032c1
0x004032d1
0x004032d7
0x00403340
0x00403340
0x00403342
0x00403344
0x00000000
0x00000000
0x004032dd
0x004032e0
0x004032e8
0x004032e8
0x004032eb
0x004032f0
0x004032f2
0x004032f2
0x004032f3
0x004032f3
0x004032f8
0x004032fb
0x00403330
0x00403335
0x0040333a
0x0040333d
0x0040333f
0x0040333f
0x0040333f
0x00000000
0x004032fd
0x004032fd
0x004032fe
0x00403301
0x00403309
0x0040330c
0x0040330e
0x0040330e
0x0040330e
0x0040330c
0x00403311
0x00403317
0x0040331f
0x00403322
0x00403324
0x00403324
0x00403324
0x00403322
0x00403327
0x0040332e
0x00403348
0x0040334b
0x0040334b
0x00403354
0x00403359
0x00403359
0x00403364
0x0040336a
0x0040336f
0x00403371
0x00403393
0x00403398
0x0040339f
0x004033a6
0x004033aa
0x00403411
0x00403411
0x00403416
0x00403420
0x0040350b
0x00403511
0x0040351c
0x00403525
0x00403527
0x0040352c
0x0040352e
0x00403530
0x00403532
0x00403534
0x00403536
0x00403538
0x00403548
0x0040354a
0x0040354c
0x00403559
0x00403568
0x00403570
0x00403578
0x00403578
0x0040354c
0x00403538
0x00403534
0x0040357d
0x00403583
0x00403585
0x00403589
0x00403589
0x00403585
0x0040358e
0x00403593
0x00403596
0x00403598
0x00403598
0x004035a0
0x004035a0
0x0040342f
0x00403436
0x00403436
0x004033ac
0x004033b2
0x00403401
0x00403401
0x0040340d
0x00000000
0x0040340d
0x004033bb
0x004033c8
0x004033bf
0x004033c5
0x00000000
0x00000000
0x004033c7
0x004033c7
0x004033c7
0x004033cc
0x004033ce
0x004033d6
0x00403442
0x00403447
0x00403456
0x00000000
0x00000000
0x0040345a
0x00403461
0x00403467
0x0040346d
0x00403475
0x00403475
0x00403483
0x0040348a
0x00403493
0x00403499
0x00403499
0x004034a5
0x004034ab
0x004034b5
0x004034c9
0x004034ca
0x004034cb
0x004034d0
0x004034dc
0x004034e2
0x004034e9
0x004034ec
0x004034f2
0x004034f2
0x004034e9
0x004034f6
0x004034fc
0x004034fc
0x004034ff
0x00403500
0x00403501
0x00000000
0x00403501
0x004033d8
0x004033da
0x004033e5
0x00000000
0x00000000
0x004033ed
0x004033f8
0x004033fd
0x00000000
0x004033fd
0x00403379
0x00403385
0x0040338a
0x0040338f
0x00403391
0x00000000
0x00000000
0x00000000
0x00403391
0x00000000
0x0040332e
0x00000000
0x00000000
0x00000000
0x004032e2
0x004032e2
0x004032e2
0x004032e3
0x004032e3
0x00000000
0x004032e2
0x00000000

APIs

#17.COMCTL32 ref: 00403244
SetErrorMode.KERNELBASE(00008001), ref: 0040324F
OleInitialize.OLE32(00000000), ref: 00403256

Part of subcall function 00405D61: GetModuleHandleA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D73
Part of subcall function 00405D61: LoadLibraryA.KERNELBASE(?,?,00000000,00403268,00000008), ref: 00405D7E
Part of subcall function 00405D61: GetProcAddress.KERNEL32(00000000,?), ref: 00405D8F

SHGetFileInfoA.SHELL32(0041F450,00000000,?,00000160,00000000,00000008), ref: 0040327E

Part of subcall function 00405A43: lstrcpynA.KERNEL32(?,?,00000400,00403293,ModSource UI Addon Pack Setup,NSIS Error), ref: 00405A50

GetCommandLineA.KERNEL32(ModSource UI Addon Pack Setup,NSIS Error), ref: 00403293
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe",00000000), ref: 004032A6
CharNextA.USER32(00000000,"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe",00000020), ref: 004032D1
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 00403364
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 00403379
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403385
DeleteFileA.KERNELBASE(1033), ref: 00403398
ExitProcess.KERNEL32(00000000), ref: 00403411
OleUninitialize.OLE32(00000000), ref: 00403416
ExitProcess.KERNEL32 ref: 00403436
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe",00000000,00000000), ref: 00403442
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe",00000000,00000000), ref: 0040344E
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040345A
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 00403461
DeleteFileA.KERNEL32(0041F050,0041F050,?,616,?), ref: 004034AB
CopyFileA.KERNEL32(C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe,0041F050,00000001), ref: 004034BF
CloseHandle.KERNEL32(00000000,0041F050,0041F050,?,0041F050,00000000), ref: 004034EC
GetCurrentProcess.KERNEL32(00000028,?,00000005,00000004,00000003), ref: 00403541
ExitWindowsEx.USER32(00000002,00000000), ref: 0040357D
ExitProcess.KERNEL32 ref: 004035A0

Strings

_?=, xrefs: 004033BF
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403235
/D=, xrefs: 00403327
C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, xrefs: 004034BA
SeShutdownPrivilege, xrefs: 00403553
ModSource UI Addon Pack Setup, xrefs: 00403289
NSIS Error, xrefs: 00403284
C:\Users\user\Desktop, xrefs: 00403447, 0040344C, 0040346F
~nsu.tmp, xrefs: 0040343C
\Temp, xrefs: 0040337F
"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe", xrefs: 00403299, 0040329F, 004033B5
C:\Users\user\AppData\Local\Temp\, xrefs: 00403359, 0040335E, 00403378, 00403384, 00403441, 0040344D, 00403459, 00403460, 00403500
616, xrefs: 0040347E
1033, xrefs: 00403393
", xrefs: 004032F3
Error launching installer, xrefs: 004033CE
NCRC, xrefs: 00403311

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ExitFileProcess$DirectoryHandle$CurrentDeleteModuleWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$"$"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe"$1033$616$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$ModSource UI Addon Pack Setup$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
API String ID: 553446912-2481819560
Opcode ID: 715d69830c5358cbc0aa25c9023e95388dc796bbf3631406a308053a31f5a69b
Instruction ID: 71fa282af5de1027f18dc485530d699f70574a0073b3e834d6f16d9d3991eef7
Opcode Fuzzy Hash: 715d69830c5358cbc0aa25c9023e95388dc796bbf3631406a308053a31f5a69b
Instruction Fuzzy Hash: 7791C370A08351BFDB216F619C89B1B7EACAB40306F44057BF541B61D2C77C9E458B6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405368 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 156
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E00405368(void* __ebx, void* __eflags, void* _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				struct _WIN32_FIND_DATAA _v332;
				signed int _t37;
				char* _t49;
				signed int _t52;
				signed int _t55;
				signed int _t61;
				signed int _t63;
				void* _t65;
				signed int _t68;
				CHAR* _t70;
				CHAR* _t72;
				char* _t75;

				_t72 = _a4;
				_t37 = E00405617(__eflags, _t72);
				_v12 = _t37;
				if((_a8 & 0x00000008) != 0) {
					_t63 = DeleteFileA(_t72); // executed
					asm("sbb eax, eax");
					_t65 =  ~_t63 + 1;
					 *0x423f28 =  *0x423f28 + _t65;
					return _t65;
				}
				_t68 = _a8 & 0x00000001;
				__eflags = _t68;
				_v8 = _t68;
				if(_t68 == 0) {
					L5:
					E00405A43(0x4214a0, _t72);
					__eflags = _t68;
					if(_t68 == 0) {
						E0040557D(_t72);
					} else {
						lstrcatA(0x4214a0, "\*.*");
					}
					__eflags =  *_t72;
					if( *_t72 != 0) {
						L10:
						lstrcatA(_t72, 0x40900c);
						L11:
						_t70 =  &(_t72[lstrlenA(_t72)]); // executed
						_t37 = FindFirstFileA(0x4214a0,  &_v332); // executed
						__eflags = _t37 - 0xffffffff;
						_a4 = _t37;
						if(_t37 == 0xffffffff) {
							L29:
							__eflags = _v8;
							if(_v8 != 0) {
								_t31 = _t70 - 1;
								 *_t31 =  *(_t70 - 1) & 0x00000000;
								__eflags =  *_t31;
							}
							goto L31;
						} else {
							goto L12;
						}
						do {
							L12:
							_t75 =  &(_v332.cFileName);
							_t49 = E00405561( &(_v332.cFileName), 0x3f);
							__eflags =  *_t49;
							if( *_t49 != 0) {
								__eflags = _v332.cAlternateFileName;
								if(_v332.cAlternateFileName != 0) {
									_t75 =  &(_v332.cAlternateFileName);
								}
							}
							__eflags =  *_t75 - 0x2e;
							if( *_t75 != 0x2e) {
								L19:
								E00405A43(_t70, _t75);
								__eflags = _v332.dwFileAttributes & 0x00000010;
								if((_v332.dwFileAttributes & 0x00000010) == 0) {
									E004056FB(_t72);
									_t52 = DeleteFileA(_t72); // executed
									__eflags = _t52;
									if(_t52 != 0) {
										E00404DE1(0xfffffff2, _t72);
									} else {
										__eflags = _a8 & 0x00000004;
										if((_a8 & 0x00000004) == 0) {
											 *0x423f28 =  *0x423f28 + 1;
										} else {
											E00404DE1(0xfffffff1, _t72);
											_push(0);
											_push(_t72);
											E00405791();
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E00405368(_t70, __eflags, _t72, _a8);
									}
								}
								goto L27;
							}
							_t61 =  *((intOrPtr*)(_t75 + 1));
							__eflags = _t61;
							if(_t61 == 0) {
								goto L27;
							}
							__eflags = _t61 - 0x2e;
							if(_t61 != 0x2e) {
								goto L19;
							}
							__eflags =  *((char*)(_t75 + 2));
							if( *((char*)(_t75 + 2)) == 0) {
								goto L27;
							}
							goto L19;
							L27:
							_t55 = FindNextFileA(_a4,  &_v332); // executed
							__eflags = _t55;
						} while (_t55 != 0);
						_t37 = FindClose(_a4);
						goto L29;
					}
					__eflags =  *0x4214a0 - 0x5c;
					if( *0x4214a0 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t37;
					if(_t37 == 0) {
						L31:
						__eflags = _v8;
						if(_v8 == 0) {
							L39:
							return _t37;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t37 = E00405D3A(_t72);
							__eflags = _t37;
							if(_t37 == 0) {
								goto L39;
							}
							E00405536(_t72);
							E004056FB(_t72);
							_t37 = RemoveDirectoryA(_t72); // executed
							__eflags = _t37;
							if(_t37 != 0) {
								return E00404DE1(0xffffffe5, _t72);
							}
							__eflags = _a8 & 0x00000004;
							if((_a8 & 0x00000004) == 0) {
								goto L33;
							}
							E00404DE1(0xfffffff1, _t72);
							_push(0);
							_push(_t72);
							return E00405791();
						}
						L33:
						 *0x423f28 =  *0x423f28 + 1;
						return _t37;
					}
					__eflags = _a8 & 0x00000002;
					if((_a8 & 0x00000002) == 0) {
						goto L31;
					}
					goto L5;
				}
			}

0x00405373
0x00405377
0x00405380
0x00405383
0x00405386
0x0040538e
0x00405390
0x00405391
0x00000000
0x00405391
0x004053a0
0x004053a0
0x004053a3
0x004053a6
0x004053ba
0x004053c1
0x004053c6
0x004053c8
0x004053d8
0x004053ca
0x004053d0
0x004053d0
0x004053dd
0x004053e0
0x004053eb
0x004053f1
0x004053f6
0x00405406
0x00405408
0x0040540e
0x00405411
0x00405414
0x004054d1
0x004054d1
0x004054d5
0x004054d7
0x004054d7
0x004054d7
0x004054d7
0x00000000
0x00000000
0x00000000
0x00000000
0x0040541a
0x0040541a
0x00405423
0x00405429
0x0040542e
0x00405431
0x00405433
0x00405437
0x00405439
0x00405439
0x00405437
0x0040543c
0x0040543f
0x00405452
0x00405454
0x00405459
0x00405460
0x00405478
0x0040547e
0x00405484
0x00405486
0x004054ab
0x00405488
0x00405488
0x0040548c
0x004054a0
0x0040548e
0x00405491
0x00405496
0x00405498
0x00405499
0x00405499
0x0040548c
0x00405462
0x00405468
0x0040546a
0x00405470
0x00405470
0x0040546a
0x00000000
0x00405460
0x00405441
0x00405444
0x00405446
0x00000000
0x00000000
0x00405448
0x0040544a
0x00000000
0x00000000
0x0040544c
0x00405450
0x00000000
0x00000000
0x00000000
0x004054b0
0x004054ba
0x004054c0
0x004054c0
0x004054cb
0x00000000
0x004054cb
0x004053e2
0x004053e9
0x00000000
0x00000000
0x00000000
0x004053a8
0x004053a8
0x004053aa
0x004054db
0x004054de
0x004054e1
0x00405533
0x00405533
0x00405533
0x004054e3
0x004054e6
0x004054f1
0x004054f6
0x004054f8
0x00000000
0x00000000
0x004054fb
0x00405501
0x00405507
0x0040550d
0x0040550f
0x00000000
0x0040552b
0x00405511
0x00405515
0x00000000
0x00000000
0x0040551a
0x0040551f
0x00405520
0x00000000
0x00405521
0x004054e8
0x004054e8
0x00000000
0x004054e8
0x004053b0
0x004053b4
0x00000000
0x00000000
0x00000000
0x004053b4

APIs

DeleteFileA.KERNELBASE(?,?,"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe",7476F560), ref: 00405386
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsb13F9.tmp\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nsb13F9.tmp\*.*,?,00000000,?,"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe",7476F560), ref: 004053D0
lstrcatA.KERNEL32(?,0040900C,?,C:\Users\user\AppData\Local\Temp\nsb13F9.tmp\*.*,?,00000000,?,"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe",7476F560), ref: 004053F1
lstrlenA.KERNEL32(?,?,0040900C,?,C:\Users\user\AppData\Local\Temp\nsb13F9.tmp\*.*,?,00000000,?,"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe",7476F560), ref: 004053F7
FindFirstFileA.KERNELBASE(C:\Users\user\AppData\Local\Temp\nsb13F9.tmp\*.*,?,?,?,0040900C,?,C:\Users\user\AppData\Local\Temp\nsb13F9.tmp\*.*,?,00000000,?,"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe",7476F560), ref: 00405408
FindNextFileA.KERNELBASE(?,00000010,000000F2,?), ref: 004054BA
FindClose.KERNEL32(?), ref: 004054CB

Strings

"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe", xrefs: 00405372
C:\Users\user\AppData\Local\Temp\, xrefs: 00405368
\*.*, xrefs: 004053CA
C:\Users\user\AppData\Local\Temp\nsb13F9.tmp\*.*, xrefs: 004053BA, 004053C0, 004053CF, 00405405

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsb13F9.tmp\*.*$\*.*
API String ID: 2035342205-1307720982
Opcode ID: 300c72b97078758442a804be84411b37fd36958cb151846e7d2c0794625577be
Instruction ID: cf9c67bea706718e69cadff60f89af37b9bc960bba5c2c4ceea64f3e0b576ccc
Opcode Fuzzy Hash: 300c72b97078758442a804be84411b37fd36958cb151846e7d2c0794625577be
Instruction Fuzzy Hash: F8510230904A447ADB216B628C89BFF3A78DF4271AF54807BF948711D2C77C5982DE6E

Uniqueness

Uniqueness Score: -1.00%

Function 0040600A Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E0040600A() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				void* _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t590;
				signed int* _t607;
				void* _t614;

				L0:
				while(1) {
					L0:
					if( *(_t614 - 0x40) != 0) {
						 *(_t614 - 0x34) = 1;
						 *(_t614 - 0x84) = 7;
						_t607 =  *(_t614 - 4) + 0x180 +  *(_t614 - 0x38) * 2;
						L132:
						 *(_t614 - 0x54) = _t607;
						L133:
						_t531 =  *_t607;
						_t590 = _t531 & 0x0000ffff;
						_t565 = ( *(_t614 - 0x10) >> 0xb) * _t590;
						if( *(_t614 - 0xc) >= _t565) {
							 *(_t614 - 0x10) =  *(_t614 - 0x10) - _t565;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) - _t565;
							 *(_t614 - 0x40) = 1;
							_t532 = _t531 - (_t531 >> 5);
							 *_t607 = _t532;
						} else {
							 *(_t614 - 0x10) = _t565;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
							 *_t607 = (0x800 - _t590 >> 5) + _t531;
						}
						if( *(_t614 - 0x10) >= 0x1000000) {
							L139:
							_t533 =  *(_t614 - 0x84);
							L140:
							 *(_t614 - 0x88) = _t533;
							goto L1;
						} else {
							L137:
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 5;
								goto L170;
							}
							 *(_t614 - 0x10) =  *(_t614 - 0x10) << 8;
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						__eax =  *(__ebp - 0x5c) & 0x000000ff;
						__esi =  *(__ebp - 0x60);
						__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
						__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
						__ecx =  *(__ebp - 0x3c);
						__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
						__ecx =  *(__ebp - 4);
						(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
						__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
						__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						if( *(__ebp - 0x38) >= 4) {
							if( *(__ebp - 0x38) >= 0xa) {
								_t97 = __ebp - 0x38;
								 *_t97 =  *(__ebp - 0x38) - 6;
							} else {
								 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
							}
						} else {
							 *(__ebp - 0x38) = 0;
						}
						if( *(__ebp - 0x34) == __edx) {
							__ebx = 0;
							__ebx = 1;
							L60:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t216 = __edx + 1; // 0x1
								__ebx = _t216;
								__cx = __ax >> 5;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L59:
								if(__ebx >= 0x100) {
									goto L54;
								}
								goto L60;
							} else {
								L57:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xf;
									goto L170;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t202 = __ebp - 0x70;
								 *_t202 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L59;
							}
						} else {
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
							}
							__ecx =  *(__ebp - 8);
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
							L40:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L38:
								__eax =  *(__ebp - 0x40);
								if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
									while(1) {
										if(__ebx >= 0x100) {
											break;
										}
										__eax =  *(__ebp - 0x58);
										__edx = __ebx + __ebx;
										__ecx =  *(__ebp - 0x10);
										__esi = __edx + __eax;
										__ecx =  *(__ebp - 0x10) >> 0xb;
										__ax =  *__esi;
										 *(__ebp - 0x54) = __esi;
										__edi = __ax & 0x0000ffff;
										__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
										if( *(__ebp - 0xc) >= __ecx) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
											__cx = __ax;
											_t169 = __edx + 1; // 0x1
											__ebx = _t169;
											__cx = __ax >> 5;
											 *__esi = __ax;
										} else {
											 *(__ebp - 0x10) = __ecx;
											0x800 = 0x800 - __edi;
											0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
											__ebx = __ebx + __ebx;
											 *__esi = __cx;
										}
										 *(__ebp - 0x44) = __ebx;
										if( *(__ebp - 0x10) < 0x1000000) {
											L45:
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t155 = __ebp - 0x70;
											 *_t155 =  *(__ebp - 0x70) + 1;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
										}
									}
									L53:
									_t172 = __ebp - 0x34;
									 *_t172 =  *(__ebp - 0x34) & 0x00000000;
									L54:
									__al =  *(__ebp - 0x44);
									 *(__ebp - 0x5c) =  *(__ebp - 0x44);
									L55:
									if( *(__ebp - 0x64) == 0) {
										 *(__ebp - 0x88) = 0x1a;
										goto L170;
									}
									__ecx =  *(__ebp - 0x68);
									__al =  *(__ebp - 0x5c);
									__edx =  *(__ebp - 8);
									 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
									 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
									 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
									 *( *(__ebp - 0x68)) = __al;
									__ecx =  *(__ebp - 0x14);
									 *(__ecx +  *(__ebp - 8)) = __al;
									__eax = __ecx + 1;
									__edx = 0;
									_t191 = __eax %  *(__ebp - 0x74);
									__eax = __eax /  *(__ebp - 0x74);
									__edx = _t191;
									L79:
									 *(__ebp - 0x14) = __edx;
									L80:
									 *(__ebp - 0x88) = 2;
									goto L1;
								}
								if(__ebx >= 0x100) {
									goto L53;
								}
								goto L40;
							} else {
								L36:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xd;
									L170:
									_t568 = 0x22;
									memcpy( *(_t614 - 0x90), _t614 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t121 = __ebp - 0x70;
								 *_t121 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L38;
							}
						}
					}
					L1:
					_t534 =  *(_t614 - 0x88);
					if(_t534 > 0x1c) {
						L171:
						_t535 = _t534 | 0xffffffff;
						goto L172;
					}
					switch( *((intOrPtr*)(_t534 * 4 +  &M004068AD))) {
						case 0:
							if( *(_t614 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t534 =  *( *(_t614 - 0x70));
							if(_t534 > 0xe1) {
								goto L171;
							}
							_t538 = _t534 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t610 = _t538 / _t570;
							_t540 = _t538 % _t570 & 0x000000ff;
							asm("cdq");
							_t605 = _t540 % _t571 & 0x000000ff;
							 *(_t614 - 0x3c) = _t605;
							 *(_t614 - 0x1c) = (1 << _t610) - 1;
							 *((intOrPtr*)(_t614 - 0x18)) = (1 << _t540 / _t571) - 1;
							_t613 = (0x300 << _t605 + _t610) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t614 - 0x78))) {
								L10:
								if(_t613 == 0) {
									L12:
									 *(_t614 - 0x48) =  *(_t614 - 0x48) & 0x00000000;
									 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t613 = _t613 - 1;
									 *((short*)( *(_t614 - 4) + _t613 * 2)) = 0x400;
								} while (_t613 != 0);
								goto L12;
							}
							if( *(_t614 - 4) != 0) {
								GlobalFree( *(_t614 - 4));
							}
							_t534 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t614 - 4) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t614 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 1;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) | ( *( *(_t614 - 0x70)) & 0x000000ff) <<  *(_t614 - 0x48) << 0x00000003;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t45 = _t614 - 0x48;
							 *_t45 =  *(_t614 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t614 - 0x48) < 4) {
								goto L13;
							}
							_t546 =  *(_t614 - 0x40);
							if(_t546 ==  *(_t614 - 0x74)) {
								L20:
								 *(_t614 - 0x48) = 5;
								 *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) =  *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t614 - 0x74) = _t546;
							if( *(_t614 - 8) != 0) {
								GlobalFree( *(_t614 - 8));
							}
							_t534 = GlobalAlloc(0x40,  *(_t614 - 0x40)); // executed
							 *(_t614 - 8) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t553 =  *(_t614 - 0x60) &  *(_t614 - 0x1c);
							 *(_t614 - 0x84) = 6;
							 *(_t614 - 0x4c) = _t553;
							_t607 =  *(_t614 - 4) + (( *(_t614 - 0x38) << 4) + _t553) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 3;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							_t67 = _t614 - 0x70;
							 *_t67 =  &(( *(_t614 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							L23:
							 *(_t614 - 0x48) =  *(_t614 - 0x48) - 1;
							if( *(_t614 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							goto L0;
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L68;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								goto L89;
							}
							__eflags =  *(__ebp - 0x60);
							if( *(__ebp - 0x60) == 0) {
								goto L171;
							}
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							_t258 =  *(__ebp - 0x38) - 7 >= 0;
							__eflags = _t258;
							0 | _t258 = _t258 + _t258 + 9;
							 *(__ebp - 0x38) = _t258 + _t258 + 9;
							goto L75;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							L89:
							__eax =  *(__ebp - 4);
							 *(__ebp - 0x80) = 0x15;
							__eax =  *(__ebp - 4) + 0xa68;
							 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
							goto L68;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							goto L36;
						case 0xe:
							goto L45;
						case 0xf:
							goto L57;
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							L68:
							__esi =  *(__ebp - 0x58);
							 *(__ebp - 0x84) = 0x12;
							goto L132;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							goto L55;
						case 0x1b:
							L75:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1b;
								goto L170;
							}
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							__eflags = __eax -  *(__ebp - 0x74);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
								__eflags = __eax;
							}
							__edx =  *(__ebp - 8);
							__cl =  *(__eax + __edx);
							__eax =  *(__ebp - 0x14);
							 *(__ebp - 0x5c) = __cl;
							 *(__eax + __edx) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t274 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t274;
							__eax =  *(__ebp - 0x68);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							_t283 = __ebp - 0x64;
							 *_t283 =  *(__ebp - 0x64) - 1;
							__eflags =  *_t283;
							 *( *(__ebp - 0x68)) = __cl;
							goto L79;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = __edx;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x0040600a
0x0040600a
0x0040600f
0x00406086
0x0040608d
0x00406097
0x00406676
0x00406676
0x00406679
0x00406679
0x0040667f
0x00406685
0x0040668b
0x004066a5
0x004066a8
0x004066ae
0x004066b9
0x004066bb
0x0040668d
0x0040668d
0x0040669c
0x004066a0
0x004066a0
0x004066c5
0x004066ec
0x004066ec
0x004066f2
0x004066f2
0x00000000
0x004066c7
0x004066c7
0x004066cb
0x0040687a
0x00000000
0x0040687a
0x004066d7
0x004066de
0x004066e6
0x004066e9
0x00000000
0x004066e9
0x00406011
0x00406011
0x00406015
0x0040601d
0x00406020
0x00406022
0x00406025
0x00406027
0x0040602c
0x0040602f
0x00406036
0x0040603d
0x00406040
0x0040604b
0x00406053
0x00406053
0x0040604d
0x0040604d
0x0040604d
0x00406042
0x00406042
0x00406042
0x0040605a
0x00406078
0x0040607a
0x0040624d
0x0040624d
0x00406250
0x00406253
0x00406256
0x00406259
0x0040625c
0x0040625f
0x00406262
0x00406265
0x0040626b
0x00406283
0x00406286
0x00406289
0x0040628c
0x0040628c
0x0040628f
0x00406295
0x0040626d
0x0040626d
0x00406275
0x0040627a
0x0040627c
0x0040627e
0x0040627e
0x0040629f
0x004062a2
0x00406245
0x0040624b
0x00000000
0x00000000
0x00000000
0x004062a4
0x00406220
0x00406224
0x0040682c
0x00000000
0x0040682c
0x0040622a
0x0040622d
0x00406230
0x00406234
0x00406237
0x0040623d
0x0040623f
0x0040623f
0x00406242
0x00000000
0x00406242
0x0040605c
0x0040605c
0x0040605f
0x00406065
0x00406067
0x00406067
0x0040606a
0x0040606d
0x0040606f
0x00406070
0x00406073
0x004060e0
0x004060e0
0x004060e4
0x004060e7
0x004060ea
0x004060ed
0x004060f0
0x004060f1
0x004060f4
0x004060f6
0x004060fc
0x004060ff
0x00406102
0x00406105
0x00406108
0x0040610e
0x0040612a
0x0040612d
0x00406130
0x00406133
0x0040613a
0x00406140
0x00406144
0x00406110
0x00406110
0x00406114
0x0040611c
0x00406121
0x00406123
0x00406125
0x00406125
0x0040614e
0x00406151
0x004060c8
0x004060c8
0x004060ce
0x00406181
0x00406187
0x00000000
0x00000000
0x00406189
0x0040618c
0x0040618f
0x00406192
0x00406195
0x00406198
0x0040619b
0x0040619e
0x004061a1
0x004061a7
0x004061bf
0x004061c2
0x004061c5
0x004061c8
0x004061c8
0x004061cb
0x004061d1
0x004061a9
0x004061a9
0x004061b1
0x004061b6
0x004061b8
0x004061ba
0x004061ba
0x004061db
0x004061de
0x0040615c
0x00406160
0x00406820
0x00000000
0x00406820
0x00406166
0x00406169
0x0040616c
0x00406170
0x00406173
0x00406179
0x0040617b
0x0040617b
0x0040617e
0x0040617e
0x004061de
0x004061e5
0x004061e5
0x004061e5
0x004061e9
0x004061e9
0x004061ec
0x004061ef
0x004061f3
0x00406838
0x00000000
0x00406838
0x004061f9
0x004061fc
0x004061ff
0x00406202
0x00406205
0x00406208
0x0040620b
0x0040620d
0x00406210
0x00406213
0x00406216
0x00406218
0x00406218
0x00406218
0x004063b5
0x004063b5
0x004063b8
0x004063b8
0x00000000
0x004063b8
0x004060da
0x00000000
0x00000000
0x00000000
0x00406157
0x004060a3
0x004060a7
0x00406814
0x00406890
0x00406898
0x0040689f
0x004068a1
0x004068a8
0x004068ac
0x004068ac
0x004060ad
0x004060b0
0x004060b3
0x004060b7
0x004060ba
0x004060c0
0x004060c2
0x004060c2
0x004060c5
0x00000000
0x004060c5
0x00406151
0x0040605a
0x00405e8e
0x00405e8e
0x00405e97
0x004068a5
0x004068a5
0x00000000
0x004068a5
0x00405e9d
0x00000000
0x00405ea8
0x00000000
0x00000000
0x00405eb1
0x00405eb4
0x00405eb7
0x00405ebb
0x00000000
0x00000000
0x00405ec1
0x00405ec4
0x00405ec6
0x00405ec7
0x00405eca
0x00405ecc
0x00405ecd
0x00405ecf
0x00405ed2
0x00405ed7
0x00405edc
0x00405ee5
0x00405ef8
0x00405efb
0x00405f07
0x00405f2f
0x00405f31
0x00405f3f
0x00405f3f
0x00405f43
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f33
0x00405f33
0x00405f36
0x00405f37
0x00405f37
0x00000000
0x00405f33
0x00405f0d
0x00405f12
0x00405f12
0x00405f1b
0x00405f23
0x00405f26
0x00000000
0x00405f2c
0x00405f2c
0x00000000
0x00405f2c
0x00000000
0x00405f49
0x00405f49
0x00405f4d
0x004067f9
0x00000000
0x004067f9
0x00405f56
0x00405f66
0x00405f69
0x00405f6c
0x00405f6c
0x00405f6c
0x00405f6f
0x00405f73
0x00000000
0x00000000
0x00405f75
0x00405f7b
0x00405fa5
0x00405fab
0x00405fb2
0x00000000
0x00405fb2
0x00405f81
0x00405f84
0x00405f89
0x00405f89
0x00405f94
0x00405f9c
0x00405f9f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405fe4
0x00405fea
0x00405fed
0x00405ffa
0x00406002
0x00000000
0x00000000
0x00405fb9
0x00405fb9
0x00405fbd
0x00406808
0x00000000
0x00406808
0x00405fc9
0x00405fd4
0x00405fd4
0x00405fd4
0x00405fd7
0x00405fda
0x00405fdd
0x00405fe2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004062a9
0x004062ad
0x004062cb
0x004062ce
0x004062d5
0x004062d8
0x004062db
0x004062de
0x004062e1
0x004062e4
0x004062e6
0x004062ed
0x004062ee
0x004062f0
0x004062f3
0x004062f6
0x004062f9
0x004062f9
0x004062fe
0x00000000
0x004062fe
0x004062af
0x004062b2
0x004062b5
0x004062bf
0x00000000
0x00000000
0x00406313
0x00406317
0x0040633a
0x0040633d
0x00406340
0x0040634a
0x00406319
0x00406319
0x0040631c
0x0040631f
0x00406322
0x0040632f
0x00406332
0x00406332
0x00000000
0x00000000
0x00406356
0x0040635a
0x00000000
0x00000000
0x00406360
0x00406364
0x00000000
0x00000000
0x0040636a
0x0040636c
0x00406370
0x00406370
0x00406373
0x00406377
0x00000000
0x00000000
0x004063c7
0x004063cb
0x004063d2
0x004063d5
0x004063d8
0x004063e2
0x00000000
0x004063e2
0x004063cd
0x00000000
0x00000000
0x004063ee
0x004063f2
0x004063f9
0x004063fc
0x004063ff
0x004063f4
0x004063f4
0x004063f4
0x00406402
0x00406405
0x00406408
0x00406408
0x0040640b
0x0040640e
0x00406411
0x00406411
0x00406414
0x0040641b
0x00406420
0x00000000
0x00000000
0x004064ae
0x004064ae
0x004064b2
0x00406850
0x00000000
0x00406850
0x004064b8
0x004064bb
0x004064be
0x004064c2
0x004064c5
0x004064cb
0x004064cd
0x004064cd
0x004064cd
0x004064d0
0x004064d3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406531
0x00406531
0x00406535
0x0040685c
0x00000000
0x0040685c
0x0040653b
0x0040653e
0x00406541
0x00406545
0x00406548
0x0040654e
0x00406550
0x00406550
0x00406550
0x00406553
0x00000000
0x00000000
0x00406301
0x00406301
0x00406304
0x00000000
0x00000000
0x00406640
0x00406644
0x00406666
0x00406669
0x00406673
0x00000000
0x00406673
0x00406646
0x00406649
0x0040664d
0x00406650
0x00406650
0x00406653
0x00000000
0x00000000
0x004066fd
0x00406701
0x0040671f
0x0040671f
0x0040671f
0x00406726
0x0040672d
0x00406734
0x00406734
0x00000000
0x00406734
0x00406703
0x00406706
0x00406709
0x0040670c
0x00406713
0x00406657
0x00406657
0x0040665a
0x00000000
0x00000000
0x004067ee
0x004067f1
0x00000000
0x00000000
0x00406428
0x0040642a
0x00406431
0x00406432
0x00406434
0x00406437
0x00000000
0x00000000
0x0040643f
0x00406442
0x00406445
0x00406447
0x00406449
0x00406449
0x0040644a
0x0040644d
0x00406454
0x00406457
0x00406465
0x00000000
0x00000000
0x0040673b
0x0040673b
0x0040673e
0x00406745
0x00000000
0x00000000
0x0040674a
0x0040674a
0x0040674e
0x00406886
0x00000000
0x00406886
0x00406754
0x00406757
0x0040675a
0x0040675e
0x00406761
0x00406767
0x00406769
0x00406769
0x00406769
0x0040676c
0x0040676f
0x0040676f
0x0040676f
0x0040676f
0x00406772
0x00406772
0x00406776
0x004067d6
0x004067d9
0x004067de
0x004067df
0x004067e1
0x004067e3
0x004067e6
0x00000000
0x004067e6
0x00406778
0x0040677e
0x00406781
0x00406784
0x00406787
0x0040678a
0x0040678d
0x00406790
0x00406793
0x00406796
0x00406799
0x004067b2
0x004067b5
0x004067b8
0x004067bb
0x004067bf
0x004067c1
0x004067c1
0x004067c2
0x004067c5
0x0040679b
0x0040679b
0x004067a3
0x004067a8
0x004067aa
0x004067ad
0x004067ad
0x004067c8
0x004067cf
0x00000000
0x004067d1
0x00000000
0x004067d1
0x00000000
0x0040646d
0x00406470
0x004064a6
0x004065d6
0x004065d6
0x004065d6
0x004065d6
0x004065d9
0x004065d9
0x004065dc
0x004065de
0x00406868
0x00000000
0x00406868
0x004065e4
0x004065e7
0x00000000
0x00000000
0x004065ed
0x004065f1
0x004065f4
0x004065f4
0x004065f4
0x00000000
0x004065f4
0x00406472
0x00406474
0x00406476
0x00406478
0x0040647b
0x0040647c
0x0040647e
0x00406480
0x00406483
0x00406486
0x0040649c
0x004064a1
0x004064d9
0x004064d9
0x004064dd
0x00406509
0x0040650b
0x00406512
0x00406515
0x00406518
0x00406518
0x0040651d
0x0040651d
0x0040651f
0x00406522
0x00406529
0x0040652c
0x00406559
0x00406559
0x0040655c
0x0040655f
0x004065d3
0x004065d3
0x004065d3
0x00000000
0x004065d3
0x00406561
0x00406567
0x0040656a
0x0040656d
0x00406570
0x00406573
0x00406576
0x00406579
0x0040657c
0x0040657f
0x00406582
0x0040659b
0x0040659d
0x004065a0
0x004065a1
0x004065a4
0x004065a6
0x004065a9
0x004065ab
0x004065ad
0x004065b0
0x004065b2
0x004065b5
0x004065b9
0x004065bb
0x004065bb
0x004065bc
0x004065bf
0x004065c2
0x00406584
0x00406584
0x0040658c
0x00406591
0x00406593
0x00406596
0x00406596
0x004065c5
0x004065cc
0x00406556
0x00406556
0x00406556
0x00406556
0x00000000
0x004065ce
0x00000000
0x004065ce
0x004065cc
0x004064df
0x004064e2
0x004064e4
0x004064e7
0x004064ea
0x004064ed
0x004064ef
0x004064f2
0x004064f5
0x004064f5
0x004064f8
0x004064f8
0x004064fb
0x00406502
0x004064d6
0x004064d6
0x004064d6
0x004064d6
0x00000000
0x00406504
0x00000000
0x00406504
0x00406502
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00000000
0x00000000
0x00000000
0x00000000
0x0040637a
0x0040637a
0x0040637e
0x00406844
0x00000000
0x00406844
0x00406384
0x00406387
0x0040638a
0x0040638d
0x0040638f
0x0040638f
0x0040638f
0x00406392
0x00406395
0x00406398
0x0040639b
0x0040639e
0x004063a1
0x004063a2
0x004063a4
0x004063a4
0x004063a4
0x004063a7
0x004063aa
0x004063ad
0x004063b0
0x004063b0
0x004063b0
0x004063b3
0x00000000
0x00000000
0x004065f7
0x004065f7
0x004065f7
0x004065fb
0x00000000
0x00000000
0x00406601
0x00406604
0x00406607
0x0040660a
0x0040660c
0x0040660c
0x0040660c
0x0040660f
0x00406612
0x00406615
0x00406618
0x0040661b
0x0040661e
0x0040661f
0x00406621
0x00406621
0x00406621
0x00406624
0x00406627
0x0040662a
0x0040662d
0x00406630
0x00406634
0x00406636
0x00406639
0x00000000
0x0040663b
0x00000000
0x0040663b
0x00406639
0x0040686e
0x00000000
0x00000000
0x00405e9d

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca48c4465a76fd19d6f3463da993c6ca3d09651b6bc0314a9d0f7ba33f731e04
Instruction ID: 4dd2872783d64c99001b1edb157d711bf7c17726e9b979133eda9d6147b50661
Opcode Fuzzy Hash: ca48c4465a76fd19d6f3463da993c6ca3d09651b6bc0314a9d0f7ba33f731e04
Instruction Fuzzy Hash: 8DF15671D00229CBDF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7785A86CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00405D3A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405D3A(CHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileA(_a4, 0x4224e8); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2); // executed
				return 0x4224e8;
			}

0x00405d45
0x00405d4e
0x00000000
0x00405d5b
0x00405d51
0x00000000

APIs

FindFirstFileA.KERNELBASE(?,004224E8,C:\,0040565A,C:\,C:\,00000000,C:\,C:\,?,?,7476F560,0040537C,?,"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe",7476F560), ref: 00405D45
FindClose.KERNELBASE(00000000), ref: 00405D51

Strings

C:\, xrefs: 00405D3A

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\
API String ID: 2295610775-3404278061
Opcode ID: faf9a5a1b02af36eb702065ba3c0ed1dca863e262e1f5f2ed0a66c6ec2a69bc9
Instruction ID: 5d39fc8c4b88dccabc2787e38e2f2122adfd1cb5ba995ef8605a3576d1a16c1a
Opcode Fuzzy Hash: faf9a5a1b02af36eb702065ba3c0ed1dca863e262e1f5f2ed0a66c6ec2a69bc9
Instruction Fuzzy Hash: 72D0C9319495206BD65037286D0C84B6A59DF15331750CA73B12AE22F0D27498518AB9

Uniqueness

Uniqueness Score: -1.00%

Function 00405D61 Relevance: 4.5, APIs: 3, Instructions: 20
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405D61(signed int _a4) {
				struct HINSTANCE__* _t5;
				CHAR* _t7;
				signed int _t9;

				_t9 = _a4 << 3;
				_t7 =  *(_t9 + 0x409218);
				_t5 = GetModuleHandleA(_t7);
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t9 + 0x40921c));
				}
				_t5 = LoadLibraryA(_t7); // executed
				if(_t5 != 0) {
					goto L2;
				}
				return _t5;
			}

0x00405d69
0x00405d6c
0x00405d73
0x00405d7b
0x00405d88
0x00000000
0x00405d8f
0x00405d7e
0x00405d86
0x00000000
0x00000000
0x00405d97

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D73
LoadLibraryA.KERNELBASE(?,?,00000000,00403268,00000008), ref: 00405D7E
GetProcAddress.KERNEL32(00000000,?), ref: 00405D8F

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: dcb02677a219034efdab4e35853fb1e5d97da29e7b116a2417b6d6f34bb30324
Instruction ID: 0b95471442b872ff96c45ebb8895c134e2226d70096e33e0af11a9781a9533ef
Opcode Fuzzy Hash: dcb02677a219034efdab4e35853fb1e5d97da29e7b116a2417b6d6f34bb30324
Instruction Fuzzy Hash: 4CE0CD329045106BC6114B709D4C97773ACDFE5741304493EF505F6150D734AC119FFA

Uniqueness

Uniqueness Score: -1.00%

Function 004035E3 Relevance: 47.5, APIs: 15, Strings: 12, Instructions: 213
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E004035E3() {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				int _v16;
				char _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t20;
				signed int _t24;
				void* _t28;
				void* _t30;
				int _t31;
				void* _t34;
				struct HINSTANCE__* _t37;
				int _t38;
				intOrPtr _t39;
				int _t42;
				intOrPtr _t59;
				char _t61;
				CHAR* _t63;
				signed char _t67;
				struct HINSTANCE__* _t75;
				CHAR* _t78;
				intOrPtr _t80;
				CHAR* _t85;

				_t80 =  *0x423eb0; // 0x6acdd0
				_t20 = E00405D61(6);
				_t87 = _t20;
				if(_t20 == 0) {
					_t78 = 0x420498;
					"1033" = 0x7830;
					E0040592A(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x420498, 0);
					__eflags =  *0x420498;
					if(__eflags == 0) {
						E0040592A(0x80000003, ".DEFAULT\\Control Panel\\International",  &M00407302, 0x420498, 0);
					}
					lstrcatA("1033", _t78);
				} else {
					E004059A1("1033",  *_t20() & 0x0000ffff);
				}
				E00403897(_t75, _t87);
				_t24 =  *0x423eb8; // 0x80
				 *0x423f20 = _t24 & 0x00000020;
				if(E00405617(_t87, 0x429400) != 0) {
					L16:
					if(E00405617(_t95, 0x429400) == 0) {
						E00405A65(0, _t78, _t80, 0x429400,  *((intOrPtr*)(_t80 + 0x118)));
					}
					_t28 = LoadImageA( *0x423ea0, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x423688 = _t28;
					if( *((intOrPtr*)(_t80 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t30 = E00403897(_t75, __eflags);
							__eflags =  *0x423f40; // 0x0
							if(__eflags != 0) {
								_t31 = E00404EB3(_t30, 0);
								__eflags = _t31;
								if(_t31 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x42366c; // 0x1
								if(__eflags == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x420470, 5);
							_t37 = LoadLibraryA("RichEd20");
							__eflags = _t37;
							if(_t37 == 0) {
								LoadLibraryA("RichEd32");
							}
							_t85 = "RichEdit20A";
							_t38 = GetClassInfoA(0, _t85, 0x423640);
							__eflags = _t38;
							if(_t38 == 0) {
								GetClassInfoA(0, "RichEdit", 0x423640);
								 *0x423664 = _t85;
								RegisterClassA(0x423640);
							}
							_t39 =  *0x423680; // 0x0
							_t42 = DialogBoxParamA( *0x423ea0, _t39 + 0x00000069 & 0x0000ffff, 0, E00403964, 0);
							E0040140B(5);
							return _t42;
						}
						L22:
						_t34 = 2;
						return _t34;
					} else {
						_t75 =  *0x423ea0; // 0x400000
						 *0x423654 = _t28;
						_v20 = 0x624e5f;
						 *0x423644 = E00401000;
						 *0x423650 = _t75;
						 *0x423664 =  &_v20;
						if(RegisterClassA(0x423640) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						_t12 =  &_v16; // 0x624e5f
						SystemParametersInfoA(0x30, 0, _t12, 0);
						 *0x420470 = CreateWindowExA(0x80,  &_v20, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x423ea0, 0);
						goto L21;
					}
				} else {
					_t75 =  *(_t80 + 0x48);
					if(_t75 == 0) {
						goto L16;
					}
					_t59 =  *0x423ed8; // 0x6ae194
					_t78 = 0x422e40;
					E0040592A( *((intOrPtr*)(_t80 + 0x44)), _t75,  *((intOrPtr*)(_t80 + 0x4c)) + _t59, 0x422e40, 0);
					_t61 =  *0x422e40; // 0x43
					if(_t61 == 0) {
						goto L16;
					}
					if(_t61 == 0x22) {
						_t78 = 0x422e41;
						 *((char*)(E00405561(0x422e41, 0x22))) = 0;
					}
					_t63 = lstrlenA(_t78) + _t78 - 4;
					if(_t63 <= _t78 || lstrcmpiA(_t63, ?str?) != 0) {
						L15:
						E00405A43(0x429400, E00405536(_t78));
						goto L16;
					} else {
						_t67 = GetFileAttributesA(_t78);
						if(_t67 == 0xffffffff) {
							L14:
							E0040557D(_t78);
							goto L15;
						}
						_t95 = _t67 & 0x00000010;
						if((_t67 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x004035e9
0x004035f2
0x004035f9
0x004035fb
0x0040360f
0x00403621
0x0040362b
0x00403630
0x00403636
0x00403649
0x00403649
0x00403654
0x004035fd
0x00403608
0x00403608
0x00403659
0x0040365e
0x0040366c
0x00403678
0x004036ff
0x00403707
0x00403710
0x00403710
0x00403726
0x0040372c
0x0040373a
0x004037c9
0x004037d1
0x004037db
0x004037e0
0x004037e6
0x00403865
0x0040386a
0x0040386c
0x00403888
0x00000000
0x00403888
0x0040386e
0x00403874
0x0040387c
0x0040387c
0x00000000
0x00403874
0x004037f0
0x00403801
0x00403803
0x00403805
0x0040380c
0x0040380c
0x00403814
0x0040381c
0x0040381e
0x00403820
0x00403829
0x0040382c
0x00403832
0x00403832
0x00403838
0x00403851
0x0040385b
0x00000000
0x00403860
0x004037d3
0x004037d5
0x00000000
0x00403740
0x00403740
0x00403746
0x00403750
0x00403758
0x00403762
0x00403768
0x00403776
0x0040388d
0x0040388d
0x00000000
0x0040388d
0x0040377c
0x00403785
0x004037c4
0x00000000
0x004037c4
0x0040367e
0x0040367e
0x00403683
0x00000000
0x00000000
0x00403688
0x0040368d
0x0040369d
0x004036a2
0x004036a9
0x00000000
0x00000000
0x004036ad
0x004036af
0x004036bc
0x004036bc
0x004036c4
0x004036ca
0x004036f2
0x004036fa
0x00000000
0x004036dc
0x004036dd
0x004036e6
0x004036ec
0x004036ed
0x00000000
0x004036ed
0x004036e8
0x004036ea
0x00000000
0x00000000
0x00000000
0x004036ea
0x004036ca

APIs

Part of subcall function 00405D61: GetModuleHandleA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D73
Part of subcall function 00405D61: LoadLibraryA.KERNELBASE(?,?,00000000,00403268,00000008), ref: 00405D7E
Part of subcall function 00405D61: GetProcAddress.KERNEL32(00000000,?), ref: 00405D8F

lstrcatA.KERNEL32(1033,00420498,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420498,00000000,00000006,"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe",00000000,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403654
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe,?,?,?,C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe,00000000,00429400,1033,00420498,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420498,00000000,00000006,"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe"), ref: 004036BF
lstrcmpiA.KERNEL32(?,.exe,C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe,?,?,?,C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe,00000000,00429400,1033,00420498,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420498,00000000), ref: 004036D2
GetFileAttributesA.KERNEL32(C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe), ref: 004036DD
LoadImageA.USER32 ref: 00403726

Part of subcall function 004059A1: wsprintfA.USER32 ref: 004059AE

RegisterClassA.USER32 ref: 0040376D
SystemParametersInfoA.USER32(00000030,00000000,_Nb,00000000), ref: 00403785
CreateWindowExA.USER32 ref: 004037BE
ShowWindow.USER32(00000005,00000000), ref: 004037F0
LoadLibraryA.KERNEL32(RichEd20), ref: 00403801
LoadLibraryA.KERNEL32(RichEd32), ref: 0040380C
GetClassInfoA.USER32 ref: 0040381C
GetClassInfoA.USER32 ref: 00403829
RegisterClassA.USER32 ref: 00403832
DialogBoxParamA.USER32 ref: 00403851

Strings

"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe", xrefs: 004035EF
C:\Users\user\AppData\Local\Temp\, xrefs: 004035E7
Control Panel\Desktop\ResourceLocale, xrefs: 00403617
.DEFAULT\Control Panel\International, xrefs: 0040363F
1033, xrefs: 00403603, 0040364F
RichEdit, xrefs: 00403823
RichEd20, xrefs: 004037FC
RichEd32, xrefs: 00403807
_Nb, xrefs: 0040377C, 00403781
C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe, xrefs: 0040368D, 00403695, 004036A2, 004036EC, 004036F2
RichEdit20A, xrefs: 00403814, 0040381A
.exe, xrefs: 004036CC

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 914957316-1789807369
Opcode ID: 14b6c047f502fb198814ad1f6744b558c0e6c74955b5b1082f2315d132549765
Instruction ID: 45f7e6f6298fecf4380e03b8fea472ff54197446901a6653a97fd0bb622000e8
Opcode Fuzzy Hash: 14b6c047f502fb198814ad1f6744b558c0e6c74955b5b1082f2315d132549765
Instruction Fuzzy Hash: 0161B2B1604200BED6307F65AC45E2B3AADEB4474AF44447FF900B22E1D77DAE05CA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00402C5B Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00402C5B(void* __eflags, signed int _a4) {
				long _v8;
				long _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _v40;
				char _v300;
				signed int _t54;
				void* _t57;
				void* _t62;
				signed int _t63;
				intOrPtr _t65;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr _t71;
				signed int _t77;
				signed int _t79;
				signed int _t82;
				signed int _t83;
				signed int _t89;
				intOrPtr _t92;
				signed int _t101;
				signed int _t103;
				void* _t105;
				signed int _t106;
				signed int _t109;
				void* _t110;

				_v8 = 0;
				_v12 = 0;
				 *0x423eac = GetTickCount() + 0x3e8;
				GetModuleFileNameA(0, "C:\\Users\\jones\\Desktop\\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe", 0x400);
				_t105 = E0040571A("C:\\Users\\jones\\Desktop\\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe", 0x80000000, 3);
				 *0x409010 = _t105;
				if(_t105 == 0xffffffff) {
					return "Error launching installer";
				}
				E00405A43("C:\\Users\\jones\\Desktop", "C:\\Users\\jones\\Desktop\\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe");
				E00405A43(0x42b000, E0040557D("C:\\Users\\jones\\Desktop"));
				_t54 = GetFileSize(_t105, 0);
				__eflags = _t54;
				 *0x41f048 = _t54;
				_t109 = _t54;
				if(_t54 <= 0) {
					L22:
					E00402BC5(1);
					__eflags =  *0x423eb4; // 0x7e00
					if(__eflags == 0) {
						goto L30;
					}
					__eflags = _v12;
					if(_v12 == 0) {
						L26:
						_t57 = GlobalAlloc(0x40, _v20); // executed
						_t110 = _t57;
						E00405E3B(0x40afb0);
						E00405749( &_v300, "C:\\Users\\jones\\AppData\\Local\\Temp\\"); // executed
						_t62 = CreateFileA( &_v300, 0xc0000000, 0, 0, 2, 0x4000100, 0); // executed
						__eflags = _t62 - 0xffffffff;
						 *0x409014 = _t62;
						if(_t62 != 0xffffffff) {
							_t63 =  *0x423eb4; // 0x7e00
							_t65 = E004031DA(_t63 + 0x1c);
							 *0x41f04c = _t65;
							 *0x417040 = _t65 - ( !_v40 & 0x00000004) + _v16 - 0x1c; // executed
							_t68 = E00402F01(_v16, 0xffffffff, 0, _t110, _v20); // executed
							__eflags = _t68 - _v20;
							if(_t68 == _v20) {
								__eflags = _v40 & 0x00000001;
								 *0x423eb0 = _t110;
								 *0x423eb8 =  *_t110;
								if((_v40 & 0x00000001) != 0) {
									 *0x423ebc =  *0x423ebc + 1;
									__eflags =  *0x423ebc;
								}
								_t45 = _t110 + 0x44; // 0x44
								_t70 = _t45;
								_t101 = 8;
								do {
									_t70 = _t70 - 8;
									 *_t70 =  *_t70 + _t110;
									_t101 = _t101 - 1;
									__eflags = _t101;
								} while (_t101 != 0);
								_t71 =  *0x41703c; // 0x2e429
								 *((intOrPtr*)(_t110 + 0x3c)) = _t71;
								E004056DB(0x423ec0, _t110 + 4, 0x40);
								__eflags = 0;
								return 0;
							}
							goto L30;
						}
						return "Error writing temporary file. Make sure your temp folder is valid.";
					}
					E004031DA( *0x417038);
					_t77 = E004031A8( &_a4, 4); // executed
					__eflags = _t77;
					if(_t77 == 0) {
						goto L30;
					}
					__eflags = _v8 - _a4;
					if(_v8 != _a4) {
						goto L30;
					}
					goto L26;
				} else {
					do {
						_t79 =  *0x423eb4; // 0x7e00
						_t106 = _t109;
						asm("sbb eax, eax");
						_t82 = ( ~_t79 & 0x00007e00) + 0x200;
						__eflags = _t109 - _t82;
						if(_t109 >= _t82) {
							_t106 = _t82;
						}
						_t83 = E004031A8(0x417048, _t106); // executed
						__eflags = _t83;
						if(_t83 == 0) {
							E00402BC5(1);
							L30:
							return "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						__eflags =  *0x423eb4; // 0x7e00
						if(__eflags != 0) {
							__eflags = _a4 & 0x00000002;
							if((_a4 & 0x00000002) == 0) {
								E00402BC5(0);
							}
							goto L19;
						}
						E004056DB( &_v40, 0x417048, 0x1c);
						_t89 = _v40;
						__eflags = _t89 & 0xfffffff0;
						if((_t89 & 0xfffffff0) != 0) {
							goto L19;
						}
						__eflags = _v36 - 0xdeadbeef;
						if(_v36 != 0xdeadbeef) {
							goto L19;
						}
						__eflags = _v24 - 0x74736e49;
						if(_v24 != 0x74736e49) {
							goto L19;
						}
						__eflags = _v28 - 0x74666f73;
						if(_v28 != 0x74666f73) {
							goto L19;
						}
						__eflags = _v32 - 0x6c6c754e;
						if(_v32 != 0x6c6c754e) {
							goto L19;
						}
						_a4 = _a4 | _t89;
						_t103 =  *0x417038; // 0x23202
						 *0x423f40 =  *0x423f40 | _a4 & 0x00000002;
						_t92 = _v16;
						__eflags = _t92 - _t109;
						 *0x423eb4 = _t103;
						if(_t92 > _t109) {
							goto L30;
						}
						__eflags = _a4 & 0x00000008;
						if((_a4 & 0x00000008) != 0) {
							L15:
							_v12 = _v12 + 1;
							_t109 = _t92 - 4;
							__eflags = _t106 - _t109;
							if(_t106 > _t109) {
								_t106 = _t109;
							}
							goto L19;
						}
						__eflags = _a4 & 0x00000004;
						if((_a4 & 0x00000004) != 0) {
							goto L22;
						}
						goto L15;
						L19:
						__eflags = _t109 -  *0x41f048; // 0x255d0
						if(__eflags < 0) {
							_v8 = E00405DCD(_v8, 0x417048, _t106);
						}
						 *0x417038 =  *0x417038 + _t106;
						_t109 = _t109 - _t106;
						__eflags = _t109;
					} while (_t109 > 0);
					goto L22;
				}
			}

0x00402c69
0x00402c6c
0x00402c86
0x00402c8b
0x00402c9e
0x00402ca3
0x00402ca9
0x00000000
0x00402cab
0x00402cbc
0x00402ccd
0x00402cd4
0x00402cda
0x00402cdc
0x00402ce1
0x00402ce3
0x00402dd3
0x00402dd5
0x00402dda
0x00402de1
0x00000000
0x00000000
0x00402de7
0x00402dea
0x00402e16
0x00402e1b
0x00402e26
0x00402e28
0x00402e39
0x00402e54
0x00402e5a
0x00402e5d
0x00402e62
0x00402e78
0x00402e81
0x00402e91
0x00402ea3
0x00402ea8
0x00402ead
0x00402eb0
0x00402eb9
0x00402ebd
0x00402ec5
0x00402eca
0x00402ecc
0x00402ecc
0x00402ecc
0x00402ed4
0x00402ed4
0x00402ed7
0x00402ed8
0x00402ed8
0x00402edb
0x00402edd
0x00402edd
0x00402edd
0x00402ee0
0x00402ee7
0x00402ef3
0x00402ef8
0x00000000
0x00402ef8
0x00000000
0x00402eb0
0x00000000
0x00402e64
0x00402df2
0x00402dfd
0x00402e02
0x00402e04
0x00000000
0x00000000
0x00402e0d
0x00402e10
0x00000000
0x00000000
0x00000000
0x00402ce9
0x00402ce9
0x00402ce9
0x00402cee
0x00402cf2
0x00402cf9
0x00402cfe
0x00402d00
0x00402d02
0x00402d02
0x00402d0a
0x00402d0f
0x00402d11
0x00402e70
0x00402eb2
0x00000000
0x00402eb2
0x00402d17
0x00402d1d
0x00402d9d
0x00402da1
0x00402da4
0x00402da9
0x00000000
0x00402da1
0x00402d2a
0x00402d2f
0x00402d32
0x00402d37
0x00000000
0x00000000
0x00402d39
0x00402d40
0x00000000
0x00000000
0x00402d42
0x00402d49
0x00000000
0x00000000
0x00402d4b
0x00402d52
0x00000000
0x00000000
0x00402d54
0x00402d5b
0x00000000
0x00000000
0x00402d5d
0x00402d63
0x00402d6c
0x00402d72
0x00402d75
0x00402d77
0x00402d7d
0x00000000
0x00000000
0x00402d83
0x00402d87
0x00402d8f
0x00402d8f
0x00402d92
0x00402d95
0x00402d97
0x00402d99
0x00402d99
0x00000000
0x00402d97
0x00402d89
0x00402d8d
0x00000000
0x00000000
0x00000000
0x00402daa
0x00402daa
0x00402db0
0x00402dc0
0x00402dc0
0x00402dc3
0x00402dc9
0x00402dcb
0x00402dcb
0x00000000
0x00402ce9

APIs

GetTickCount.KERNEL32 ref: 00402C6F
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe,00000400), ref: 00402C8B

Part of subcall function 0040571A: GetFileAttributesA.KERNELBASE(00000003,00402C9E,C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe,80000000,00000003), ref: 0040571E
Part of subcall function 0040571A: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405740

GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe,C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe,80000000,00000003), ref: 00402CD4
GlobalAlloc.KERNELBASE(00000040,00409128), ref: 00402E1B

Strings

"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe", xrefs: 00402C68
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C5B, 00402E33
Inst, xrefs: 00402D42
soft, xrefs: 00402D4B
Null, xrefs: 00402D54
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402E64
C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe, xrefs: 00402C75, 00402C84, 00402C98, 00402CB5
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402EB2
Error launching installer, xrefs: 00402CAB
C:\Users\user\Desktop, xrefs: 00402CB6, 00402CBB, 00402CC1

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-1166299161
Opcode ID: 8790b8aae124665c7df97377218882a0297d8b6d52db77be7ffb01220fe77194
Instruction ID: 828b4c4c124608c6ece817eb75cbb5c4208d087c7274c687d5ed474e8a635a34
Opcode Fuzzy Hash: 8790b8aae124665c7df97377218882a0297d8b6d52db77be7ffb01220fe77194
Instruction Fuzzy Hash: 7961E331A40204ABDB21DF64DE89B9A7BB4AF04315F10417BF505B62D1D7BC9E858B9C

Uniqueness

Uniqueness Score: -1.00%

Function 00401734 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00401734(FILETIME* __ebx, void* __eflags) {
				void* _t33;
				void* _t41;
				void* _t43;
				FILETIME* _t49;
				FILETIME* _t62;
				void* _t64;
				signed int _t70;
				FILETIME* _t71;
				FILETIME* _t75;
				signed int _t77;
				void* _t80;
				CHAR* _t82;
				CHAR* _t83;
				void* _t85;

				_t75 = __ebx;
				_t82 = E004029E8(0x31);
				 *(_t85 - 8) = _t82;
				 *(_t85 + 8) =  *(_t85 - 0x24) & 0x00000007;
				_t33 = E004055A3(_t82);
				_push(_t82);
				_t83 = "C:\\Users\\jones\\AppData\\Local\\Temp\\ModSource UI Addon Pack\\ModSource UI Addon Pack.exe";
				if(_t33 == 0) {
					lstrcatA(E00405536(E00405A43(_t83, 0x429800)), ??);
				} else {
					E00405A43();
				}
				E00405CA1(_t83);
				while(1) {
					__eflags =  *(_t85 + 8) - 3;
					if( *(_t85 + 8) >= 3) {
						_t64 = E00405D3A(_t83);
						_t77 = 0;
						__eflags = _t64 - _t75;
						if(_t64 != _t75) {
							_t71 = _t64 + 0x14;
							__eflags = _t71;
							_t77 = CompareFileTime(_t71, _t85 - 0x18);
						}
						asm("sbb eax, eax");
						_t70 =  ~(( *(_t85 + 8) + 0xfffffffd | 0x80000000) & _t77) + 1;
						__eflags = _t70;
						 *(_t85 + 8) = _t70;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) == _t75) {
						E004056FB(_t83);
					}
					__eflags =  *(_t85 + 8) - 1;
					_t41 = E0040571A(_t83, 0x40000000, (0 |  *(_t85 + 8) != 0x00000001) + 1);
					__eflags = _t41 - 0xffffffff;
					 *(_t85 - 0x34) = _t41;
					if(_t41 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) != _t75) {
						E00404DE1(0xffffffe2,  *(_t85 - 8));
						__eflags =  *(_t85 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t85 - 4)) = 1;
						}
						L31:
						 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t85 - 4));
						__eflags =  *0x423f28;
						goto L32;
					} else {
						E00405A43(0x409ba0, "616");
						E00405A43("616", _t83);
						E00405A65(_t75, 0x409ba0, _t83, "C:\Users\jones\AppData\Local\Temp\nsb13F9.tmp\ZipDLL.dll",  *((intOrPtr*)(_t85 - 0x10)));
						E00405A43("616", 0x409ba0);
						_t62 = E00405304("C:\Users\jones\AppData\Local\Temp\nsb13F9.tmp\ZipDLL.dll",  *(_t85 - 0x24) >> 3) - 4;
						__eflags = _t62;
						if(_t62 == 0) {
							continue;
						} else {
							__eflags = _t62 == 1;
							if(_t62 == 1) {
								 *0x423f28 =  &( *0x423f28->dwLowDateTime);
								L32:
								_t49 = 0;
								__eflags = 0;
							} else {
								_push(_t83);
								_push(0xfffffffa);
								E00404DE1();
								L29:
								_t49 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t49;
				}
				E00404DE1(0xffffffea,  *(_t85 - 8));
				 *0x423f54 =  *0x423f54 + 1;
				_t43 = E00402F01(_t77,  *((intOrPtr*)(_t85 - 0x1c)),  *(_t85 - 0x34), _t75, _t75); // executed
				 *0x423f54 =  *0x423f54 - 1;
				__eflags =  *(_t85 - 0x18) - 0xffffffff;
				_t80 = _t43;
				if( *(_t85 - 0x18) != 0xffffffff) {
					L22:
					SetFileTime( *(_t85 - 0x34), _t85 - 0x18, _t75, _t85 - 0x18);
				} else {
					__eflags =  *((intOrPtr*)(_t85 - 0x14)) - 0xffffffff;
					if( *((intOrPtr*)(_t85 - 0x14)) != 0xffffffff) {
						goto L22;
					}
				}
				FindCloseChangeNotification( *(_t85 - 0x34)); // executed
				__eflags = _t80 - _t75;
				if(_t80 >= _t75) {
					goto L31;
				} else {
					__eflags = _t80 - 0xfffffffe;
					if(_t80 != 0xfffffffe) {
						E00405A65(_t75, _t80, _t83, _t83, 0xffffffee);
					} else {
						E00405A65(_t75, _t80, _t83, _t83, 0xffffffe9);
						lstrcatA(_t83,  *(_t85 - 8));
					}
					_push(0x200010);
					_push(_t83);
					E00405304();
					goto L29;
				}
				goto L33;
			}

0x00401734
0x0040173b
0x00401744
0x00401747
0x0040174a
0x0040174f
0x00401750
0x00401757
0x00401773
0x00401759
0x0040175a
0x0040175a
0x00401779
0x00401783
0x00401783
0x00401787
0x0040178a
0x0040178f
0x00401791
0x00401793
0x00401798
0x00401798
0x004017a3
0x004017a3
0x004017b4
0x004017b6
0x004017b6
0x004017b7
0x004017b7
0x004017ba
0x004017bd
0x004017c0
0x004017c0
0x004017c7
0x004017d6
0x004017db
0x004017de
0x004017e1
0x00000000
0x00000000
0x004017e3
0x004017e6
0x00401840
0x00401845
0x004015a8
0x0040264e
0x0040264e
0x0040287d
0x00402880
0x00402880
0x00000000
0x004017e8
0x004017ee
0x004017f9
0x00401806
0x00401811
0x00401827
0x00401827
0x0040182a
0x00000000
0x00401830
0x00401830
0x00401831
0x0040184e
0x00402886
0x00402886
0x00402886
0x00401833
0x00401833
0x00401834
0x00401492
0x00402200
0x00402200
0x00402200
0x00401831
0x0040182a
0x00402888
0x0040288c
0x0040288c
0x0040185e
0x00401863
0x00401871
0x00401876
0x0040187c
0x00401880
0x00401882
0x0040188a
0x00401896
0x00401884
0x00401884
0x00401888
0x00000000
0x00000000
0x00401888
0x0040189f
0x004018a5
0x004018a7
0x00000000
0x004018ad
0x004018ad
0x004018b0
0x004018c8
0x004018b2
0x004018b5
0x004018be
0x004018be
0x004018cd
0x004018d2
0x004021fb
0x00000000
0x004021fb
0x00000000

APIs

lstrcatA.KERNEL32(00000000,00000000,C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe,00429800,00000000,00000000,00000031), ref: 00401773
CompareFileTime.KERNEL32(-00000014,?,C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe,C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe,00000000,00000000,C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe,00429800,00000000,00000000,00000031), ref: 0040179D

Part of subcall function 00405A43: lstrcpynA.KERNEL32(?,?,00000400,00403293,ModSource UI Addon Pack Setup,NSIS Error), ref: 00405A50

Part of subcall function 00404DE1: lstrlenA.KERNEL32(0041FC70,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E1A
Part of subcall function 00404DE1: lstrlenA.KERNEL32(00402C3C,0041FC70,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E2A
Part of subcall function 00404DE1: lstrcatA.KERNEL32(0041FC70,00402C3C,00402C3C,0041FC70,00000000,00000000,00000000), ref: 00404E3D
Part of subcall function 00404DE1: SetWindowTextA.USER32(0041FC70,0041FC70), ref: 00404E4F
Part of subcall function 00404DE1: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E75
Part of subcall function 00404DE1: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E8F
Part of subcall function 00404DE1: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E9D

Strings

616, xrefs: 004017E8, 004017F4, 0040180C
C:\Users\user\AppData\Local\Temp\nsb13F9.tmp\ZipDLL.dll, xrefs: 00401801, 0040181D
C:\Users\user\AppData\Local\Temp\nsb13F9.tmp, xrefs: 0040177E, 004017ED, 0040180B
C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe, xrefs: 00401750, 00401759, 00401766, 00401778, 00401789, 004017BF, 004017D5, 004017F3, 00401833, 004018B4, 004018BD, 004018C7, 004018D2

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: 616$C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe$C:\Users\user\AppData\Local\Temp\nsb13F9.tmp$C:\Users\user\AppData\Local\Temp\nsb13F9.tmp\ZipDLL.dll
API String ID: 1941528284-931260396
Opcode ID: 224d90be2eca02a5716eafeb341a463fed3a3e12b57624656fd1b0101a174965
Instruction ID: 2b12cca6981bf47a5925f40f6a2934e76afa92bf474aa0434c862d9453808f70
Opcode Fuzzy Hash: 224d90be2eca02a5716eafeb341a463fed3a3e12b57624656fd1b0101a174965
Instruction Fuzzy Hash: 2A41C031A00514BACF10BBB5DD86DAF3A69EF45368B60433BF511B21E1D67C8B418E6D

Uniqueness

Uniqueness Score: -1.00%

Function 00402F01 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 109
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00402F01(void* __ecx, void _a4, void* _a8, void* _a12, long _a16) {
				long _v8;
				intOrPtr _v12;
				void _t31;
				intOrPtr _t32;
				int _t35;
				long _t36;
				int _t37;
				long _t38;
				int _t40;
				int _t42;
				long _t43;
				long _t44;
				intOrPtr _t51;
				long _t55;
				long _t57;

				_t31 = _a4;
				if(_t31 >= 0) {
					_t51 =  *0x423ef8; // 0x1c21
					_t44 = _t31 + _t51;
					 *0x41703c = _t44;
					SetFilePointer( *0x409014, _t44, 0, 0); // executed
				}
				_t57 = 4;
				_t32 = E0040302C(_t57);
				if(_t32 >= 0) {
					_t35 = ReadFile( *0x409014,  &_a4, _t57,  &_v8, 0); // executed
					if(_t35 == 0 || _v8 != _t57) {
						L23:
						_push(0xfffffffd);
						goto L24;
					} else {
						 *0x41703c =  *0x41703c + _t57;
						_t32 = E0040302C(_a4);
						_v12 = _t32;
						if(_t32 >= 0) {
							if(_a12 != 0) {
								_t36 = _a4;
								if(_t36 >= _a16) {
									_t36 = _a16;
								}
								_t37 = ReadFile( *0x409014, _a12, _t36,  &_v8, 0); // executed
								if(_t37 == 0) {
									goto L23;
								} else {
									_t38 = _v8;
									 *0x41703c =  *0x41703c + _t38;
									_v12 = _t38;
									goto L22;
								}
							} else {
								if(_a4 <= 0) {
									L22:
									_t32 = _v12;
								} else {
									while(1) {
										_t55 = 0x4000;
										if(_a4 < 0x4000) {
											_t55 = _a4;
										}
										_t40 = ReadFile( *0x409014, 0x413038, _t55,  &_v8, 0); // executed
										if(_t40 == 0 || _t55 != _v8) {
											goto L23;
										}
										_t42 = WriteFile(_a8, 0x413038, _v8,  &_a16, 0); // executed
										if(_t42 == 0 || _a16 != _t55) {
											_push(0xfffffffe);
											L24:
											_pop(_t32);
										} else {
											_t43 = _v8;
											_v12 = _v12 + _t43;
											_a4 = _a4 - _t43;
											 *0x41703c =  *0x41703c + _t43;
											if(_a4 > 0) {
												continue;
											} else {
												goto L22;
											}
										}
										goto L25;
									}
									goto L23;
								}
							}
						}
					}
				}
				L25:
				return _t32;
			}

0x00402f06
0x00402f10
0x00402f12
0x00402f19
0x00402f1d
0x00402f28
0x00402f28
0x00402f30
0x00402f32
0x00402f39
0x00402f55
0x00402f59
0x00403022
0x00403022
0x00000000
0x00402f68
0x00402f6b
0x00402f71
0x00402f78
0x00402f7b
0x00402f84
0x00402ff1
0x00402ff7
0x00402ff9
0x00402ff9
0x0040300b
0x0040300f
0x00000000
0x00403011
0x00403011
0x00403014
0x0040301a
0x00000000
0x0040301a
0x00402f86
0x00402f89
0x0040301d
0x0040301d
0x00402f8f
0x00402f94
0x00402f94
0x00402f9c
0x00402f9e
0x00402f9e
0x00402faf
0x00402fb3
0x00000000
0x00000000
0x00402fc7
0x00402fcf
0x00402fed
0x00403024
0x00403024
0x00402fd6
0x00402fd6
0x00402fd9
0x00402fdc
0x00402fdf
0x00402fe9
0x00000000
0x00402feb
0x00000000
0x00402feb
0x00402fe9
0x00000000
0x00402fcf
0x00000000
0x00402f94
0x00402f89
0x00402f84
0x00402f7b
0x00402f59
0x00403025
0x00403029

APIs

SetFilePointer.KERNELBASE(00409128,00000000,00000000,00000000,00000000,00000000,?,?,?,00402EAD,000000FF,00000000,00000000,00409128,00007DE4), ref: 00402F28
ReadFile.KERNELBASE(00409128,00000004,00007DE4,00000000,00000004,00000000,00000000,00000000,?,?,?,00402EAD,000000FF,00000000,00000000,00409128), ref: 00402F55
ReadFile.KERNELBASE(00413038,00004000,00007DE4,00000000,00409128,?,00402EAD,000000FF,00000000,00000000,00409128,00007DE4), ref: 00402FAF
WriteFile.KERNELBASE(00000000,00413038,00007DE4,000000FF,00000000,?,00402EAD,000000FF,00000000,00000000,00409128,00007DE4), ref: 00402FC7

Strings

80A, xrefs: 00402F8F

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: File$Read$PointerWrite
String ID: 80A
API String ID: 2113905535-195308239
Opcode ID: 1d0c5bb9ecfe910818843e6bf7809c02e5eaef0b1ff428f1de7b4674f3045140
Instruction ID: 41b23491bffeaa1753be022b97a7ffae9df7beca0cc47644b0b6bde15745b2e9
Opcode Fuzzy Hash: 1d0c5bb9ecfe910818843e6bf7809c02e5eaef0b1ff428f1de7b4674f3045140
Instruction Fuzzy Hash: 91310B31901209EFDF21CF55DE84DAE7BB8EB453A5F20403AF504E61E0D2749E41EB69

Uniqueness

Uniqueness Score: -1.00%

Function 00401F51 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 57%

			E00401F51(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t18;
				struct HINSTANCE__* _t25;
				void* _t26;
				struct HINSTANCE__* _t29;
				CHAR* _t31;
				intOrPtr* _t32;
				void* _t33;

				_t26 = __ebx;
				asm("sbb eax, 0x423f58");
				 *(_t33 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L14:
					E00401423();
					L15:
					 *0x423f28 =  *0x423f28 +  *(_t33 - 4);
					return 0;
				}
				_t31 = E004029E8(0xfffffff0);
				 *(_t33 + 8) = E004029E8(1);
				if( *((intOrPtr*)(_t33 - 0x14)) == __ebx) {
					L3:
					_t18 = LoadLibraryExA(_t31, _t26, 8); // executed
					_t29 = _t18;
					if(_t29 == _t26) {
						_push(0xfffffff6);
						goto L14;
					}
					L4:
					_t32 = GetProcAddress(_t29,  *(_t33 + 8));
					if(_t32 == _t26) {
						E00404DE1(0xfffffff7,  *(_t33 + 8));
					} else {
						 *(_t33 - 4) = _t26;
						if( *((intOrPtr*)(_t33 - 0x1c)) == _t26) {
							 *_t32( *((intOrPtr*)(_t33 - 0x34)), 0x400, "616", 0x40afa0, " ?B"); // executed
						} else {
							E00401423( *((intOrPtr*)(_t33 - 0x1c)));
							if( *_t32() != 0) {
								 *(_t33 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t33 - 0x18)) == _t26) {
						FreeLibrary(_t29); // executed
					}
					goto L15;
				}
				_t25 = GetModuleHandleA(_t31); // executed
				_t29 = _t25;
				if(_t29 != __ebx) {
					goto L4;
				}
				goto L3;
			}

0x00401f51
0x00401f51
0x00401f56
0x00401f5d
0x0040200b
0x00402156
0x00402156
0x0040287d
0x00402880
0x0040288c
0x0040288c
0x00401f6c
0x00401f76
0x00401f79
0x00401f88
0x00401f8c
0x00401f92
0x00401f96
0x00402004
0x00000000
0x00402004
0x00401f98
0x00401fa2
0x00401fa6
0x00401fea
0x00401fa8
0x00401fab
0x00401fae
0x00401fde
0x00401fb0
0x00401fb3
0x00401fbc
0x00401fbe
0x00401fbe
0x00401fbc
0x00401fae
0x00401ff2
0x00401ff9
0x00401ff9
0x00000000
0x00401ff2
0x00401f7c
0x00401f82
0x00401f86
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 00401F7C

Part of subcall function 00404DE1: lstrlenA.KERNEL32(0041FC70,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E1A
Part of subcall function 00404DE1: lstrlenA.KERNEL32(00402C3C,0041FC70,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E2A
Part of subcall function 00404DE1: lstrcatA.KERNEL32(0041FC70,00402C3C,00402C3C,0041FC70,00000000,00000000,00000000), ref: 00404E3D
Part of subcall function 00404DE1: SetWindowTextA.USER32(0041FC70,0041FC70), ref: 00404E4F
Part of subcall function 00404DE1: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E75
Part of subcall function 00404DE1: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E8F
Part of subcall function 00404DE1: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E9D

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00401F8C
GetProcAddress.KERNEL32(00000000,?), ref: 00401F9C
FreeLibrary.KERNELBASE(00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00401FF9

Strings

616, xrefs: 00401FD1
?B, xrefs: 00401FC7

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID: ?B$616
API String ID: 2987980305-2208263123
Opcode ID: d3d10e17a51d79236a6c2abccc8dad1941955a65f3bb676badb279eedb99240f
Instruction ID: be6dc4b3cdaf7f9b98e7fdb42c2a9d2cba13b94bfdb64dea6ad1c22ab91f0007
Opcode Fuzzy Hash: d3d10e17a51d79236a6c2abccc8dad1941955a65f3bb676badb279eedb99240f
Instruction Fuzzy Hash: BA11D572D04216EBCF107FA4DE89EAE76B0AB44359F204237F611B62E0C77C89419A5E

Uniqueness

Uniqueness Score: -1.00%

Function 0040302C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E0040302C(intOrPtr _a4) {
				long _v4;
				void* __ecx;
				intOrPtr _t12;
				intOrPtr _t13;
				signed int _t14;
				void* _t16;
				void* _t17;
				long _t18;
				int _t21;
				intOrPtr _t22;
				intOrPtr _t34;
				long _t35;
				intOrPtr _t37;
				void* _t39;
				long _t40;
				intOrPtr _t46;
				intOrPtr _t47;
				intOrPtr _t53;

				_t35 =  *0x41703c; // 0x2e429
				_t37 = _t35 -  *0x40afa8 + _a4;
				 *0x423eac = GetTickCount() + 0x1f4;
				if(_t37 <= 0) {
					L23:
					E00402BC5(1);
					return 0;
				}
				E004031DA( *0x41f04c);
				SetFilePointer( *0x409014,  *0x40afa8, 0, 0); // executed
				 *0x41f048 = _t37;
				 *0x417038 = 0;
				while(1) {
					L2:
					_t12 =  *0x417040; // 0x1c5d4
					_t34 = 0x4000;
					_t13 = _t12 -  *0x41f04c;
					if(_t13 <= 0x4000) {
						_t34 = _t13;
					}
					_t14 = E004031A8(0x413038, _t34); // executed
					if(_t14 == 0) {
						break;
					}
					 *0x41f04c =  *0x41f04c + _t34;
					 *0x40afc8 = 0x413038;
					 *0x40afcc = _t34;
					while(1) {
						_t46 =  *0x423eb0; // 0x6acdd0
						if(_t46 != 0) {
							_t47 =  *0x423f40; // 0x0
							if(_t47 == 0) {
								_t22 =  *0x41f048; // 0x255d0
								 *0x417038 = _t22 -  *0x41703c - _a4 +  *0x40afa8;
								E00402BC5(0);
							}
						}
						 *0x40afd0 = 0x40b038;
						 *0x40afd4 = 0x8000; // executed
						_t16 = E00405E5B(0x40afb0); // executed
						if(_t16 < 0) {
							break;
						}
						_t39 =  *0x40afd0; // 0x40d406
						_t40 = _t39 - 0x40b038;
						if(_t40 == 0) {
							__eflags =  *0x40afcc; // 0x0
							if(__eflags != 0) {
								break;
							}
							__eflags = _t34;
							if(_t34 == 0) {
								break;
							}
							L17:
							_t18 =  *0x41703c; // 0x2e429
							if(_t18 -  *0x40afa8 + _a4 > 0) {
								goto L2;
							}
							SetFilePointer( *0x409014, _t18, 0, 0); // executed
							goto L23;
						}
						_t21 = WriteFile( *0x409014, 0x40b038, _t40,  &_v4, 0); // executed
						if(_t21 == 0 || _t40 != _v4) {
							_push(0xfffffffe);
							L22:
							_pop(_t17);
							return _t17;
						} else {
							 *0x40afa8 =  *0x40afa8 + _t40;
							_t53 =  *0x40afcc; // 0x0
							if(_t53 != 0) {
								continue;
							}
							goto L17;
						}
					}
					_push(0xfffffffd);
					goto L22;
				}
				return _t14 | 0xffffffff;
			}

0x00403030
0x0040303d
0x00403050
0x00403055
0x00403196
0x00403198
0x00000000
0x0040319e
0x00403061
0x00403074
0x0040307a
0x00403080
0x0040308b
0x0040308b
0x0040308b
0x00403090
0x00403095
0x0040309d
0x0040309f
0x0040309f
0x004030a8
0x004030af
0x00000000
0x00000000
0x004030b5
0x004030bb
0x004030c1
0x004030c7
0x004030c7
0x004030cd
0x004030cf
0x004030d5
0x004030d7
0x004030ed
0x004030f2
0x004030f7
0x004030d5
0x004030fd
0x00403103
0x0040310d
0x00403114
0x00000000
0x00000000
0x00403116
0x0040311c
0x0040311e
0x00403152
0x00403158
0x00000000
0x00000000
0x0040315a
0x0040315c
0x00000000
0x00000000
0x0040315e
0x0040315e
0x00403171
0x00000000
0x00000000
0x00403180
0x00000000
0x00403180
0x0040312e
0x00403136
0x0040318d
0x00403193
0x00403193
0x00000000
0x0040313e
0x0040313e
0x00403144
0x0040314a
0x00000000
0x00000000
0x00000000
0x00403150
0x00403136
0x00403191
0x00000000
0x00403191
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00403041

Part of subcall function 004031DA: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402E86,00007DE4), ref: 004031E8

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,?,00402F37,00000004,00000000,00000000,00000000,?,?,?,00402EAD,000000FF,00000000), ref: 00403074
WriteFile.KERNELBASE(0040B038,0040D406,00000000,00000000,00413038,00004000,?,00000000,?,00402F37,00000004,00000000,00000000,00000000,?,?), ref: 0040312E
SetFilePointer.KERNELBASE(0002E429,00000000,00000000,00413038,00004000,?,00000000,?,00402F37,00000004,00000000,00000000,00000000,?,?), ref: 00403180

Strings

80A, xrefs: 004030A1

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: File$Pointer$CountTickWrite
String ID: 80A
API String ID: 2146148272-195308239
Opcode ID: 7b5ba65b503cf5e284d2aab76f8910b62b5a6b48927bceecad8eef0c57fd47cd
Instruction ID: 72ef22bd29afdbd351de75f464c4cdd90f0b93df6537b0aaac70e9b4709237b8
Opcode Fuzzy Hash: 7b5ba65b503cf5e284d2aab76f8910b62b5a6b48927bceecad8eef0c57fd47cd
Instruction Fuzzy Hash: 81417FB2504302AFD7109F19EE8496A3FBCF748396710813BE501B72F1C7386A559BAE

Uniqueness

Uniqueness Score: -1.00%

Function 00405749 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405749(char _a4, intOrPtr _a6, CHAR* _a8) {
				signed int _t11;
				int _t14;
				signed int _t16;
				void* _t19;
				CHAR* _t20;

				_t20 = _a4;
				_t19 = 0x64;
				while(1) {
					_t19 = _t19 - 1;
					_a4 = 0x61736e;
					_t11 = GetTickCount();
					_t16 = 0x1a;
					_a6 = _a6 + _t11 % _t16;
					_t14 = GetTempFileNameA(_a8,  &_a4, 0, _t20); // executed
					if(_t14 != 0) {
						break;
					}
					if(_t19 != 0) {
						continue;
					}
					 *_t20 =  *_t20 & 0x00000000;
					return _t14;
				}
				return _t20;
			}

0x0040574d
0x00405753
0x00405754
0x00405754
0x00405755
0x0040575c
0x00405766
0x00405773
0x00405776
0x0040577e
0x00000000
0x00000000
0x00405782
0x00000000
0x00000000
0x00405784
0x00000000
0x00405784
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0040575C
GetTempFileNameA.KERNELBASE(?,0061736E,00000000,?), ref: 00405776

Strings

"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe", xrefs: 00405750
C:\Users\user\AppData\Local\Temp\, xrefs: 00405749, 0040574C
nsa, xrefs: 00405755

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-3974337669
Opcode ID: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction ID: 034d2fd5f9dd90bdc64dfe9fa05123f4a2a2f766a0f29b75e345e617da869bcc
Opcode Fuzzy Hash: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction Fuzzy Hash: 9CF0A736348204BADB104F55DC04B9B7F59DF91750F14C027FE449B1C0D6B1995897A5

Uniqueness

Uniqueness Score: -1.00%

Function 004052A3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004052A3(CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x4224a0->cb = 0x44;
				_t7 = CreateProcessA(0, _a4, 0, 0, 0, 0, 0, 0, 0x4224a0,  &_v20); // executed
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x004052ac
0x004052c8
0x004052d0
0x004052d5
0x00000000
0x004052db
0x004052df

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004224A0,Error launching installer), ref: 004052C8
CloseHandle.KERNEL32(?), ref: 004052D5

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004052A3
Error launching installer, xrefs: 004052B6

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: C:\Users\user\AppData\Local\Temp\$Error launching installer
API String ID: 3712363035-1785902839
Opcode ID: 6b6a0bc2a3a2861d1b4fb8cb28cdb7ee12dd8b27d4ddea3b465ed8bf02dd5c13
Instruction ID: a902a948de4d47caae69ccc844ec3c4844eb40df907f1985e70e83d94773ad0e
Opcode Fuzzy Hash: 6b6a0bc2a3a2861d1b4fb8cb28cdb7ee12dd8b27d4ddea3b465ed8bf02dd5c13
Instruction Fuzzy Hash: 9CE0ECB4A00209BFDB00AF64ED09A6B7BBDFB04308F808522A911E2190D774E8108A79

Uniqueness

Uniqueness Score: -1.00%

Function 004015B3 Relevance: 6.1, APIs: 4, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E004015B3(struct _SECURITY_ATTRIBUTES* __ebx) {
				struct _SECURITY_ATTRIBUTES** _t10;
				int _t19;
				struct _SECURITY_ATTRIBUTES* _t20;
				signed char _t22;
				struct _SECURITY_ATTRIBUTES* _t23;
				CHAR* _t25;
				struct _SECURITY_ATTRIBUTES** _t29;
				void* _t30;

				_t23 = __ebx;
				_t25 = E004029E8(0xfffffff0);
				_t10 = E004055CA(_t25);
				_t27 = _t10;
				if(_t10 != __ebx) {
					do {
						_t29 = E00405561(_t27, 0x5c);
						 *_t29 = _t23;
						 *((char*)(_t30 + 0xb)) =  *_t29;
						_t19 = CreateDirectoryA(_t25, _t23); // executed
						if(_t19 == 0) {
							if(GetLastError() != 0xb7) {
								L4:
								 *((intOrPtr*)(_t30 - 4)) =  *((intOrPtr*)(_t30 - 4)) + 1;
							} else {
								_t22 = GetFileAttributesA(_t25); // executed
								if((_t22 & 0x00000010) == 0) {
									goto L4;
								}
							}
						}
						_t20 =  *((intOrPtr*)(_t30 + 0xb));
						 *_t29 = _t20;
						_t27 =  &(_t29[0]);
					} while (_t20 != _t23);
				}
				if( *((intOrPtr*)(_t30 - 0x20)) == _t23) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E00405A43(0x429800, _t25);
					SetCurrentDirectoryA(_t25);
				}
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t30 - 4));
				return 0;
			}

0x004015b3
0x004015ba
0x004015bd
0x004015c2
0x004015c6
0x004015c8
0x004015d0
0x004015d6
0x004015d8
0x004015db
0x004015e3
0x004015f0
0x004015fd
0x004015fd
0x004015f2
0x004015f3
0x004015fb
0x00000000
0x00000000
0x004015fb
0x004015f0
0x00401600
0x00401603
0x00401605
0x00401606
0x004015c8
0x0040160d
0x0040162d
0x00402156
0x0040160f
0x00401611
0x0040161c
0x00401622
0x00401622
0x00402880
0x0040288c

APIs

Part of subcall function 004055CA: CharNextA.USER32(|S@,?,C:\,00000000,0040562E,C:\,C:\,?,?,7476F560,0040537C,?,"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe",7476F560), ref: 004055D8
Part of subcall function 004055CA: CharNextA.USER32(00000000), ref: 004055DD
Part of subcall function 004055CA: CharNextA.USER32(00000000), ref: 004055EC

CreateDirectoryA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015DB
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015E5
GetFileAttributesA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015F3
SetCurrentDirectoryA.KERNEL32(00000000,00429800,00000000,00000000,000000F0), ref: 00401622

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID:
API String ID: 3751793516-0
Opcode ID: 482e05731911e48d3dd6ab2aa510f5c91f5b0d585e162992215dcdbeb4e09994
Instruction ID: 500e971df782f7e0228770013ad7a8f0c6fc77df75080e4b1de2a425256b3434
Opcode Fuzzy Hash: 482e05731911e48d3dd6ab2aa510f5c91f5b0d585e162992215dcdbeb4e09994
Instruction Fuzzy Hash: 81010431908150ABDB116FB55D44D7F6BB0EA56365728063BF491B22E2C63C8942D62E

Uniqueness

Uniqueness Score: -1.00%

Function 00405617 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 53%

			E00405617(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				long _t16;
				intOrPtr _t18;
				intOrPtr* _t21;
				void* _t22;

				E00405A43(0x4218a0, _a4);
				_t21 = E004055CA(0x4218a0);
				if(_t21 != 0) {
					E00405CA1(_t21);
					if(( *0x423eb8 & 0x00000080) == 0) {
						L5:
						_t22 = _t21 - 0x4218a0;
						while(1) {
							_t11 = lstrlenA(0x4218a0);
							_push(0x4218a0);
							if(_t11 <= _t22) {
								break;
							}
							_t12 = E00405D3A();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E0040557D(0x4218a0);
								continue;
							} else {
								goto L1;
							}
						}
						E00405536();
						_t16 = GetFileAttributesA(??); // executed
						return 0 | _t16 != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}

0x00405623
0x0040562e
0x00405632
0x00405639
0x00405645
0x00405651
0x00405651
0x00405669
0x0040566a
0x00405671
0x00405672
0x00000000
0x00000000
0x00405655
0x0040565c
0x00405664
0x00000000
0x00000000
0x00000000
0x00000000
0x0040565c
0x00405674
0x0040567a
0x00000000
0x00405688
0x00405647
0x0040564b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040564b
0x00405634
0x00000000

APIs

Part of subcall function 00405A43: lstrcpynA.KERNEL32(?,?,00000400,00403293,ModSource UI Addon Pack Setup,NSIS Error), ref: 00405A50

Part of subcall function 004055CA: CharNextA.USER32(|S@,?,C:\,00000000,0040562E,C:\,C:\,?,?,7476F560,0040537C,?,"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe",7476F560), ref: 004055D8
Part of subcall function 004055CA: CharNextA.USER32(00000000), ref: 004055DD
Part of subcall function 004055CA: CharNextA.USER32(00000000), ref: 004055EC

lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,?,?,7476F560,0040537C,?,"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe",7476F560), ref: 0040566A
GetFileAttributesA.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,?,?,7476F560,0040537C,?,"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe",7476F560), ref: 0040567A

Strings

C:\, xrefs: 0040561D, 00405622, 00405628, 00405663, 00405669, 00405671, 00405679

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\
API String ID: 3248276644-3404278061
Opcode ID: 092cd18329d5dfc6f9a71267f0953547a198154f688d0c3f002119218c3bba5f
Instruction ID: 88644df969cb8f40c77f35f2ca7db10f6ec49a52a40565d12c5c53c9f11e70c6
Opcode Fuzzy Hash: 092cd18329d5dfc6f9a71267f0953547a198154f688d0c3f002119218c3bba5f
Instruction Fuzzy Hash: 64F0F921205D5026C72232351C49AAF0A55CE6232879D0E3FF858B12D1CA3D8943DC6D

Uniqueness

Uniqueness Score: -1.00%

Function 004031F1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E004031F1(void* __eflags) {
				void* _t2;
				void* _t5;
				CHAR* _t6;

				_t6 = "C:\\Users\\jones\\AppData\\Local\\Temp\\";
				E00405CA1(_t6);
				_t2 = E004055A3(_t6);
				if(_t2 != 0) {
					E00405536(_t6);
					CreateDirectoryA(_t6, 0); // executed
					_t5 = E00405749("1033", _t6); // executed
					return _t5;
				} else {
					return _t2;
				}
			}

0x004031f2
0x004031f8
0x004031fe
0x00403205
0x0040320a
0x00403212
0x0040321e
0x00403224
0x00403208
0x00403208
0x00403208

APIs

Part of subcall function 00405CA1: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe",C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405CF9
Part of subcall function 00405CA1: CharNextA.USER32(?,?,?,00000000), ref: 00405D06
Part of subcall function 00405CA1: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe",C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D0B
Part of subcall function 00405CA1: CharPrevA.USER32(?,?,"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe",C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D1B

CreateDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00403212

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004031F2, 004031F7, 004031FD, 00403209, 00403211, 00403218
1033, xrefs: 00403219

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-517883005
Opcode ID: 6d9c69d8dece2bddb05ca95613e1d6fe124b38e8b49121791a09e34daebbdd31
Instruction ID: 8509fc719cfacdd3e0f19311c8db3474c91ee7b64774067ccbe91e129429c82f
Opcode Fuzzy Hash: 6d9c69d8dece2bddb05ca95613e1d6fe124b38e8b49121791a09e34daebbdd31
Instruction Fuzzy Hash: 75D0A92160AD3036CA613B273C0AFCF090C8F0232DF2500BBF804B00C68B6C5A8218EF

Uniqueness

Uniqueness Score: -1.00%

Function 0040643F Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E0040643F() {
				signed int _t530;
				void _t537;
				signed int _t538;
				signed int _t539;
				unsigned short _t569;
				signed int _t579;
				signed int _t607;
				void* _t627;
				signed int _t628;
				signed int _t635;
				signed int* _t643;
				void* _t644;

				L0:
				while(1) {
					L0:
					_t530 =  *(_t644 - 0x30);
					if(_t530 >= 4) {
					}
					 *(_t644 - 0x40) = 6;
					 *(_t644 - 0x7c) = 0x19;
					 *((intOrPtr*)(_t644 - 0x58)) = (_t530 << 7) +  *(_t644 - 4) + 0x360;
					while(1) {
						L145:
						 *(_t644 - 0x50) = 1;
						 *(_t644 - 0x48) =  *(_t644 - 0x40);
						while(1) {
							L149:
							if( *(_t644 - 0x48) <= 0) {
								goto L155;
							}
							L150:
							_t627 =  *(_t644 - 0x50) +  *(_t644 - 0x50);
							_t643 = _t627 +  *((intOrPtr*)(_t644 - 0x58));
							 *(_t644 - 0x54) = _t643;
							_t569 =  *_t643;
							_t635 = _t569 & 0x0000ffff;
							_t607 = ( *(_t644 - 0x10) >> 0xb) * _t635;
							if( *(_t644 - 0xc) >= _t607) {
								 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t607;
								 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t607;
								_t628 = _t627 + 1;
								 *_t643 = _t569 - (_t569 >> 5);
								 *(_t644 - 0x50) = _t628;
							} else {
								 *(_t644 - 0x10) = _t607;
								 *(_t644 - 0x50) =  *(_t644 - 0x50) << 1;
								 *_t643 = (0x800 - _t635 >> 5) + _t569;
							}
							if( *(_t644 - 0x10) >= 0x1000000) {
								L148:
								_t487 = _t644 - 0x48;
								 *_t487 =  *(_t644 - 0x48) - 1;
								L149:
								if( *(_t644 - 0x48) <= 0) {
									goto L155;
								}
								goto L150;
							} else {
								L154:
								L146:
								if( *(_t644 - 0x6c) == 0) {
									L169:
									 *(_t644 - 0x88) = 0x18;
									L170:
									_t579 = 0x22;
									memcpy( *(_t644 - 0x90), _t644 - 0x88, _t579 << 2);
									_t539 = 0;
									L172:
									return _t539;
								}
								L147:
								 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
								 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
								_t484 = _t644 - 0x70;
								 *_t484 =  &(( *(_t644 - 0x70))[1]);
								 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
								goto L148;
							}
							L155:
							_t537 =  *(_t644 - 0x7c);
							 *((intOrPtr*)(_t644 - 0x44)) =  *(_t644 - 0x50) - (1 <<  *(_t644 - 0x40));
							while(1) {
								L140:
								 *(_t644 - 0x88) = _t537;
								while(1) {
									L1:
									_t538 =  *(_t644 - 0x88);
									if(_t538 > 0x1c) {
										break;
									}
									L2:
									switch( *((intOrPtr*)(_t538 * 4 +  &M004068AD))) {
										case 0:
											L3:
											if( *(_t644 - 0x6c) == 0) {
												goto L170;
											}
											L4:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t538 =  *( *(_t644 - 0x70));
											if(_t538 > 0xe1) {
												goto L171;
											}
											L5:
											_t542 = _t538 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t581);
											_push(9);
											_pop(_t582);
											_t638 = _t542 / _t581;
											_t544 = _t542 % _t581 & 0x000000ff;
											asm("cdq");
											_t633 = _t544 % _t582 & 0x000000ff;
											 *(_t644 - 0x3c) = _t633;
											 *(_t644 - 0x1c) = (1 << _t638) - 1;
											 *((intOrPtr*)(_t644 - 0x18)) = (1 << _t544 / _t582) - 1;
											_t641 = (0x300 << _t633 + _t638) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t644 - 0x78))) {
												L10:
												if(_t641 == 0) {
													L12:
													 *(_t644 - 0x48) =  *(_t644 - 0x48) & 0x00000000;
													 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t641 = _t641 - 1;
													 *((short*)( *(_t644 - 4) + _t641 * 2)) = 0x400;
												} while (_t641 != 0);
												goto L12;
											}
											L6:
											if( *(_t644 - 4) != 0) {
												GlobalFree( *(_t644 - 4));
											}
											_t538 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t644 - 4) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t644 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L157:
												 *(_t644 - 0x88) = 1;
												goto L170;
											}
											L14:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x40) =  *(_t644 - 0x40) | ( *( *(_t644 - 0x70)) & 0x000000ff) <<  *(_t644 - 0x48) << 0x00000003;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t45 = _t644 - 0x48;
											 *_t45 =  *(_t644 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t644 - 0x48) < 4) {
												goto L13;
											}
											L16:
											_t550 =  *(_t644 - 0x40);
											if(_t550 ==  *(_t644 - 0x74)) {
												L20:
												 *(_t644 - 0x48) = 5;
												 *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) =  *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											L17:
											 *(_t644 - 0x74) = _t550;
											if( *(_t644 - 8) != 0) {
												GlobalFree( *(_t644 - 8));
											}
											_t538 = GlobalAlloc(0x40,  *(_t644 - 0x40)); // executed
											 *(_t644 - 8) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t557 =  *(_t644 - 0x60) &  *(_t644 - 0x1c);
											 *(_t644 - 0x84) = 6;
											 *(_t644 - 0x4c) = _t557;
											_t642 =  *(_t644 - 4) + (( *(_t644 - 0x38) << 4) + _t557) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L158:
												 *(_t644 - 0x88) = 3;
												goto L170;
											}
											L22:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											_t67 = _t644 - 0x70;
											 *_t67 =  &(( *(_t644 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L23:
											 *(_t644 - 0x48) =  *(_t644 - 0x48) - 1;
											if( *(_t644 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t559 =  *_t642;
											_t626 = _t559 & 0x0000ffff;
											_t596 = ( *(_t644 - 0x10) >> 0xb) * _t626;
											if( *(_t644 - 0xc) >= _t596) {
												 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t596;
												 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t596;
												 *(_t644 - 0x40) = 1;
												_t560 = _t559 - (_t559 >> 5);
												__eflags = _t560;
												 *_t642 = _t560;
											} else {
												 *(_t644 - 0x10) = _t596;
												 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
												 *_t642 = (0x800 - _t626 >> 5) + _t559;
											}
											if( *(_t644 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t644 - 0x6c) == 0) {
												L168:
												 *(_t644 - 0x88) = 5;
												goto L170;
											}
											L138:
											 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L139:
											_t537 =  *(_t644 - 0x84);
											L140:
											 *(_t644 - 0x88) = _t537;
											goto L1;
										case 6:
											L25:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L36:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L26:
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												L35:
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												L32:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											L66:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												L68:
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											L67:
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											L70:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											L73:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											L74:
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											L75:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											L82:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L84:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L83:
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											L85:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L164:
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											L100:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L159:
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											L38:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											L40:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												L45:
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L160:
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											L47:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												L49:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													L53:
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L161:
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											L59:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												L65:
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L165:
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											L110:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											goto L132;
										case 0x12:
											L128:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L131:
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												L132:
												 *(_t644 - 0x54) = _t642;
												goto L133;
											}
											L129:
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											L141:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L143:
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *((intOrPtr*)(__ebp - 0x7c)) = 0x14;
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
											L142:
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											L156:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											while(1) {
												L140:
												 *(_t644 - 0x88) = _t537;
												goto L1;
											}
										case 0x15:
											L91:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											goto L0;
										case 0x17:
											while(1) {
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
										case 0x18:
											goto L146;
										case 0x19:
											L94:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												L98:
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													L166:
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												L121:
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												L122:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											L95:
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												L97:
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													L107:
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														L118:
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													L113:
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														L117:
														goto L109;
													}
												}
												L103:
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													L106:
													goto L99;
												}
											}
											L96:
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L162:
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											L57:
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L163:
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											L77:
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												L124:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L127:
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											L167:
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t539 = _t538 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x0040643f
0x0040643f
0x0040643f
0x0040643f
0x00406445
0x00406449
0x0040644d
0x00406457
0x00406465
0x0040673b
0x0040673b
0x0040673e
0x00406745
0x00406772
0x00406772
0x00406776
0x00000000
0x00000000
0x00406778
0x00406781
0x00406787
0x0040678a
0x0040678d
0x00406790
0x00406793
0x00406799
0x004067b2
0x004067b5
0x004067c1
0x004067c2
0x004067c5
0x0040679b
0x0040679b
0x004067aa
0x004067ad
0x004067ad
0x004067cf
0x0040676f
0x0040676f
0x0040676f
0x00406772
0x00406776
0x00000000
0x00000000
0x00000000
0x004067d1
0x004067d1
0x0040674a
0x0040674e
0x00406886
0x00406886
0x00406890
0x00406898
0x0040689f
0x004068a1
0x004068a8
0x004068ac
0x004068ac
0x00406754
0x0040675a
0x00406761
0x00406769
0x00406769
0x0040676c
0x00000000
0x0040676c
0x004067d6
0x004067e3
0x004067e6
0x004066f2
0x004066f2
0x004066f2
0x00405e8e
0x00405e8e
0x00405e8e
0x00405e97
0x00000000
0x00000000
0x00405e9d
0x00405e9d
0x00000000
0x00405ea4
0x00405ea8
0x00000000
0x00000000
0x00405eae
0x00405eb1
0x00405eb4
0x00405eb7
0x00405ebb
0x00000000
0x00000000
0x00405ec1
0x00405ec1
0x00405ec4
0x00405ec6
0x00405ec7
0x00405eca
0x00405ecc
0x00405ecd
0x00405ecf
0x00405ed2
0x00405ed7
0x00405edc
0x00405ee5
0x00405ef8
0x00405efb
0x00405f07
0x00405f2f
0x00405f31
0x00405f3f
0x00405f3f
0x00405f43
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f33
0x00405f33
0x00405f36
0x00405f37
0x00405f37
0x00000000
0x00405f33
0x00405f09
0x00405f0d
0x00405f12
0x00405f12
0x00405f1b
0x00405f23
0x00405f26
0x00000000
0x00405f2c
0x00405f2c
0x00000000
0x00405f2c
0x00000000
0x00405f49
0x00405f49
0x00405f4d
0x004067f9
0x004067f9
0x00000000
0x004067f9
0x00405f53
0x00405f56
0x00405f66
0x00405f69
0x00405f6c
0x00405f6c
0x00405f6c
0x00405f6f
0x00405f73
0x00000000
0x00000000
0x00405f75
0x00405f75
0x00405f7b
0x00405fa5
0x00405fab
0x00405fb2
0x00000000
0x00405fb2
0x00405f7d
0x00405f81
0x00405f84
0x00405f89
0x00405f89
0x00405f94
0x00405f9c
0x00405f9f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405fe4
0x00405fea
0x00405fed
0x00405ffa
0x00406002
0x00000000
0x00000000
0x00405fb9
0x00405fb9
0x00405fbd
0x00406808
0x00406808
0x00000000
0x00406808
0x00405fc3
0x00405fc9
0x00405fd4
0x00405fd4
0x00405fd4
0x00405fd7
0x00405fda
0x00405fdd
0x00405fe2
0x00000000
0x00000000
0x00000000
0x00000000
0x00406679
0x00406679
0x0040667f
0x00406685
0x0040668b
0x004066a5
0x004066a8
0x004066ae
0x004066b9
0x004066b9
0x004066bb
0x0040668d
0x0040668d
0x0040669c
0x004066a0
0x004066a0
0x004066c5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004066c7
0x004066cb
0x0040687a
0x0040687a
0x00000000
0x0040687a
0x004066d1
0x004066d7
0x004066de
0x004066e6
0x004066e9
0x004066ec
0x004066ec
0x004066f2
0x004066f2
0x00000000
0x00000000
0x0040600a
0x0040600a
0x0040600c
0x0040600f
0x00406080
0x00406080
0x00406083
0x00406086
0x0040608d
0x00406097
0x00000000
0x00406097
0x00406011
0x00406011
0x00406015
0x00406018
0x0040601a
0x0040601d
0x00406020
0x00406022
0x00406025
0x00406027
0x0040602c
0x0040602f
0x00406032
0x00406036
0x0040603d
0x00406040
0x00406047
0x0040604b
0x00406053
0x00406053
0x00406053
0x0040604d
0x0040604d
0x0040604d
0x00406042
0x00406042
0x00406042
0x00406057
0x0040605a
0x00406078
0x00406078
0x0040607a
0x00000000
0x0040605c
0x0040605c
0x0040605c
0x0040605f
0x00406062
0x00406065
0x00406067
0x00406067
0x00406067
0x0040606a
0x0040606d
0x0040606f
0x00406070
0x00406073
0x00000000
0x00406073
0x00000000
0x004062a9
0x004062a9
0x004062ad
0x004062cb
0x004062cb
0x004062ce
0x004062d5
0x004062d8
0x004062db
0x004062de
0x004062e1
0x004062e4
0x004062e6
0x004062ed
0x004062ee
0x004062f0
0x004062f3
0x004062f6
0x004062f9
0x004062f9
0x004062fe
0x00000000
0x004062fe
0x004062af
0x004062af
0x004062b2
0x004062b5
0x004062bf
0x00000000
0x00000000
0x00406313
0x00406313
0x00406317
0x0040633a
0x0040633d
0x00406340
0x0040634a
0x00406319
0x00406319
0x0040631c
0x0040631f
0x00406322
0x0040632f
0x00406332
0x00406332
0x00000000
0x00000000
0x00406356
0x00406356
0x0040635a
0x00000000
0x00000000
0x00406360
0x00406360
0x00406364
0x00000000
0x00000000
0x0040636a
0x0040636a
0x0040636c
0x00406370
0x00406370
0x00406373
0x00406377
0x00000000
0x00000000
0x004063c7
0x004063c7
0x004063cb
0x004063d2
0x004063d2
0x004063d5
0x004063d8
0x004063e2
0x00000000
0x004063e2
0x004063cd
0x004063cd
0x00000000
0x00000000
0x004063ee
0x004063ee
0x004063f2
0x004063f9
0x004063fc
0x004063ff
0x004063f4
0x004063f4
0x004063f4
0x00406402
0x00406405
0x00406408
0x00406408
0x0040640b
0x0040640e
0x00406411
0x00406411
0x00406414
0x0040641b
0x00406420
0x00000000
0x00000000
0x004064ae
0x004064ae
0x004064b2
0x00406850
0x00406850
0x00000000
0x00406850
0x004064b8
0x004064b8
0x004064bb
0x004064be
0x004064c2
0x004064c5
0x004064cb
0x004064cd
0x004064cd
0x004064cd
0x004064d0
0x004064d3
0x00000000
0x00000000
0x004060a3
0x004060a3
0x004060a7
0x00406814
0x00406814
0x00000000
0x00406814
0x004060ad
0x004060ad
0x004060b0
0x004060b3
0x004060b7
0x004060ba
0x004060c0
0x004060c2
0x004060c2
0x004060c2
0x004060c5
0x004060c8
0x004060c8
0x004060cb
0x004060ce
0x00000000
0x00000000
0x004060d4
0x004060d4
0x004060da
0x00000000
0x00000000
0x004060e0
0x004060e0
0x004060e4
0x004060e7
0x004060ea
0x004060ed
0x004060f0
0x004060f1
0x004060f4
0x004060f6
0x004060fc
0x004060ff
0x00406102
0x00406105
0x00406108
0x0040610b
0x0040610e
0x0040612a
0x0040612d
0x00406130
0x00406133
0x0040613a
0x0040613e
0x00406140
0x00406144
0x00406110
0x00406110
0x00406114
0x0040611c
0x00406121
0x00406123
0x00406125
0x00406125
0x00406147
0x0040614e
0x00406151
0x00000000
0x00406157
0x00406157
0x00000000
0x00406157
0x00000000
0x0040615c
0x0040615c
0x00406160
0x00406820
0x00406820
0x00000000
0x00406820
0x00406166
0x00406166
0x00406169
0x0040616c
0x00406170
0x00406173
0x00406179
0x0040617b
0x0040617b
0x0040617b
0x0040617e
0x00406181
0x00406181
0x00406181
0x00406187
0x00000000
0x00000000
0x00406189
0x00406189
0x0040618c
0x0040618f
0x00406192
0x00406195
0x00406198
0x0040619b
0x0040619e
0x004061a1
0x004061a4
0x004061a7
0x004061bf
0x004061c2
0x004061c5
0x004061c8
0x004061c8
0x004061cb
0x004061cf
0x004061d1
0x004061a9
0x004061a9
0x004061b1
0x004061b6
0x004061b8
0x004061ba
0x004061ba
0x004061d4
0x004061db
0x004061de
0x00000000
0x004061e0
0x004061e0
0x00000000
0x004061e0
0x004061de
0x004061e5
0x004061e5
0x004061e5
0x004061e5
0x00000000
0x00000000
0x00406220
0x00406220
0x00406224
0x0040682c
0x0040682c
0x00000000
0x0040682c
0x0040622a
0x0040622a
0x0040622d
0x00406230
0x00406234
0x00406237
0x0040623d
0x0040623f
0x0040623f
0x0040623f
0x00406242
0x00406245
0x00406245
0x0040624b
0x004061e9
0x004061e9
0x004061ec
0x00000000
0x004061ec
0x0040624d
0x0040624d
0x00406250
0x00406253
0x00406256
0x00406259
0x0040625c
0x0040625f
0x00406262
0x00406265
0x00406268
0x0040626b
0x00406283
0x00406286
0x00406289
0x0040628c
0x0040628c
0x0040628f
0x00406293
0x00406295
0x0040626d
0x0040626d
0x00406275
0x0040627a
0x0040627c
0x0040627e
0x0040627e
0x00406298
0x0040629f
0x004062a2
0x00000000
0x004062a4
0x004062a4
0x00000000
0x004062a4
0x00000000
0x00406531
0x00406531
0x00406535
0x0040685c
0x0040685c
0x00000000
0x0040685c
0x0040653b
0x0040653b
0x0040653e
0x00406541
0x00406545
0x00406548
0x0040654e
0x00406550
0x00406550
0x00406550
0x00406553
0x00000000
0x00000000
0x00406301
0x00406301
0x00406304
0x00000000
0x00000000
0x00406640
0x00406640
0x00406644
0x00406666
0x00406666
0x00406669
0x00406673
0x00406676
0x00406676
0x00000000
0x00406676
0x00406646
0x00406646
0x00406649
0x0040664d
0x00406650
0x00406650
0x00406653
0x00000000
0x00000000
0x004066fd
0x004066fd
0x00406701
0x0040671f
0x0040671f
0x0040671f
0x0040671f
0x00406726
0x0040672d
0x00406734
0x00406734
0x0040673b
0x0040673e
0x00406745
0x00000000
0x00406748
0x00406703
0x00406703
0x00406706
0x00406709
0x0040670c
0x00406713
0x00406657
0x00406657
0x0040665a
0x00000000
0x00000000
0x004067ee
0x004067ee
0x004067f1
0x004066f2
0x004066f2
0x004066f2
0x00000000
0x004066f8
0x00000000
0x00406428
0x00406428
0x0040642a
0x00406431
0x00406432
0x00406434
0x00406437
0x00000000
0x00000000
0x00000000
0x00000000
0x0040673b
0x0040673b
0x0040673e
0x00406745
0x00000000
0x00406748
0x00000000
0x00000000
0x00000000
0x0040646d
0x0040646d
0x00406470
0x004064a6
0x004064a6
0x004065d6
0x004065d6
0x004065d6
0x004065d6
0x004065d9
0x004065d9
0x004065dc
0x004065de
0x00406868
0x00406868
0x00000000
0x00406868
0x004065e4
0x004065e4
0x004065e7
0x00000000
0x00000000
0x004065ed
0x004065ed
0x004065f1
0x004065f4
0x004065f4
0x004065f4
0x00000000
0x004065f4
0x00406472
0x00406472
0x00406474
0x00406476
0x00406478
0x0040647b
0x0040647c
0x0040647e
0x00406480
0x00406483
0x00406486
0x0040649c
0x0040649c
0x004064a1
0x004064d9
0x004064d9
0x004064dd
0x00406506
0x00406509
0x0040650b
0x00406512
0x00406515
0x00406518
0x00406518
0x0040651d
0x0040651d
0x0040651f
0x00406522
0x00406529
0x0040652c
0x00406559
0x00406559
0x0040655c
0x0040655f
0x004065d3
0x004065d3
0x004065d3
0x004065d3
0x00000000
0x004065d3
0x00406561
0x00406561
0x00406567
0x0040656a
0x0040656d
0x00406570
0x00406573
0x00406576
0x00406579
0x0040657c
0x0040657f
0x00406582
0x0040659b
0x0040659d
0x004065a0
0x004065a1
0x004065a4
0x004065a6
0x004065a9
0x004065ab
0x004065ad
0x004065b0
0x004065b2
0x004065b5
0x004065b9
0x004065bb
0x004065bb
0x004065bc
0x004065bf
0x004065c2
0x00406584
0x00406584
0x0040658c
0x00406591
0x00406593
0x00406596
0x00406596
0x004065c5
0x004065cc
0x00406556
0x00406556
0x00406556
0x00406556
0x00000000
0x004065ce
0x004065ce
0x00000000
0x004065ce
0x004065cc
0x004064df
0x004064df
0x004064e2
0x004064e4
0x004064e7
0x004064ea
0x004064ed
0x004064ef
0x004064f2
0x004064f5
0x004064f5
0x004064f8
0x004064f8
0x004064fb
0x00406502
0x004064d6
0x004064d6
0x004064d6
0x004064d6
0x00000000
0x00406504
0x00406504
0x00000000
0x00406504
0x00406502
0x00406488
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00000000
0x00000000
0x004061ef
0x004061ef
0x004061f3
0x00406838
0x00406838
0x00000000
0x00406838
0x004061f9
0x004061f9
0x004061fc
0x004061ff
0x00406202
0x00406205
0x00406208
0x0040620b
0x0040620d
0x00406210
0x00406213
0x00406216
0x00406218
0x00406218
0x00406218
0x00000000
0x00000000
0x0040637a
0x0040637a
0x0040637e
0x00406844
0x00406844
0x00000000
0x00406844
0x00406384
0x00406384
0x00406387
0x0040638a
0x0040638d
0x0040638f
0x0040638f
0x0040638f
0x00406392
0x00406395
0x00406398
0x0040639b
0x0040639e
0x004063a1
0x004063a2
0x004063a4
0x004063a4
0x004063a4
0x004063a7
0x004063aa
0x004063ad
0x004063b0
0x004063b0
0x004063b0
0x004063b3
0x004063b5
0x004063b5
0x00000000
0x00000000
0x004065f7
0x004065f7
0x004065f7
0x004065fb
0x00000000
0x00000000
0x00406601
0x00406601
0x00406604
0x00406607
0x0040660a
0x0040660c
0x0040660c
0x0040660c
0x0040660f
0x00406612
0x00406615
0x00406618
0x0040661b
0x0040661e
0x0040661f
0x00406621
0x00406621
0x00406621
0x00406624
0x00406627
0x0040662a
0x0040662d
0x00406630
0x00406634
0x00406636
0x00406639
0x00000000
0x0040663b
0x0040663b
0x004063b8
0x004063b8
0x00000000
0x004063b8
0x00406639
0x0040686e
0x0040686e
0x00000000
0x00000000
0x00405e9d
0x004068a5
0x004068a5
0x00000000
0x004068a5
0x004066f2
0x00406772
0x0040673b

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2ec5e691eefeb7895a1ac387bd927eff239bfafd377499becc957e94103ad58
Instruction ID: 46f5cb6b99077c8a932221f6f95319a4d003604abf7c8fe4deea8dd62122f91f
Opcode Fuzzy Hash: e2ec5e691eefeb7895a1ac387bd927eff239bfafd377499becc957e94103ad58
Instruction Fuzzy Hash: 1EA13371D00229CBEF28CFA8C8547ADBBB1FF44309F15856AD816BB281D7785A86DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406640 Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406640() {
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int* _t605;
				void* _t612;

				L0:
				while(1) {
					L0:
					if( *(_t612 - 0x40) != 0) {
						 *(_t612 - 0x84) = 0x13;
						_t605 =  *((intOrPtr*)(_t612 - 0x58)) + 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x4c);
						 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
						__ecx =  *(__ebp - 0x58);
						__eax =  *(__ebp - 0x4c) << 4;
						__eax =  *(__ebp - 0x58) + __eax + 4;
						L130:
						 *(__ebp - 0x58) = __eax;
						 *(__ebp - 0x40) = 3;
						L144:
						 *(__ebp - 0x7c) = 0x14;
						L145:
						__eax =  *(__ebp - 0x40);
						 *(__ebp - 0x50) = 1;
						 *(__ebp - 0x48) =  *(__ebp - 0x40);
						L149:
						if( *(__ebp - 0x48) <= 0) {
							__ecx =  *(__ebp - 0x40);
							__ebx =  *(__ebp - 0x50);
							0 = 1;
							__eax = 1 << __cl;
							__ebx =  *(__ebp - 0x50) - (1 << __cl);
							__eax =  *(__ebp - 0x7c);
							 *(__ebp - 0x44) = __ebx;
							while(1) {
								L140:
								 *(_t612 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t612 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M004068AD))) {
										case 0:
											if( *(_t612 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t534 =  *( *(_t612 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t569);
											_push(9);
											_pop(_t570);
											_t608 = _t538 / _t569;
											_t540 = _t538 % _t569 & 0x000000ff;
											asm("cdq");
											_t603 = _t540 % _t570 & 0x000000ff;
											 *(_t612 - 0x3c) = _t603;
											 *(_t612 - 0x1c) = (1 << _t608) - 1;
											 *((intOrPtr*)(_t612 - 0x18)) = (1 << _t540 / _t570) - 1;
											_t611 = (0x300 << _t603 + _t608) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t612 - 0x78))) {
												L10:
												if(_t611 == 0) {
													L12:
													 *(_t612 - 0x48) =  *(_t612 - 0x48) & 0x00000000;
													 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t611 = _t611 - 1;
													 *((short*)( *(_t612 - 4) + _t611 * 2)) = 0x400;
												} while (_t611 != 0);
												goto L12;
											}
											if( *(_t612 - 4) != 0) {
												GlobalFree( *(_t612 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t612 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t612 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 1;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x40) =  *(_t612 - 0x40) | ( *( *(_t612 - 0x70)) & 0x000000ff) <<  *(_t612 - 0x48) << 0x00000003;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t45 = _t612 - 0x48;
											 *_t45 =  *(_t612 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t612 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t612 - 0x40);
											if(_t546 ==  *(_t612 - 0x74)) {
												L20:
												 *(_t612 - 0x48) = 5;
												 *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) =  *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t612 - 0x74) = _t546;
											if( *(_t612 - 8) != 0) {
												GlobalFree( *(_t612 - 8));
											}
											_t534 = GlobalAlloc(0x40,  *(_t612 - 0x40)); // executed
											 *(_t612 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t612 - 0x60) &  *(_t612 - 0x1c);
											 *(_t612 - 0x84) = 6;
											 *(_t612 - 0x4c) = _t553;
											_t605 =  *(_t612 - 4) + (( *(_t612 - 0x38) << 4) + _t553) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 3;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											_t67 = _t612 - 0x70;
											 *_t67 =  &(( *(_t612 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L23:
											 *(_t612 - 0x48) =  *(_t612 - 0x48) - 1;
											if( *(_t612 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t605;
											_t588 = _t531 & 0x0000ffff;
											_t564 = ( *(_t612 - 0x10) >> 0xb) * _t588;
											if( *(_t612 - 0xc) >= _t564) {
												 *(_t612 - 0x10) =  *(_t612 - 0x10) - _t564;
												 *(_t612 - 0xc) =  *(_t612 - 0xc) - _t564;
												 *(_t612 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												__eflags = _t532;
												 *_t605 = _t532;
											} else {
												 *(_t612 - 0x10) = _t564;
												 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
												 *_t605 = (0x800 - _t588 >> 5) + _t531;
											}
											if( *(_t612 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 5;
												goto L170;
											}
											 *(_t612 - 0x10) =  *(_t612 - 0x10) << 8;
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L139:
											_t533 =  *(_t612 - 0x84);
											goto L140;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L100:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t335 = __ebp - 0x70;
											 *_t335 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t335;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L102;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L110:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t366 = __ebp - 0x70;
											 *_t366 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t366;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L112;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											L132:
											 *(_t612 - 0x54) = _t605;
											goto L133;
										case 0x12:
											goto L0;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												goto L144;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											goto L130;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											L140:
											 *(_t612 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L121;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											goto L145;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											goto L149;
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L120:
												_t394 = __ebp - 0x2c;
												 *_t394 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t394;
												L121:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t401 = __ebp - 0x60;
												 *_t401 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t401;
												goto L124;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L103:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L109:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L113:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t392 = __ebp - 0x2c;
														 *_t392 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t392;
														goto L120;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L112:
														_t369 = __ebp - 0x48;
														 *_t369 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t369;
														goto L113;
													} else {
														goto L110;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L102:
													_t339 = __ebp - 0x48;
													 *_t339 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t339;
													goto L103;
												} else {
													goto L100;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L109;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L124:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t415 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t415;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t415;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											L170:
											_push(0x22);
											_pop(_t567);
											memcpy( *(_t612 - 0x90), _t612 - 0x88, _t567 << 2);
											_t535 = 0;
											L172:
											return _t535;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
						__eax =  *(__ebp - 0x50);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
						__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
						__eax =  *(__ebp - 0x58);
						__esi = __edx + __eax;
						 *(__ebp - 0x54) = __esi;
						__ax =  *__esi;
						__edi = __ax & 0x0000ffff;
						__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
						if( *(__ebp - 0xc) >= __ecx) {
							 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
							__cx = __ax;
							__cx = __ax >> 5;
							__eax = __eax - __ecx;
							__edx = __edx + 1;
							 *__esi = __ax;
							 *(__ebp - 0x50) = __edx;
						} else {
							 *(__ebp - 0x10) = __ecx;
							0x800 = 0x800 - __edi;
							0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
							 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
							 *__esi = __cx;
						}
						if( *(__ebp - 0x10) >= 0x1000000) {
							goto L148;
						} else {
							goto L146;
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406640
0x00406640
0x00406644
0x00406669
0x00406673
0x00000000
0x00406646
0x00406646
0x00406649
0x0040664d
0x00406650
0x00406653
0x00406657
0x00406657
0x0040665a
0x00406734
0x00406734
0x0040673b
0x0040673b
0x0040673e
0x00406745
0x00406772
0x00406776
0x004067d6
0x004067d9
0x004067de
0x004067df
0x004067e1
0x004067e3
0x004067e6
0x004066f2
0x004066f2
0x004066f2
0x00405e8e
0x00405e8e
0x00405e8e
0x00405e97
0x00000000
0x00000000
0x00405e9d
0x00000000
0x00405ea8
0x00000000
0x00000000
0x00405eb1
0x00405eb4
0x00405eb7
0x00405ebb
0x00000000
0x00000000
0x00405ec1
0x00405ec4
0x00405ec6
0x00405ec7
0x00405eca
0x00405ecc
0x00405ecd
0x00405ecf
0x00405ed2
0x00405ed7
0x00405edc
0x00405ee5
0x00405ef8
0x00405efb
0x00405f07
0x00405f2f
0x00405f31
0x00405f3f
0x00405f3f
0x00405f43
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f33
0x00405f33
0x00405f36
0x00405f37
0x00405f37
0x00000000
0x00405f33
0x00405f0d
0x00405f12
0x00405f12
0x00405f1b
0x00405f23
0x00405f26
0x00000000
0x00405f2c
0x00405f2c
0x00000000
0x00405f2c
0x00000000
0x00405f49
0x00405f49
0x00405f4d
0x004067f9
0x00000000
0x004067f9
0x00405f56
0x00405f66
0x00405f69
0x00405f6c
0x00405f6c
0x00405f6c
0x00405f6f
0x00405f73
0x00000000
0x00000000
0x00405f75
0x00405f7b
0x00405fa5
0x00405fab
0x00405fb2
0x00000000
0x00405fb2
0x00405f81
0x00405f84
0x00405f89
0x00405f89
0x00405f94
0x00405f9c
0x00405f9f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405fe4
0x00405fea
0x00405fed
0x00405ffa
0x00406002
0x00000000
0x00000000
0x00405fb9
0x00405fb9
0x00405fbd
0x00406808
0x00000000
0x00406808
0x00405fc9
0x00405fd4
0x00405fd4
0x00405fd4
0x00405fd7
0x00405fda
0x00405fdd
0x00405fe2
0x00000000
0x00000000
0x00000000
0x00000000
0x00406679
0x00406679
0x0040667f
0x00406685
0x0040668b
0x004066a5
0x004066a8
0x004066ae
0x004066b9
0x004066b9
0x004066bb
0x0040668d
0x0040668d
0x0040669c
0x004066a0
0x004066a0
0x004066c5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004066c7
0x004066cb
0x0040687a
0x00000000
0x0040687a
0x004066d7
0x004066de
0x004066e6
0x004066e9
0x004066ec
0x004066ec
0x00000000
0x00000000
0x0040600a
0x0040600c
0x0040600f
0x00406080
0x00406083
0x00406086
0x0040608d
0x00406097
0x00000000
0x00406097
0x00406011
0x00406015
0x00406018
0x0040601a
0x0040601d
0x00406020
0x00406022
0x00406025
0x00406027
0x0040602c
0x0040602f
0x00406032
0x00406036
0x0040603d
0x00406040
0x00406047
0x0040604b
0x00406053
0x00406053
0x00406053
0x0040604d
0x0040604d
0x0040604d
0x00406042
0x00406042
0x00406042
0x00406057
0x0040605a
0x00406078
0x0040607a
0x00000000
0x0040605c
0x0040605c
0x0040605f
0x00406062
0x00406065
0x00406067
0x00406067
0x00406067
0x0040606a
0x0040606d
0x0040606f
0x00406070
0x00406073
0x00000000
0x00406073
0x00000000
0x004062a9
0x004062ad
0x004062cb
0x004062ce
0x004062d5
0x004062d8
0x004062db
0x004062de
0x004062e1
0x004062e4
0x004062e6
0x004062ed
0x004062ee
0x004062f0
0x004062f3
0x004062f6
0x004062f9
0x004062f9
0x004062fe
0x00000000
0x004062fe
0x004062af
0x004062b2
0x004062b5
0x004062bf
0x00000000
0x00000000
0x00406313
0x00406317
0x0040633a
0x0040633d
0x00406340
0x0040634a
0x00406319
0x00406319
0x0040631c
0x0040631f
0x00406322
0x0040632f
0x00406332
0x00406332
0x00000000
0x00000000
0x00406356
0x0040635a
0x00000000
0x00000000
0x00406360
0x00406364
0x00000000
0x00000000
0x0040636a
0x0040636c
0x00406370
0x00406370
0x00406373
0x00406377
0x00000000
0x00000000
0x004063c7
0x004063cb
0x004063d2
0x004063d5
0x004063d8
0x004063e2
0x00000000
0x004063e2
0x004063cd
0x00000000
0x00000000
0x004063ee
0x004063f2
0x004063f9
0x004063fc
0x004063ff
0x004063f4
0x004063f4
0x004063f4
0x00406402
0x00406405
0x00406408
0x00406408
0x0040640b
0x0040640e
0x00406411
0x00406411
0x00406414
0x0040641b
0x00406420
0x00000000
0x00000000
0x004064ae
0x004064ae
0x004064b2
0x00406850
0x00000000
0x00406850
0x004064b8
0x004064bb
0x004064be
0x004064c2
0x004064c5
0x004064cb
0x004064cd
0x004064cd
0x004064cd
0x004064d0
0x004064d3
0x00000000
0x00000000
0x004060a3
0x004060a3
0x004060a7
0x00406814
0x00000000
0x00406814
0x004060ad
0x004060b0
0x004060b3
0x004060b7
0x004060ba
0x004060c0
0x004060c2
0x004060c2
0x004060c2
0x004060c5
0x004060c8
0x004060c8
0x004060cb
0x004060ce
0x00000000
0x00000000
0x004060d4
0x004060da
0x00000000
0x00000000
0x004060e0
0x004060e0
0x004060e4
0x004060e7
0x004060ea
0x004060ed
0x004060f0
0x004060f1
0x004060f4
0x004060f6
0x004060fc
0x004060ff
0x00406102
0x00406105
0x00406108
0x0040610b
0x0040610e
0x0040612a
0x0040612d
0x00406130
0x00406133
0x0040613a
0x0040613e
0x00406140
0x00406144
0x00406110
0x00406110
0x00406114
0x0040611c
0x00406121
0x00406123
0x00406125
0x00406125
0x00406147
0x0040614e
0x00406151
0x00000000
0x00406157
0x00000000
0x00406157
0x00000000
0x0040615c
0x0040615c
0x00406160
0x00406820
0x00000000
0x00406820
0x00406166
0x00406169
0x0040616c
0x00406170
0x00406173
0x00406179
0x0040617b
0x0040617b
0x0040617b
0x0040617e
0x00406181
0x00406181
0x00406181
0x00406187
0x00000000
0x00000000
0x00406189
0x0040618c
0x0040618f
0x00406192
0x00406195
0x00406198
0x0040619b
0x0040619e
0x004061a1
0x004061a4
0x004061a7
0x004061bf
0x004061c2
0x004061c5
0x004061c8
0x004061c8
0x004061cb
0x004061cf
0x004061d1
0x004061a9
0x004061a9
0x004061b1
0x004061b6
0x004061b8
0x004061ba
0x004061ba
0x004061d4
0x004061db
0x004061de
0x00000000
0x004061e0
0x00000000
0x004061e0
0x004061de
0x004061e5
0x004061e5
0x004061e5
0x004061e5
0x00000000
0x00000000
0x00406220
0x00406220
0x00406224
0x0040682c
0x00000000
0x0040682c
0x0040622a
0x0040622d
0x00406230
0x00406234
0x00406237
0x0040623d
0x0040623f
0x0040623f
0x0040623f
0x00406242
0x00406245
0x00406245
0x0040624b
0x004061e9
0x004061e9
0x004061ec
0x00000000
0x004061ec
0x0040624d
0x0040624d
0x00406250
0x00406253
0x00406256
0x00406259
0x0040625c
0x0040625f
0x00406262
0x00406265
0x00406268
0x0040626b
0x00406283
0x00406286
0x00406289
0x0040628c
0x0040628c
0x0040628f
0x00406293
0x00406295
0x0040626d
0x0040626d
0x00406275
0x0040627a
0x0040627c
0x0040627e
0x0040627e
0x00406298
0x0040629f
0x004062a2
0x00000000
0x004062a4
0x00000000
0x004062a4
0x00000000
0x00406531
0x00406531
0x00406535
0x0040685c
0x00000000
0x0040685c
0x0040653b
0x0040653e
0x00406541
0x00406545
0x00406548
0x0040654e
0x00406550
0x00406550
0x00406550
0x00406553
0x00000000
0x00000000
0x00406301
0x00406301
0x00406304
0x00406676
0x00406676
0x00000000
0x00000000
0x00000000
0x00000000
0x004066fd
0x00406701
0x0040671f
0x0040671f
0x0040671f
0x00406726
0x0040672d
0x00000000
0x0040672d
0x00406703
0x00406706
0x00406709
0x0040670c
0x00406713
0x00000000
0x00000000
0x004067ee
0x004067f1
0x004066f2
0x004066f2
0x00000000
0x00000000
0x00406428
0x0040642a
0x00406431
0x00406432
0x00406434
0x00406437
0x00000000
0x00000000
0x0040643f
0x00406442
0x00406445
0x00406447
0x00406449
0x00406449
0x0040644a
0x0040644d
0x00406454
0x00406457
0x00406465
0x00000000
0x00000000
0x00000000
0x00000000
0x0040674a
0x0040674a
0x0040674e
0x00406886
0x00000000
0x00406886
0x00406754
0x00406757
0x0040675a
0x0040675e
0x00406761
0x00406767
0x00406769
0x00406769
0x00406769
0x0040676c
0x0040676f
0x0040676f
0x0040676f
0x0040676f
0x00000000
0x00000000
0x0040646d
0x00406470
0x004064a6
0x004065d6
0x004065d6
0x004065d6
0x004065d6
0x004065d9
0x004065d9
0x004065dc
0x004065de
0x00406868
0x00000000
0x00406868
0x004065e4
0x004065e7
0x00000000
0x00000000
0x004065ed
0x004065f1
0x004065f4
0x004065f4
0x004065f4
0x00000000
0x004065f4
0x00406472
0x00406474
0x00406476
0x00406478
0x0040647b
0x0040647c
0x0040647e
0x00406480
0x00406483
0x00406486
0x0040649c
0x004064a1
0x004064d9
0x004064d9
0x004064dd
0x00406509
0x0040650b
0x00406512
0x00406515
0x00406518
0x00406518
0x0040651d
0x0040651d
0x0040651f
0x00406522
0x00406529
0x0040652c
0x00406559
0x00406559
0x0040655c
0x0040655f
0x004065d3
0x004065d3
0x004065d3
0x00000000
0x004065d3
0x00406561
0x00406567
0x0040656a
0x0040656d
0x00406570
0x00406573
0x00406576
0x00406579
0x0040657c
0x0040657f
0x00406582
0x0040659b
0x0040659d
0x004065a0
0x004065a1
0x004065a4
0x004065a6
0x004065a9
0x004065ab
0x004065ad
0x004065b0
0x004065b2
0x004065b5
0x004065b9
0x004065bb
0x004065bb
0x004065bc
0x004065bf
0x004065c2
0x00406584
0x00406584
0x0040658c
0x00406591
0x00406593
0x00406596
0x00406596
0x004065c5
0x004065cc
0x00406556
0x00406556
0x00406556
0x00406556
0x00000000
0x004065ce
0x00000000
0x004065ce
0x004065cc
0x004064df
0x004064e2
0x004064e4
0x004064e7
0x004064ea
0x004064ed
0x004064ef
0x004064f2
0x004064f5
0x004064f5
0x004064f8
0x004064f8
0x004064fb
0x00406502
0x004064d6
0x004064d6
0x004064d6
0x004064d6
0x00000000
0x00406504
0x00000000
0x00406504
0x00406502
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00000000
0x00000000
0x004061ef
0x004061ef
0x004061f3
0x00406838
0x00000000
0x00406838
0x004061f9
0x004061fc
0x004061ff
0x00406202
0x00406205
0x00406208
0x0040620b
0x0040620d
0x00406210
0x00406213
0x00406216
0x00406218
0x00406218
0x00406218
0x00000000
0x00000000
0x0040637a
0x0040637a
0x0040637e
0x00406844
0x00000000
0x00406844
0x00406384
0x00406387
0x0040638a
0x0040638d
0x0040638f
0x0040638f
0x0040638f
0x00406392
0x00406395
0x00406398
0x0040639b
0x0040639e
0x004063a1
0x004063a2
0x004063a4
0x004063a4
0x004063a4
0x004063a7
0x004063aa
0x004063ad
0x004063b0
0x004063b0
0x004063b0
0x004063b3
0x004063b5
0x004063b5
0x00000000
0x00000000
0x004065f7
0x004065f7
0x004065f7
0x004065fb
0x00000000
0x00000000
0x00406601
0x00406604
0x00406607
0x0040660a
0x0040660c
0x0040660c
0x0040660c
0x0040660f
0x00406612
0x00406615
0x00406618
0x0040661b
0x0040661e
0x0040661f
0x00406621
0x00406621
0x00406621
0x00406624
0x00406627
0x0040662a
0x0040662d
0x00406630
0x00406634
0x00406636
0x00406639
0x00000000
0x0040663b
0x004063b8
0x004063b8
0x00000000
0x004063b8
0x00406639
0x0040686e
0x00406890
0x00406896
0x00406898
0x0040689f
0x004068a1
0x004068a8
0x004068ac
0x00000000
0x00405e9d
0x004068a5
0x004068a5
0x00000000
0x004068a5
0x004066f2
0x00406778
0x0040677e
0x00406781
0x00406784
0x00406787
0x0040678a
0x0040678d
0x00406790
0x00406793
0x00406799
0x004067b2
0x004067b5
0x004067b8
0x004067bb
0x004067bf
0x004067c1
0x004067c2
0x004067c5
0x0040679b
0x0040679b
0x004067a3
0x004067a8
0x004067aa
0x004067ad
0x004067ad
0x004067cf
0x00000000
0x004067d1
0x00000000
0x004067d1
0x004067cf
0x00000000
0x00406644

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec64765bbfe4fe864a44f2a148697461047da27e0e17663b57c602867936ff4
Instruction ID: b6d6ccc853a16e4f483ba8b04077c6698ffe39116f32d6ac079e48ce0b9a1d5b
Opcode Fuzzy Hash: 0ec64765bbfe4fe864a44f2a148697461047da27e0e17663b57c602867936ff4
Instruction Fuzzy Hash: 9C912071D00229CBEF28CF98C844BADBBB1FF44305F15816AD816BB291D7789A86DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406356 Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406356() {
				unsigned short _t532;
				signed int _t533;
				void _t534;
				void* _t535;
				signed int _t536;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						L89:
						 *((intOrPtr*)(_t613 - 0x80)) = 0x15;
						 *(_t613 - 0x58) =  *(_t613 - 4) + 0xa68;
						L69:
						_t606 =  *(_t613 - 0x58);
						 *(_t613 - 0x84) = 0x12;
						L132:
						 *(_t613 - 0x54) = _t606;
						L133:
						_t532 =  *_t606;
						_t589 = _t532 & 0x0000ffff;
						_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
						if( *(_t613 - 0xc) >= _t565) {
							 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
							 *(_t613 - 0x40) = 1;
							_t533 = _t532 - (_t532 >> 5);
							 *_t606 = _t533;
						} else {
							 *(_t613 - 0x10) = _t565;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
							 *_t606 = (0x800 - _t589 >> 5) + _t532;
						}
						if( *(_t613 - 0x10) >= 0x1000000) {
							L139:
							_t534 =  *(_t613 - 0x84);
							L140:
							 *(_t613 - 0x88) = _t534;
							goto L1;
						} else {
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								goto L170;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						if( *(__ebp - 0x60) == 0) {
							L171:
							_t536 = _t535 | 0xffffffff;
							L172:
							return _t536;
						}
						__eax = 0;
						_t258 =  *(__ebp - 0x38) - 7 >= 0;
						0 | _t258 = _t258 + _t258 + 9;
						 *(__ebp - 0x38) = _t258 + _t258 + 9;
						L75:
						if( *(__ebp - 0x64) == 0) {
							 *(__ebp - 0x88) = 0x1b;
							L170:
							_t568 = 0x22;
							memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
							_t536 = 0;
							goto L172;
						}
						__eax =  *(__ebp - 0x14);
						__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
						if(__eax >=  *(__ebp - 0x74)) {
							__eax = __eax +  *(__ebp - 0x74);
						}
						__edx =  *(__ebp - 8);
						__cl =  *(__eax + __edx);
						__eax =  *(__ebp - 0x14);
						 *(__ebp - 0x5c) = __cl;
						 *(__eax + __edx) = __cl;
						__eax = __eax + 1;
						__edx = 0;
						_t274 = __eax %  *(__ebp - 0x74);
						__eax = __eax /  *(__ebp - 0x74);
						__edx = _t274;
						__eax =  *(__ebp - 0x68);
						 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
						 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
						_t283 = __ebp - 0x64;
						 *_t283 =  *(__ebp - 0x64) - 1;
						 *( *(__ebp - 0x68)) = __cl;
						L79:
						 *(__ebp - 0x14) = __edx;
						L80:
						 *(__ebp - 0x88) = 2;
					}
					L1:
					_t535 =  *(_t613 - 0x88);
					if(_t535 > 0x1c) {
						goto L171;
					}
					switch( *((intOrPtr*)(_t535 * 4 +  &M004068AD))) {
						case 0:
							if( *(_t613 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t535 =  *( *(_t613 - 0x70));
							if(_t535 > 0xe1) {
								goto L171;
							}
							_t539 = _t535 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t609 = _t539 / _t570;
							_t541 = _t539 % _t570 & 0x000000ff;
							asm("cdq");
							_t604 = _t541 % _t571 & 0x000000ff;
							 *(_t613 - 0x3c) = _t604;
							 *(_t613 - 0x1c) = (1 << _t609) - 1;
							 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t541 / _t571) - 1;
							_t612 = (0x300 << _t604 + _t609) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
								L10:
								if(_t612 == 0) {
									L12:
									 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t612 = _t612 - 1;
									 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
								} while (_t612 != 0);
								goto L12;
							}
							if( *(_t613 - 4) != 0) {
								GlobalFree( *(_t613 - 4));
							}
							_t535 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t613 - 4) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 1;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t45 = _t613 - 0x48;
							 *_t45 =  *(_t613 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t613 - 0x48) < 4) {
								goto L13;
							}
							_t547 =  *(_t613 - 0x40);
							if(_t547 ==  *(_t613 - 0x74)) {
								L20:
								 *(_t613 - 0x48) = 5;
								 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t613 - 0x74) = _t547;
							if( *(_t613 - 8) != 0) {
								GlobalFree( *(_t613 - 8));
							}
							_t535 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
							 *(_t613 - 8) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t554 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
							 *(_t613 - 0x84) = 6;
							 *(_t613 - 0x4c) = _t554;
							_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t554) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 3;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							_t67 = _t613 - 0x70;
							 *_t67 =  &(( *(_t613 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L23:
							 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
							if( *(_t613 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							__edx = 0;
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x34) = 1;
								 *(__ebp - 0x84) = 7;
								__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x5c) & 0x000000ff;
							__esi =  *(__ebp - 0x60);
							__cl = 8;
							__cl = 8 -  *(__ebp - 0x3c);
							__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
							__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
							__ecx =  *(__ebp - 0x3c);
							__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
							__ecx =  *(__ebp - 4);
							(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
							__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
							__eflags =  *(__ebp - 0x38) - 4;
							__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							if( *(__ebp - 0x38) >= 4) {
								__eflags =  *(__ebp - 0x38) - 0xa;
								if( *(__ebp - 0x38) >= 0xa) {
									_t98 = __ebp - 0x38;
									 *_t98 =  *(__ebp - 0x38) - 6;
									__eflags =  *_t98;
								} else {
									 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
								}
							} else {
								 *(__ebp - 0x38) = 0;
							}
							__eflags =  *(__ebp - 0x34) - __edx;
							if( *(__ebp - 0x34) == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L61;
							} else {
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__ecx =  *(__ebp - 8);
								__ebx = 0;
								__ebx = 1;
								__al =  *((intOrPtr*)(__eax + __ecx));
								 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
								goto L41;
							}
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L69;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							goto L0;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							goto L89;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							L37:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xd;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t122 = __ebp - 0x70;
							 *_t122 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t122;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L39:
							__eax =  *(__ebp - 0x40);
							__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
							if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
								goto L48;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L54;
							}
							L41:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L39;
							} else {
								goto L37;
							}
						case 0xe:
							L46:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xe;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t156 = __ebp - 0x70;
							 *_t156 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t156;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							while(1) {
								L48:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax =  *(__ebp - 0x58);
								__edx = __ebx + __ebx;
								__ecx =  *(__ebp - 0x10);
								__esi = __edx + __eax;
								__ecx =  *(__ebp - 0x10) >> 0xb;
								__ax =  *__esi;
								 *(__ebp - 0x54) = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
								__eflags =  *(__ebp - 0xc) - __ecx;
								if( *(__ebp - 0xc) >= __ecx) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
									 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
									__cx = __ax;
									_t170 = __edx + 1; // 0x1
									__ebx = _t170;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									 *(__ebp - 0x10) = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0x10) >= 0x1000000) {
									continue;
								} else {
									goto L46;
								}
							}
							L54:
							_t173 = __ebp - 0x34;
							 *_t173 =  *(__ebp - 0x34) & 0x00000000;
							__eflags =  *_t173;
							goto L55;
						case 0xf:
							L58:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xf;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t203 = __ebp - 0x70;
							 *_t203 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t203;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L60:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L55:
								__al =  *(__ebp - 0x44);
								 *(__ebp - 0x5c) =  *(__ebp - 0x44);
								goto L56;
							}
							L61:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t217 = __edx + 1; // 0x1
								__ebx = _t217;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L60;
							} else {
								goto L58;
							}
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							goto L69;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							L56:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1a;
								goto L170;
							}
							__ecx =  *(__ebp - 0x68);
							__al =  *(__ebp - 0x5c);
							__edx =  *(__ebp - 8);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
							 *( *(__ebp - 0x68)) = __al;
							__ecx =  *(__ebp - 0x14);
							 *(__ecx +  *(__ebp - 8)) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t192 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t192;
							goto L79;
						case 0x1b:
							goto L75;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = _t414;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x00406356
0x00406356
0x0040635a
0x00406411
0x00406414
0x00406420
0x00406301
0x00406301
0x00406304
0x00406676
0x00406676
0x00406679
0x00406679
0x0040667f
0x00406685
0x0040668b
0x004066a5
0x004066a8
0x004066ae
0x004066b9
0x004066bb
0x0040668d
0x0040668d
0x0040669c
0x004066a0
0x004066a0
0x004066c5
0x004066ec
0x004066ec
0x004066f2
0x004066f2
0x00000000
0x004066c7
0x004066c7
0x004066cb
0x0040687a
0x00000000
0x0040687a
0x004066d7
0x004066de
0x004066e6
0x004066e9
0x00000000
0x004066e9
0x00406360
0x00406364
0x004068a5
0x004068a5
0x004068a8
0x004068ac
0x004068ac
0x0040636a
0x00406370
0x00406373
0x00406377
0x0040637a
0x0040637e
0x00406844
0x00406890
0x00406898
0x0040689f
0x004068a1
0x00000000
0x004068a1
0x00406384
0x00406387
0x0040638d
0x0040638f
0x0040638f
0x00406392
0x00406395
0x00406398
0x0040639b
0x0040639e
0x004063a1
0x004063a2
0x004063a4
0x004063a4
0x004063a4
0x004063a7
0x004063aa
0x004063ad
0x004063b0
0x004063b0
0x004063b3
0x004063b5
0x004063b5
0x004063b8
0x004063b8
0x004063b8
0x00405e8e
0x00405e8e
0x00405e97
0x00000000
0x00000000
0x00405e9d
0x00000000
0x00405ea8
0x00000000
0x00000000
0x00405eb1
0x00405eb4
0x00405eb7
0x00405ebb
0x00000000
0x00000000
0x00405ec1
0x00405ec4
0x00405ec6
0x00405ec7
0x00405eca
0x00405ecc
0x00405ecd
0x00405ecf
0x00405ed2
0x00405ed7
0x00405edc
0x00405ee5
0x00405ef8
0x00405efb
0x00405f07
0x00405f2f
0x00405f31
0x00405f3f
0x00405f3f
0x00405f43
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f33
0x00405f33
0x00405f36
0x00405f37
0x00405f37
0x00000000
0x00405f33
0x00405f0d
0x00405f12
0x00405f12
0x00405f1b
0x00405f23
0x00405f26
0x00000000
0x00405f2c
0x00405f2c
0x00000000
0x00405f2c
0x00000000
0x00405f49
0x00405f49
0x00405f4d
0x004067f9
0x00000000
0x004067f9
0x00405f56
0x00405f66
0x00405f69
0x00405f6c
0x00405f6c
0x00405f6c
0x00405f6f
0x00405f73
0x00000000
0x00000000
0x00405f75
0x00405f7b
0x00405fa5
0x00405fab
0x00405fb2
0x00000000
0x00405fb2
0x00405f81
0x00405f84
0x00405f89
0x00405f89
0x00405f94
0x00405f9c
0x00405f9f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405fe4
0x00405fea
0x00405fed
0x00405ffa
0x00406002
0x00000000
0x00000000
0x00405fb9
0x00405fb9
0x00405fbd
0x00406808
0x00000000
0x00406808
0x00405fc9
0x00405fd4
0x00405fd4
0x00405fd4
0x00405fd7
0x00405fda
0x00405fdd
0x00405fe2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040600a
0x0040600c
0x0040600f
0x00406080
0x00406083
0x00406086
0x0040608d
0x00406097
0x00000000
0x00406097
0x00406011
0x00406015
0x00406018
0x0040601a
0x0040601d
0x00406020
0x00406022
0x00406025
0x00406027
0x0040602c
0x0040602f
0x00406032
0x00406036
0x0040603d
0x00406040
0x00406047
0x0040604b
0x00406053
0x00406053
0x00406053
0x0040604d
0x0040604d
0x0040604d
0x00406042
0x00406042
0x00406042
0x00406057
0x0040605a
0x00406078
0x0040607a
0x00000000
0x0040605c
0x0040605c
0x0040605f
0x00406062
0x00406065
0x00406067
0x00406067
0x00406067
0x0040606a
0x0040606d
0x0040606f
0x00406070
0x00406073
0x00000000
0x00406073
0x00000000
0x004062a9
0x004062ad
0x004062cb
0x004062ce
0x004062d5
0x004062d8
0x004062db
0x004062de
0x004062e1
0x004062e4
0x004062e6
0x004062ed
0x004062ee
0x004062f0
0x004062f3
0x004062f6
0x004062f9
0x004062f9
0x004062fe
0x00000000
0x004062fe
0x004062af
0x004062b2
0x004062b5
0x004062bf
0x00000000
0x00000000
0x00406313
0x00406317
0x0040633a
0x0040633d
0x00406340
0x0040634a
0x00406319
0x00406319
0x0040631c
0x0040631f
0x00406322
0x0040632f
0x00406332
0x00406332
0x00000000
0x00000000
0x00000000
0x00000000
0x004063c7
0x004063cb
0x004063d2
0x004063d5
0x004063d8
0x004063e2
0x00000000
0x004063e2
0x004063cd
0x00000000
0x00000000
0x004063ee
0x004063f2
0x004063f9
0x004063fc
0x004063ff
0x004063f4
0x004063f4
0x004063f4
0x00406402
0x00406405
0x00406408
0x00406408
0x0040640b
0x0040640e
0x00000000
0x00000000
0x004064ae
0x004064ae
0x004064b2
0x00406850
0x00000000
0x00406850
0x004064b8
0x004064bb
0x004064be
0x004064c2
0x004064c5
0x004064cb
0x004064cd
0x004064cd
0x004064cd
0x004064d0
0x004064d3
0x00000000
0x00000000
0x004060a3
0x004060a3
0x004060a7
0x00406814
0x00000000
0x00406814
0x004060ad
0x004060b0
0x004060b3
0x004060b7
0x004060ba
0x004060c0
0x004060c2
0x004060c2
0x004060c2
0x004060c5
0x004060c8
0x004060c8
0x004060cb
0x004060ce
0x00000000
0x00000000
0x004060d4
0x004060da
0x00000000
0x00000000
0x004060e0
0x004060e0
0x004060e4
0x004060e7
0x004060ea
0x004060ed
0x004060f0
0x004060f1
0x004060f4
0x004060f6
0x004060fc
0x004060ff
0x00406102
0x00406105
0x00406108
0x0040610b
0x0040610e
0x0040612a
0x0040612d
0x00406130
0x00406133
0x0040613a
0x0040613e
0x00406140
0x00406144
0x00406110
0x00406110
0x00406114
0x0040611c
0x00406121
0x00406123
0x00406125
0x00406125
0x00406147
0x0040614e
0x00406151
0x00000000
0x00406157
0x00000000
0x00406157
0x00000000
0x0040615c
0x0040615c
0x00406160
0x00406820
0x00000000
0x00406820
0x00406166
0x00406169
0x0040616c
0x00406170
0x00406173
0x00406179
0x0040617b
0x0040617b
0x0040617b
0x0040617e
0x00406181
0x00406181
0x00406181
0x00406187
0x00000000
0x00000000
0x00406189
0x0040618c
0x0040618f
0x00406192
0x00406195
0x00406198
0x0040619b
0x0040619e
0x004061a1
0x004061a4
0x004061a7
0x004061bf
0x004061c2
0x004061c5
0x004061c8
0x004061c8
0x004061cb
0x004061cf
0x004061d1
0x004061a9
0x004061a9
0x004061b1
0x004061b6
0x004061b8
0x004061ba
0x004061ba
0x004061d4
0x004061db
0x004061de
0x00000000
0x004061e0
0x00000000
0x004061e0
0x004061de
0x004061e5
0x004061e5
0x004061e5
0x004061e5
0x00000000
0x00000000
0x00406220
0x00406220
0x00406224
0x0040682c
0x00000000
0x0040682c
0x0040622a
0x0040622d
0x00406230
0x00406234
0x00406237
0x0040623d
0x0040623f
0x0040623f
0x0040623f
0x00406242
0x00406245
0x00406245
0x0040624b
0x004061e9
0x004061e9
0x004061ec
0x00000000
0x004061ec
0x0040624d
0x0040624d
0x00406250
0x00406253
0x00406256
0x00406259
0x0040625c
0x0040625f
0x00406262
0x00406265
0x00406268
0x0040626b
0x00406283
0x00406286
0x00406289
0x0040628c
0x0040628c
0x0040628f
0x00406293
0x00406295
0x0040626d
0x0040626d
0x00406275
0x0040627a
0x0040627c
0x0040627e
0x0040627e
0x00406298
0x0040629f
0x004062a2
0x00000000
0x004062a4
0x00000000
0x004062a4
0x00000000
0x00406531
0x00406531
0x00406535
0x0040685c
0x00000000
0x0040685c
0x0040653b
0x0040653e
0x00406541
0x00406545
0x00406548
0x0040654e
0x00406550
0x00406550
0x00406550
0x00406553
0x00000000
0x00000000
0x00000000
0x00000000
0x00406640
0x00406644
0x00406666
0x00406669
0x00406673
0x00000000
0x00406673
0x00406646
0x00406649
0x0040664d
0x00406650
0x00406650
0x00406653
0x00000000
0x00000000
0x004066fd
0x00406701
0x0040671f
0x0040671f
0x0040671f
0x00406726
0x0040672d
0x00406734
0x00406734
0x00000000
0x00406734
0x00406703
0x00406706
0x00406709
0x0040670c
0x00406713
0x00406657
0x00406657
0x0040665a
0x00000000
0x00000000
0x004067ee
0x004067f1
0x00000000
0x00000000
0x00406428
0x0040642a
0x00406431
0x00406432
0x00406434
0x00406437
0x00000000
0x00000000
0x0040643f
0x00406442
0x00406445
0x00406447
0x00406449
0x00406449
0x0040644a
0x0040644d
0x00406454
0x00406457
0x00406465
0x00000000
0x00000000
0x0040673b
0x0040673b
0x0040673e
0x00406745
0x00000000
0x00000000
0x0040674a
0x0040674a
0x0040674e
0x00406886
0x00000000
0x00406886
0x00406754
0x00406757
0x0040675a
0x0040675e
0x00406761
0x00406767
0x00406769
0x00406769
0x00406769
0x0040676c
0x0040676f
0x0040676f
0x0040676f
0x0040676f
0x00406772
0x00406772
0x00406776
0x004067d6
0x004067d9
0x004067de
0x004067df
0x004067e1
0x004067e3
0x004067e6
0x00000000
0x004067e6
0x00406778
0x0040677e
0x00406781
0x00406784
0x00406787
0x0040678a
0x0040678d
0x00406790
0x00406793
0x00406796
0x00406799
0x004067b2
0x004067b5
0x004067b8
0x004067bb
0x004067bf
0x004067c1
0x004067c1
0x004067c2
0x004067c5
0x0040679b
0x0040679b
0x004067a3
0x004067a8
0x004067aa
0x004067ad
0x004067ad
0x004067c8
0x004067cf
0x00000000
0x004067d1
0x00000000
0x004067d1
0x00000000
0x0040646d
0x00406470
0x004064a6
0x004065d6
0x004065d6
0x004065d6
0x004065d6
0x004065d9
0x004065d9
0x004065dc
0x004065de
0x00406868
0x00000000
0x00406868
0x004065e4
0x004065e7
0x00000000
0x00000000
0x004065ed
0x004065f1
0x004065f4
0x004065f4
0x004065f4
0x00000000
0x004065f4
0x00406472
0x00406474
0x00406476
0x00406478
0x0040647b
0x0040647c
0x0040647e
0x00406480
0x00406483
0x00406486
0x0040649c
0x004064a1
0x004064d9
0x004064d9
0x004064dd
0x00406509
0x0040650b
0x00406512
0x00406515
0x00406518
0x00406518
0x0040651d
0x0040651d
0x0040651f
0x00406522
0x00406529
0x0040652c
0x00406559
0x00406559
0x0040655c
0x0040655f
0x004065d3
0x004065d3
0x004065d3
0x00000000
0x004065d3
0x00406561
0x00406567
0x0040656a
0x0040656d
0x00406570
0x00406573
0x00406576
0x00406579
0x0040657c
0x0040657f
0x00406582
0x0040659b
0x0040659d
0x004065a0
0x004065a1
0x004065a4
0x004065a6
0x004065a9
0x004065ab
0x004065ad
0x004065b0
0x004065b2
0x004065b5
0x004065b9
0x004065bb
0x004065bb
0x004065bc
0x004065bf
0x004065c2
0x00406584
0x00406584
0x0040658c
0x00406591
0x00406593
0x00406596
0x00406596
0x004065c5
0x004065cc
0x00406556
0x00406556
0x00406556
0x00406556
0x00000000
0x004065ce
0x00000000
0x004065ce
0x004065cc
0x004064df
0x004064e2
0x004064e4
0x004064e7
0x004064ea
0x004064ed
0x004064ef
0x004064f2
0x004064f5
0x004064f5
0x004064f8
0x004064f8
0x004064fb
0x00406502
0x004064d6
0x004064d6
0x004064d6
0x004064d6
0x00000000
0x00406504
0x00000000
0x00406504
0x00406502
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00000000
0x00000000
0x004061ef
0x004061ef
0x004061f3
0x00406838
0x00000000
0x00406838
0x004061f9
0x004061fc
0x004061ff
0x00406202
0x00406205
0x00406208
0x0040620b
0x0040620d
0x00406210
0x00406213
0x00406216
0x00406218
0x00406218
0x00406218
0x00000000
0x00000000
0x00000000
0x00000000
0x004065f7
0x004065f7
0x004065f7
0x004065fb
0x00000000
0x00000000
0x00406601
0x00406604
0x00406607
0x0040660a
0x0040660c
0x0040660c
0x0040660c
0x0040660f
0x00406612
0x00406615
0x00406618
0x0040661b
0x0040661e
0x0040661f
0x00406621
0x00406621
0x00406621
0x00406624
0x00406627
0x0040662a
0x0040662d
0x00406630
0x00406634
0x00406636
0x00406639
0x00000000
0x0040663b
0x00000000
0x0040663b
0x00406639
0x0040686e
0x00000000
0x00000000
0x00405e9d

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eb68f714ae239f9d96536ddefa0b0130c78a53d72885ed6635004d34bb0e1c3
Instruction ID: 9f2062d8dd3c72469bab0aaa0c4d472ca99449d25692711e554c959146fb5a05
Opcode Fuzzy Hash: 7eb68f714ae239f9d96536ddefa0b0130c78a53d72885ed6635004d34bb0e1c3
Instruction Fuzzy Hash: 5F812471D00229CFEF24CFA9C8447AEBBB1FB44305F25816AD816BB281C7789985DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00405E5B Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00405E5B(void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v95;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				void _v140;
				void* _v148;
				signed int _t537;
				signed int _t538;
				signed int _t572;

				_t572 = 0x22;
				_v148 = __ecx;
				memcpy( &_v140, __ecx, _t572 << 2);
				if(_v52 == 0xffffffff) {
					return 1;
				}
				while(1) {
					L3:
					_t537 = _v140;
					if(_t537 > 0x1c) {
						break;
					}
					switch( *((intOrPtr*)(_t537 * 4 +  &M004068AD))) {
						case 0:
							__eflags = _v112;
							if(_v112 == 0) {
								goto L173;
							}
							_v112 = _v112 - 1;
							_v116 = _v116 + 1;
							_t537 =  *_v116;
							__eflags = _t537 - 0xe1;
							if(_t537 > 0xe1) {
								goto L174;
							}
							_t542 = _t537 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t576);
							_push(9);
							_pop(_t577);
							_t622 = _t542 / _t576;
							_t544 = _t542 % _t576 & 0x000000ff;
							asm("cdq");
							_t617 = _t544 % _t577 & 0x000000ff;
							_v64 = _t617;
							_v32 = (1 << _t622) - 1;
							_v28 = (1 << _t544 / _t577) - 1;
							_t625 = (0x300 << _t617 + _t622) + 0x736;
							__eflags = 0x600 - _v124;
							if(0x600 == _v124) {
								L12:
								__eflags = _t625;
								if(_t625 == 0) {
									L14:
									_v76 = _v76 & 0x00000000;
									_v68 = _v68 & 0x00000000;
									goto L17;
								} else {
									goto L13;
								}
								do {
									L13:
									_t625 = _t625 - 1;
									__eflags = _t625;
									 *((short*)(_v8 + _t625 * 2)) = 0x400;
								} while (_t625 != 0);
								goto L14;
							}
							__eflags = _v8;
							if(_v8 != 0) {
								GlobalFree(_v8);
							}
							_t537 = GlobalAlloc(0x40, 0x600); // executed
							__eflags = _t537;
							_v8 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								_v124 = 0x600;
								goto L12;
							}
						case 1:
							L15:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 1;
								goto L173;
							}
							_v112 = _v112 - 1;
							_v68 = _v68 | ( *_v116 & 0x000000ff) << _v76 << 0x00000003;
							_v116 = _v116 + 1;
							_t50 =  &_v76;
							 *_t50 = _v76 + 1;
							__eflags =  *_t50;
							L17:
							__eflags = _v76 - 4;
							if(_v76 < 4) {
								goto L15;
							}
							_t550 = _v68;
							__eflags = _t550 - _v120;
							if(_t550 == _v120) {
								L22:
								_v76 = 5;
								 *(_v12 + _v120 - 1) =  *(_v12 + _v120 - 1) & 0x00000000;
								goto L25;
							}
							__eflags = _v12;
							_v120 = _t550;
							if(_v12 != 0) {
								GlobalFree(_v12);
							}
							_t537 = GlobalAlloc(0x40, _v68); // executed
							__eflags = _t537;
							_v12 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								goto L22;
							}
						case 2:
							L26:
							_t557 = _v100 & _v32;
							_v136 = 6;
							_v80 = _t557;
							_t626 = _v8 + ((_v60 << 4) + _t557) * 2;
							goto L135;
						case 3:
							L23:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 3;
								goto L173;
							}
							_v112 = _v112 - 1;
							_t72 =  &_v116;
							 *_t72 = _v116 + 1;
							__eflags =  *_t72;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L25:
							_v76 = _v76 - 1;
							__eflags = _v76;
							if(_v76 != 0) {
								goto L23;
							}
							goto L26;
						case 4:
							L136:
							_t559 =  *_t626;
							_t610 = _t559 & 0x0000ffff;
							_t591 = (_v20 >> 0xb) * _t610;
							__eflags = _v16 - _t591;
							if(_v16 >= _t591) {
								_v20 = _v20 - _t591;
								_v16 = _v16 - _t591;
								_v68 = 1;
								_t560 = _t559 - (_t559 >> 5);
								__eflags = _t560;
								 *_t626 = _t560;
							} else {
								_v20 = _t591;
								_v68 = _v68 & 0x00000000;
								 *_t626 = (0x800 - _t610 >> 5) + _t559;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L142;
							} else {
								goto L140;
							}
						case 5:
							L140:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 5;
								goto L173;
							}
							_v20 = _v20 << 8;
							_v112 = _v112 - 1;
							_t464 =  &_v116;
							 *_t464 = _v116 + 1;
							__eflags =  *_t464;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L142:
							_t561 = _v136;
							goto L143;
						case 6:
							__edx = 0;
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v56 = 1;
								_v136 = 7;
								__esi = _v8 + 0x180 + _v60 * 2;
								goto L135;
							}
							__eax = _v96 & 0x000000ff;
							__esi = _v100;
							__cl = 8;
							__cl = 8 - _v64;
							__esi = _v100 & _v28;
							__eax = (_v96 & 0x000000ff) >> 8;
							__ecx = _v64;
							__esi = (_v100 & _v28) << 8;
							__ecx = _v8;
							((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2;
							__eax = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9;
							__eflags = _v60 - 4;
							__eax = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							_v92 = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							if(_v60 >= 4) {
								__eflags = _v60 - 0xa;
								if(_v60 >= 0xa) {
									_t103 =  &_v60;
									 *_t103 = _v60 - 6;
									__eflags =  *_t103;
								} else {
									_v60 = _v60 - 3;
								}
							} else {
								_v60 = 0;
							}
							__eflags = _v56 - __edx;
							if(_v56 == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L63;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__ecx = _v12;
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							_v95 =  *((intOrPtr*)(__eax + __ecx));
							goto L43;
						case 7:
							__eflags = _v68 - 1;
							if(_v68 != 1) {
								__eax = _v40;
								_v132 = 0x16;
								_v36 = _v40;
								__eax = _v44;
								_v40 = _v44;
								__eax = _v48;
								_v44 = _v48;
								__eax = 0;
								__eflags = _v60 - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								_v60 = (__eflags >= 0) - 1 + 0xa;
								__eax = _v8;
								__eax = _v8 + 0x664;
								__eflags = __eax;
								_v92 = __eax;
								goto L71;
							}
							__eax = _v8;
							__ecx = _v60;
							_v136 = 8;
							__esi = _v8 + 0x198 + _v60 * 2;
							goto L135;
						case 8:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xa;
								__esi = _v8 + 0x1b0 + _v60 * 2;
							} else {
								__eax = _v60;
								__ecx = _v8;
								__eax = _v60 + 0xf;
								_v136 = 9;
								_v60 + 0xf << 4 = (_v60 + 0xf << 4) + _v80;
								__esi = _v8 + ((_v60 + 0xf << 4) + _v80) * 2;
							}
							goto L135;
						case 9:
							__eflags = _v68;
							if(_v68 != 0) {
								goto L92;
							}
							__eflags = _v100;
							if(_v100 == 0) {
								goto L174;
							}
							__eax = 0;
							__eflags = _v60 - 7;
							_t264 = _v60 - 7 >= 0;
							__eflags = _t264;
							0 | _t264 = _t264 + _t264 + 9;
							_v60 = _t264 + _t264 + 9;
							goto L78;
						case 0xa:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xb;
								__esi = _v8 + 0x1c8 + _v60 * 2;
								goto L135;
							}
							__eax = _v44;
							goto L91;
						case 0xb:
							__eflags = _v68;
							if(_v68 != 0) {
								__ecx = _v40;
								__eax = _v36;
								_v36 = _v40;
							} else {
								__eax = _v40;
							}
							__ecx = _v44;
							_v40 = _v44;
							L91:
							__ecx = _v48;
							_v48 = __eax;
							_v44 = _v48;
							L92:
							__eax = _v8;
							_v132 = 0x15;
							__eax = _v8 + 0xa68;
							_v92 = _v8 + 0xa68;
							goto L71;
						case 0xc:
							L102:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xc;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t340 =  &_v116;
							 *_t340 = _v116 + 1;
							__eflags =  *_t340;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							__eax = _v48;
							goto L104;
						case 0xd:
							L39:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xd;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t127 =  &_v116;
							 *_t127 = _v116 + 1;
							__eflags =  *_t127;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L41:
							__eax = _v68;
							__eflags = _v76 - _v68;
							if(_v76 != _v68) {
								goto L50;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L56;
							}
							L43:
							__eax = _v95 & 0x000000ff;
							_v95 = _v95 << 1;
							__ecx = _v92;
							__eax = (_v95 & 0x000000ff) >> 7;
							_v76 = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi = _v92 + __eax * 2;
							_v20 = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edx;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_v68 = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								_v68 = _v68 & 0x00000000;
								_v20 = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L41;
							} else {
								goto L39;
							}
						case 0xe:
							L48:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xe;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t161 =  &_v116;
							 *_t161 = _v116 + 1;
							__eflags =  *_t161;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							while(1) {
								L50:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax = _v92;
								__edx = __ebx + __ebx;
								__ecx = _v20;
								__esi = __edx + __eax;
								__ecx = _v20 >> 0xb;
								__ax =  *__esi;
								_v88 = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = (_v20 >> 0xb) * __edi;
								__eflags = _v16 - __ecx;
								if(_v16 >= __ecx) {
									_v20 = _v20 - __ecx;
									_v16 = _v16 - __ecx;
									__cx = __ax;
									_t175 = __edx + 1; // 0x1
									__ebx = _t175;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									_v20 = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags = _v20 - 0x1000000;
								_v72 = __ebx;
								if(_v20 >= 0x1000000) {
									continue;
								} else {
									goto L48;
								}
							}
							L56:
							_t178 =  &_v56;
							 *_t178 = _v56 & 0x00000000;
							__eflags =  *_t178;
							goto L57;
						case 0xf:
							L60:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xf;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t208 =  &_v116;
							 *_t208 = _v116 + 1;
							__eflags =  *_t208;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L62:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L57:
								__al = _v72;
								_v96 = _v72;
								goto L58;
							}
							L63:
							__eax = _v92;
							__edx = __ebx + __ebx;
							__ecx = _v20;
							__esi = __edx + __eax;
							__ecx = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_t222 = __edx + 1; // 0x1
								__ebx = _t222;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L62;
							} else {
								goto L60;
							}
						case 0x10:
							L112:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x10;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t371 =  &_v116;
							 *_t371 = _v116 + 1;
							__eflags =  *_t371;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							goto L114;
						case 0x11:
							L71:
							__esi = _v92;
							_v136 = 0x12;
							goto L135;
						case 0x12:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v92;
								_v136 = 0x13;
								__esi = _v92 + 2;
								L135:
								_v88 = _t626;
								goto L136;
							}
							__eax = _v80;
							_v52 = _v52 & 0x00000000;
							__ecx = _v92;
							__eax = _v80 << 4;
							__eflags = __eax;
							__eax = _v92 + __eax + 4;
							goto L133;
						case 0x13:
							__eflags = _v68;
							if(_v68 != 0) {
								_t475 =  &_v92;
								 *_t475 = _v92 + 0x204;
								__eflags =  *_t475;
								_v52 = 0x10;
								_v68 = 8;
								L147:
								_v128 = 0x14;
								goto L148;
							}
							__eax = _v80;
							__ecx = _v92;
							__eax = _v80 << 4;
							_v52 = 8;
							__eax = _v92 + (_v80 << 4) + 0x104;
							L133:
							_v92 = __eax;
							_v68 = 3;
							goto L147;
						case 0x14:
							_v52 = _v52 + __ebx;
							__eax = _v132;
							goto L143;
						case 0x15:
							__eax = 0;
							__eflags = _v60 - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							_v60 = (__eflags >= 0) - 1 + 0xb;
							goto L123;
						case 0x16:
							__eax = _v52;
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx = _v8;
							_v68 = 6;
							__eax = __eax << 7;
							_v128 = 0x19;
							_v92 = __eax;
							goto L148;
						case 0x17:
							L148:
							__eax = _v68;
							_v84 = 1;
							_v76 = _v68;
							goto L152;
						case 0x18:
							L149:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x18;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t490 =  &_v116;
							 *_t490 = _v116 + 1;
							__eflags =  *_t490;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L151:
							_t493 =  &_v76;
							 *_t493 = _v76 - 1;
							__eflags =  *_t493;
							L152:
							__eflags = _v76;
							if(_v76 <= 0) {
								__ecx = _v68;
								__ebx = _v84;
								0 = 1;
								__eax = 1 << __cl;
								__ebx = _v84 - (1 << __cl);
								__eax = _v128;
								_v72 = __ebx;
								L143:
								_v140 = _t561;
								goto L3;
							}
							__eax = _v84;
							_v20 = _v20 >> 0xb;
							__edx = _v84 + _v84;
							__eax = _v92;
							__esi = __edx + __eax;
							_v88 = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								_v84 = __edx;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								_v84 = _v84 << 1;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L151;
							} else {
								goto L149;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								_v48 = __ebx;
								L122:
								_t399 =  &_v48;
								 *_t399 = _v48 + 1;
								__eflags =  *_t399;
								L123:
								__eax = _v48;
								__eflags = __eax;
								if(__eax == 0) {
									_v52 = _v52 | 0xffffffff;
									goto L173;
								}
								__eflags = __eax - _v100;
								if(__eax > _v100) {
									goto L174;
								}
								_v52 = _v52 + 2;
								__eax = _v52;
								_t406 =  &_v100;
								 *_t406 = _v100 + _v52;
								__eflags =  *_t406;
								goto L126;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							_v48 = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								_v76 = __ecx;
								L105:
								__eflags = _v76;
								if(_v76 <= 0) {
									__eax = __eax + __ebx;
									_v68 = 4;
									_v48 = __eax;
									__eax = _v8;
									__eax = _v8 + 0x644;
									__eflags = __eax;
									L111:
									__ebx = 0;
									_v92 = __eax;
									_v84 = 1;
									_v72 = 0;
									_v76 = 0;
									L115:
									__eax = _v68;
									__eflags = _v76 - _v68;
									if(_v76 >= _v68) {
										_t397 =  &_v48;
										 *_t397 = _v48 + __ebx;
										__eflags =  *_t397;
										goto L122;
									}
									__eax = _v84;
									_v20 = _v20 >> 0xb;
									__edi = _v84 + _v84;
									__eax = _v92;
									__esi = __edi + __eax;
									_v88 = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = (_v20 >> 0xb) * __ecx;
									__eflags = _v16 - __edx;
									if(_v16 >= __edx) {
										__ecx = 0;
										_v20 = _v20 - __edx;
										__ecx = 1;
										_v16 = _v16 - __edx;
										__ebx = 1;
										__ecx = _v76;
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx = _v72;
										__ebx = _v72 | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										_v72 = __ebx;
										 *__esi = __ax;
										_v84 = __edi;
									} else {
										_v20 = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										_v84 = _v84 << 1;
										 *__esi = __dx;
									}
									__eflags = _v20 - 0x1000000;
									if(_v20 >= 0x1000000) {
										L114:
										_t374 =  &_v76;
										 *_t374 = _v76 + 1;
										__eflags =  *_t374;
										goto L115;
									} else {
										goto L112;
									}
								}
								__ecx = _v16;
								__ebx = __ebx + __ebx;
								_v20 = _v20 >> 1;
								__eflags = _v16 - _v20;
								_v72 = __ebx;
								if(_v16 >= _v20) {
									__ecx = _v20;
									_v16 = _v16 - _v20;
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									_v72 = __ebx;
								}
								__eflags = _v20 - 0x1000000;
								if(_v20 >= 0x1000000) {
									L104:
									_t344 =  &_v76;
									 *_t344 = _v76 - 1;
									__eflags =  *_t344;
									goto L105;
								} else {
									goto L102;
								}
							}
							__edx = _v8;
							__eax = __eax - __ebx;
							_v68 = __ecx;
							__eax = _v8 + 0x55e + __eax * 2;
							goto L111;
						case 0x1a:
							L58:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1a;
								goto L173;
							}
							__ecx = _v108;
							__al = _v96;
							__edx = _v12;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_v104 = _v104 - 1;
							 *_v108 = __al;
							__ecx = _v24;
							 *(_v12 + __ecx) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t197 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t197;
							goto L82;
						case 0x1b:
							L78:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1b;
								goto L173;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__edx = _v12;
							__cl =  *(__edx + __eax);
							__eax = _v24;
							_v96 = __cl;
							 *(__edx + __eax) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t280 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t280;
							__eax = _v108;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_t289 =  &_v104;
							 *_t289 = _v104 - 1;
							__eflags =  *_t289;
							 *_v108 = __cl;
							L82:
							_v24 = __edx;
							goto L83;
						case 0x1c:
							while(1) {
								L126:
								__eflags = _v104;
								if(_v104 == 0) {
									break;
								}
								__eax = _v24;
								__eax = _v24 - _v48;
								__eflags = __eax - _v120;
								if(__eax >= _v120) {
									__eax = __eax + _v120;
									__eflags = __eax;
								}
								__edx = _v12;
								__cl =  *(__edx + __eax);
								__eax = _v24;
								_v96 = __cl;
								 *(__edx + __eax) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t420 = __eax % _v120;
								__eax = __eax / _v120;
								__edx = _t420;
								__eax = _v108;
								_v108 = _v108 + 1;
								_v104 = _v104 - 1;
								_v52 = _v52 - 1;
								__eflags = _v52;
								 *_v108 = __cl;
								_v24 = _t420;
								if(_v52 > 0) {
									continue;
								} else {
									L83:
									_v140 = 2;
									goto L3;
								}
							}
							_v140 = 0x1c;
							L173:
							_push(0x22);
							_pop(_t574);
							memcpy(_v148,  &_v140, _t574 << 2);
							return 0;
					}
				}
				L174:
				_t538 = _t537 | 0xffffffff;
				return _t538;
			}

0x00405e6b
0x00405e72
0x00405e78
0x00405e7e
0x00000000
0x00405e82
0x00405e8e
0x00405e8e
0x00405e8e
0x00405e97
0x00000000
0x00000000
0x00405e9d
0x00000000
0x00405ea4
0x00405ea8
0x00000000
0x00000000
0x00405eb1
0x00405eb4
0x00405eb7
0x00405eb9
0x00405ebb
0x00000000
0x00000000
0x00405ec1
0x00405ec4
0x00405ec6
0x00405ec7
0x00405eca
0x00405ecc
0x00405ecd
0x00405ecf
0x00405ed2
0x00405ed7
0x00405edc
0x00405ee5
0x00405ef8
0x00405efb
0x00405f04
0x00405f07
0x00405f2f
0x00405f2f
0x00405f31
0x00405f3f
0x00405f3f
0x00405f43
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f33
0x00405f33
0x00405f36
0x00405f36
0x00405f37
0x00405f37
0x00000000
0x00405f33
0x00405f09
0x00405f0d
0x00405f12
0x00405f12
0x00405f1b
0x00405f21
0x00405f23
0x00405f26
0x00000000
0x00405f2c
0x00405f2c
0x00000000
0x00405f2c
0x00000000
0x00405f49
0x00405f49
0x00405f4d
0x004067f9
0x00000000
0x004067f9
0x00405f56
0x00405f66
0x00405f69
0x00405f6c
0x00405f6c
0x00405f6c
0x00405f6f
0x00405f6f
0x00405f73
0x00000000
0x00000000
0x00405f75
0x00405f78
0x00405f7b
0x00405fa5
0x00405fab
0x00405fb2
0x00000000
0x00405fb2
0x00405f7d
0x00405f81
0x00405f84
0x00405f89
0x00405f89
0x00405f94
0x00405f9a
0x00405f9c
0x00405f9f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405fe4
0x00405fea
0x00405fed
0x00405ffa
0x00406002
0x00000000
0x00000000
0x00405fb9
0x00405fb9
0x00405fbd
0x00406808
0x00000000
0x00406808
0x00405fc9
0x00405fd4
0x00405fd4
0x00405fd4
0x00405fd7
0x00405fda
0x00405fdd
0x00405fe0
0x00405fe2
0x00000000
0x00000000
0x00000000
0x00000000
0x00406679
0x00406679
0x0040667f
0x00406685
0x00406688
0x0040668b
0x004066a5
0x004066a8
0x004066ae
0x004066b9
0x004066b9
0x004066bb
0x0040668d
0x0040668d
0x0040669c
0x004066a0
0x004066a0
0x004066be
0x004066c5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004066c7
0x004066c7
0x004066cb
0x0040687a
0x00000000
0x0040687a
0x004066d7
0x004066de
0x004066e6
0x004066e6
0x004066e6
0x004066e9
0x004066ec
0x004066ec
0x00000000
0x00000000
0x0040600a
0x0040600c
0x0040600f
0x00406080
0x00406083
0x00406086
0x0040608d
0x00406097
0x00000000
0x00406097
0x00406011
0x00406015
0x00406018
0x0040601a
0x0040601d
0x00406020
0x00406022
0x00406025
0x00406027
0x0040602c
0x0040602f
0x00406032
0x00406036
0x0040603d
0x00406040
0x00406047
0x0040604b
0x00406053
0x00406053
0x00406053
0x0040604d
0x0040604d
0x0040604d
0x00406042
0x00406042
0x00406042
0x00406057
0x0040605a
0x00406078
0x0040607a
0x00000000
0x0040607a
0x0040605c
0x0040605f
0x00406062
0x00406065
0x00406067
0x00406067
0x00406067
0x0040606a
0x0040606d
0x0040606f
0x00406070
0x00406073
0x00000000
0x00000000
0x004062a9
0x004062ad
0x004062cb
0x004062ce
0x004062d5
0x004062d8
0x004062db
0x004062de
0x004062e1
0x004062e4
0x004062e6
0x004062ed
0x004062ee
0x004062f0
0x004062f3
0x004062f6
0x004062f9
0x004062f9
0x004062fe
0x00000000
0x004062fe
0x004062af
0x004062b2
0x004062b5
0x004062bf
0x00000000
0x00000000
0x00406313
0x00406317
0x0040633a
0x0040633d
0x00406340
0x0040634a
0x00406319
0x00406319
0x0040631c
0x0040631f
0x00406322
0x0040632f
0x00406332
0x00406332
0x00000000
0x00000000
0x00406356
0x0040635a
0x00000000
0x00000000
0x00406360
0x00406364
0x00000000
0x00000000
0x0040636a
0x0040636c
0x00406370
0x00406370
0x00406373
0x00406377
0x00000000
0x00000000
0x004063c7
0x004063cb
0x004063d2
0x004063d5
0x004063d8
0x004063e2
0x00000000
0x004063e2
0x004063cd
0x00000000
0x00000000
0x004063ee
0x004063f2
0x004063f9
0x004063fc
0x004063ff
0x004063f4
0x004063f4
0x004063f4
0x00406402
0x00406405
0x00406408
0x00406408
0x0040640b
0x0040640e
0x00406411
0x00406411
0x00406414
0x0040641b
0x00406420
0x00000000
0x00000000
0x004064ae
0x004064ae
0x004064b2
0x00406850
0x00000000
0x00406850
0x004064b8
0x004064bb
0x004064be
0x004064c2
0x004064c5
0x004064cb
0x004064cd
0x004064cd
0x004064cd
0x004064d0
0x004064d3
0x00000000
0x00000000
0x004060a3
0x004060a3
0x004060a7
0x00406814
0x00000000
0x00406814
0x004060ad
0x004060b0
0x004060b3
0x004060b7
0x004060ba
0x004060c0
0x004060c2
0x004060c2
0x004060c2
0x004060c5
0x004060c8
0x004060c8
0x004060cb
0x004060ce
0x00000000
0x00000000
0x004060d4
0x004060da
0x00000000
0x00000000
0x004060e0
0x004060e0
0x004060e4
0x004060e7
0x004060ea
0x004060ed
0x004060f0
0x004060f1
0x004060f4
0x004060f6
0x004060fc
0x004060ff
0x00406102
0x00406105
0x00406108
0x0040610b
0x0040610e
0x0040612a
0x0040612d
0x00406130
0x00406133
0x0040613a
0x0040613e
0x00406140
0x00406144
0x00406110
0x00406110
0x00406114
0x0040611c
0x00406121
0x00406123
0x00406125
0x00406125
0x00406147
0x0040614e
0x00406151
0x00000000
0x00406157
0x00000000
0x00406157
0x00000000
0x0040615c
0x0040615c
0x00406160
0x00406820
0x00000000
0x00406820
0x00406166
0x00406169
0x0040616c
0x00406170
0x00406173
0x00406179
0x0040617b
0x0040617b
0x0040617b
0x0040617e
0x00406181
0x00406181
0x00406181
0x00406187
0x00000000
0x00000000
0x00406189
0x0040618c
0x0040618f
0x00406192
0x00406195
0x00406198
0x0040619b
0x0040619e
0x004061a1
0x004061a4
0x004061a7
0x004061bf
0x004061c2
0x004061c5
0x004061c8
0x004061c8
0x004061cb
0x004061cf
0x004061d1
0x004061a9
0x004061a9
0x004061b1
0x004061b6
0x004061b8
0x004061ba
0x004061ba
0x004061d4
0x004061db
0x004061de
0x00000000
0x004061e0
0x00000000
0x004061e0
0x004061de
0x004061e5
0x004061e5
0x004061e5
0x004061e5
0x00000000
0x00000000
0x00406220
0x00406220
0x00406224
0x0040682c
0x00000000
0x0040682c
0x0040622a
0x0040622d
0x00406230
0x00406234
0x00406237
0x0040623d
0x0040623f
0x0040623f
0x0040623f
0x00406242
0x00406245
0x00406245
0x0040624b
0x004061e9
0x004061e9
0x004061ec
0x00000000
0x004061ec
0x0040624d
0x0040624d
0x00406250
0x00406253
0x00406256
0x00406259
0x0040625c
0x0040625f
0x00406262
0x00406265
0x00406268
0x0040626b
0x00406283
0x00406286
0x00406289
0x0040628c
0x0040628c
0x0040628f
0x00406293
0x00406295
0x0040626d
0x0040626d
0x00406275
0x0040627a
0x0040627c
0x0040627e
0x0040627e
0x00406298
0x0040629f
0x004062a2
0x00000000
0x004062a4
0x00000000
0x004062a4
0x00000000
0x00406531
0x00406531
0x00406535
0x0040685c
0x00000000
0x0040685c
0x0040653b
0x0040653e
0x00406541
0x00406545
0x00406548
0x0040654e
0x00406550
0x00406550
0x00406550
0x00406553
0x00000000
0x00000000
0x00406301
0x00406301
0x00406304
0x00000000
0x00000000
0x00406640
0x00406644
0x00406666
0x00406669
0x00406673
0x00406676
0x00406676
0x00000000
0x00406676
0x00406646
0x00406649
0x0040664d
0x00406650
0x00406650
0x00406653
0x00000000
0x00000000
0x004066fd
0x00406701
0x0040671f
0x0040671f
0x0040671f
0x00406726
0x0040672d
0x00406734
0x00406734
0x00000000
0x00406734
0x00406703
0x00406706
0x00406709
0x0040670c
0x00406713
0x00406657
0x00406657
0x0040665a
0x00000000
0x00000000
0x004067ee
0x004067f1
0x00000000
0x00000000
0x00406428
0x0040642a
0x00406431
0x00406432
0x00406434
0x00406437
0x00000000
0x00000000
0x0040643f
0x00406442
0x00406445
0x00406447
0x00406449
0x00406449
0x0040644a
0x0040644d
0x00406454
0x00406457
0x00406465
0x00000000
0x00000000
0x0040673b
0x0040673b
0x0040673e
0x00406745
0x00000000
0x00000000
0x0040674a
0x0040674a
0x0040674e
0x00406886
0x00000000
0x00406886
0x00406754
0x00406757
0x0040675a
0x0040675e
0x00406761
0x00406767
0x00406769
0x00406769
0x00406769
0x0040676c
0x0040676f
0x0040676f
0x0040676f
0x0040676f
0x00406772
0x00406772
0x00406776
0x004067d6
0x004067d9
0x004067de
0x004067df
0x004067e1
0x004067e3
0x004067e6
0x004066f2
0x004066f2
0x00000000
0x004066f2
0x00406778
0x0040677e
0x00406781
0x00406784
0x00406787
0x0040678a
0x0040678d
0x00406790
0x00406793
0x00406796
0x00406799
0x004067b2
0x004067b5
0x004067b8
0x004067bb
0x004067bf
0x004067c1
0x004067c1
0x004067c2
0x004067c5
0x0040679b
0x0040679b
0x004067a3
0x004067a8
0x004067aa
0x004067ad
0x004067ad
0x004067c8
0x004067cf
0x00000000
0x004067d1
0x00000000
0x004067d1
0x00000000
0x0040646d
0x00406470
0x004064a6
0x004065d6
0x004065d6
0x004065d6
0x004065d6
0x004065d9
0x004065d9
0x004065dc
0x004065de
0x00406868
0x00000000
0x00406868
0x004065e4
0x004065e7
0x00000000
0x00000000
0x004065ed
0x004065f1
0x004065f4
0x004065f4
0x004065f4
0x00000000
0x004065f4
0x00406472
0x00406474
0x00406476
0x00406478
0x0040647b
0x0040647c
0x0040647e
0x00406480
0x00406483
0x00406486
0x0040649c
0x004064a1
0x004064d9
0x004064d9
0x004064dd
0x00406509
0x0040650b
0x00406512
0x00406515
0x00406518
0x00406518
0x0040651d
0x0040651d
0x0040651f
0x00406522
0x00406529
0x0040652c
0x00406559
0x00406559
0x0040655c
0x0040655f
0x004065d3
0x004065d3
0x004065d3
0x00000000
0x004065d3
0x00406561
0x00406567
0x0040656a
0x0040656d
0x00406570
0x00406573
0x00406576
0x00406579
0x0040657c
0x0040657f
0x00406582
0x0040659b
0x0040659d
0x004065a0
0x004065a1
0x004065a4
0x004065a6
0x004065a9
0x004065ab
0x004065ad
0x004065b0
0x004065b2
0x004065b5
0x004065b9
0x004065bb
0x004065bb
0x004065bc
0x004065bf
0x004065c2
0x00406584
0x00406584
0x0040658c
0x00406591
0x00406593
0x00406596
0x00406596
0x004065c5
0x004065cc
0x00406556
0x00406556
0x00406556
0x00406556
0x00000000
0x004065ce
0x00000000
0x004065ce
0x004065cc
0x004064df
0x004064e2
0x004064e4
0x004064e7
0x004064ea
0x004064ed
0x004064ef
0x004064f2
0x004064f5
0x004064f5
0x004064f8
0x004064f8
0x004064fb
0x00406502
0x004064d6
0x004064d6
0x004064d6
0x004064d6
0x00000000
0x00406504
0x00000000
0x00406504
0x00406502
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00000000
0x00000000
0x004061ef
0x004061ef
0x004061f3
0x00406838
0x00000000
0x00406838
0x004061f9
0x004061fc
0x004061ff
0x00406202
0x00406205
0x00406208
0x0040620b
0x0040620d
0x00406210
0x00406213
0x00406216
0x00406218
0x00406218
0x00406218
0x00000000
0x00000000
0x0040637a
0x0040637a
0x0040637e
0x00406844
0x00000000
0x00406844
0x00406384
0x00406387
0x0040638a
0x0040638d
0x0040638f
0x0040638f
0x0040638f
0x00406392
0x00406395
0x00406398
0x0040639b
0x0040639e
0x004063a1
0x004063a2
0x004063a4
0x004063a4
0x004063a4
0x004063a7
0x004063aa
0x004063ad
0x004063b0
0x004063b0
0x004063b0
0x004063b3
0x004063b5
0x004063b5
0x00000000
0x00000000
0x004065f7
0x004065f7
0x004065f7
0x004065fb
0x00000000
0x00000000
0x00406601
0x00406604
0x00406607
0x0040660a
0x0040660c
0x0040660c
0x0040660c
0x0040660f
0x00406612
0x00406615
0x00406618
0x0040661b
0x0040661e
0x0040661f
0x00406621
0x00406621
0x00406621
0x00406624
0x00406627
0x0040662a
0x0040662d
0x00406630
0x00406634
0x00406636
0x00406639
0x00000000
0x0040663b
0x004063b8
0x004063b8
0x00000000
0x004063b8
0x00406639
0x0040686e
0x00406890
0x00406896
0x00406898
0x0040689f
0x00000000
0x00000000
0x00405e9d
0x004068a5
0x004068a5
0x00000000

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2482ce101b79804f74797cf326f25a845d592d71d58d7df2a3bf49f74afb3583
Instruction ID: 84f98c36384fe8ee64262c0bd4aeca6ab0d9deaaf6f503267966aff3759d9c01
Opcode Fuzzy Hash: 2482ce101b79804f74797cf326f25a845d592d71d58d7df2a3bf49f74afb3583
Instruction Fuzzy Hash: DB816672D04229CBEF24CFA9C8447AEBBB0FF44305F25816AD856B7281C7785A86DF54

Uniqueness

Uniqueness Score: -1.00%

Function 004062A9 Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004062A9() {
				signed int _t539;
				unsigned short _t540;
				signed int _t541;
				void _t542;
				signed int _t543;
				signed int _t544;
				signed int _t573;
				signed int _t576;
				signed int _t597;
				signed int* _t614;
				void* _t621;

				L0:
				while(1) {
					L0:
					if( *(_t621 - 0x40) != 1) {
						 *((intOrPtr*)(_t621 - 0x80)) = 0x16;
						 *((intOrPtr*)(_t621 - 0x20)) =  *((intOrPtr*)(_t621 - 0x24));
						 *((intOrPtr*)(_t621 - 0x24)) =  *((intOrPtr*)(_t621 - 0x28));
						 *((intOrPtr*)(_t621 - 0x28)) =  *((intOrPtr*)(_t621 - 0x2c));
						 *(_t621 - 0x38) = ((0 |  *(_t621 - 0x38) - 0x00000007 >= 0x00000000) - 0x00000001 & 0x000000fd) + 0xa;
						_t539 =  *(_t621 - 4) + 0x664;
						 *(_t621 - 0x58) = _t539;
						goto L68;
					} else {
						 *(__ebp - 0x84) = 8;
						while(1) {
							L132:
							 *(_t621 - 0x54) = _t614;
							while(1) {
								L133:
								_t540 =  *_t614;
								_t597 = _t540 & 0x0000ffff;
								_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
								if( *(_t621 - 0xc) >= _t573) {
									 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
									 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
									 *(_t621 - 0x40) = 1;
									_t541 = _t540 - (_t540 >> 5);
									 *_t614 = _t541;
								} else {
									 *(_t621 - 0x10) = _t573;
									 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
									 *_t614 = (0x800 - _t597 >> 5) + _t540;
								}
								if( *(_t621 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t621 - 0x6c) == 0) {
									 *(_t621 - 0x88) = 5;
									L170:
									_t576 = 0x22;
									memcpy( *(_t621 - 0x90), _t621 - 0x88, _t576 << 2);
									_t544 = 0;
									L172:
									return _t544;
								}
								 *(_t621 - 0x10) =  *(_t621 - 0x10) << 8;
								 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
								 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
								 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
								L139:
								_t542 =  *(_t621 - 0x84);
								while(1) {
									 *(_t621 - 0x88) = _t542;
									while(1) {
										L1:
										_t543 =  *(_t621 - 0x88);
										if(_t543 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t543 * 4 +  &M004068AD))) {
											case 0:
												if( *(_t621 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t543 =  *( *(_t621 - 0x70));
												if(_t543 > 0xe1) {
													goto L171;
												}
												_t547 = _t543 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t578);
												_push(9);
												_pop(_t579);
												_t617 = _t547 / _t578;
												_t549 = _t547 % _t578 & 0x000000ff;
												asm("cdq");
												_t612 = _t549 % _t579 & 0x000000ff;
												 *(_t621 - 0x3c) = _t612;
												 *(_t621 - 0x1c) = (1 << _t617) - 1;
												 *((intOrPtr*)(_t621 - 0x18)) = (1 << _t549 / _t579) - 1;
												_t620 = (0x300 << _t612 + _t617) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t621 - 0x78))) {
													L10:
													if(_t620 == 0) {
														L12:
														 *(_t621 - 0x48) =  *(_t621 - 0x48) & 0x00000000;
														 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t620 = _t620 - 1;
														 *((short*)( *(_t621 - 4) + _t620 * 2)) = 0x400;
													} while (_t620 != 0);
													goto L12;
												}
												if( *(_t621 - 4) != 0) {
													GlobalFree( *(_t621 - 4));
												}
												_t543 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t621 - 4) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t621 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 1;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x40) =  *(_t621 - 0x40) | ( *( *(_t621 - 0x70)) & 0x000000ff) <<  *(_t621 - 0x48) << 0x00000003;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t45 = _t621 - 0x48;
												 *_t45 =  *(_t621 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t621 - 0x48) < 4) {
													goto L13;
												}
												_t555 =  *(_t621 - 0x40);
												if(_t555 ==  *(_t621 - 0x74)) {
													L20:
													 *(_t621 - 0x48) = 5;
													 *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) =  *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t621 - 0x74) = _t555;
												if( *(_t621 - 8) != 0) {
													GlobalFree( *(_t621 - 8));
												}
												_t543 = GlobalAlloc(0x40,  *(_t621 - 0x40)); // executed
												 *(_t621 - 8) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t562 =  *(_t621 - 0x60) &  *(_t621 - 0x1c);
												 *(_t621 - 0x84) = 6;
												 *(_t621 - 0x4c) = _t562;
												_t614 =  *(_t621 - 4) + (( *(_t621 - 0x38) << 4) + _t562) * 2;
												goto L132;
											case 3:
												L21:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 3;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												_t67 = _t621 - 0x70;
												 *_t67 =  &(( *(_t621 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
												L23:
												 *(_t621 - 0x48) =  *(_t621 - 0x48) - 1;
												if( *(_t621 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t540 =  *_t614;
												_t597 = _t540 & 0x0000ffff;
												_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
												if( *(_t621 - 0xc) >= _t573) {
													 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
													 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
													 *(_t621 - 0x40) = 1;
													_t541 = _t540 - (_t540 >> 5);
													 *_t614 = _t541;
												} else {
													 *(_t621 - 0x10) = _t573;
													 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
													 *_t614 = (0x800 - _t597 >> 5) + _t540;
												}
												if( *(_t621 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												goto L0;
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t258 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t258;
												0 | _t258 = _t258 + _t258 + 9;
												 *(__ebp - 0x38) = _t258 + _t258 + 9;
												goto L75;
											case 0xa:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xb;
													__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x28);
												goto L88;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												L88:
												__ecx =  *(__ebp - 0x2c);
												 *(__ebp - 0x2c) = __eax;
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												L89:
												__eax =  *(__ebp - 4);
												 *(__ebp - 0x80) = 0x15;
												__eax =  *(__ebp - 4) + 0xa68;
												 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
												goto L68;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												L68:
												_t614 =  *(_t621 - 0x58);
												 *(_t621 - 0x84) = 0x12;
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t621 - 0x88) = _t542;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t621 - 0x88) = _t542;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L79;
											case 0x1b:
												L75:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t274 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t274;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t283 = __ebp - 0x64;
												 *_t283 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t283;
												 *( *(__ebp - 0x68)) = __cl;
												L79:
												 *(__ebp - 0x14) = __edx;
												goto L80;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L80:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t544 = _t543 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x004062a9
0x004062a9
0x004062ad
0x004062ce
0x004062d5
0x004062db
0x004062e1
0x004062f3
0x004062f9
0x004062fe
0x00000000
0x004062af
0x004062b5
0x00406676
0x00406676
0x00406676
0x00406679
0x00406679
0x00406679
0x0040667f
0x00406685
0x0040668b
0x004066a5
0x004066a8
0x004066ae
0x004066b9
0x004066bb
0x0040668d
0x0040668d
0x0040669c
0x004066a0
0x004066a0
0x004066c5
0x00000000
0x00000000
0x004066c7
0x004066cb
0x0040687a
0x00406890
0x00406898
0x0040689f
0x004068a1
0x004068a8
0x004068ac
0x004068ac
0x004066d7
0x004066de
0x004066e6
0x004066e9
0x004066ec
0x004066ec
0x004066f2
0x004066f2
0x00405e8e
0x00405e8e
0x00405e8e
0x00405e97
0x00000000
0x00000000
0x00405e9d
0x00000000
0x00405ea8
0x00000000
0x00000000
0x00405eb1
0x00405eb4
0x00405eb7
0x00405ebb
0x00000000
0x00000000
0x00405ec1
0x00405ec4
0x00405ec6
0x00405ec7
0x00405eca
0x00405ecc
0x00405ecd
0x00405ecf
0x00405ed2
0x00405ed7
0x00405edc
0x00405ee5
0x00405ef8
0x00405efb
0x00405f07
0x00405f2f
0x00405f31
0x00405f3f
0x00405f3f
0x00405f43
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f33
0x00405f33
0x00405f36
0x00405f37
0x00405f37
0x00000000
0x00405f33
0x00405f0d
0x00405f12
0x00405f12
0x00405f1b
0x00405f23
0x00405f26
0x00000000
0x00405f2c
0x00405f2c
0x00000000
0x00405f2c
0x00000000
0x00405f49
0x00405f49
0x00405f4d
0x004067f9
0x00000000
0x004067f9
0x00405f56
0x00405f66
0x00405f69
0x00405f6c
0x00405f6c
0x00405f6c
0x00405f6f
0x00405f73
0x00000000
0x00000000
0x00405f75
0x00405f7b
0x00405fa5
0x00405fab
0x00405fb2
0x00000000
0x00405fb2
0x00405f81
0x00405f84
0x00405f89
0x00405f89
0x00405f94
0x00405f9c
0x00405f9f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405fe4
0x00405fea
0x00405fed
0x00405ffa
0x00406002
0x00000000
0x00000000
0x00405fb9
0x00405fb9
0x00405fbd
0x00406808
0x00000000
0x00406808
0x00405fc9
0x00405fd4
0x00405fd4
0x00405fd4
0x00405fd7
0x00405fda
0x00405fdd
0x00405fe2
0x00000000
0x00000000
0x00000000
0x00000000
0x00406679
0x00406679
0x0040667f
0x00406685
0x0040668b
0x004066a5
0x004066a8
0x004066ae
0x004066b9
0x004066bb
0x0040668d
0x0040668d
0x0040669c
0x004066a0
0x004066a0
0x004066c5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040600a
0x0040600c
0x0040600f
0x00406080
0x00406083
0x00406086
0x0040608d
0x00406097
0x00406676
0x00406676
0x00000000
0x00406676
0x00406011
0x00406015
0x00406018
0x0040601a
0x0040601d
0x00406020
0x00406022
0x00406025
0x00406027
0x0040602c
0x0040602f
0x00406032
0x00406036
0x0040603d
0x00406040
0x00406047
0x0040604b
0x00406053
0x00406053
0x00406053
0x0040604d
0x0040604d
0x0040604d
0x00406042
0x00406042
0x00406042
0x00406057
0x0040605a
0x00406078
0x0040607a
0x00000000
0x0040605c
0x0040605c
0x0040605f
0x00406062
0x00406065
0x00406067
0x00406067
0x00406067
0x0040606a
0x0040606d
0x0040606f
0x00406070
0x00406073
0x00000000
0x00406073
0x00000000
0x00000000
0x00000000
0x00406313
0x00406317
0x0040633a
0x0040633d
0x00406340
0x0040634a
0x00406319
0x00406319
0x0040631c
0x0040631f
0x00406322
0x0040632f
0x00406332
0x00406332
0x00406676
0x00406676
0x00406676
0x00000000
0x00406676
0x00000000
0x00406356
0x0040635a
0x00000000
0x00000000
0x00406360
0x00406364
0x00000000
0x00000000
0x0040636a
0x0040636c
0x00406370
0x00406370
0x00406373
0x00406377
0x00000000
0x00000000
0x004063c7
0x004063cb
0x004063d2
0x004063d5
0x004063d8
0x004063e2
0x00406676
0x00406676
0x00406676
0x00000000
0x00406676
0x00406676
0x004063cd
0x00000000
0x00000000
0x004063ee
0x004063f2
0x004063f9
0x004063fc
0x004063ff
0x004063f4
0x004063f4
0x004063f4
0x00406402
0x00406405
0x00406408
0x00406408
0x0040640b
0x0040640e
0x00406411
0x00406411
0x00406414
0x0040641b
0x00406420
0x00000000
0x00000000
0x004064ae
0x004064ae
0x004064b2
0x00406850
0x00000000
0x00406850
0x004064b8
0x004064bb
0x004064be
0x004064c2
0x004064c5
0x004064cb
0x004064cd
0x004064cd
0x004064cd
0x004064d0
0x004064d3
0x00000000
0x00000000
0x004060a3
0x004060a3
0x004060a7
0x00406814
0x00000000
0x00406814
0x004060ad
0x004060b0
0x004060b3
0x004060b7
0x004060ba
0x004060c0
0x004060c2
0x004060c2
0x004060c2
0x004060c5
0x004060c8
0x004060c8
0x004060cb
0x004060ce
0x00000000
0x00000000
0x004060d4
0x004060da
0x00000000
0x00000000
0x004060e0
0x004060e0
0x004060e4
0x004060e7
0x004060ea
0x004060ed
0x004060f0
0x004060f1
0x004060f4
0x004060f6
0x004060fc
0x004060ff
0x00406102
0x00406105
0x00406108
0x0040610b
0x0040610e
0x0040612a
0x0040612d
0x00406130
0x00406133
0x0040613a
0x0040613e
0x00406140
0x00406144
0x00406110
0x00406110
0x00406114
0x0040611c
0x00406121
0x00406123
0x00406125
0x00406125
0x00406147
0x0040614e
0x00406151
0x00000000
0x00406157
0x00000000
0x00406157
0x00000000
0x0040615c
0x0040615c
0x00406160
0x00406820
0x00000000
0x00406820
0x00406166
0x00406169
0x0040616c
0x00406170
0x00406173
0x00406179
0x0040617b
0x0040617b
0x0040617b
0x0040617e
0x00406181
0x00406181
0x00406181
0x00406187
0x00000000
0x00000000
0x00406189
0x0040618c
0x0040618f
0x00406192
0x00406195
0x00406198
0x0040619b
0x0040619e
0x004061a1
0x004061a4
0x004061a7
0x004061bf
0x004061c2
0x004061c5
0x004061c8
0x004061c8
0x004061cb
0x004061cf
0x004061d1
0x004061a9
0x004061a9
0x004061b1
0x004061b6
0x004061b8
0x004061ba
0x004061ba
0x004061d4
0x004061db
0x004061de
0x00000000
0x004061e0
0x00000000
0x004061e0
0x004061de
0x004061e5
0x004061e5
0x004061e5
0x004061e5
0x00000000
0x00000000
0x00406220
0x00406220
0x00406224
0x0040682c
0x00000000
0x0040682c
0x0040622a
0x0040622d
0x00406230
0x00406234
0x00406237
0x0040623d
0x0040623f
0x0040623f
0x0040623f
0x00406242
0x00406245
0x00406245
0x0040624b
0x004061e9
0x004061e9
0x004061ec
0x00000000
0x004061ec
0x0040624d
0x0040624d
0x00406250
0x00406253
0x00406256
0x00406259
0x0040625c
0x0040625f
0x00406262
0x00406265
0x00406268
0x0040626b
0x00406283
0x00406286
0x00406289
0x0040628c
0x0040628c
0x0040628f
0x00406293
0x00406295
0x0040626d
0x0040626d
0x00406275
0x0040627a
0x0040627c
0x0040627e
0x0040627e
0x00406298
0x0040629f
0x004062a2
0x00000000
0x004062a4
0x00000000
0x004062a4
0x00000000
0x00406531
0x00406531
0x00406535
0x0040685c
0x00000000
0x0040685c
0x0040653b
0x0040653e
0x00406541
0x00406545
0x00406548
0x0040654e
0x00406550
0x00406550
0x00406550
0x00406553
0x00000000
0x00000000
0x00406301
0x00406301
0x00406304
0x00406676
0x00406676
0x00406676
0x00000000
0x00406676
0x00000000
0x00406640
0x00406644
0x00406666
0x00406669
0x00406673
0x00406676
0x00406676
0x00406676
0x00000000
0x00406676
0x00406676
0x00406646
0x00406649
0x0040664d
0x00406650
0x00406650
0x00406653
0x00000000
0x00000000
0x004066fd
0x00406701
0x0040671f
0x0040671f
0x0040671f
0x00406726
0x0040672d
0x00406734
0x00406734
0x00000000
0x00406734
0x00406703
0x00406706
0x00406709
0x0040670c
0x00406713
0x00406657
0x00406657
0x0040665a
0x00000000
0x00000000
0x004067ee
0x004067f1
0x004066f2
0x00000000
0x00000000
0x00406428
0x0040642a
0x00406431
0x00406432
0x00406434
0x00406437
0x00000000
0x00000000
0x0040643f
0x00406442
0x00406445
0x00406447
0x00406449
0x00406449
0x0040644a
0x0040644d
0x00406454
0x00406457
0x00406465
0x00000000
0x00000000
0x0040673b
0x0040673b
0x0040673e
0x00406745
0x00000000
0x00000000
0x0040674a
0x0040674a
0x0040674e
0x00406886
0x00000000
0x00406886
0x00406754
0x00406757
0x0040675a
0x0040675e
0x00406761
0x00406767
0x00406769
0x00406769
0x00406769
0x0040676c
0x0040676f
0x0040676f
0x0040676f
0x0040676f
0x00406772
0x00406772
0x00406776
0x004067d6
0x004067d9
0x004067de
0x004067df
0x004067e1
0x004067e3
0x004067e6
0x004066f2
0x004066f2
0x00000000
0x004066f8
0x004066f2
0x00406778
0x0040677e
0x00406781
0x00406784
0x00406787
0x0040678a
0x0040678d
0x00406790
0x00406793
0x00406796
0x00406799
0x004067b2
0x004067b5
0x004067b8
0x004067bb
0x004067bf
0x004067c1
0x004067c1
0x004067c2
0x004067c5
0x0040679b
0x0040679b
0x004067a3
0x004067a8
0x004067aa
0x004067ad
0x004067ad
0x004067c8
0x004067cf
0x00000000
0x004067d1
0x00000000
0x004067d1
0x00000000
0x0040646d
0x00406470
0x004064a6
0x004065d6
0x004065d6
0x004065d6
0x004065d6
0x004065d9
0x004065d9
0x004065dc
0x004065de
0x00406868
0x00000000
0x00406868
0x004065e4
0x004065e7
0x00000000
0x00000000
0x004065ed
0x004065f1
0x004065f4
0x004065f4
0x004065f4
0x00000000
0x004065f4
0x00406472
0x00406474
0x00406476
0x00406478
0x0040647b
0x0040647c
0x0040647e
0x00406480
0x00406483
0x00406486
0x0040649c
0x004064a1
0x004064d9
0x004064d9
0x004064dd
0x00406509
0x0040650b
0x00406512
0x00406515
0x00406518
0x00406518
0x0040651d
0x0040651d
0x0040651f
0x00406522
0x00406529
0x0040652c
0x00406559
0x00406559
0x0040655c
0x0040655f
0x004065d3
0x004065d3
0x004065d3
0x00000000
0x004065d3
0x00406561
0x00406567
0x0040656a
0x0040656d
0x00406570
0x00406573
0x00406576
0x00406579
0x0040657c
0x0040657f
0x00406582
0x0040659b
0x0040659d
0x004065a0
0x004065a1
0x004065a4
0x004065a6
0x004065a9
0x004065ab
0x004065ad
0x004065b0
0x004065b2
0x004065b5
0x004065b9
0x004065bb
0x004065bb
0x004065bc
0x004065bf
0x004065c2
0x00406584
0x00406584
0x0040658c
0x00406591
0x00406593
0x00406596
0x00406596
0x004065c5
0x004065cc
0x00406556
0x00406556
0x00406556
0x00406556
0x00000000
0x004065ce
0x00000000
0x004065ce
0x004065cc
0x004064df
0x004064e2
0x004064e4
0x004064e7
0x004064ea
0x004064ed
0x004064ef
0x004064f2
0x004064f5
0x004064f5
0x004064f8
0x004064f8
0x004064fb
0x00406502
0x004064d6
0x004064d6
0x004064d6
0x004064d6
0x00000000
0x00406504
0x00000000
0x00406504
0x00406502
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00000000
0x00000000
0x004061ef
0x004061ef
0x004061f3
0x00406838
0x00000000
0x00406838
0x004061f9
0x004061fc
0x004061ff
0x00406202
0x00406205
0x00406208
0x0040620b
0x0040620d
0x00406210
0x00406213
0x00406216
0x00406218
0x00406218
0x00406218
0x00000000
0x00000000
0x0040637a
0x0040637a
0x0040637e
0x00406844
0x00000000
0x00406844
0x00406384
0x00406387
0x0040638a
0x0040638d
0x0040638f
0x0040638f
0x0040638f
0x00406392
0x00406395
0x00406398
0x0040639b
0x0040639e
0x004063a1
0x004063a2
0x004063a4
0x004063a4
0x004063a4
0x004063a7
0x004063aa
0x004063ad
0x004063b0
0x004063b0
0x004063b0
0x004063b3
0x004063b5
0x004063b5
0x00000000
0x00000000
0x004065f7
0x004065f7
0x004065f7
0x004065fb
0x00000000
0x00000000
0x00406601
0x00406604
0x00406607
0x0040660a
0x0040660c
0x0040660c
0x0040660c
0x0040660f
0x00406612
0x00406615
0x00406618
0x0040661b
0x0040661e
0x0040661f
0x00406621
0x00406621
0x00406621
0x00406624
0x00406627
0x0040662a
0x0040662d
0x00406630
0x00406634
0x00406636
0x00406639
0x00000000
0x0040663b
0x004063b8
0x004063b8
0x00000000
0x004063b8
0x00406639
0x0040686e
0x00000000
0x00000000
0x00405e9d
0x004068a5
0x004068a5
0x00000000
0x004068a5
0x004066f2
0x00406679
0x00406676
0x00000000
0x004062ad

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e377961aab5915f676f277977e9088cd48e73eb1c2f96f4c26015d5a799a0d8
Instruction ID: 87842c1f76f394e9967038b09935c6923b6a3569bddc7a9db877803d8644aafd
Opcode Fuzzy Hash: 2e377961aab5915f676f277977e9088cd48e73eb1c2f96f4c26015d5a799a0d8
Instruction Fuzzy Hash: BE711171D00229CFEF28CF98C844BADBBB1FB48305F15806AD816B7281D7789996DF54

Uniqueness

Uniqueness Score: -1.00%

Function 004063C7 Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004063C7() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xb;
						_t606 =  *(_t613 - 4) + 0x1c8 +  *(_t613 - 0x38) * 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x28);
						L88:
						 *(__ebp - 0x2c) = __eax;
						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
						L89:
						__eax =  *(__ebp - 4);
						 *(__ebp - 0x80) = 0x15;
						__eax =  *(__ebp - 4) + 0xa68;
						 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
						L69:
						 *(__ebp - 0x84) = 0x12;
						while(1) {
							L132:
							 *(_t613 - 0x54) = _t606;
							while(1) {
								L133:
								_t531 =  *_t606;
								_t589 = _t531 & 0x0000ffff;
								_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
								if( *(_t613 - 0xc) >= _t565) {
									 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
									 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
									 *(_t613 - 0x40) = 1;
									_t532 = _t531 - (_t531 >> 5);
									 *_t606 = _t532;
								} else {
									 *(_t613 - 0x10) = _t565;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									 *_t606 = (0x800 - _t589 >> 5) + _t531;
								}
								if( *(_t613 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t613 - 0x6c) == 0) {
									 *(_t613 - 0x88) = 5;
									L170:
									_t568 = 0x22;
									memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
								 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
								 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
								 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
								L139:
								_t533 =  *(_t613 - 0x84);
								while(1) {
									 *(_t613 - 0x88) = _t533;
									while(1) {
										L1:
										_t534 =  *(_t613 - 0x88);
										if(_t534 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t534 * 4 +  &M004068AD))) {
											case 0:
												if( *(_t613 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t534 =  *( *(_t613 - 0x70));
												if(_t534 > 0xe1) {
													goto L171;
												}
												_t538 = _t534 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t570);
												_push(9);
												_pop(_t571);
												_t609 = _t538 / _t570;
												_t540 = _t538 % _t570 & 0x000000ff;
												asm("cdq");
												_t604 = _t540 % _t571 & 0x000000ff;
												 *(_t613 - 0x3c) = _t604;
												 *(_t613 - 0x1c) = (1 << _t609) - 1;
												 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
												_t612 = (0x300 << _t604 + _t609) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
													L10:
													if(_t612 == 0) {
														L12:
														 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
														 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t612 = _t612 - 1;
														 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
													} while (_t612 != 0);
													goto L12;
												}
												if( *(_t613 - 4) != 0) {
													GlobalFree( *(_t613 - 4));
												}
												_t534 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t613 - 4) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 1;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t45 = _t613 - 0x48;
												 *_t45 =  *(_t613 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t613 - 0x48) < 4) {
													goto L13;
												}
												_t546 =  *(_t613 - 0x40);
												if(_t546 ==  *(_t613 - 0x74)) {
													L20:
													 *(_t613 - 0x48) = 5;
													 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t613 - 0x74) = _t546;
												if( *(_t613 - 8) != 0) {
													GlobalFree( *(_t613 - 8));
												}
												_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
												 *(_t613 - 8) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
												 *(_t613 - 0x84) = 6;
												 *(_t613 - 0x4c) = _t553;
												_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
												L132:
												 *(_t613 - 0x54) = _t606;
												goto L133;
											case 3:
												L21:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 3;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												_t67 = _t613 - 0x70;
												 *_t67 =  &(( *(_t613 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
												L23:
												 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
												if( *(_t613 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t531 =  *_t606;
												_t589 = _t531 & 0x0000ffff;
												_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
												if( *(_t613 - 0xc) >= _t565) {
													 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
													 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
													 *(_t613 - 0x40) = 1;
													_t532 = _t531 - (_t531 >> 5);
													 *_t606 = _t532;
												} else {
													 *(_t613 - 0x10) = _t565;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													 *_t606 = (0x800 - _t589 >> 5) + _t531;
												}
												if( *(_t613 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												__eflags =  *(__ebp - 0x40) - 1;
												if( *(__ebp - 0x40) != 1) {
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x80) = 0x16;
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x28);
													 *(__ebp - 0x24) =  *(__ebp - 0x28);
													__eax =  *(__ebp - 0x2c);
													 *(__ebp - 0x28) =  *(__ebp - 0x2c);
													__eax = 0;
													__eflags =  *(__ebp - 0x38) - 7;
													0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
													__al = __al & 0x000000fd;
													__eax = (__eflags >= 0) - 1 + 0xa;
													 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x664;
													__eflags = __eax;
													 *(__ebp - 0x58) = __eax;
													goto L69;
												}
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 8;
												__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t259 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t259;
												0 | _t259 = _t259 + _t259 + 9;
												 *(__ebp - 0x38) = _t259 + _t259 + 9;
												goto L76;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												goto L88;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												goto L69;
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t613 - 0x88) = _t533;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t613 - 0x88) = _t533;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L80;
											case 0x1b:
												L76:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t275 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t275;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t284 = __ebp - 0x64;
												 *_t284 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t284;
												 *( *(__ebp - 0x68)) = __cl;
												L80:
												 *(__ebp - 0x14) = __edx;
												goto L81;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L81:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t535 = _t534 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x004063c7
0x004063c7
0x004063cb
0x004063d8
0x004063e2
0x00000000
0x004063cd
0x004063cd
0x00406408
0x0040640b
0x0040640e
0x00406411
0x00406411
0x00406414
0x0040641b
0x00406420
0x00406301
0x00406304
0x00406676
0x00406676
0x00406676
0x00406679
0x00406679
0x00406679
0x0040667f
0x00406685
0x0040668b
0x004066a5
0x004066a8
0x004066ae
0x004066b9
0x004066bb
0x0040668d
0x0040668d
0x0040669c
0x004066a0
0x004066a0
0x004066c5
0x00000000
0x00000000
0x004066c7
0x004066cb
0x0040687a
0x00406890
0x00406898
0x0040689f
0x004068a1
0x004068a8
0x004068ac
0x004068ac
0x004066d7
0x004066de
0x004066e6
0x004066e9
0x004066ec
0x004066ec
0x004066f2
0x004066f2
0x00405e8e
0x00405e8e
0x00405e8e
0x00405e97
0x00000000
0x00000000
0x00405e9d
0x00000000
0x00405ea8
0x00000000
0x00000000
0x00405eb1
0x00405eb4
0x00405eb7
0x00405ebb
0x00000000
0x00000000
0x00405ec1
0x00405ec4
0x00405ec6
0x00405ec7
0x00405eca
0x00405ecc
0x00405ecd
0x00405ecf
0x00405ed2
0x00405ed7
0x00405edc
0x00405ee5
0x00405ef8
0x00405efb
0x00405f07
0x00405f2f
0x00405f31
0x00405f3f
0x00405f3f
0x00405f43
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f33
0x00405f33
0x00405f36
0x00405f37
0x00405f37
0x00000000
0x00405f33
0x00405f0d
0x00405f12
0x00405f12
0x00405f1b
0x00405f23
0x00405f26
0x00000000
0x00405f2c
0x00405f2c
0x00000000
0x00405f2c
0x00000000
0x00405f49
0x00405f49
0x00405f4d
0x004067f9
0x00000000
0x004067f9
0x00405f56
0x00405f66
0x00405f69
0x00405f6c
0x00405f6c
0x00405f6c
0x00405f6f
0x00405f73
0x00000000
0x00000000
0x00405f75
0x00405f7b
0x00405fa5
0x00405fab
0x00405fb2
0x00000000
0x00405fb2
0x00405f81
0x00405f84
0x00405f89
0x00405f89
0x00405f94
0x00405f9c
0x00405f9f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405fe4
0x00405fea
0x00405fed
0x00405ffa
0x00406002
0x00406676
0x00406676
0x00000000
0x00000000
0x00405fb9
0x00405fb9
0x00405fbd
0x00406808
0x00000000
0x00406808
0x00405fc9
0x00405fd4
0x00405fd4
0x00405fd4
0x00405fd7
0x00405fda
0x00405fdd
0x00405fe2
0x00000000
0x00000000
0x00000000
0x00000000
0x00406679
0x00406679
0x0040667f
0x00406685
0x0040668b
0x004066a5
0x004066a8
0x004066ae
0x004066b9
0x004066bb
0x0040668d
0x0040668d
0x0040669c
0x004066a0
0x004066a0
0x004066c5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040600a
0x0040600c
0x0040600f
0x00406080
0x00406083
0x00406086
0x0040608d
0x00406097
0x00406676
0x00406676
0x00406676
0x00000000
0x00406676
0x00406676
0x00406011
0x00406015
0x00406018
0x0040601a
0x0040601d
0x00406020
0x00406022
0x00406025
0x00406027
0x0040602c
0x0040602f
0x00406032
0x00406036
0x0040603d
0x00406040
0x00406047
0x0040604b
0x00406053
0x00406053
0x00406053
0x0040604d
0x0040604d
0x0040604d
0x00406042
0x00406042
0x00406042
0x00406057
0x0040605a
0x00406078
0x0040607a
0x00000000
0x0040605c
0x0040605c
0x0040605f
0x00406062
0x00406065
0x00406067
0x00406067
0x00406067
0x0040606a
0x0040606d
0x0040606f
0x00406070
0x00406073
0x00000000
0x00406073
0x00000000
0x004062a9
0x004062ad
0x004062cb
0x004062ce
0x004062d5
0x004062d8
0x004062db
0x004062de
0x004062e1
0x004062e4
0x004062e6
0x004062ed
0x004062ee
0x004062f0
0x004062f3
0x004062f6
0x004062f9
0x004062f9
0x004062fe
0x00000000
0x004062fe
0x004062af
0x004062b2
0x004062b5
0x004062bf
0x00406676
0x00406676
0x00406676
0x00000000
0x00406676
0x00000000
0x00406313
0x00406317
0x0040633a
0x0040633d
0x00406340
0x0040634a
0x00406319
0x00406319
0x0040631c
0x0040631f
0x00406322
0x0040632f
0x00406332
0x00406332
0x00406676
0x00406676
0x00406676
0x00000000
0x00406676
0x00000000
0x00406356
0x0040635a
0x00000000
0x00000000
0x00406360
0x00406364
0x00000000
0x00000000
0x0040636a
0x0040636c
0x00406370
0x00406370
0x00406373
0x00406377
0x00000000
0x00000000
0x00000000
0x00000000
0x004063ee
0x004063f2
0x004063f9
0x004063fc
0x004063ff
0x004063f4
0x004063f4
0x004063f4
0x00406402
0x00406405
0x00000000
0x00000000
0x004064ae
0x004064ae
0x004064b2
0x00406850
0x00000000
0x00406850
0x004064b8
0x004064bb
0x004064be
0x004064c2
0x004064c5
0x004064cb
0x004064cd
0x004064cd
0x004064cd
0x004064d0
0x004064d3
0x00000000
0x00000000
0x004060a3
0x004060a3
0x004060a7
0x00406814
0x00000000
0x00406814
0x004060ad
0x004060b0
0x004060b3
0x004060b7
0x004060ba
0x004060c0
0x004060c2
0x004060c2
0x004060c2
0x004060c5
0x004060c8
0x004060c8
0x004060cb
0x004060ce
0x00000000
0x00000000
0x004060d4
0x004060da
0x00000000
0x00000000
0x004060e0
0x004060e0
0x004060e4
0x004060e7
0x004060ea
0x004060ed
0x004060f0
0x004060f1
0x004060f4
0x004060f6
0x004060fc
0x004060ff
0x00406102
0x00406105
0x00406108
0x0040610b
0x0040610e
0x0040612a
0x0040612d
0x00406130
0x00406133
0x0040613a
0x0040613e
0x00406140
0x00406144
0x00406110
0x00406110
0x00406114
0x0040611c
0x00406121
0x00406123
0x00406125
0x00406125
0x00406147
0x0040614e
0x00406151
0x00000000
0x00406157
0x00000000
0x00406157
0x00000000
0x0040615c
0x0040615c
0x00406160
0x00406820
0x00000000
0x00406820
0x00406166
0x00406169
0x0040616c
0x00406170
0x00406173
0x00406179
0x0040617b
0x0040617b
0x0040617b
0x0040617e
0x00406181
0x00406181
0x00406181
0x00406187
0x00000000
0x00000000
0x00406189
0x0040618c
0x0040618f
0x00406192
0x00406195
0x00406198
0x0040619b
0x0040619e
0x004061a1
0x004061a4
0x004061a7
0x004061bf
0x004061c2
0x004061c5
0x004061c8
0x004061c8
0x004061cb
0x004061cf
0x004061d1
0x004061a9
0x004061a9
0x004061b1
0x004061b6
0x004061b8
0x004061ba
0x004061ba
0x004061d4
0x004061db
0x004061de
0x00000000
0x004061e0
0x00000000
0x004061e0
0x004061de
0x004061e5
0x004061e5
0x004061e5
0x004061e5
0x00000000
0x00000000
0x00406220
0x00406220
0x00406224
0x0040682c
0x00000000
0x0040682c
0x0040622a
0x0040622d
0x00406230
0x00406234
0x00406237
0x0040623d
0x0040623f
0x0040623f
0x0040623f
0x00406242
0x00406245
0x00406245
0x0040624b
0x004061e9
0x004061e9
0x004061ec
0x00000000
0x004061ec
0x0040624d
0x0040624d
0x00406250
0x00406253
0x00406256
0x00406259
0x0040625c
0x0040625f
0x00406262
0x00406265
0x00406268
0x0040626b
0x00406283
0x00406286
0x00406289
0x0040628c
0x0040628c
0x0040628f
0x00406293
0x00406295
0x0040626d
0x0040626d
0x00406275
0x0040627a
0x0040627c
0x0040627e
0x0040627e
0x00406298
0x0040629f
0x004062a2
0x00000000
0x004062a4
0x00000000
0x004062a4
0x00000000
0x00406531
0x00406531
0x00406535
0x0040685c
0x00000000
0x0040685c
0x0040653b
0x0040653e
0x00406541
0x00406545
0x00406548
0x0040654e
0x00406550
0x00406550
0x00406550
0x00406553
0x00000000
0x00000000
0x00000000
0x00000000
0x00406640
0x00406644
0x00406666
0x00406669
0x00406673
0x00406676
0x00406676
0x00406676
0x00000000
0x00406676
0x00406676
0x00406646
0x00406649
0x0040664d
0x00406650
0x00406650
0x00406653
0x00000000
0x00000000
0x004066fd
0x00406701
0x0040671f
0x0040671f
0x0040671f
0x00406726
0x0040672d
0x00406734
0x00406734
0x00000000
0x00406734
0x00406703
0x00406706
0x00406709
0x0040670c
0x00406713
0x00406657
0x00406657
0x0040665a
0x00000000
0x00000000
0x004067ee
0x004067f1
0x004066f2
0x00000000
0x00000000
0x00406428
0x0040642a
0x00406431
0x00406432
0x00406434
0x00406437
0x00000000
0x00000000
0x0040643f
0x00406442
0x00406445
0x00406447
0x00406449
0x00406449
0x0040644a
0x0040644d
0x00406454
0x00406457
0x00406465
0x00000000
0x00000000
0x0040673b
0x0040673b
0x0040673e
0x00406745
0x00000000
0x00000000
0x0040674a
0x0040674a
0x0040674e
0x00406886
0x00000000
0x00406886
0x00406754
0x00406757
0x0040675a
0x0040675e
0x00406761
0x00406767
0x00406769
0x00406769
0x00406769
0x0040676c
0x0040676f
0x0040676f
0x0040676f
0x0040676f
0x00406772
0x00406772
0x00406776
0x004067d6
0x004067d9
0x004067de
0x004067df
0x004067e1
0x004067e3
0x004067e6
0x004066f2
0x004066f2
0x00000000
0x004066f8
0x004066f2
0x00406778
0x0040677e
0x00406781
0x00406784
0x00406787
0x0040678a
0x0040678d
0x00406790
0x00406793
0x00406796
0x00406799
0x004067b2
0x004067b5
0x004067b8
0x004067bb
0x004067bf
0x004067c1
0x004067c1
0x004067c2
0x004067c5
0x0040679b
0x0040679b
0x004067a3
0x004067a8
0x004067aa
0x004067ad
0x004067ad
0x004067c8
0x004067cf
0x00000000
0x004067d1
0x00000000
0x004067d1
0x00000000
0x0040646d
0x00406470
0x004064a6
0x004065d6
0x004065d6
0x004065d6
0x004065d6
0x004065d9
0x004065d9
0x004065dc
0x004065de
0x00406868
0x00000000
0x00406868
0x004065e4
0x004065e7
0x00000000
0x00000000
0x004065ed
0x004065f1
0x004065f4
0x004065f4
0x004065f4
0x00000000
0x004065f4
0x00406472
0x00406474
0x00406476
0x00406478
0x0040647b
0x0040647c
0x0040647e
0x00406480
0x00406483
0x00406486
0x0040649c
0x004064a1
0x004064d9
0x004064d9
0x004064dd
0x00406509
0x0040650b
0x00406512
0x00406515
0x00406518
0x00406518
0x0040651d
0x0040651d
0x0040651f
0x00406522
0x00406529
0x0040652c
0x00406559
0x00406559
0x0040655c
0x0040655f
0x004065d3
0x004065d3
0x004065d3
0x00000000
0x004065d3
0x00406561
0x00406567
0x0040656a
0x0040656d
0x00406570
0x00406573
0x00406576
0x00406579
0x0040657c
0x0040657f
0x00406582
0x0040659b
0x0040659d
0x004065a0
0x004065a1
0x004065a4
0x004065a6
0x004065a9
0x004065ab
0x004065ad
0x004065b0
0x004065b2
0x004065b5
0x004065b9
0x004065bb
0x004065bb
0x004065bc
0x004065bf
0x004065c2
0x00406584
0x00406584
0x0040658c
0x00406591
0x00406593
0x00406596
0x00406596
0x004065c5
0x004065cc
0x00406556
0x00406556
0x00406556
0x00406556
0x00000000
0x004065ce
0x00000000
0x004065ce
0x004065cc
0x004064df
0x004064e2
0x004064e4
0x004064e7
0x004064ea
0x004064ed
0x004064ef
0x004064f2
0x004064f5
0x004064f5
0x004064f8
0x004064f8
0x004064fb
0x00406502
0x004064d6
0x004064d6
0x004064d6
0x004064d6
0x00000000
0x00406504
0x00000000
0x00406504
0x00406502
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00000000
0x00000000
0x004061ef
0x004061ef
0x004061f3
0x00406838
0x00000000
0x00406838
0x004061f9
0x004061fc
0x004061ff
0x00406202
0x00406205
0x00406208
0x0040620b
0x0040620d
0x00406210
0x00406213
0x00406216
0x00406218
0x00406218
0x00406218
0x00000000
0x00000000
0x0040637a
0x0040637a
0x0040637e
0x00406844
0x00000000
0x00406844
0x00406384
0x00406387
0x0040638a
0x0040638d
0x0040638f
0x0040638f
0x0040638f
0x00406392
0x00406395
0x00406398
0x0040639b
0x0040639e
0x004063a1
0x004063a2
0x004063a4
0x004063a4
0x004063a4
0x004063a7
0x004063aa
0x004063ad
0x004063b0
0x004063b0
0x004063b0
0x004063b3
0x004063b5
0x004063b5
0x00000000
0x00000000
0x004065f7
0x004065f7
0x004065f7
0x004065fb
0x00000000
0x00000000
0x00406601
0x00406604
0x00406607
0x0040660a
0x0040660c
0x0040660c
0x0040660c
0x0040660f
0x00406612
0x00406615
0x00406618
0x0040661b
0x0040661e
0x0040661f
0x00406621
0x00406621
0x00406621
0x00406624
0x00406627
0x0040662a
0x0040662d
0x00406630
0x00406634
0x00406636
0x00406639
0x00000000
0x0040663b
0x004063b8
0x004063b8
0x00000000
0x004063b8
0x00406639
0x0040686e
0x00000000
0x00000000
0x00405e9d
0x004068a5
0x004068a5
0x00000000
0x004068a5
0x004066f2
0x00406679
0x00406676
0x00000000
0x004063cb

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce8f1a48a343de5ee94cf1d77394f6fa9a4da1696e9cf57581d11998677c295c
Instruction ID: f29c7650ca7732be42b715054819f9ef2f9a8d26a50ddb16a6e1c9f426a403c7
Opcode Fuzzy Hash: ce8f1a48a343de5ee94cf1d77394f6fa9a4da1696e9cf57581d11998677c295c
Instruction Fuzzy Hash: C6712271E00229CBEF28CF99C844BAEBBB1FB44305F15806AD816B7281C7789996DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00406313 Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406313() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xa;
						_t606 =  *(_t613 - 4) + 0x1b0 +  *(_t613 - 0x38) * 2;
					} else {
						 *(__ebp - 0x84) = 9;
						 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
					}
					while(1) {
						 *(_t613 - 0x54) = _t606;
						while(1) {
							L133:
							_t531 =  *_t606;
							_t589 = _t531 & 0x0000ffff;
							_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
							if( *(_t613 - 0xc) >= _t565) {
								 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
								 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
								 *(_t613 - 0x40) = 1;
								_t532 = _t531 - (_t531 >> 5);
								 *_t606 = _t532;
							} else {
								 *(_t613 - 0x10) = _t565;
								 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
								 *_t606 = (0x800 - _t589 >> 5) + _t531;
							}
							if( *(_t613 - 0x10) >= 0x1000000) {
								goto L139;
							}
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								L170:
								_t568 = 0x22;
								memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
								_t535 = 0;
								L172:
								return _t535;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L139:
							_t533 =  *(_t613 - 0x84);
							while(1) {
								 *(_t613 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t613 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M004068AD))) {
										case 0:
											if( *(_t613 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t534 =  *( *(_t613 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t570);
											_push(9);
											_pop(_t571);
											_t609 = _t538 / _t570;
											_t540 = _t538 % _t570 & 0x000000ff;
											asm("cdq");
											_t604 = _t540 % _t571 & 0x000000ff;
											 *(_t613 - 0x3c) = _t604;
											 *(_t613 - 0x1c) = (1 << _t609) - 1;
											 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
											_t612 = (0x300 << _t604 + _t609) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
												L10:
												if(_t612 == 0) {
													L12:
													 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t612 = _t612 - 1;
													 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
												} while (_t612 != 0);
												goto L12;
											}
											if( *(_t613 - 4) != 0) {
												GlobalFree( *(_t613 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t613 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 1;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t45 = _t613 - 0x48;
											 *_t45 =  *(_t613 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t613 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t613 - 0x40);
											if(_t546 ==  *(_t613 - 0x74)) {
												L20:
												 *(_t613 - 0x48) = 5;
												 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t613 - 0x74) = _t546;
											if( *(_t613 - 8) != 0) {
												GlobalFree( *(_t613 - 8));
											}
											_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
											 *(_t613 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
											 *(_t613 - 0x84) = 6;
											 *(_t613 - 0x4c) = _t553;
											_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
											 *(_t613 - 0x54) = _t606;
											goto L133;
										case 3:
											L21:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 3;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											_t67 = _t613 - 0x70;
											 *_t67 =  &(( *(_t613 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
											L23:
											 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
											if( *(_t613 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t606;
											_t589 = _t531 & 0x0000ffff;
											_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
											if( *(_t613 - 0xc) >= _t565) {
												 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
												 *(_t613 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												 *_t606 = _t532;
											} else {
												 *(_t613 - 0x10) = _t565;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
												 *_t606 = (0x800 - _t589 >> 5) + _t531;
											}
											if( *(_t613 - 0x10) >= 0x1000000) {
												goto L139;
											}
										case 5:
											goto L137;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 8:
											goto L0;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L89;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t258 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t258;
											0 | _t258 = _t258 + _t258 + 9;
											 *(__ebp - 0x38) = _t258 + _t258 + 9;
											goto L75;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x28);
											goto L88;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L88:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L89:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 0x12:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *(__ebp - 0x7c) = 0x14;
												goto L145;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											 *(_t613 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											L145:
											__eax =  *(__ebp - 0x40);
											 *(__ebp - 0x50) = 1;
											 *(__ebp - 0x48) =  *(__ebp - 0x40);
											goto L149;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											L149:
											__eflags =  *(__ebp - 0x48);
											if( *(__ebp - 0x48) <= 0) {
												__ecx =  *(__ebp - 0x40);
												__ebx =  *(__ebp - 0x50);
												0 = 1;
												__eax = 1 << __cl;
												__ebx =  *(__ebp - 0x50) - (1 << __cl);
												__eax =  *(__ebp - 0x7c);
												 *(__ebp - 0x44) = __ebx;
												while(1) {
													 *(_t613 - 0x88) = _t533;
													goto L1;
												}
											}
											__eax =  *(__ebp - 0x50);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
											__eax =  *(__ebp - 0x58);
											__esi = __edx + __eax;
											 *(__ebp - 0x54) = __esi;
											__ax =  *__esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__cx = __ax >> 5;
												__eax = __eax - __ecx;
												__edx = __edx + 1;
												__eflags = __edx;
												 *__esi = __ax;
												 *(__ebp - 0x50) = __edx;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L148;
											} else {
												goto L146;
											}
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														goto L109;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													goto L99;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L79;
										case 0x1b:
											L75:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t274 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t274;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t283 = __ebp - 0x64;
											 *_t283 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t283;
											 *( *(__ebp - 0x68)) = __cl;
											L79:
											 *(__ebp - 0x14) = __edx;
											goto L80;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L80:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00000000
0x00406313
0x00406313
0x00406317
0x00406340
0x0040634a
0x00406319
0x00406322
0x0040632f
0x00406332
0x00406676
0x00406676
0x00406679
0x00406679
0x00406679
0x0040667f
0x00406685
0x0040668b
0x004066a5
0x004066a8
0x004066ae
0x004066b9
0x004066bb
0x0040668d
0x0040668d
0x0040669c
0x004066a0
0x004066a0
0x004066c5
0x00000000
0x00000000
0x004066c7
0x004066cb
0x0040687a
0x00406890
0x00406898
0x0040689f
0x004068a1
0x004068a8
0x004068ac
0x004068ac
0x004066d7
0x004066de
0x004066e6
0x004066e9
0x004066ec
0x004066ec
0x004066f2
0x004066f2
0x00405e8e
0x00405e8e
0x00405e8e
0x00405e97
0x00000000
0x00000000
0x00405e9d
0x00000000
0x00405ea8
0x00000000
0x00000000
0x00405eb1
0x00405eb4
0x00405eb7
0x00405ebb
0x00000000
0x00000000
0x00405ec1
0x00405ec4
0x00405ec6
0x00405ec7
0x00405eca
0x00405ecc
0x00405ecd
0x00405ecf
0x00405ed2
0x00405ed7
0x00405edc
0x00405ee5
0x00405ef8
0x00405efb
0x00405f07
0x00405f2f
0x00405f31
0x00405f3f
0x00405f3f
0x00405f43
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f33
0x00405f33
0x00405f36
0x00405f37
0x00405f37
0x00000000
0x00405f33
0x00405f0d
0x00405f12
0x00405f12
0x00405f1b
0x00405f23
0x00405f26
0x00000000
0x00405f2c
0x00405f2c
0x00000000
0x00405f2c
0x00000000
0x00405f49
0x00405f49
0x00405f4d
0x004067f9
0x00000000
0x004067f9
0x00405f56
0x00405f66
0x00405f69
0x00405f6c
0x00405f6c
0x00405f6c
0x00405f6f
0x00405f73
0x00000000
0x00000000
0x00405f75
0x00405f7b
0x00405fa5
0x00405fab
0x00405fb2
0x00000000
0x00405fb2
0x00405f81
0x00405f84
0x00405f89
0x00405f89
0x00405f94
0x00405f9c
0x00405f9f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405fe4
0x00405fea
0x00405fed
0x00405ffa
0x00406002
0x00406676
0x00000000
0x00000000
0x00405fb9
0x00405fb9
0x00405fbd
0x00406808
0x00000000
0x00406808
0x00405fc9
0x00405fd4
0x00405fd4
0x00405fd4
0x00405fd7
0x00405fda
0x00405fdd
0x00405fe2
0x00000000
0x00000000
0x00000000
0x00000000
0x00406679
0x00406679
0x0040667f
0x00406685
0x0040668b
0x004066a5
0x004066a8
0x004066ae
0x004066b9
0x004066bb
0x0040668d
0x0040668d
0x0040669c
0x004066a0
0x004066a0
0x004066c5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040600a
0x0040600c
0x0040600f
0x00406080
0x00406083
0x00406086
0x0040608d
0x00406097
0x00406676
0x00406676
0x00000000
0x00406676
0x00406676
0x00406011
0x00406015
0x00406018
0x0040601a
0x0040601d
0x00406020
0x00406022
0x00406025
0x00406027
0x0040602c
0x0040602f
0x00406032
0x00406036
0x0040603d
0x00406040
0x00406047
0x0040604b
0x00406053
0x00406053
0x00406053
0x0040604d
0x0040604d
0x0040604d
0x00406042
0x00406042
0x00406042
0x00406057
0x0040605a
0x00406078
0x0040607a
0x00000000
0x0040605c
0x0040605c
0x0040605f
0x00406062
0x00406065
0x00406067
0x00406067
0x00406067
0x0040606a
0x0040606d
0x0040606f
0x00406070
0x00406073
0x00000000
0x00406073
0x00000000
0x004062a9
0x004062ad
0x004062cb
0x004062ce
0x004062d5
0x004062d8
0x004062db
0x004062de
0x004062e1
0x004062e4
0x004062e6
0x004062ed
0x004062ee
0x004062f0
0x004062f3
0x004062f6
0x004062f9
0x004062f9
0x004062fe
0x00000000
0x004062fe
0x004062af
0x004062b2
0x004062b5
0x004062bf
0x00406676
0x00406676
0x00000000
0x00406676
0x00000000
0x00000000
0x00000000
0x00406356
0x0040635a
0x00000000
0x00000000
0x00406360
0x00406364
0x00000000
0x00000000
0x0040636a
0x0040636c
0x00406370
0x00406370
0x00406373
0x00406377
0x00000000
0x00000000
0x004063c7
0x004063cb
0x004063d2
0x004063d5
0x004063d8
0x004063e2
0x00406676
0x00406676
0x00000000
0x00406676
0x00406676
0x004063cd
0x00000000
0x00000000
0x004063ee
0x004063f2
0x004063f9
0x004063fc
0x004063ff
0x004063f4
0x004063f4
0x004063f4
0x00406402
0x00406405
0x00406408
0x00406408
0x0040640b
0x0040640e
0x00406411
0x00406411
0x00406414
0x0040641b
0x00406420
0x00000000
0x00000000
0x004064ae
0x004064ae
0x004064b2
0x00406850
0x00000000
0x00406850
0x004064b8
0x004064bb
0x004064be
0x004064c2
0x004064c5
0x004064cb
0x004064cd
0x004064cd
0x004064cd
0x004064d0
0x004064d3
0x00000000
0x00000000
0x004060a3
0x004060a3
0x004060a7
0x00406814
0x00000000
0x00406814
0x004060ad
0x004060b0
0x004060b3
0x004060b7
0x004060ba
0x004060c0
0x004060c2
0x004060c2
0x004060c2
0x004060c5
0x004060c8
0x004060c8
0x004060cb
0x004060ce
0x00000000
0x00000000
0x004060d4
0x004060da
0x00000000
0x00000000
0x004060e0
0x004060e0
0x004060e4
0x004060e7
0x004060ea
0x004060ed
0x004060f0
0x004060f1
0x004060f4
0x004060f6
0x004060fc
0x004060ff
0x00406102
0x00406105
0x00406108
0x0040610b
0x0040610e
0x0040612a
0x0040612d
0x00406130
0x00406133
0x0040613a
0x0040613e
0x00406140
0x00406144
0x00406110
0x00406110
0x00406114
0x0040611c
0x00406121
0x00406123
0x00406125
0x00406125
0x00406147
0x0040614e
0x00406151
0x00000000
0x00406157
0x00000000
0x00406157
0x00000000
0x0040615c
0x0040615c
0x00406160
0x00406820
0x00000000
0x00406820
0x00406166
0x00406169
0x0040616c
0x00406170
0x00406173
0x00406179
0x0040617b
0x0040617b
0x0040617b
0x0040617e
0x00406181
0x00406181
0x00406181
0x00406187
0x00000000
0x00000000
0x00406189
0x0040618c
0x0040618f
0x00406192
0x00406195
0x00406198
0x0040619b
0x0040619e
0x004061a1
0x004061a4
0x004061a7
0x004061bf
0x004061c2
0x004061c5
0x004061c8
0x004061c8
0x004061cb
0x004061cf
0x004061d1
0x004061a9
0x004061a9
0x004061b1
0x004061b6
0x004061b8
0x004061ba
0x004061ba
0x004061d4
0x004061db
0x004061de
0x00000000
0x004061e0
0x00000000
0x004061e0
0x004061de
0x004061e5
0x004061e5
0x004061e5
0x004061e5
0x00000000
0x00000000
0x00406220
0x00406220
0x00406224
0x0040682c
0x00000000
0x0040682c
0x0040622a
0x0040622d
0x00406230
0x00406234
0x00406237
0x0040623d
0x0040623f
0x0040623f
0x0040623f
0x00406242
0x00406245
0x00406245
0x0040624b
0x004061e9
0x004061e9
0x004061ec
0x00000000
0x004061ec
0x0040624d
0x0040624d
0x00406250
0x00406253
0x00406256
0x00406259
0x0040625c
0x0040625f
0x00406262
0x00406265
0x00406268
0x0040626b
0x00406283
0x00406286
0x00406289
0x0040628c
0x0040628c
0x0040628f
0x00406293
0x00406295
0x0040626d
0x0040626d
0x00406275
0x0040627a
0x0040627c
0x0040627e
0x0040627e
0x00406298
0x0040629f
0x004062a2
0x00000000
0x004062a4
0x00000000
0x004062a4
0x00000000
0x00406531
0x00406531
0x00406535
0x0040685c
0x00000000
0x0040685c
0x0040653b
0x0040653e
0x00406541
0x00406545
0x00406548
0x0040654e
0x00406550
0x00406550
0x00406550
0x00406553
0x00000000
0x00000000
0x00406301
0x00406301
0x00406304
0x00406676
0x00406676
0x00000000
0x00406676
0x00000000
0x00406640
0x00406644
0x00406666
0x00406669
0x00406673
0x00406676
0x00406676
0x00000000
0x00406676
0x00406676
0x00406646
0x00406649
0x0040664d
0x00406650
0x00406650
0x00406653
0x00000000
0x00000000
0x004066fd
0x00406701
0x0040671f
0x0040671f
0x0040671f
0x00406726
0x0040672d
0x00406734
0x00406734
0x00000000
0x00406734
0x00406703
0x00406706
0x00406709
0x0040670c
0x00406713
0x00406657
0x00406657
0x0040665a
0x00000000
0x00000000
0x004067ee
0x004067f1
0x004066f2
0x00000000
0x00000000
0x00406428
0x0040642a
0x00406431
0x00406432
0x00406434
0x00406437
0x00000000
0x00000000
0x0040643f
0x00406442
0x00406445
0x00406447
0x00406449
0x00406449
0x0040644a
0x0040644d
0x00406454
0x00406457
0x00406465
0x00000000
0x00000000
0x0040673b
0x0040673b
0x0040673e
0x00406745
0x00000000
0x00000000
0x0040674a
0x0040674a
0x0040674e
0x00406886
0x00000000
0x00406886
0x00406754
0x00406757
0x0040675a
0x0040675e
0x00406761
0x00406767
0x00406769
0x00406769
0x00406769
0x0040676c
0x0040676f
0x0040676f
0x0040676f
0x0040676f
0x00406772
0x00406772
0x00406776
0x004067d6
0x004067d9
0x004067de
0x004067df
0x004067e1
0x004067e3
0x004067e6
0x004066f2
0x004066f2
0x00000000
0x004066f8
0x004066f2
0x00406778
0x0040677e
0x00406781
0x00406784
0x00406787
0x0040678a
0x0040678d
0x00406790
0x00406793
0x00406796
0x00406799
0x004067b2
0x004067b5
0x004067b8
0x004067bb
0x004067bf
0x004067c1
0x004067c1
0x004067c2
0x004067c5
0x0040679b
0x0040679b
0x004067a3
0x004067a8
0x004067aa
0x004067ad
0x004067ad
0x004067c8
0x004067cf
0x00000000
0x004067d1
0x00000000
0x004067d1
0x00000000
0x0040646d
0x00406470
0x004064a6
0x004065d6
0x004065d6
0x004065d6
0x004065d6
0x004065d9
0x004065d9
0x004065dc
0x004065de
0x00406868
0x00000000
0x00406868
0x004065e4
0x004065e7
0x00000000
0x00000000
0x004065ed
0x004065f1
0x004065f4
0x004065f4
0x004065f4
0x00000000
0x004065f4
0x00406472
0x00406474
0x00406476
0x00406478
0x0040647b
0x0040647c
0x0040647e
0x00406480
0x00406483
0x00406486
0x0040649c
0x004064a1
0x004064d9
0x004064d9
0x004064dd
0x00406509
0x0040650b
0x00406512
0x00406515
0x00406518
0x00406518
0x0040651d
0x0040651d
0x0040651f
0x00406522
0x00406529
0x0040652c
0x00406559
0x00406559
0x0040655c
0x0040655f
0x004065d3
0x004065d3
0x004065d3
0x00000000
0x004065d3
0x00406561
0x00406567
0x0040656a
0x0040656d
0x00406570
0x00406573
0x00406576
0x00406579
0x0040657c
0x0040657f
0x00406582
0x0040659b
0x0040659d
0x004065a0
0x004065a1
0x004065a4
0x004065a6
0x004065a9
0x004065ab
0x004065ad
0x004065b0
0x004065b2
0x004065b5
0x004065b9
0x004065bb
0x004065bb
0x004065bc
0x004065bf
0x004065c2
0x00406584
0x00406584
0x0040658c
0x00406591
0x00406593
0x00406596
0x00406596
0x004065c5
0x004065cc
0x00406556
0x00406556
0x00406556
0x00406556
0x00000000
0x004065ce
0x00000000
0x004065ce
0x004065cc
0x004064df
0x004064e2
0x004064e4
0x004064e7
0x004064ea
0x004064ed
0x004064ef
0x004064f2
0x004064f5
0x004064f5
0x004064f8
0x004064f8
0x004064fb
0x00406502
0x004064d6
0x004064d6
0x004064d6
0x004064d6
0x00000000
0x00406504
0x00000000
0x00406504
0x00406502
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00000000
0x00000000
0x004061ef
0x004061ef
0x004061f3
0x00406838
0x00000000
0x00406838
0x004061f9
0x004061fc
0x004061ff
0x00406202
0x00406205
0x00406208
0x0040620b
0x0040620d
0x00406210
0x00406213
0x00406216
0x00406218
0x00406218
0x00406218
0x00000000
0x00000000
0x0040637a
0x0040637a
0x0040637e
0x00406844
0x00000000
0x00406844
0x00406384
0x00406387
0x0040638a
0x0040638d
0x0040638f
0x0040638f
0x0040638f
0x00406392
0x00406395
0x00406398
0x0040639b
0x0040639e
0x004063a1
0x004063a2
0x004063a4
0x004063a4
0x004063a4
0x004063a7
0x004063aa
0x004063ad
0x004063b0
0x004063b0
0x004063b0
0x004063b3
0x004063b5
0x004063b5
0x00000000
0x00000000
0x004065f7
0x004065f7
0x004065f7
0x004065fb
0x00000000
0x00000000
0x00406601
0x00406604
0x00406607
0x0040660a
0x0040660c
0x0040660c
0x0040660c
0x0040660f
0x00406612
0x00406615
0x00406618
0x0040661b
0x0040661e
0x0040661f
0x00406621
0x00406621
0x00406621
0x00406624
0x00406627
0x0040662a
0x0040662d
0x00406630
0x00406634
0x00406636
0x00406639
0x00000000
0x0040663b
0x004063b8
0x004063b8
0x00000000
0x004063b8
0x00406639
0x0040686e
0x00000000
0x00000000
0x00405e9d
0x004068a5
0x004068a5
0x00000000
0x004068a5
0x004066f2
0x00406679
0x00406676

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd3b2ec3f5e172a28ac146294ee31ecb58d2767ae15e01e397df032d3a520fc
Instruction ID: 150ce1bc09a2c7df66eb9a1793004520446428f7a11f196e4037732027db8909
Opcode Fuzzy Hash: cfd3b2ec3f5e172a28ac146294ee31ecb58d2767ae15e01e397df032d3a520fc
Instruction Fuzzy Hash: 31712371D00229CBEF28CF98C844BAEBBB1FF44305F15806AD816B7291C7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00401E1B Relevance: 4.5, APIs: 3, Instructions: 48
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00401E1B() {
				void* _t15;
				void* _t24;
				void* _t26;
				void* _t31;

				_t28 = E004029E8(_t24);
				E00404DE1(0xffffffeb, _t13);
				_t15 = E004052A3(_t28); // executed
				 *(_t31 + 8) = _t15;
				if(_t15 == _t24) {
					 *((intOrPtr*)(_t31 - 4)) = 1;
				} else {
					if( *((intOrPtr*)(_t31 - 0x1c)) != _t24) {
						while(WaitForSingleObject( *(_t31 + 8), 0x64) == 0x102) {
							E00405D9A(0xf);
						}
						GetExitCodeProcess( *(_t31 + 8), _t31 - 8);
						if( *((intOrPtr*)(_t31 - 0x20)) < _t24) {
							if( *(_t31 - 8) != _t24) {
								 *((intOrPtr*)(_t31 - 4)) = 1;
							}
						} else {
							E004059A1(_t26,  *(_t31 - 8));
						}
					}
					_push( *(_t31 + 8));
					CloseHandle();
				}
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t31 - 4));
				return 0;
			}

0x00401e21
0x00401e26
0x00401e2c
0x00401e33
0x00401e36
0x0040264e
0x00401e3c
0x00401e3f
0x00401e50
0x00401e4b
0x00401e4b
0x00401e65
0x00401e6e
0x00401e7e
0x00401e80
0x00401e80
0x00401e70
0x00401e74
0x00401e74
0x00401e6e
0x00401e87
0x00401e8a
0x00401e8a
0x00402880
0x0040288c

APIs

Part of subcall function 00404DE1: lstrlenA.KERNEL32(0041FC70,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E1A
Part of subcall function 00404DE1: lstrlenA.KERNEL32(00402C3C,0041FC70,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E2A
Part of subcall function 00404DE1: lstrcatA.KERNEL32(0041FC70,00402C3C,00402C3C,0041FC70,00000000,00000000,00000000), ref: 00404E3D
Part of subcall function 00404DE1: SetWindowTextA.USER32(0041FC70,0041FC70), ref: 00404E4F
Part of subcall function 00404DE1: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E75
Part of subcall function 00404DE1: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E8F
Part of subcall function 00404DE1: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E9D

Part of subcall function 004052A3: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004224A0,Error launching installer), ref: 004052C8
Part of subcall function 004052A3: CloseHandle.KERNEL32(?), ref: 004052D5

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401E55
GetExitCodeProcess.KERNEL32 ref: 00401E65
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401E8A

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcat
String ID:
API String ID: 3521207402-0
Opcode ID: 5483148f8689d3546700e9ba7d11306ac2b002d296ed6754778d7c727088f6da
Instruction ID: 163b6f721bf1a97c63a3878f1de7942b832bdb1621ef8ae7fbbde92b7b33b127
Opcode Fuzzy Hash: 5483148f8689d3546700e9ba7d11306ac2b002d296ed6754778d7c727088f6da
Instruction Fuzzy Hash: 11018C71D04104EBCF11AFA1CD85AAE7A71EF01354F20803BFA05B51E0C77D8A81DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004035A6 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004035A6() {
				void* _t1;
				void* _t2;
				void* _t3;
				void* _t6;
				signed int _t11;

				_t1 =  *0x409010; // 0xffffffff
				if(_t1 != 0xffffffff) {
					CloseHandle(_t1);
					 *0x409010 =  *0x409010 | 0xffffffff;
				}
				_t2 =  *0x409014; // 0xffffffff
				if(_t2 != 0xffffffff) {
					CloseHandle(_t2);
					 *0x409014 =  *0x409014 | 0xffffffff;
					_t11 =  *0x409014;
				}
				_t3 = E00405368(_t6, _t11, "C:\\Users\\jones\\AppData\\Local\\Temp\\nsb13F9.tmp\\", 7); // executed
				return _t3;
			}

0x004035a6
0x004035b5
0x004035b8
0x004035ba
0x004035ba
0x004035c1
0x004035c9
0x004035cc
0x004035ce
0x004035ce
0x004035ce
0x004035dc
0x004035e2

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,00403416,00000000), ref: 004035B8
CloseHandle.KERNEL32(FFFFFFFF,00000000,00403416,00000000), ref: 004035CC

Strings

C:\Users\user\AppData\Local\Temp\nsb13F9.tmp\, xrefs: 004035D7

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\nsb13F9.tmp\
API String ID: 2962429428-154548634
Opcode ID: e791c43d3f2c15357cd5853a26efddeddf9909534bf99fde0ed9ff0c6461a485
Instruction ID: f9564199049be1f32d817ae5fae54506e28515e34a5cdd4db7d8b8eaa5d9f10b
Opcode Fuzzy Hash: e791c43d3f2c15357cd5853a26efddeddf9909534bf99fde0ed9ff0c6461a485
Instruction Fuzzy Hash: 6EE0C230904A10A6C630AF3CBE499063A6C6B413317244B26F174F21F1C778AE428AA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405304 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405304(intOrPtr _a4, unsigned int _a8) {
				unsigned int _t3;
				intOrPtr _t4;
				intOrPtr _t5;
				int _t7;
				unsigned int _t8;
				signed int _t10;

				_t3 = _a8;
				_t10 = _t3 & 0x001fffff;
				if( *0x423f40 == 0) {
					L2:
					if( *0x423f48 != 0) {
						_t10 = _t10 ^ 0x00180000;
					}
					_t4 =  *0x423ea8; // 0x0
					 *0x4091f4 = _t4;
					_t5 =  *0x423ea0; // 0x400000
					 *0x4091f8 = _t5;
					 *0x4091fc = _a4;
					 *0x409200 = 0x4236a0;
					 *0x409204 = _t10; // executed
					_t7 = MessageBoxIndirectA("("); // executed
					return _t7;
				}
				_t8 = _t3 >> 0x15;
				if(_t8 == 0) {
					goto L2;
				}
				return _t8;
			}

0x00405304
0x0040530a
0x00405317
0x0040531e
0x00405325
0x00405327
0x00405327
0x0040532d
0x00405337
0x0040533c
0x00405341
0x0040534a
0x0040534f
0x00405359
0x0040535f
0x00000000
0x0040535f
0x00405319
0x0040531c
0x00000000
0x00000000
0x00405365

APIs

MessageBoxIndirectA.USER32(004091F0), ref: 0040535F

Strings

ModSource UI Addon Pack Setup, xrefs: 0040534F

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: IndirectMessage
String ID: ModSource UI Addon Pack Setup
API String ID: 1874166685-726907697
Opcode ID: 4ed8ae7cc3e653f1de06bf39d29f7cb0a97230ab46a7f82e8a902ca915a5ee7c
Instruction ID: eabdd34b4406e58b6f2f509cb26db1ea51dfe020bfbfb77917f6367e8d25c275
Opcode Fuzzy Hash: 4ed8ae7cc3e653f1de06bf39d29f7cb0a97230ab46a7f82e8a902ca915a5ee7c
Instruction Fuzzy Hash: C7F05E31600206AFD724CF28EA9871237F0F348345F80803ED550A63B2D7B84885CF08

Uniqueness

Uniqueness Score: -1.00%

Function 004024F8 Relevance: 3.1, APIs: 2, Instructions: 79
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004024F8(intOrPtr __ebx, void* __edi, void* __esi) {
				intOrPtr _t28;
				void* _t37;
				void* _t40;

				 *((intOrPtr*)(_t37 - 0x2c)) = __ebx;
				_t28 = E004029CB(2);
				_t40 = _t28 - 1;
				 *((intOrPtr*)(_t37 - 0x34)) = _t28;
				if(_t40 < 0) {
					L25:
					 *0x423f28 =  *0x423f28 +  *(_t37 - 4);
				} else {
					__ecx = 0x3ff;
					if(__eax > 0x3ff) {
						 *((intOrPtr*)(__ebp - 0x34)) = 0x3ff;
					}
					if( *__esi == __bl) {
						L22:
						__esi =  *((intOrPtr*)(__ebp - 0x2c));
						goto L23;
					} else {
						 *((char*)(__ebp + 0xb)) = __bl;
						 *(__ebp - 8) = E004059BA(__ecx, __esi);
						if( *((intOrPtr*)(__ebp - 0x34)) <= __ebx) {
							goto L22;
						} else {
							__esi =  *((intOrPtr*)(__ebp - 0x2c));
							while(1) {
								__ebp - 0x30 = __ebp - 9;
								__eax = ReadFile( *(__ebp - 8), __ebp - 9, 1, __ebp - 0x30, __ebx); // executed
								if(__eax == 0 ||  *(__ebp - 0x30) != 1) {
									break;
								}
								if( *((intOrPtr*)(__ebp - 0x18)) != __ebx) {
									 *(__ebp - 9) & 0x000000ff = E004059A1(__edi,  *(__ebp - 9) & 0x000000ff);
								} else {
									if( *((char*)(__ebp + 0xb)) == 0xd ||  *((char*)(__ebp + 0xb)) == 0xa) {
										__al =  *(__ebp - 9);
										if( *((intOrPtr*)(__ebp + 0xb)) == __al || __al != 0xd && __al != 0xa) {
											__eax = SetFilePointer( *(__ebp - 8), 0xffffffff, __ebx, 1);
										} else {
											 *((char*)(__esi + __edi)) = __al;
											__esi = __esi + 1;
										}
										break;
									} else {
										__al =  *(__ebp - 9);
										 *((char*)(__esi + __edi)) = __al;
										__esi = __esi + 1;
										 *((char*)(__ebp + 0xb)) = __al;
										if(__al == __bl) {
											break;
										} else {
											if(__esi <  *((intOrPtr*)(__ebp - 0x34))) {
												continue;
											} else {
												break;
											}
										}
									}
								}
								goto L26;
							}
							L23:
							 *((char*)(__esi + __edi)) = __bl;
							if(_t40 == 0) {
								 *(_t37 - 4) = 1;
							}
							goto L25;
						}
					}
				}
				L26:
				return 0;
			}

0x004024fa
0x004024fd
0x00402502
0x00402505
0x00402508
0x0040287d
0x00402880
0x0040250e
0x0040250e
0x00402515
0x00402517
0x00402517
0x0040251c
0x004025b0
0x004025b0
0x00000000
0x00402522
0x00402523
0x0040252e
0x00402531
0x00000000
0x00402533
0x00402533
0x00402536
0x0040253b
0x00402544
0x0040254c
0x00000000
0x00000000
0x00402557
0x00402580
0x00402559
0x0040255d
0x0040258a
0x00402590
0x004025a8
0x0040259a
0x0040259a
0x0040259d
0x0040259d
0x00000000
0x00402565
0x00402565
0x00402568
0x0040256b
0x0040256e
0x00402571
0x00000000
0x00402573
0x00402576
0x00000000
0x00402578
0x00000000
0x00402578
0x00402576
0x00402571
0x0040255d
0x00000000
0x00402557
0x004025b3
0x004025b3
0x004015a8
0x0040264e
0x0040264e
0x00000000
0x004015a8
0x00402531
0x0040251c
0x00402886
0x0040288c

APIs

ReadFile.KERNELBASE(?,?,00000001,?,?,?,00000002), ref: 00402544

Part of subcall function 004059A1: wsprintfA.USER32 ref: 004059AE

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: FileReadwsprintf
String ID:
API String ID: 3326442220-0
Opcode ID: 191ec26cefd6494aa627ba24051ae3a4623b09a6cc8d0be23cb55b7214c58b9c
Instruction ID: 815e20ce524f5b49240a6c976f1a7ca34920555b8f95ff4c8726014049068783
Opcode Fuzzy Hash: 191ec26cefd6494aa627ba24051ae3a4623b09a6cc8d0be23cb55b7214c58b9c
Instruction Fuzzy Hash: 5B21D270D05149FBDF228FA48E586AEBB749B01314F1441BBE480B63C1D2B88A81CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 004023A1 Relevance: 3.1, APIs: 2, Instructions: 57
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E004023A1(int* __ebx, char* __esi) {
				void* _t18;
				char* _t19;
				void* _t35;
				void* _t39;
				void* _t42;

				_t37 = __esi;
				_t29 = __ebx;
				_t18 = E00402AF2(_t42, 0x20019); // executed
				_t35 = _t18;
				_t19 = E004029E8(0x33);
				 *__esi = __ebx;
				if(_t35 == __ebx) {
					 *(_t39 - 4) = 1;
				} else {
					 *(_t39 - 8) = 0x3ff;
					if(RegQueryValueExA(_t35, _t19, __ebx, _t39 + 8, __esi, _t39 - 8) != 0) {
						L7:
						 *_t37 = _t29;
						 *(_t39 - 4) = 1;
					} else {
						if( *(_t39 + 8) == 4) {
							__eflags =  *(_t39 - 0x14) - __ebx;
							 *(_t39 - 4) = 0 |  *(_t39 - 0x14) == __ebx;
							E004059A1(__esi,  *__esi);
						} else {
							if( *(_t39 + 8) == 1 ||  *(_t39 + 8) == 2) {
								 *(_t39 - 4) =  *(_t39 - 0x14);
								_t37[ *(_t39 - 8)] = _t29;
							} else {
								goto L7;
							}
						}
					}
					_push(_t35);
					RegCloseKey();
				}
				 *0x423f28 =  *0x423f28 +  *(_t39 - 4);
				return 0;
			}

0x004023a1
0x004023a1
0x004023a6
0x004023ad
0x004023af
0x004023b6
0x004023b8
0x0040264e
0x004023be
0x004023c1
0x004023dc
0x00402412
0x00402412
0x00402414
0x004023de
0x004023e2
0x00402401
0x00402408
0x0040240b
0x004023e4
0x004023e7
0x004023f2
0x004023f8
0x00000000
0x00000000
0x00000000
0x004023e7
0x004023e2
0x0040246e
0x0040246f
0x0040246f
0x00402880
0x0040288c

APIs

Part of subcall function 00402AF2: RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B1A

RegQueryValueExA.ADVAPI32(00000000,00000000,?,000003FF,?,?,?,?,00000033), ref: 004023D1
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsb13F9.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040246F

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: db2a1afb6f688353670a079c476f6bbf674200faaa0c1d0cb837c1268d57a959
Instruction ID: 717a199c2dc7dc59bf44b4d86f9df1ca50c5fb7cf967777bee29523d37b730e4
Opcode Fuzzy Hash: db2a1afb6f688353670a079c476f6bbf674200faaa0c1d0cb837c1268d57a959
Instruction Fuzzy Hash: 3E118271A05205EFDB15CFA4CA4C9AE7BB4EF10354F20807FE441B72C0D6B88A45EB26

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				intOrPtr _t15;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t15 =  *0x423ed0; // 0x6ad394
					_t6 = _t17 * 0x1c + _t15;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x42368c =  *0x42368c + _t12;
						SendMessageA( *(_t18 + 0x18), 0x402, MulDiv( *0x42368c, 0x7530,  *0x423674), 0);
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x00401392
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 7b8e9ba5108b55dad21e1cb19ef7846daac3b048e1c883625bc8c045044f289d
Instruction ID: b71ad761f0ea07ecc4e6183a90c0cd8288537aab3e92bb5761005deb6e4a9b1f
Opcode Fuzzy Hash: 7b8e9ba5108b55dad21e1cb19ef7846daac3b048e1c883625bc8c045044f289d
Instruction Fuzzy Hash: 20014431B24210ABE7291B388D08B2A32ADE714315F10423FF801F32F0D678DC028B4C

Uniqueness

Uniqueness Score: -1.00%

Function 0040571A Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040571A(CHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesA(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileA(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x0040571e
0x0040572b
0x00405740
0x00405746

APIs

GetFileAttributesA.KERNELBASE(00000003,00402C9E,C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe,80000000,00000003), ref: 0040571E
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405740

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6d56aff3fab625e069b8f0f4beb3d6c68df7a2746e2dd21b0a72e0224e52029a
Instruction ID: 90a47e22fdd321f70bf06df01bfdefa11f3e73682391c7296034eb3a8fe04f39
Opcode Fuzzy Hash: 6d56aff3fab625e069b8f0f4beb3d6c68df7a2746e2dd21b0a72e0224e52029a
Instruction Fuzzy Hash: 8CD09E31658301AFEF098F20DD1AF2E7AA2EB84B00F10562CB646940E0D6715815DB16

Uniqueness

Uniqueness Score: -1.00%

Function 004056FB Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004056FB(CHAR* _a4) {
				signed char _t3;
				int _t5;

				_t3 = GetFileAttributesA(_a4); // executed
				if(_t3 != 0xffffffff) {
					_t5 = SetFileAttributesA(_a4, _t3 & 0x000000fe); // executed
					return _t5;
				}
				return _t3;
			}

0x004056ff
0x00405708
0x00405711
0x00000000
0x00405711
0x00405717

APIs

GetFileAttributesA.KERNELBASE(?,00405506,?,?,?), ref: 004056FF
SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405711

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
Instruction ID: 1a0f39e157c28011d0f8c1384ae394ffa0e61bdf00c6ebf87dc07efa44195b5a
Opcode Fuzzy Hash: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
Instruction Fuzzy Hash: 16C04CB1818506ABD6056B24DF0D81F7B66EF90321B108B35F569E00F0C7355C66EE1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402AF2 Relevance: 1.5, APIs: 1, Instructions: 22
registryCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00402AF2(void* __eflags, void* _a4) {
				signed int _t6;
				char* _t8;
				intOrPtr _t9;
				signed int _t11;

				_t6 =  *0x423f50; // 0x0
				_t8 = E004029E8(0x22);
				_t9 =  *0x40939c; // 0x19f9ec
				_t11 = RegOpenKeyExA(E00402ADD( *((intOrPtr*)(_t9 + 4))), _t8, 0, _t6 | _a4,  &_a4); // executed
				asm("sbb eax, eax");
				return  !( ~_t11) & _a4;
			}

0x00402af9
0x00402b06
0x00402b0c
0x00402b1a
0x00402b22
0x00402b2a

APIs

RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B1A

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 74efa9882ef272ee74e6f4fc3f156a8e5b49cd2219cd822f1e810691b5770b64
Instruction ID: a39c04b8538598ea337aaf08c586a8415de061dfd9d17289158aa853abfe76c1
Opcode Fuzzy Hash: 74efa9882ef272ee74e6f4fc3f156a8e5b49cd2219cd822f1e810691b5770b64
Instruction Fuzzy Hash: 88E04F76250108AFDB00DFA4ED47F9537ECA704341F008421B50CD7091C674E9408B58

Uniqueness

Uniqueness Score: -1.00%

Function 004031A8 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004031A8(void* _a4, long _a8) {
				int _t6;
				long _t10;

				_t10 = _a8;
				_t6 = ReadFile( *0x409010, _a4, _t10,  &_a8, 0); // executed
				if(_t6 == 0 || _a8 != _t10) {
					return 0;
				} else {
					return 1;
				}
			}

0x004031ac
0x004031bf
0x004031c7
0x00000000
0x004031ce
0x00000000
0x004031d0

APIs

ReadFile.KERNELBASE(00409128,00000000,00000000,00000000,00413038,0040B038,004030AD,00413038,00004000,?,00000000,?,00402F37,00000004,00000000,00000000), ref: 004031BF

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: b55c46bdf794a51955d6c22ef273c930d40ecd644cbb4da6e13cbea0766faea3
Instruction ID: b8f1ad64850fa721b7c3123cc302f733781f6218d307da9d2aa6486ecc23217a
Opcode Fuzzy Hash: b55c46bdf794a51955d6c22ef273c930d40ecd644cbb4da6e13cbea0766faea3
Instruction Fuzzy Hash: 4BE08632254119BBCF105E619C00AD73F5CEB0A3A2F008432FD55E9190D230EA11DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004031DA Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004031DA(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x409010, _a4, 0, 0); // executed
				return _t2;
			}

0x004031e8
0x004031ee

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402E86,00007DE4), ref: 004031E8

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: a4f108b6483d59a247dd719aa3338c70368b303c79d310cc125f674897935547
Instruction ID: 0cdacc43d416a0c3c320ce55ce8d4373a9ea66752a7e2c64ddc4eeaf6ba3fa4d
Opcode Fuzzy Hash: a4f108b6483d59a247dd719aa3338c70368b303c79d310cc125f674897935547
Instruction Fuzzy Hash: 49B01271644200BFDA214F00DF05F057B31B790700F108430B394380F082712420EB0D

Uniqueness

Uniqueness Score: -1.00%

Function 00405561 Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405561(CHAR* _a4, intOrPtr _a8) {
				CHAR* _t3;
				char _t4;

				_t3 = _a4;
				while(1) {
					_t4 =  *_t3;
					if(_t4 == 0) {
						break;
					}
					if(_t4 != _a8) {
						_t3 = CharNextA(_t3); // executed
						continue;
					}
					break;
				}
				return _t3;
			}

0x00405561
0x00405574
0x00405574
0x00405578
0x00000000
0x00000000
0x0040556b
0x0040556e
0x00000000
0x0040556e
0x00000000
0x0040556b
0x0040557a

APIs

CharNextA.USER32(?,004032D0,"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe",00000020), ref: 0040556E

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: 10cd4d19b72e12b0d646a530e1cb92258a05f85d45f981c2b986421ba67828a8
Instruction ID: db5ef075456721b90aa4e0f542554a171b524b6474e1f96e6382a0f96a03b25b
Opcode Fuzzy Hash: 10cd4d19b72e12b0d646a530e1cb92258a05f85d45f981c2b986421ba67828a8
Instruction Fuzzy Hash: D1C0806480C58477C91047309C24D6BBFE1FB61341F188457F4C163154C13469408F3E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404730 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 478
windowmemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00404730(struct HWND__* _a4, int _a8, unsigned int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				signed int _v16;
				intOrPtr _v20;
				void* _v24;
				long _v28;
				int _v32;
				signed int _v40;
				int _v44;
				signed int* _v56;
				intOrPtr _v60;
				signed int _v64;
				long _v68;
				void* _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t182;
				intOrPtr _t183;
				int _t189;
				int _t196;
				intOrPtr _t198;
				long _t202;
				signed int _t206;
				signed int _t217;
				void* _t220;
				void* _t221;
				int _t227;
				intOrPtr _t231;
				signed int _t232;
				signed int _t233;
				signed int _t240;
				signed int _t242;
				signed int _t245;
				signed int _t247;
				struct HBITMAP__* _t250;
				void* _t252;
				char* _t268;
				signed char _t269;
				long _t274;
				int _t280;
				signed int* _t281;
				int _t282;
				long _t283;
				signed int* _t284;
				int _t285;
				long _t286;
				signed int _t287;
				long _t288;
				signed int _t291;
				int _t294;
				signed int _t298;
				signed int _t300;
				signed int _t302;
				intOrPtr _t309;
				int* _t310;
				void* _t311;
				int _t315;
				int _t316;
				int _t317;
				signed int _t318;
				void* _t320;
				void* _t328;
				void* _t331;

				_v12 = GetDlgItem(_a4, 0x3f9);
				_t182 = GetDlgItem(_a4, 0x408);
				_t280 =  *0x423ec8; // 0x6acf7c
				_t320 = SendMessageA;
				_v8 = _t182;
				_t183 =  *0x423eb0; // 0x6acdd0
				_t315 = 0;
				_v32 = _t280;
				_v20 = _t183 + 0x94;
				if(_a8 != 0x110) {
					L23:
					__eflags = _a8 - 0x405;
					if(_a8 != 0x405) {
						_t289 = _a16;
					} else {
						_a12 = _t315;
						_t289 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					__eflags = _a8 - 0x4e;
					if(_a8 == 0x4e) {
						L28:
						__eflags = _a8 - 0x413;
						_v16 = _t289;
						if(_a8 == 0x413) {
							L30:
							__eflags =  *0x423eb9 & 0x00000002;
							if(( *0x423eb9 & 0x00000002) != 0) {
								L41:
								__eflags = _v16 - _t315;
								if(_v16 != _t315) {
									_t232 = _v16;
									__eflags =  *((intOrPtr*)(_t232 + 8)) - 0xfffffe6e;
									if( *((intOrPtr*)(_t232 + 8)) == 0xfffffe6e) {
										SendMessageA(_v8, 0x419, _t315,  *(_t232 + 0x5c));
									}
									_t233 = _v16;
									__eflags =  *((intOrPtr*)(_t233 + 8)) - 0xfffffe6a;
									if( *((intOrPtr*)(_t233 + 8)) == 0xfffffe6a) {
										__eflags =  *((intOrPtr*)(_t233 + 0xc)) - 2;
										if( *((intOrPtr*)(_t233 + 0xc)) != 2) {
											_t284 =  *(_t233 + 0x5c) * 0x418 + _t280 + 8;
											 *_t284 =  *_t284 & 0xffffffdf;
											__eflags =  *_t284;
										} else {
											 *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) =  *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							__eflags = _a8 - 0x413;
							if(_a8 == 0x413) {
								L33:
								__eflags = _a8 - 0x413;
								_t289 = 0 | _a8 != 0x00000413;
								_t240 = E004046B0(_v8, _a8 != 0x413);
								__eflags = _t240 - _t315;
								if(_t240 >= _t315) {
									_t93 = _t280 + 8; // 0x8
									_t310 = _t240 * 0x418 + _t93;
									_t289 =  *_t310;
									__eflags = _t289 & 0x00000010;
									if((_t289 & 0x00000010) == 0) {
										__eflags = _t289 & 0x00000040;
										if((_t289 & 0x00000040) == 0) {
											_t298 = _t289 ^ 0x00000001;
											__eflags = _t298;
										} else {
											_t300 = _t289 ^ 0x00000080;
											__eflags = _t300;
											if(_t300 >= 0) {
												_t298 = _t300 & 0xfffffffe;
											} else {
												_t298 = _t300 | 0x00000001;
											}
										}
										 *_t310 = _t298;
										E0040117D(_t240);
										_t242 =  *0x423eb8; // 0x80
										_t289 = 1;
										_a8 = 0x40f;
										_t245 =  !_t242 >> 0x00000008 & 1;
										__eflags = _t245;
										_a12 = 1;
										_a16 = _t245;
									}
								}
								goto L41;
							}
							_t289 = _a16;
							__eflags =  *((intOrPtr*)(_t289 + 8)) - 0xfffffffe;
							if( *((intOrPtr*)(_t289 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						}
						__eflags =  *((intOrPtr*)(_t289 + 4)) - 0x408;
						if( *((intOrPtr*)(_t289 + 4)) != 0x408) {
							goto L48;
						}
						goto L30;
					} else {
						__eflags = _a8 - 0x413;
						if(_a8 != 0x413) {
							L48:
							__eflags = _a8 - 0x111;
							if(_a8 != 0x111) {
								L56:
								__eflags = _a8 - 0x200;
								if(_a8 == 0x200) {
									SendMessageA(_v8, 0x200, _t315, _t315);
								}
								__eflags = _a8 - 0x40b;
								if(_a8 == 0x40b) {
									_t220 =  *0x420474;
									__eflags = _t220 - _t315;
									if(_t220 != _t315) {
										ImageList_Destroy(_t220);
									}
									_t221 =  *0x42048c;
									__eflags = _t221 - _t315;
									if(_t221 != _t315) {
										GlobalFree(_t221);
									}
									 *0x420474 = _t315;
									 *0x42048c = _t315;
									 *0x423f00 = _t315;
								}
								__eflags = _a8 - 0x40f;
								if(_a8 != 0x40f) {
									L86:
									__eflags = _a8 - 0x420;
									if(_a8 == 0x420) {
										__eflags =  *0x423eb9 & 0x00000001;
										if(( *0x423eb9 & 0x00000001) != 0) {
											__eflags = _a16 - 0x20;
											_t189 = (0 | _a16 == 0x00000020) << 3;
											__eflags = _t189;
											_t316 = _t189;
											ShowWindow(_v8, _t316);
											ShowWindow(GetDlgItem(_a4, 0x3fe), _t316);
										}
									}
									goto L89;
								} else {
									E004011EF(_t289, _t315, _t315);
									__eflags = _a12 - _t315;
									if(_a12 != _t315) {
										E0040140B(8);
									}
									__eflags = _a16 - _t315;
									if(_a16 == _t315) {
										L73:
										E004011EF(_t289, _t315, _t315);
										__eflags =  *0x423ecc - _t315; // 0x1
										_v32 =  *0x42048c;
										_t196 =  *0x423ec8; // 0x6acf7c
										_v60 = 0xf030;
										_v16 = _t315;
										if(__eflags <= 0) {
											L84:
											InvalidateRect(_v8, _t315, 1);
											_t198 =  *0x42367c; // 0x6ae931
											__eflags =  *((intOrPtr*)(_t198 + 0x10)) - _t315;
											if( *((intOrPtr*)(_t198 + 0x10)) != _t315) {
												E004045CE(0x3ff, 0xfffffffb, E00404683(5));
											}
											goto L86;
										} else {
											_t142 = _t196 + 8; // 0x6acf84
											_t281 = _t142;
											do {
												_t202 =  *((intOrPtr*)(_v32 + _v16 * 4));
												__eflags = _t202 - _t315;
												if(_t202 != _t315) {
													_t291 =  *_t281;
													_v68 = _t202;
													__eflags = _t291 & 0x00000001;
													_v72 = 8;
													if((_t291 & 0x00000001) != 0) {
														_t151 =  &(_t281[4]); // 0x6acf94
														_v72 = 9;
														_v56 = _t151;
														_t154 =  &(_t281[0]);
														 *_t154 = _t281[0] & 0x000000fe;
														__eflags =  *_t154;
													}
													__eflags = _t291 & 0x00000040;
													if((_t291 & 0x00000040) == 0) {
														_t206 = (_t291 & 0x00000001) + 1;
														__eflags = _t291 & 0x00000010;
														if((_t291 & 0x00000010) != 0) {
															_t206 = _t206 + 3;
															__eflags = _t206;
														}
													} else {
														_t206 = 3;
													}
													_t294 = (_t291 >> 0x00000005 & 0x00000001) + 1;
													__eflags = _t294;
													_v64 = (_t206 << 0x0000000b | _t291 & 0x00000008) + (_t206 << 0x0000000b | _t291 & 0x00000008) | _t291 & 0x00000020;
													SendMessageA(_v8, 0x1102, _t294, _v68);
													SendMessageA(_v8, 0x110d, _t315,  &_v72);
												}
												_v16 = _v16 + 1;
												_t281 =  &(_t281[0x106]);
												__eflags = _v16 -  *0x423ecc; // 0x1
											} while (__eflags < 0);
											goto L84;
										}
									} else {
										_t282 = E004012E2( *0x42048c);
										E00401299(_t282);
										_t217 = 0;
										_t289 = 0;
										__eflags = _t282 - _t315;
										if(_t282 <= _t315) {
											L72:
											SendMessageA(_v12, 0x14e, _t289, _t315);
											_a16 = _t282;
											_a8 = 0x420;
											goto L73;
										} else {
											goto L69;
										}
										do {
											L69:
											_t309 = _v20;
											__eflags =  *((intOrPtr*)(_t309 + _t217 * 4)) - _t315;
											if( *((intOrPtr*)(_t309 + _t217 * 4)) != _t315) {
												_t289 = _t289 + 1;
												__eflags = _t289;
											}
											_t217 = _t217 + 1;
											__eflags = _t217 - _t282;
										} while (_t217 < _t282);
										goto L72;
									}
								}
							}
							__eflags = _a12 - 0x3f9;
							if(_a12 != 0x3f9) {
								goto L89;
							}
							__eflags = _a12 >> 0x10 - 1;
							if(_a12 >> 0x10 != 1) {
								goto L89;
							}
							_t227 = SendMessageA(_v12, 0x147, _t315, _t315);
							__eflags = _t227 - 0xffffffff;
							if(_t227 == 0xffffffff) {
								goto L89;
							}
							_t283 = SendMessageA(_v12, 0x150, _t227, _t315);
							__eflags = _t283 - 0xffffffff;
							if(_t283 == 0xffffffff) {
								L54:
								_t283 = 0x20;
								L55:
								E00401299(_t283);
								SendMessageA(_a4, 0x420, _t315, _t283);
								_a12 = 1;
								_a16 = _t315;
								_a8 = 0x40f;
								goto L56;
							}
							_t231 = _v20;
							__eflags =  *((intOrPtr*)(_t231 + _t283 * 4)) - _t315;
							if( *((intOrPtr*)(_t231 + _t283 * 4)) != _t315) {
								goto L55;
							}
							goto L54;
						}
						goto L28;
					}
				} else {
					 *0x423f00 = _a4;
					_t247 =  *0x423ecc; // 0x1
					_t285 = 2;
					_v28 = 0;
					_v16 = _t285;
					 *0x42048c = GlobalAlloc(0x40, _t247 << 2);
					_t250 = LoadBitmapA( *0x423ea0, 0x6e);
					 *0x420480 =  *0x420480 | 0xffffffff;
					_v24 = _t250;
					 *0x420488 = SetWindowLongA(_v8, 0xfffffffc, E00404D31);
					_t252 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x420474 = _t252;
					ImageList_AddMasked(_t252, _v24, 0xff00ff);
					SendMessageA(_v8, 0x1109, _t285,  *0x420474);
					if(SendMessageA(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageA(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_v24);
					_t286 = 0;
					do {
						_t258 =  *((intOrPtr*)(_v20 + _t286 * 4));
						if( *((intOrPtr*)(_v20 + _t286 * 4)) != _t315) {
							if(_t286 != 0x20) {
								_v16 = _t315;
							}
							SendMessageA(_v12, 0x151, SendMessageA(_v12, 0x143, _t315, E00405A65(_t286, _t315, _t320, _t315, _t258)), _t286);
						}
						_t286 = _t286 + 1;
					} while (_t286 < 0x21);
					_t317 = _a16;
					_t287 = _v16;
					_push( *((intOrPtr*)(_t317 + 0x30 + _t287 * 4)));
					_push(0x15);
					E00403E37(_a4);
					_push( *((intOrPtr*)(_t317 + 0x34 + _t287 * 4)));
					_push(0x16);
					E00403E37(_a4);
					_t318 = 0;
					_t288 = 0;
					_t328 =  *0x423ecc - _t318; // 0x1
					if(_t328 <= 0) {
						L19:
						SetWindowLongA(_v8, 0xfffffff0, GetWindowLongA(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t311 = _v32 + 8;
						_v24 = _t311;
						do {
							_t268 = _t311 + 0x10;
							if( *_t268 != 0) {
								_v60 = _t268;
								_t269 =  *_t311;
								_t302 = 0x20;
								_v84 = _t288;
								_v80 = 0xffff0002;
								_v76 = 0xd;
								_v64 = _t302;
								_v40 = _t318;
								_v68 = _t269 & _t302;
								if((_t269 & 0x00000002) == 0) {
									__eflags = _t269 & 0x00000004;
									if((_t269 & 0x00000004) == 0) {
										 *( *0x42048c + _t318 * 4) = SendMessageA(_v8, 0x1100, 0,  &_v84);
									} else {
										_t288 = SendMessageA(_v8, 0x110a, 3, _t288);
									}
								} else {
									_v76 = 0x4d;
									_v44 = 1;
									_t274 = SendMessageA(_v8, 0x1100, 0,  &_v84);
									_v28 = 1;
									 *( *0x42048c + _t318 * 4) = _t274;
									_t288 =  *( *0x42048c + _t318 * 4);
								}
							}
							_t318 = _t318 + 1;
							_t311 = _v24 + 0x418;
							_t331 = _t318 -  *0x423ecc; // 0x1
							_v24 = _t311;
						} while (_t331 < 0);
						if(_v28 != 0) {
							L20:
							if(_v16 != 0) {
								E00403E6C(_v8);
								_t280 = _v32;
								_t315 = 0;
								__eflags = 0;
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E00403E6C(_v12);
								L89:
								return E00403E9E(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x0040474e
0x00404754
0x00404756
0x0040475c
0x00404762
0x00404765
0x0040476f
0x00404778
0x0040477b
0x0040477e
0x004049a6
0x004049a6
0x004049ad
0x004049c1
0x004049af
0x004049b1
0x004049b4
0x004049b5
0x004049bc
0x004049bc
0x004049c4
0x004049cd
0x004049d8
0x004049d8
0x004049db
0x004049de
0x004049ed
0x004049ed
0x004049f4
0x00404a6c
0x00404a6c
0x00404a6f
0x00404a71
0x00404a74
0x00404a7b
0x00404a89
0x00404a89
0x00404a8b
0x00404a8e
0x00404a95
0x00404a97
0x00404a9b
0x00404ab8
0x00404abc
0x00404abc
0x00404a9d
0x00404aaa
0x00404aaa
0x00404a9b
0x00404a95
0x00000000
0x00404a6f
0x004049f6
0x004049f9
0x00404a04
0x00404a06
0x00404a09
0x00404a10
0x00404a15
0x00404a17
0x00404a21
0x00404a21
0x00404a25
0x00404a27
0x00404a2a
0x00404a2c
0x00404a2f
0x00404a45
0x00404a45
0x00404a31
0x00404a31
0x00404a37
0x00404a39
0x00404a40
0x00404a3b
0x00404a3b
0x00404a3b
0x00404a39
0x00404a49
0x00404a4b
0x00404a50
0x00404a59
0x00404a5a
0x00404a64
0x00404a64
0x00404a66
0x00404a69
0x00404a69
0x00404a2a
0x00000000
0x00404a17
0x004049fb
0x004049fe
0x00404a02
0x00000000
0x00000000
0x00000000
0x00404a02
0x004049e0
0x004049e7
0x00000000
0x00000000
0x00000000
0x004049cf
0x004049cf
0x004049d2
0x00404abf
0x00404abf
0x00404ac6
0x00404b3a
0x00404b3a
0x00404b41
0x00404b4d
0x00404b4d
0x00404b4f
0x00404b56
0x00404b58
0x00404b5d
0x00404b5f
0x00404b62
0x00404b62
0x00404b68
0x00404b6d
0x00404b6f
0x00404b72
0x00404b72
0x00404b78
0x00404b7e
0x00404b84
0x00404b84
0x00404b8a
0x00404b91
0x00404cde
0x00404cde
0x00404ce5
0x00404ce7
0x00404cee
0x00404cf2
0x00404cff
0x00404cff
0x00404d02
0x00404d08
0x00404d1a
0x00404d1a
0x00404cee
0x00000000
0x00404b97
0x00404b99
0x00404b9e
0x00404ba1
0x00404ba5
0x00404ba5
0x00404baa
0x00404bad
0x00404bee
0x00404bf0
0x00404bfa
0x00404c00
0x00404c03
0x00404c08
0x00404c0f
0x00404c12
0x00404cb4
0x00404cba
0x00404cc0
0x00404cc5
0x00404cc8
0x00404cd9
0x00404cd9
0x00000000
0x00404c18
0x00404c18
0x00404c18
0x00404c1b
0x00404c21
0x00404c24
0x00404c26
0x00404c28
0x00404c2a
0x00404c2d
0x00404c30
0x00404c37
0x00404c39
0x00404c3c
0x00404c43
0x00404c46
0x00404c46
0x00404c46
0x00404c46
0x00404c4a
0x00404c4d
0x00404c59
0x00404c5a
0x00404c5d
0x00404c5f
0x00404c5f
0x00404c5f
0x00404c4f
0x00404c51
0x00404c51
0x00404c7e
0x00404c7e
0x00404c7f
0x00404c8b
0x00404c9a
0x00404c9a
0x00404c9c
0x00404c9f
0x00404ca8
0x00404ca8
0x00000000
0x00404c1b
0x00404baf
0x00404bba
0x00404bbd
0x00404bc2
0x00404bc4
0x00404bc6
0x00404bc8
0x00404bd8
0x00404be2
0x00404be4
0x00404be7
0x00000000
0x00000000
0x00000000
0x00000000
0x00404bca
0x00404bca
0x00404bca
0x00404bcd
0x00404bd0
0x00404bd2
0x00404bd2
0x00404bd2
0x00404bd3
0x00404bd4
0x00404bd4
0x00000000
0x00404bca
0x00404bad
0x00404b91
0x00404ac8
0x00404ace
0x00000000
0x00000000
0x00404ada
0x00404ade
0x00000000
0x00000000
0x00404aee
0x00404af0
0x00404af3
0x00000000
0x00000000
0x00404b05
0x00404b07
0x00404b0a
0x00404b14
0x00404b16
0x00404b17
0x00404b18
0x00404b27
0x00404b29
0x00404b30
0x00404b33
0x00000000
0x00404b33
0x00404b0c
0x00404b0f
0x00404b12
0x00000000
0x00000000
0x00000000
0x00404b12
0x00000000
0x004049d2
0x00404784
0x00404789
0x0040478e
0x00404793
0x00404794
0x0040479d
0x004047a8
0x004047b3
0x004047b9
0x004047c7
0x004047dc
0x004047e1
0x004047ec
0x004047f5
0x0040480a
0x0040481b
0x00404828
0x00404828
0x0040482d
0x00404833
0x00404835
0x00404838
0x0040483d
0x00404842
0x00404844
0x00404844
0x00404864
0x00404864
0x00404866
0x00404867
0x0040486c
0x0040486f
0x00404872
0x00404876
0x0040487b
0x00404880
0x00404884
0x00404889
0x0040488e
0x00404890
0x00404892
0x00404898
0x00404962
0x00404975
0x00000000
0x0040489e
0x004048a1
0x004048a4
0x004048a7
0x004048a7
0x004048ad
0x004048b3
0x004048b6
0x004048bc
0x004048bd
0x004048c2
0x004048cb
0x004048d2
0x004048d5
0x004048d8
0x004048db
0x00404915
0x00404917
0x00404940
0x00404919
0x00404926
0x00404926
0x004048dd
0x004048e0
0x004048ef
0x004048f9
0x00404901
0x00404908
0x00404910
0x00404910
0x004048db
0x00404946
0x00404947
0x0040494d
0x00404953
0x00404953
0x00404960
0x0040497b
0x0040497f
0x0040499c
0x004049a1
0x004049a4
0x004049a4
0x00000000
0x00404981
0x00404986
0x0040498f
0x00404d1c
0x00404d2e
0x00404d2e
0x0040497f
0x00000000
0x00404960
0x00404898

APIs

GetDlgItem.USER32 ref: 00404747
GetDlgItem.USER32 ref: 00404754
GlobalAlloc.KERNEL32(00000040,00000001), ref: 004047A0
LoadBitmapA.USER32 ref: 004047B3
SetWindowLongA.USER32 ref: 004047CD
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004047E1
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 004047F5
SendMessageA.USER32(?,00001109,00000002), ref: 0040480A
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404816
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404828
DeleteObject.GDI32(?), ref: 0040482D
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404858
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404864
SendMessageA.USER32(?,00001100,00000000,?), ref: 004048F9
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404924
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404938
GetWindowLongA.USER32 ref: 00404967
SetWindowLongA.USER32 ref: 00404975
ShowWindow.USER32(?,00000005), ref: 00404986
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404A89
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404AEE
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404B03
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404B27
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404B4D
ImageList_Destroy.COMCTL32(?), ref: 00404B62
GlobalFree.KERNEL32 ref: 00404B72
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404BE2
SendMessageA.USER32(?,00001102,00000410,?), ref: 00404C8B
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404C9A
InvalidateRect.USER32(?,00000000,00000001), ref: 00404CBA
ShowWindow.USER32(?,00000000), ref: 00404D08
GetDlgItem.USER32 ref: 00404D13
ShowWindow.USER32(00000000), ref: 00404D1A

Strings

, xrefs: 00404CF2
N, xrefs: 004049C4
M, xrefs: 004048E0
1j, xrefs: 00404CC0

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $1j$M$N
API String ID: 1638840714-1549960456
Opcode ID: 56c99f3a0f6c519e682ece0615a0cb18f623ba1a930f717a2223d941dacd93ec
Instruction ID: fb58c968ba9f4d14096cd3b519f9cb2dcf6b811396bab046f3000754b75b80e4
Opcode Fuzzy Hash: 56c99f3a0f6c519e682ece0615a0cb18f623ba1a930f717a2223d941dacd93ec
Instruction Fuzzy Hash: A5029EB0A00209AFDB21DF64CC45AAE7BB5FB84315F10817AF610BA2E1D7799A41CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00404F1F Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 278
windowclipboardmemoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00404F1F(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t87;
				unsigned int _t92;
				unsigned int _t93;
				int _t94;
				int _t95;
				long _t98;
				void* _t101;
				intOrPtr _t112;
				intOrPtr _t123;
				struct HWND__* _t127;
				int _t149;
				int _t150;
				struct HWND__* _t154;
				struct HWND__* _t158;
				struct HMENU__* _t160;
				long _t162;
				void* _t163;
				short* _t164;

				_t154 =  *0x423684; // 0x0
				_t149 = 0;
				_v8 = _t154;
				if(_a8 != 0x110) {
					__eflags = _a8 - 0x405;
					if(_a8 == 0x405) {
						CloseHandle(CreateThread(0, 0, E00404EB3, GetDlgItem(_a4, 0x3ec), 0,  &_v12));
					}
					__eflags = _a8 - 0x111;
					if(_a8 != 0x111) {
						L17:
						__eflags = _a8 - 0x404;
						if(_a8 != 0x404) {
							L25:
							__eflags = _a8 - 0x7b;
							if(_a8 != 0x7b) {
								goto L20;
							}
							__eflags = _a12 - _t154;
							if(_a12 != _t154) {
								goto L20;
							}
							_t87 = SendMessageA(_t154, 0x1004, _t149, _t149);
							__eflags = _t87 - _t149;
							_a8 = _t87;
							if(_t87 <= _t149) {
								L37:
								return 0;
							}
							_t160 = CreatePopupMenu();
							AppendMenuA(_t160, _t149, 1, E00405A65(_t149, _t154, _t160, _t149, 0xffffffe1));
							_t92 = _a16;
							__eflags = _t92 - 0xffffffff;
							if(_t92 != 0xffffffff) {
								_t150 = _t92;
								_t93 = _t92 >> 0x10;
								__eflags = _t93;
								_t94 = _t93;
							} else {
								GetWindowRect(_t154,  &_v28);
								_t150 = _v28.left;
								_t94 = _v28.top;
							}
							_t95 = TrackPopupMenu(_t160, 0x180, _t150, _t94, _t149, _a4, _t149);
							_t162 = 1;
							__eflags = _t95 - 1;
							if(_t95 == 1) {
								_v60 = _t149;
								_v48 = 0x420498;
								_v44 = 0xfff;
								_a4 = _a8;
								do {
									_a4 = _a4 - 1;
									_t98 = SendMessageA(_v8, 0x102d, _a4,  &_v68);
									__eflags = _a4 - _t149;
									_t162 = _t162 + _t98 + 2;
								} while (_a4 != _t149);
								OpenClipboard(_t149);
								EmptyClipboard();
								_t101 = GlobalAlloc(0x42, _t162);
								_a4 = _t101;
								_t163 = GlobalLock(_t101);
								do {
									_v48 = _t163;
									_t164 = _t163 + SendMessageA(_v8, 0x102d, _t149,  &_v68);
									 *_t164 = 0xa0d;
									_t163 = _t164 + 2;
									_t149 = _t149 + 1;
									__eflags = _t149 - _a8;
								} while (_t149 < _a8);
								GlobalUnlock(_a4);
								SetClipboardData(1, _a4);
								CloseClipboard();
							}
							goto L37;
						}
						__eflags =  *0x42366c - _t149; // 0x1
						if(__eflags == 0) {
							ShowWindow( *0x423ea8, 8);
							__eflags =  *0x423f2c - _t149; // 0x0
							if(__eflags == 0) {
								_t112 =  *0x41fc68; // 0x0
								E00404DE1( *((intOrPtr*)(_t112 + 0x34)), _t149);
							}
							E00403E10(1);
							goto L25;
						}
						 *0x41f860 = 2;
						E00403E10(0x78);
						goto L20;
					} else {
						__eflags = _a12 - 0x403;
						if(_a12 != 0x403) {
							L20:
							return E00403E9E(_a8, _a12, _a16);
						}
						ShowWindow( *0x423670, _t149);
						ShowWindow(_t154, 8);
						E00403E6C(_t154);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_v60 = 2;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t123 =  *0x423eb0; // 0x6acdd0
				_a8 =  *((intOrPtr*)(_t123 + 0x5c));
				_a12 =  *((intOrPtr*)(_t123 + 0x60));
				 *0x423670 = GetDlgItem(_a4, 0x403);
				 *0x423668 = GetDlgItem(_a4, 0x3ee);
				_t127 = GetDlgItem(_a4, 0x3f8);
				 *0x423684 = _t127;
				_v8 = _t127;
				E00403E6C( *0x423670);
				 *0x423674 = E00404683(4);
				 *0x42368c = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(0x15);
				SendMessageA(_v8, 0x101b, 0,  &_v60);
				SendMessageA(_v8, 0x1036, 0x4000, 0x4000);
				if(_a8 >= 0) {
					SendMessageA(_v8, 0x1001, 0, _a8);
					SendMessageA(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t149) {
					SendMessageA(_v8, 0x1024, _t149, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E00403E37(_a4);
				if(( *0x423eb8 & 0x00000003) != 0) {
					ShowWindow( *0x423670, _t149);
					if(( *0x423eb8 & 0x00000002) != 0) {
						 *0x423670 = _t149;
					} else {
						ShowWindow(_v8, 8);
					}
					E00403E6C( *0x423668);
				}
				_t158 = GetDlgItem(_a4, 0x3ec);
				SendMessageA(_t158, 0x401, _t149, 0x75300000);
				if(( *0x423eb8 & 0x00000004) != 0) {
					SendMessageA(_t158, 0x409, _t149, _a12);
					SendMessageA(_t158, 0x2001, _t149, _a8);
				}
				goto L37;
			}

0x00404f28
0x00404f2e
0x00404f37
0x00404f3a
0x004050cb
0x004050d2
0x004050f6
0x004050f6
0x004050fc
0x00405109
0x00405127
0x00405127
0x0040512e
0x00405185
0x00405185
0x00405189
0x00000000
0x00000000
0x0040518b
0x0040518e
0x00000000
0x00000000
0x00405198
0x0040519e
0x004051a0
0x004051a3
0x0040529c
0x00000000
0x0040529c
0x004051b2
0x004051be
0x004051c4
0x004051c7
0x004051ca
0x004051df
0x004051e2
0x004051e2
0x004051e5
0x004051cc
0x004051d1
0x004051d7
0x004051da
0x004051da
0x004051f5
0x004051fd
0x004051fe
0x00405200
0x00405209
0x0040520c
0x00405213
0x0040521a
0x00405222
0x00405222
0x00405230
0x00405236
0x00405239
0x00405239
0x00405240
0x00405246
0x0040524f
0x00405256
0x0040525f
0x00405261
0x00405264
0x00405273
0x00405275
0x0040527b
0x0040527c
0x0040527d
0x0040527d
0x00405285
0x00405290
0x00405296
0x00405296
0x00000000
0x00405200
0x00405130
0x00405136
0x00405166
0x00405168
0x0040516e
0x00405170
0x00405179
0x00405179
0x00405180
0x00000000
0x00405180
0x0040513a
0x00405144
0x00000000
0x0040510b
0x0040510b
0x00405111
0x00405149
0x00000000
0x00405152
0x0040511a
0x0040511f
0x00405122
0x00000000
0x00405122
0x00405109
0x00404f40
0x00404f44
0x00404f4d
0x00404f54
0x00404f57
0x00404f5a
0x00404f5d
0x00404f5e
0x00404f5f
0x00404f78
0x00404f7b
0x00404f85
0x00404f94
0x00404f9c
0x00404fa4
0x00404fa9
0x00404fac
0x00404fb8
0x00404fc1
0x00404fca
0x00404fed
0x00404ff3
0x00405004
0x00405009
0x00405017
0x00405025
0x00405025
0x0040502a
0x00405038
0x00405038
0x0040503d
0x00405040
0x00405045
0x00405051
0x0040505a
0x00405067
0x00405076
0x00405069
0x0040506e
0x0040506e
0x00405082
0x00405082
0x00405096
0x0040509f
0x004050a8
0x004050b8
0x004050c4
0x004050c4
0x00000000

APIs

GetDlgItem.USER32 ref: 00404F7E
GetDlgItem.USER32 ref: 00404F8D
GetClientRect.USER32 ref: 00404FCA
GetSystemMetrics.USER32 ref: 00404FD2
SendMessageA.USER32(?,0000101B,00000000,00000002), ref: 00404FF3
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405004
SendMessageA.USER32(?,00001001,00000000,00000110), ref: 00405017
SendMessageA.USER32(?,00001026,00000000,00000110), ref: 00405025
SendMessageA.USER32(?,00001024,00000000,?), ref: 00405038
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040505A
ShowWindow.USER32(?,00000008), ref: 0040506E
GetDlgItem.USER32 ref: 0040508F
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 0040509F
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004050B8
SendMessageA.USER32(00000000,00002001,00000000,00000110), ref: 004050C4
GetDlgItem.USER32 ref: 00404F9C

Part of subcall function 00403E6C: SendMessageA.USER32(00000028,?,00000001,00403C9D), ref: 00403E7A

GetDlgItem.USER32 ref: 004050E1
CreateThread.KERNEL32 ref: 004050EF
CloseHandle.KERNEL32(00000000), ref: 004050F6
ShowWindow.USER32(00000000), ref: 0040511A
ShowWindow.USER32(00000000,00000008), ref: 0040511F
ShowWindow.USER32(00000008), ref: 00405166
SendMessageA.USER32(00000000,00001004,00000000,00000000), ref: 00405198
CreatePopupMenu.USER32 ref: 004051A9
AppendMenuA.USER32 ref: 004051BE
GetWindowRect.USER32 ref: 004051D1
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004051F5
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405230
OpenClipboard.USER32(00000000), ref: 00405240
EmptyClipboard.USER32(?,?,00000000,?,00000000), ref: 00405246
GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 0040524F
GlobalLock.KERNEL32 ref: 00405259
SendMessageA.USER32(?,0000102D,00000000,?), ref: 0040526D
GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00405285
SetClipboardData.USER32 ref: 00405290
CloseClipboard.USER32 ref: 00405296

Strings

{, xrefs: 00405185

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: d6234904f7ec8a2b835cac3fde064e0d006e914c734cef6e16551ee70c0426af
Instruction ID: 84c9a86842734fbd8882db8e1e478190fd6364d20f7a0a8916aca3ed04ef35f5
Opcode Fuzzy Hash: d6234904f7ec8a2b835cac3fde064e0d006e914c734cef6e16551ee70c0426af
Instruction Fuzzy Hash: 6EA13B70900208BFDB219F60DD89AAE7F79FB04355F00417AFA05BA2A0C7795E51DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00404275 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 242
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00404275(struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				char _v24;
				long _v28;
				char _v32;
				intOrPtr _v36;
				long _v40;
				signed int _v44;
				CHAR* _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				CHAR* _v68;
				void _v72;
				char _v76;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t75;
				signed char* _t80;
				intOrPtr* _t81;
				int _t86;
				int _t88;
				int _t100;
				signed int _t105;
				char* _t110;
				intOrPtr _t112;
				intOrPtr* _t127;
				intOrPtr _t135;
				signed int _t139;
				signed int _t144;
				CHAR* _t150;

				_t75 =  *0x41fc68; // 0x0
				_v36 = _t75;
				_t150 = ( *(_t75 + 0x3c) << 0xa) + 0x424000;
				_v12 =  *((intOrPtr*)(_t75 + 0x38));
				if(_a8 == 0x40b) {
					E004052E8(0x3fb, _t150);
					E00405CA1(_t150);
				}
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							_t144 = _t143 | 0xffffffff;
							E004052E8(0x3fb, _t150);
							if(E00405617(_t169, _t150) == 0) {
								_v8 = 1;
							}
							E00405A43(0x41f460, _t150);
							_t80 = E004055CA(0x41f460);
							if(_t80 != 0) {
								 *_t80 =  *_t80 & 0x00000000;
							}
							_t81 = E00405D61(0);
							if(_t81 == 0) {
								L29:
								_t86 = GetDiskFreeSpaceA(0x41f460,  &_v20,  &_v28,  &_v16,  &_v40);
								__eflags = _t86;
								if(_t86 == 0) {
									goto L32;
								}
								_t100 = _v20 * _v28;
								__eflags = _t100;
								_t144 = MulDiv(_t100, _v16, 0x400);
								goto L31;
							} else {
								_push( &_v32);
								_push( &_v24);
								_push( &_v44);
								_push(0x41f460);
								if( *_t81() == 0) {
									goto L29;
								}
								_t144 = (_v40 << 0x00000020 | _v44) >> 0xa;
								L31:
								_v12 = 1;
								L32:
								if(_t144 < E00404683(5)) {
									_v8 = 2;
								}
								_t135 =  *0x42367c; // 0x6ae931
								if( *((intOrPtr*)(_t135 + 0x10)) != 0) {
									E004045CE(0x3ff, 0xfffffffb, _t87);
									if(_v12 == 0) {
										SetDlgItemTextA(_a4, 0x400, 0x41f450);
									} else {
										E004045CE(0x400, 0xfffffffc, _t144);
									}
								}
								_t88 = _v8;
								 *0x423f44 = _t88;
								if(_t88 == 0) {
									_v8 = E0040140B(7);
								}
								if(( *(_v36 + 0x14) & 0x00000400) != 0) {
									_v8 = 0;
								}
								E00403E59(0 | _v8 == 0x00000000);
								if(_v8 == 0 &&  *0x420484 == 0) {
									E0040420A();
								}
								 *0x420484 = 0;
								goto L46;
							}
						}
						_t169 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L46;
						}
						goto L22;
					}
					_t105 = _a12 & 0x0000ffff;
					if(_t105 != 0x3fb) {
						L12:
						if(_t105 == 0x3e9) {
							_t139 = 7;
							memset( &_v72, 0, _t139 << 2);
							_t143 = 0x420498;
							_v76 = _a4;
							_v68 = 0x420498;
							_v56 = E00404568;
							_v52 = _t150;
							_v64 = E00405A65(0x3fb, 0x420498, _t150, 0x41f868, _v12);
							_t110 =  &_v76;
							_v60 = 0x41;
							__imp__SHBrowseForFolderA(_t110);
							if(_t110 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t110);
								E00405536(_t150);
								_t112 =  *0x423eb0; // 0x6acdd0
								_t113 =  *((intOrPtr*)(_t112 + 0x11c));
								if( *((intOrPtr*)(_t112 + 0x11c)) != 0 && _t150 == 0x429400) {
									E00405A65(0x3fb, 0x420498, _t150, 0, _t113);
									_t143 = 0x422e40;
									if(lstrcmpiA(0x422e40, 0x420498) != 0) {
										lstrcatA(_t150, 0x422e40);
									}
								}
								 *0x420484 =  *0x420484 + 1;
								SetDlgItemTextA(_a4, 0x3fb, _t150);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L46;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t143 = GetDlgItem(_a4, 0x3fb);
					if(E004055A3(_t150) != 0 && E004055CA(_t150) == 0) {
						E00405536(_t150);
					}
					 *0x423678 = _a4;
					SetWindowTextA(_t143, _t150);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E00403E37(_a4);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E00403E37(_a4);
					E00403E6C(_t143);
					_t127 = E00405D61(7);
					if(_t127 == 0) {
						L46:
						return E00403E9E(_a8, _a12, _a16);
					}
					 *_t127(_t143, 1);
					goto L8;
				}
			}

0x0040427b
0x00404282
0x0040428e
0x0040429c
0x004042a4
0x004042a8
0x004042ae
0x004042ae
0x004042ba
0x0040432c
0x00404333
0x00404408
0x0040440f
0x0040441e
0x0040441e
0x00404422
0x00404428
0x0040442b
0x00404438
0x0040443a
0x0040443a
0x00404448
0x0040444e
0x00404455
0x00404457
0x00404457
0x0040445c
0x00404468
0x0040448c
0x0040449d
0x004044a3
0x004044a5
0x00000000
0x00000000
0x004044ab
0x004044ab
0x004044b9
0x00000000
0x0040446a
0x0040446d
0x00404471
0x00404475
0x00404476
0x0040447b
0x00000000
0x00000000
0x00404483
0x004044bb
0x004044bb
0x004044c2
0x004044cb
0x004044cd
0x004044cd
0x004044d4
0x004044df
0x004044e9
0x004044f1
0x00404507
0x004044f3
0x004044f7
0x004044f7
0x004044f1
0x0040450c
0x00404511
0x00404516
0x0040451f
0x0040451f
0x00404528
0x0040452a
0x0040452a
0x00404536
0x0040453e
0x00404548
0x00404548
0x0040454d
0x00000000
0x0040454d
0x00404468
0x00404411
0x00404418
0x00000000
0x00000000
0x00000000
0x00404418
0x00404339
0x0040433f
0x00404359
0x0040435e
0x00404368
0x0040436f
0x00404374
0x0040437e
0x00404381
0x00404384
0x0040438b
0x00404393
0x00404396
0x0040439a
0x004043a1
0x004043a9
0x00404401
0x004043ab
0x004043ac
0x004043b3
0x004043b8
0x004043bd
0x004043c5
0x004043d2
0x004043d8
0x004043e6
0x004043ea
0x004043ea
0x004043e6
0x004043ef
0x004043fa
0x004043fa
0x004043a9
0x00000000
0x0040435e
0x0040434c
0x00000000
0x00000000
0x00404352
0x00000000
0x004042bc
0x004042c7
0x004042d0
0x004042dd
0x004042dd
0x004042e7
0x004042ec
0x004042f5
0x004042f8
0x004042fd
0x00404305
0x00404308
0x0040430d
0x00404313
0x0040431a
0x00404321
0x00404553
0x00404565
0x00404565
0x0040432a
0x00000000
0x0040432a

APIs

GetDlgItem.USER32 ref: 004042C0
SetWindowTextA.USER32(00000000,?), ref: 004042EC
SHBrowseForFolderA.SHELL32(?,0041F868,?), ref: 004043A1
CoTaskMemFree.OLE32(00000000), ref: 004043AC
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe,00420498,00000000,?,?), ref: 004043DE
lstrcatA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe), ref: 004043EA
SetDlgItemTextA.USER32 ref: 004043FA

Part of subcall function 004052E8: GetDlgItemTextA.USER32 ref: 004052FB

Part of subcall function 00405CA1: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe",C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405CF9
Part of subcall function 00405CA1: CharNextA.USER32(?,?,?,00000000), ref: 00405D06
Part of subcall function 00405CA1: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe",C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D0B
Part of subcall function 00405CA1: CharPrevA.USER32(?,?,"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe",C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D1B

GetDiskFreeSpaceA.KERNEL32(0041F460,?,?,0000040F,?,00000000,0041F460,0041F460,?,?,000003FB,?), ref: 0040449D
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004044B3
SetDlgItemTextA.USER32 ref: 00404507

Strings

616, xrefs: 0040428E
A, xrefs: 0040439A
C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe, xrefs: 004043D8, 004043DD, 004043E8
1j, xrefs: 004044D4

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: 1j$616$A$C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe
API String ID: 2246997448-496404625
Opcode ID: 936e3baaaad2312772332b7812137867e2faf91efd78c67934408538fd53f714
Instruction ID: bf73891eaa7ceb25cd2d176da2664e738739afe01e185979f8a0921e91be6a6b
Opcode Fuzzy Hash: 936e3baaaad2312772332b7812137867e2faf91efd78c67934408538fd53f714
Instruction Fuzzy Hash: 7E816BB1A00218BBDB11AFA5CD45B9F7BA8EF44314F50817BFB04B62D1C7789A41CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00405A65 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 195
stringCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00405A65(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				struct _ITEMIDLIST* _v12;
				signed int _v16;
				signed char _v20;
				signed char _v24;
				signed int _v28;
				signed int _t36;
				CHAR* _t37;
				signed char _t39;
				signed int _t40;
				int _t41;
				char _t51;
				char _t52;
				char _t54;
				char _t56;
				void* _t64;
				signed int _t68;
				intOrPtr _t72;
				signed int _t73;
				signed char _t74;
				intOrPtr _t77;
				char _t81;
				void* _t83;
				CHAR* _t84;
				void* _t86;
				signed int _t93;
				signed int _t95;
				void* _t96;

				_t86 = __esi;
				_t83 = __edi;
				_t64 = __ebx;
				_t36 = _a8;
				if(_t36 < 0) {
					_t77 =  *0x42367c; // 0x6ae931
					_t36 =  *(_t77 - 4 + _t36 * 4);
				}
				_t72 =  *0x423ed8; // 0x6ae194
				_t73 = _t72 + _t36;
				_t37 = 0x422e40;
				_push(_t64);
				_push(_t86);
				_push(_t83);
				_t84 = 0x422e40;
				if(_a4 - 0x422e40 < 0x800) {
					_t84 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t81 =  *_t73;
					if(_t81 == 0) {
						break;
					}
					__eflags = _t84 - _t37 - 0x400;
					if(_t84 - _t37 >= 0x400) {
						break;
					}
					_t73 = _t73 + 1;
					__eflags = _t81 - 0xfc;
					_a8 = _t73;
					if(__eflags <= 0) {
						if(__eflags != 0) {
							 *_t84 = _t81;
							_t84 =  &(_t84[1]);
							__eflags = _t84;
						} else {
							 *_t84 =  *_t73;
							_t84 =  &(_t84[1]);
							_t73 = _t73 + 1;
						}
						continue;
					}
					_t39 =  *(_t73 + 1);
					_t74 =  *_t73;
					_a8 = _a8 + 2;
					_v20 = _t39;
					_t93 = (_t39 & 0x0000007f) << 0x00000007 | _t74 & 0x0000007f;
					_t68 = _t74;
					_t40 = _t39 | 0x00000080;
					__eflags = _t81 - 0xfe;
					_v28 = _t68;
					_v24 = _t74 | 0x00000080;
					_v16 = _t40;
					if(_t81 != 0xfe) {
						__eflags = _t81 - 0xfd;
						if(_t81 != 0xfd) {
							__eflags = _t81 - 0xff;
							if(_t81 == 0xff) {
								__eflags = (_t40 | 0xffffffff) - _t93;
								E00405A65(_t68, _t84, _t93, _t84, (_t40 | 0xffffffff) - _t93);
							}
							L41:
							_t41 = lstrlenA(_t84);
							_t73 = _a8;
							_t84 =  &(_t84[_t41]);
							_t37 = 0x422e40;
							continue;
						}
						__eflags = _t93 - 0x1d;
						if(_t93 != 0x1d) {
							__eflags = (_t93 << 0xa) + 0x424000;
							E00405A43(_t84, (_t93 << 0xa) + 0x424000);
						} else {
							E004059A1(_t84,  *0x423ea8);
						}
						__eflags = _t93 + 0xffffffeb - 7;
						if(_t93 + 0xffffffeb < 7) {
							L32:
							E00405CA1(_t84);
						}
						goto L41;
					}
					_t95 = 2;
					_t51 = GetVersion();
					__eflags = _t51;
					if(_t51 >= 0) {
						L12:
						_v8 = 1;
						L13:
						__eflags =  *0x423f24;
						if( *0x423f24 != 0) {
							_t95 = 4;
						}
						__eflags = _t68;
						if(_t68 >= 0) {
							__eflags = _t68 - 0x25;
							if(_t68 != 0x25) {
								__eflags = _t68 - 0x24;
								if(_t68 == 0x24) {
									GetWindowsDirectoryA(_t84, 0x400);
									_t95 = 0;
								}
								while(1) {
									__eflags = _t95;
									if(_t95 == 0) {
										goto L29;
									}
									_t52 =  *0x423ea4; // 0x73d51340
									_t95 = _t95 - 1;
									__eflags = _t52;
									if(_t52 == 0) {
										L25:
										_t54 = SHGetSpecialFolderLocation( *0x423ea8,  *(_t96 + _t95 * 4 - 0x18),  &_v12);
										__eflags = _t54;
										if(_t54 != 0) {
											L27:
											 *_t84 =  *_t84 & 0x00000000;
											__eflags =  *_t84;
											continue;
										}
										__imp__SHGetPathFromIDListA(_v12, _t84);
										__imp__CoTaskMemFree(_v12);
										__eflags = _t54;
										if(_t54 != 0) {
											goto L29;
										}
										goto L27;
									}
									__eflags = _v8;
									if(_v8 == 0) {
										goto L25;
									}
									_t56 =  *_t52( *0x423ea8,  *(_t96 + _t95 * 4 - 0x18), 0, 0, _t84);
									__eflags = _t56;
									if(_t56 == 0) {
										goto L29;
									}
									goto L25;
								}
								goto L29;
							}
							GetSystemDirectoryA(_t84, 0x400);
							goto L29;
						} else {
							_t71 = (_t68 & 0x0000003f) +  *0x423ed8;
							E0040592A(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion", (_t68 & 0x0000003f) +  *0x423ed8, _t84, _t68 & 0x00000040);
							__eflags =  *_t84;
							if( *_t84 != 0) {
								L30:
								__eflags = _v20 - 0x1a;
								if(_v20 == 0x1a) {
									lstrcatA(_t84, "\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L32;
							}
							E00405A65(_t71, _t84, _t95, _t84, _v20);
							L29:
							__eflags =  *_t84;
							if( *_t84 == 0) {
								goto L32;
							}
							goto L30;
						}
					}
					__eflags = _t51 - 0x5a04;
					if(_t51 == 0x5a04) {
						goto L12;
					}
					__eflags = _v20 - 0x23;
					if(_v20 == 0x23) {
						goto L12;
					}
					__eflags = _v20 - 0x2e;
					if(_v20 == 0x2e) {
						goto L12;
					} else {
						_v8 = _v8 & 0x00000000;
						goto L13;
					}
				}
				 *_t84 =  *_t84 & 0x00000000;
				if(_a4 == 0) {
					return _t37;
				}
				return E00405A43(_a4, _t37);
			}

0x00405a65
0x00405a65
0x00405a65
0x00405a6b
0x00405a70
0x00405a72
0x00405a81
0x00405a81
0x00405a83
0x00405a8c
0x00405a8e
0x00405a93
0x00405a96
0x00405a97
0x00405a9e
0x00405aa0
0x00405aa6
0x00405aa9
0x00405aa9
0x00405c7e
0x00405c7e
0x00405c82
0x00000000
0x00000000
0x00405ab6
0x00405abc
0x00000000
0x00000000
0x00405ac2
0x00405ac3
0x00405ac6
0x00405ac9
0x00405c71
0x00405c7b
0x00405c7d
0x00405c7d
0x00405c73
0x00405c75
0x00405c77
0x00405c78
0x00405c78
0x00000000
0x00405c71
0x00405acf
0x00405ad3
0x00405ad8
0x00405ae7
0x00405aea
0x00405aec
0x00405af1
0x00405af4
0x00405af7
0x00405afa
0x00405afd
0x00405b00
0x00405c1b
0x00405c1e
0x00405c4e
0x00405c51
0x00405c56
0x00405c5a
0x00405c5a
0x00405c5f
0x00405c60
0x00405c65
0x00405c68
0x00405c6a
0x00000000
0x00405c6a
0x00405c20
0x00405c23
0x00405c38
0x00405c3f
0x00405c25
0x00405c2c
0x00405c2c
0x00405c47
0x00405c4a
0x00405c13
0x00405c14
0x00405c14
0x00000000
0x00405c4a
0x00405b08
0x00405b09
0x00405b0f
0x00405b11
0x00405b2b
0x00405b2b
0x00405b32
0x00405b32
0x00405b39
0x00405b3d
0x00405b3d
0x00405b3e
0x00405b40
0x00405b79
0x00405b7c
0x00405b8c
0x00405b8f
0x00405b97
0x00405b9d
0x00405b9d
0x00405bf9
0x00405bf9
0x00405bfb
0x00000000
0x00000000
0x00405ba1
0x00405ba8
0x00405ba9
0x00405bab
0x00405bc5
0x00405bd3
0x00405bd9
0x00405bdb
0x00405bf6
0x00405bf6
0x00405bf6
0x00000000
0x00405bf6
0x00405be1
0x00405bec
0x00405bf2
0x00405bf4
0x00000000
0x00000000
0x00000000
0x00405bf4
0x00405bad
0x00405bb0
0x00000000
0x00000000
0x00405bbf
0x00405bc1
0x00405bc3
0x00000000
0x00000000
0x00000000
0x00405bc3
0x00000000
0x00405bf9
0x00405b84
0x00000000
0x00405b42
0x00405b47
0x00405b5d
0x00405b62
0x00405b65
0x00405c02
0x00405c02
0x00405c06
0x00405c0e
0x00405c0e
0x00000000
0x00405c06
0x00405b6f
0x00405bfd
0x00405bfd
0x00405c00
0x00000000
0x00000000
0x00000000
0x00405c00
0x00405b40
0x00405b13
0x00405b17
0x00000000
0x00000000
0x00405b19
0x00405b1d
0x00000000
0x00000000
0x00405b1f
0x00405b23
0x00000000
0x00405b25
0x00405b25
0x00000000
0x00405b25
0x00405b23
0x00405c88
0x00405c92
0x00405c9e
0x00405c9e
0x00000000

APIs

GetVersion.KERNEL32(00000000,0041FC70,00000000,00404E19,0041FC70,00000000), ref: 00405B09
GetSystemDirectoryA.KERNEL32 ref: 00405B84
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe,00000400), ref: 00405B97
SHGetSpecialFolderLocation.SHELL32(?,00000000), ref: 00405BD3
SHGetPathFromIDListA.SHELL32(00000000,C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe), ref: 00405BE1
CoTaskMemFree.OLE32(00000000), ref: 00405BEC
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe,\Microsoft\Internet Explorer\Quick Launch), ref: 00405C0E
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe,00000000,0041FC70,00000000,00404E19,0041FC70,00000000), ref: 00405C60

Strings

616, xrefs: 00405C38
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405C08
C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe, xrefs: 00405A8E, 00405B51, 00405B6E, 00405B83, 00405B96, 00405BB2, 00405BDD, 00405C0D, 00405C13, 00405C2B, 00405C3E, 00405C59, 00405C5F, 00405C6A, 00405C94
1j, xrefs: 00405A72
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405B53

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: 1j$616$C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-2638225960
Opcode ID: 407c166c66189a839f24298505df86d50d8c40c523b254d0433e8548935abd6e
Instruction ID: 7ee21fb2fc3cc9820636396ad5dfe7f88664caf88b33913cf2431378ed05aae4
Opcode Fuzzy Hash: 407c166c66189a839f24298505df86d50d8c40c523b254d0433e8548935abd6e
Instruction Fuzzy Hash: 25510571A04A05AAEB216F64DC84B7F3BB4EB11714F14023BE911B62E1D37C6982DF5E

Uniqueness

Uniqueness Score: -1.00%

Function 00402012 Relevance: 3.1, APIs: 2, Instructions: 134
comCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00402012() {
				void* _t44;
				intOrPtr* _t48;
				intOrPtr* _t50;
				intOrPtr* _t52;
				intOrPtr* _t54;
				signed int _t58;
				intOrPtr* _t59;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t69;
				intOrPtr* _t71;
				int _t75;
				signed int _t81;
				intOrPtr* _t88;
				void* _t95;
				void* _t96;
				void* _t100;

				 *(_t100 - 0x30) = E004029E8(0xfffffff0);
				_t96 = E004029E8(0xffffffdf);
				 *((intOrPtr*)(_t100 - 0x2c)) = E004029E8(2);
				 *((intOrPtr*)(_t100 - 8)) = E004029E8(0xffffffcd);
				 *((intOrPtr*)(_t100 - 0x44)) = E004029E8(0x45);
				if(E004055A3(_t96) == 0) {
					E004029E8(0x21);
				}
				_t44 = _t100 + 8;
				__imp__CoCreateInstance(0x407384, _t75, 1, 0x407374, _t44);
				if(_t44 < _t75) {
					L13:
					 *((intOrPtr*)(_t100 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t48 =  *((intOrPtr*)(_t100 + 8));
					_t95 =  *((intOrPtr*)( *_t48))(_t48, 0x407394, _t100 - 0x34);
					if(_t95 >= _t75) {
						_t52 =  *((intOrPtr*)(_t100 + 8));
						_t95 =  *((intOrPtr*)( *_t52 + 0x50))(_t52, _t96);
						_t54 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t54 + 0x24))(_t54, 0x429800);
						_t81 =  *(_t100 - 0x14);
						_t58 = _t81 >> 0x00000008 & 0x000000ff;
						if(_t58 != 0) {
							_t88 =  *((intOrPtr*)(_t100 + 8));
							 *((intOrPtr*)( *_t88 + 0x3c))(_t88, _t58);
							_t81 =  *(_t100 - 0x14);
						}
						_t59 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t59 + 0x34))(_t59, _t81 >> 0x10);
						if( *((intOrPtr*)( *((intOrPtr*)(_t100 - 8)))) != _t75) {
							_t71 =  *((intOrPtr*)(_t100 + 8));
							 *((intOrPtr*)( *_t71 + 0x44))(_t71,  *((intOrPtr*)(_t100 - 8)),  *(_t100 - 0x14) & 0x000000ff);
						}
						_t62 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t62 + 0x2c))(_t62,  *((intOrPtr*)(_t100 - 0x2c)));
						_t64 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t64 + 0x1c))(_t64,  *((intOrPtr*)(_t100 - 0x44)));
						if(_t95 >= _t75) {
							_t95 = 0x80004005;
							if(MultiByteToWideChar(_t75, _t75,  *(_t100 - 0x30), 0xffffffff, 0x40a7a0, 0x400) != 0) {
								_t69 =  *((intOrPtr*)(_t100 - 0x34));
								_t95 =  *((intOrPtr*)( *_t69 + 0x18))(_t69, 0x40a7a0, 1);
							}
						}
						_t66 =  *((intOrPtr*)(_t100 - 0x34));
						 *((intOrPtr*)( *_t66 + 8))(_t66);
					}
					_t50 =  *((intOrPtr*)(_t100 + 8));
					 *((intOrPtr*)( *_t50 + 8))(_t50);
					if(_t95 >= _t75) {
						_push(0xfffffff4);
					} else {
						goto L13;
					}
				}
				E00401423();
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t100 - 4));
				return 0;
			}

0x0040201b
0x00402025
0x0040202e
0x00402038
0x00402041
0x0040204b
0x0040204f
0x0040204f
0x00402054
0x00402065
0x0040206d
0x0040214d
0x0040214d
0x00402154
0x00402073
0x00402073
0x00402084
0x00402088
0x0040208e
0x00402098
0x0040209a
0x004020a5
0x004020a8
0x004020b5
0x004020b7
0x004020b9
0x004020c0
0x004020c3
0x004020c3
0x004020c6
0x004020d0
0x004020d8
0x004020dd
0x004020e9
0x004020e9
0x004020ec
0x004020f5
0x004020f8
0x00402101
0x00402106
0x00402118
0x00402127
0x00402129
0x00402135
0x00402135
0x00402127
0x00402137
0x0040213d
0x0040213d
0x00402140
0x00402146
0x0040214b
0x00402160
0x00000000
0x00000000
0x00000000
0x0040214b
0x00402156
0x00402880
0x0040288c

APIs

CoCreateInstance.OLE32(00407384,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402065
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,0040A7A0,00000400,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040211F

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 57f3c6c8d44a3fddadac14ac92663a14f5239f5a3a8b7d215843731e5d6df28d
Instruction ID: f80ce63f98a2f882e3be49352075ba1f2772856d238ef38af8f522e875768035
Opcode Fuzzy Hash: 57f3c6c8d44a3fddadac14ac92663a14f5239f5a3a8b7d215843731e5d6df28d
Instruction Fuzzy Hash: 70416FB5A00104AFDB00DFA4CD89E9E7BB9AF49314B20456AF905EB2D1CA79DD41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00402630 Relevance: 1.5, APIs: 1, Instructions: 29
fileCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E00402630(char __ebx, char* __edi, char* __esi) {
				void* _t19;

				if(FindFirstFileA(E004029E8(2), _t19 - 0x1a4) != 0xffffffff) {
					E004059A1(__edi, _t6);
					_push(_t19 - 0x178);
					_push(__esi);
					E00405A43();
				} else {
					 *__edi = __ebx;
					 *__esi = __ebx;
					 *((intOrPtr*)(_t19 - 4)) = 1;
				}
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t19 - 4));
				return 0;
			}

0x00402648
0x0040265c
0x00402667
0x00402668
0x004027a3
0x0040264a
0x0040264a
0x0040264c
0x0040264e
0x0040264e
0x00402880
0x0040288c

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 0040263F

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 2eb120d8036e36941adcd11ac8ee285c4c95a022228aa41322176192dbd1c0a4
Instruction ID: 6bfd48b26eb8f02bf015f0d6c769e2a48c0d6d1fddf8ae21a0d75cbc2d3c474c
Opcode Fuzzy Hash: 2eb120d8036e36941adcd11ac8ee285c4c95a022228aa41322176192dbd1c0a4
Instruction Fuzzy Hash: A6F0A772604110DFD700EBB59D49EEE7768DF51324F6006BBE111F20C1C7B88A429A2A

Uniqueness

Uniqueness Score: -1.00%

Function 00403964 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00403964(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t37;
				signed int _t39;
				intOrPtr _t44;
				struct HWND__* _t49;
				signed int _t67;
				struct HWND__* _t73;
				signed int _t86;
				struct HWND__* _t91;
				signed int _t99;
				int _t103;
				signed int _t115;
				signed int _t116;
				int _t117;
				signed int _t122;
				struct HWND__* _t125;
				struct HWND__* _t126;
				int _t127;
				long _t130;
				int _t132;
				int _t133;
				void* _t134;
				void* _t141;
				void* _t142;

				_t115 = _a8;
				if(_t115 == 0x110 || _t115 == 0x408) {
					_t35 = _a12;
					_t125 = _a4;
					__eflags = _t115 - 0x110;
					 *0x42047c = _t35;
					if(_t115 == 0x110) {
						 *0x423ea8 = _t125;
						 *0x420490 = GetDlgItem(_t125, 1);
						_t91 = GetDlgItem(_t125, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x41f458 = _t91;
						E00403E37(_t125);
						SetClassLongA(_t125, 0xfffffff2,  *0x423688);
						 *0x42366c = E0040140B(4);
						_t35 = 1;
						__eflags = 1;
						 *0x42047c = 1;
					}
					_t122 =  *0x4091bc; // 0xffffffff
					_t133 = 0;
					_t130 = (_t122 << 6) +  *0x423ec0;
					__eflags = _t122;
					if(_t122 < 0) {
						L34:
						E00403E83(0x40b);
						while(1) {
							_t37 =  *0x42047c;
							 *0x4091bc =  *0x4091bc + _t37;
							_t130 = _t130 + (_t37 << 6);
							_t39 =  *0x4091bc; // 0xffffffff
							__eflags = _t39 -  *0x423ec4; // 0x2
							if(__eflags == 0) {
								E0040140B(1);
							}
							__eflags =  *0x42366c - _t133; // 0x1
							if(__eflags != 0) {
								break;
							}
							_t44 =  *0x423ec4; // 0x2
							__eflags =  *0x4091bc - _t44; // 0xffffffff
							if(__eflags >= 0) {
								break;
							}
							_t116 =  *(_t130 + 0x14);
							E00405A65(_t116, _t125, _t130, 0x42b800,  *((intOrPtr*)(_t130 + 0x24)));
							_push( *((intOrPtr*)(_t130 + 0x20)));
							_push(0xfffffc19);
							E00403E37(_t125);
							_push( *((intOrPtr*)(_t130 + 0x1c)));
							_push(0xfffffc1b);
							E00403E37(_t125);
							_push( *((intOrPtr*)(_t130 + 0x28)));
							_push(0xfffffc1a);
							E00403E37(_t125);
							_t49 = GetDlgItem(_t125, 3);
							__eflags =  *0x423f2c - _t133; // 0x0
							_v32 = _t49;
							if(__eflags != 0) {
								_t116 = _t116 & 0x0000fefd | 0x00000004;
								__eflags = _t116;
							}
							ShowWindow(_t49, _t116 & 0x00000008);
							EnableWindow( *(_t134 + 0x30), _t116 & 0x00000100);
							E00403E59(_t116 & 0x00000002);
							_t117 = _t116 & 0x00000004;
							EnableWindow( *0x41f458, _t117);
							__eflags = _t117 - _t133;
							if(_t117 == _t133) {
								_push(1);
							} else {
								_push(_t133);
							}
							EnableMenuItem(GetSystemMenu(_t125, _t133), 0xf060, ??);
							SendMessageA( *(_t134 + 0x38), 0xf4, _t133, 1);
							__eflags =  *0x423f2c - _t133; // 0x0
							if(__eflags == 0) {
								_push( *0x420490);
							} else {
								SendMessageA(_t125, 0x401, 2, _t133);
								_push( *0x41f458);
							}
							E00403E6C();
							E00405A43(0x420498, "ModSource UI Addon Pack Setup");
							E00405A65(0x420498, _t125, _t130,  &(0x420498[lstrlenA(0x420498)]),  *((intOrPtr*)(_t130 + 0x18)));
							SetWindowTextA(_t125, 0x420498);
							_push(_t133);
							_t67 = E00401389( *((intOrPtr*)(_t130 + 8)));
							__eflags = _t67;
							if(_t67 != 0) {
								continue;
							} else {
								__eflags =  *_t130 - _t133;
								if( *_t130 == _t133) {
									continue;
								}
								__eflags =  *(_t130 + 4) - 5;
								if( *(_t130 + 4) != 5) {
									DestroyWindow( *0x423678);
									 *0x41fc68 = _t130;
									__eflags =  *_t130 - _t133;
									if( *_t130 <= _t133) {
										goto L58;
									}
									_t73 = CreateDialogParamA( *0x423ea0,  *_t130 +  *0x423680 & 0x0000ffff, _t125,  *(0x4091c0 +  *(_t130 + 4) * 4), _t130);
									__eflags = _t73 - _t133;
									 *0x423678 = _t73;
									if(_t73 == _t133) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t130 + 0x2c)));
									_push(6);
									E00403E37(_t73);
									GetWindowRect(GetDlgItem(_t125, 0x3fa), _t134 + 0x10);
									ScreenToClient(_t125, _t134 + 0x10);
									SetWindowPos( *0x423678, _t133,  *(_t134 + 0x20),  *(_t134 + 0x20), _t133, _t133, 0x15);
									_push(_t133);
									E00401389( *((intOrPtr*)(_t130 + 0xc)));
									__eflags =  *0x42366c - _t133; // 0x1
									if(__eflags != 0) {
										goto L61;
									}
									ShowWindow( *0x423678, 8);
									E00403E83(0x405);
									goto L58;
								}
								__eflags =  *0x423f2c - _t133; // 0x0
								if(__eflags != 0) {
									goto L61;
								}
								__eflags =  *0x423f20 - _t133; // 0x0
								if(__eflags != 0) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x423678);
						 *0x423ea8 = _t133;
						EndDialog(_t125,  *0x41f860);
						goto L58;
					} else {
						__eflags = _t35 - 1;
						if(_t35 != 1) {
							L33:
							__eflags =  *_t130 - _t133;
							if( *_t130 == _t133) {
								goto L61;
							}
							goto L34;
						}
						_push(0);
						_t86 = E00401389( *((intOrPtr*)(_t130 + 0x10)));
						__eflags = _t86;
						if(_t86 == 0) {
							goto L33;
						}
						SendMessageA( *0x423678, 0x40f, 0, 1);
						__eflags =  *0x42366c - _t133; // 0x1
						return 0 | __eflags == 0x00000000;
					}
				} else {
					_t125 = _a4;
					_t133 = 0;
					if(_t115 == 0x47) {
						SetWindowPos( *0x420470, _t125, 0, 0, 0, 0, 0x13);
					}
					if(_t115 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x420470,  ~(_a12 - 1) & _t115);
					}
					if(_t115 != 0x40d) {
						__eflags = _t115 - 0x11;
						if(_t115 != 0x11) {
							__eflags = _t115 - 0x111;
							if(_t115 != 0x111) {
								L26:
								return E00403E9E(_t115, _a12, _a16);
							}
							_t132 = _a12 & 0x0000ffff;
							_t126 = GetDlgItem(_t125, _t132);
							__eflags = _t126 - _t133;
							if(_t126 == _t133) {
								L13:
								__eflags = _t132 - 1;
								if(_t132 != 1) {
									__eflags = _t132 - 3;
									if(_t132 != 3) {
										_t127 = 2;
										__eflags = _t132 - _t127;
										if(_t132 != _t127) {
											L25:
											SendMessageA( *0x423678, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x423f2c - _t133; // 0x0
										if(__eflags == 0) {
											_t99 = E0040140B(3);
											__eflags = _t99;
											if(_t99 != 0) {
												goto L26;
											}
											 *0x41f860 = 1;
											L21:
											_push(0x78);
											L22:
											E00403E10();
											goto L26;
										}
										E0040140B(_t127);
										 *0x41f860 = _t127;
										goto L21;
									}
									__eflags =  *0x4091bc - _t133; // 0xffffffff
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t132);
								goto L22;
							}
							SendMessageA(_t126, 0xf3, _t133, _t133);
							_t103 = IsWindowEnabled(_t126);
							__eflags = _t103;
							if(_t103 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongA(_t125, _t133, _t133);
						return 1;
					} else {
						DestroyWindow( *0x423678);
						 *0x423678 = _a12;
						L58:
						_t141 =  *0x421498 - _t133; // 0x0
						if(_t141 == 0) {
							_t142 =  *0x423678 - _t133; // 0x0
							if(_t142 != 0) {
								ShowWindow(_t125, 0xa);
								 *0x421498 = 1;
							}
						}
						L61:
						return 0;
					}
				}
			}

0x0040396d
0x00403976
0x00403ab7
0x00403abb
0x00403abf
0x00403ac1
0x00403ac6
0x00403ad1
0x00403adc
0x00403ae1
0x00403ae3
0x00403ae5
0x00403ae8
0x00403aed
0x00403afb
0x00403b08
0x00403b0f
0x00403b0f
0x00403b10
0x00403b10
0x00403b15
0x00403b1b
0x00403b22
0x00403b28
0x00403b2a
0x00403b6a
0x00403b6f
0x00403b74
0x00403b74
0x00403b79
0x00403b82
0x00403b84
0x00403b89
0x00403b8f
0x00403b93
0x00403b93
0x00403b98
0x00403b9e
0x00000000
0x00000000
0x00403ba4
0x00403ba9
0x00403baf
0x00000000
0x00000000
0x00403bb8
0x00403bc0
0x00403bc5
0x00403bc8
0x00403bce
0x00403bd3
0x00403bd6
0x00403bdc
0x00403be1
0x00403be4
0x00403bea
0x00403bf2
0x00403bf8
0x00403bfe
0x00403c02
0x00403c09
0x00403c09
0x00403c09
0x00403c13
0x00403c25
0x00403c31
0x00403c36
0x00403c40
0x00403c46
0x00403c48
0x00403c4d
0x00403c4a
0x00403c4a
0x00403c4a
0x00403c5d
0x00403c75
0x00403c77
0x00403c7d
0x00403c92
0x00403c7f
0x00403c88
0x00403c8a
0x00403c8a
0x00403c98
0x00403ca8
0x00403cb9
0x00403cc0
0x00403cc6
0x00403cca
0x00403ccf
0x00403cd1
0x00000000
0x00403cd7
0x00403cd7
0x00403cd9
0x00000000
0x00000000
0x00403cdf
0x00403ce3
0x00403d08
0x00403d0e
0x00403d14
0x00403d16
0x00000000
0x00000000
0x00403d3c
0x00403d42
0x00403d44
0x00403d49
0x00000000
0x00000000
0x00403d4f
0x00403d52
0x00403d55
0x00403d6c
0x00403d78
0x00403d91
0x00403d97
0x00403d9b
0x00403da0
0x00403da6
0x00000000
0x00000000
0x00403db0
0x00403dbb
0x00000000
0x00403dbb
0x00403ce5
0x00403ceb
0x00000000
0x00000000
0x00403cf1
0x00403cf7
0x00000000
0x00000000
0x00000000
0x00403cfd
0x00403cd1
0x00403dc8
0x00403dd4
0x00403ddb
0x00000000
0x00403b2c
0x00403b2c
0x00403b2f
0x00403b62
0x00403b62
0x00403b64
0x00000000
0x00000000
0x00000000
0x00403b64
0x00403b31
0x00403b35
0x00403b3a
0x00403b3c
0x00000000
0x00000000
0x00403b4c
0x00403b54
0x00000000
0x00403b5a
0x00403988
0x00403988
0x0040398c
0x00403991
0x004039a0
0x004039a0
0x004039a9
0x004039b2
0x004039bd
0x004039bd
0x004039c9
0x004039e5
0x004039e8
0x004039fb
0x00403a01
0x00403aa4
0x00000000
0x00403aad
0x00403a07
0x00403a14
0x00403a16
0x00403a18
0x00403a37
0x00403a37
0x00403a3a
0x00403a3f
0x00403a42
0x00403a52
0x00403a53
0x00403a55
0x00403a8b
0x00403a9e
0x00000000
0x00403a9e
0x00403a57
0x00403a5d
0x00403a76
0x00403a7b
0x00403a7d
0x00000000
0x00000000
0x00403a7f
0x00403a6b
0x00403a6b
0x00403a6d
0x00403a6d
0x00000000
0x00403a6d
0x00403a60
0x00403a65
0x00000000
0x00403a65
0x00403a44
0x00403a4a
0x00000000
0x00000000
0x00403a4c
0x00000000
0x00403a4c
0x00403a3c
0x00000000
0x00403a3c
0x00403a22
0x00403a29
0x00403a2f
0x00403a31
0x00000000
0x00000000
0x00000000
0x00403a31
0x004039ed
0x00000000
0x004039cb
0x004039d1
0x004039db
0x00403de1
0x00403de1
0x00403de7
0x00403de9
0x00403def
0x00403df4
0x00403dfa
0x00403dfa
0x00403def
0x00403e04
0x00000000
0x00403e04
0x004039c9

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004039A0
ShowWindow.USER32(?), ref: 004039BD
DestroyWindow.USER32 ref: 004039D1
SetWindowLongA.USER32 ref: 004039ED
GetDlgItem.USER32 ref: 00403A0E
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403A22
IsWindowEnabled.USER32(00000000), ref: 00403A29
GetDlgItem.USER32 ref: 00403AD7
GetDlgItem.USER32 ref: 00403AE1
SetClassLongA.USER32(?,000000F2,?,0000001C,000000FF), ref: 00403AFB
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403B4C
GetDlgItem.USER32 ref: 00403BF2
ShowWindow.USER32(00000000,?), ref: 00403C13
EnableWindow.USER32(?,?), ref: 00403C25
EnableWindow.USER32(?,?), ref: 00403C40
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403C56
EnableMenuItem.USER32 ref: 00403C5D
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403C75
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403C88
lstrlenA.KERNEL32(00420498,?,00420498,ModSource UI Addon Pack Setup), ref: 00403CB1
SetWindowTextA.USER32(?,00420498), ref: 00403CC0
ShowWindow.USER32(?,0000000A), ref: 00403DF4

Strings

ModSource UI Addon Pack Setup, xrefs: 00403CA2

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: ModSource UI Addon Pack Setup
API String ID: 184305955-726907697
Opcode ID: 5bd1228aa0fcdd69b69209796a2d378b3baa167acadb9b82a188c19aeb21d88e
Instruction ID: 51696fdb46be689e531b8a1be0e487da60f951fcccfd6c6acce19ac6ba18c0db
Opcode Fuzzy Hash: 5bd1228aa0fcdd69b69209796a2d378b3baa167acadb9b82a188c19aeb21d88e
Instruction Fuzzy Hash: CCC1B071A04204BBDB206F21ED85E2B7E7CEB05706F40453EF641B12E1C779AA429F6E

Uniqueness

Uniqueness Score: -1.00%

Function 00403F7F Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 204
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00403F7F(struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, int _a16) {
				char* _v8;
				signed int _v12;
				void* _v16;
				struct HWND__* _t52;
				intOrPtr _t71;
				intOrPtr _t85;
				long _t86;
				int _t98;
				struct HWND__* _t99;
				signed int _t100;
				intOrPtr _t103;
				intOrPtr _t107;
				intOrPtr _t109;
				int _t110;
				signed int* _t112;
				signed int _t113;
				char* _t114;
				CHAR* _t115;

				if(_a8 != 0x110) {
					if(_a8 != 0x111) {
						L11:
						if(_a8 != 0x4e) {
							if(_a8 == 0x40b) {
								 *0x420478 =  *0x420478 + 1;
							}
							L25:
							_t110 = _a16;
							L26:
							return E00403E9E(_a8, _a12, _t110);
						}
						_t52 = GetDlgItem(_a4, 0x3e8);
						_t110 = _a16;
						if( *((intOrPtr*)(_t110 + 8)) == 0x70b &&  *((intOrPtr*)(_t110 + 0xc)) == 0x201) {
							_t100 =  *((intOrPtr*)(_t110 + 0x1c));
							_t109 =  *((intOrPtr*)(_t110 + 0x18));
							_v12 = _t100;
							_v16 = _t109;
							_v8 = 0x422e40;
							if(_t100 - _t109 < 0x800) {
								SendMessageA(_t52, 0x44b, 0,  &_v16);
								SetCursor(LoadCursorA(0, 0x7f02));
								ShellExecuteA(_a4, "open", _v8, 0, 0, 1);
								SetCursor(LoadCursorA(0, 0x7f00));
								_t110 = _a16;
							}
						}
						if( *((intOrPtr*)(_t110 + 8)) != 0x700 ||  *((intOrPtr*)(_t110 + 0xc)) != 0x100) {
							goto L26;
						} else {
							if( *((intOrPtr*)(_t110 + 0x10)) == 0xd) {
								SendMessageA( *0x423ea8, 0x111, 1, 0);
							}
							if( *((intOrPtr*)(_t110 + 0x10)) == 0x1b) {
								SendMessageA( *0x423ea8, 0x10, 0, 0);
							}
							return 1;
						}
					}
					if(_a12 >> 0x10 != 0 ||  *0x420478 != 0) {
						goto L25;
					} else {
						_t103 =  *0x41fc68; // 0x0
						_t25 = _t103 + 0x14; // 0x14
						_t112 = _t25;
						if(( *_t112 & 0x00000020) == 0) {
							goto L25;
						}
						 *_t112 =  *_t112 & 0xfffffffe | SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
						E00403E59(SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
						E0040420A();
						goto L11;
					}
				}
				_t98 = _a16;
				_t113 =  *(_t98 + 0x30);
				if(_t113 < 0) {
					_t107 =  *0x42367c; // 0x6ae931
					_t113 =  *(_t107 - 4 + _t113 * 4);
				}
				_t71 =  *0x423ed8; // 0x6ae194
				_push( *((intOrPtr*)(_t98 + 0x34)));
				_t114 = _t113 + _t71;
				_push(0x22);
				_a16 =  *_t114;
				_v12 = _v12 & 0x00000000;
				_t115 = _t114 + 1;
				_v16 = _t115;
				_v8 = E00403F4B;
				E00403E37(_a4);
				_push( *((intOrPtr*)(_t98 + 0x38)));
				_push(0x23);
				E00403E37(_a4);
				CheckDlgButton(_a4, (0 | ( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
				E00403E59( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001);
				_t99 = GetDlgItem(_a4, 0x3e8);
				E00403E6C(_t99);
				SendMessageA(_t99, 0x45b, 1, 0);
				_t85 =  *0x423eb0; // 0x6acdd0
				_t86 =  *(_t85 + 0x68);
				if(_t86 < 0) {
					_t86 = GetSysColor( ~_t86);
				}
				SendMessageA(_t99, 0x443, 0, _t86);
				SendMessageA(_t99, 0x445, 0, 0x4010000);
				 *0x41f45c =  *0x41f45c & 0x00000000;
				SendMessageA(_t99, 0x435, 0, lstrlenA(_t115));
				SendMessageA(_t99, 0x449, _a16,  &_v16);
				 *0x420478 =  *0x420478 & 0x00000000;
				return 0;
			}

0x00403f8f
0x004040b5
0x00404111
0x00404115
0x004041ec
0x004041ee
0x004041ee
0x004041f4
0x004041f4
0x004041f7
0x00000000
0x004041fe
0x00404123
0x00404125
0x0040412f
0x0040413a
0x0040413d
0x00404140
0x0040414b
0x0040414e
0x00404155
0x00404163
0x0040417b
0x0040418e
0x0040419e
0x004041a0
0x004041a0
0x00404155
0x004041aa
0x00000000
0x004041b5
0x004041b9
0x004041ca
0x004041ca
0x004041d0
0x004041de
0x004041de
0x00000000
0x004041e2
0x004041aa
0x004040c0
0x00000000
0x004040d4
0x004040d4
0x004040da
0x004040da
0x004040e0
0x00000000
0x00000000
0x00404105
0x00404107
0x0040410c
0x00000000
0x0040410c
0x004040c0
0x00403f95
0x00403f98
0x00403f9d
0x00403f9f
0x00403fae
0x00403fae
0x00403fb0
0x00403fb5
0x00403fb8
0x00403fba
0x00403fbf
0x00403fc8
0x00403fce
0x00403fda
0x00403fdd
0x00403fe6
0x00403feb
0x00403fee
0x00403ff3
0x0040400a
0x00404011
0x00404024
0x00404027
0x0040403c
0x0040403e
0x00404043
0x00404048
0x0040404d
0x0040404d
0x0040405c
0x0040406b
0x0040406d
0x00404083
0x00404092
0x00404094
0x00000000

APIs

CheckDlgButton.USER32 ref: 0040400A
GetDlgItem.USER32 ref: 0040401E
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 0040403C
GetSysColor.USER32(?), ref: 0040404D
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 0040405C
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 0040406B
lstrlenA.KERNEL32(?), ref: 00404075
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404083
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404092
GetDlgItem.USER32 ref: 004040F5
SendMessageA.USER32(00000000), ref: 004040F8
GetDlgItem.USER32 ref: 00404123
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404163
LoadCursorA.USER32 ref: 00404172
SetCursor.USER32(00000000), ref: 0040417B
ShellExecuteA.SHELL32(0000070B,open,@.B,00000000,00000000,00000001), ref: 0040418E
LoadCursorA.USER32 ref: 0040419B
SetCursor.USER32(00000000), ref: 0040419E
SendMessageA.USER32(00000111,00000001,00000000), ref: 004041CA
SendMessageA.USER32(00000010,00000000,00000000), ref: 004041DE

Strings

N, xrefs: 00404111
C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe, xrefs: 0040414E
1j, xrefs: 00403F9F
open, xrefs: 00404186
@.B, xrefs: 00404183

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: 1j$@.B$C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe$N$open
API String ID: 3615053054-2153913839
Opcode ID: 086c9584272f405e5d23a234cb3672cb38a546f38c26fc4f0f37582571ec5c76
Instruction ID: 37c7ef6c6620c2b7dda319eb73433029e403bd6f7b5c42189f778147e1498c59
Opcode Fuzzy Hash: 086c9584272f405e5d23a234cb3672cb38a546f38c26fc4f0f37582571ec5c76
Instruction Fuzzy Hash: CE61C4B1A40209BFEB109F60CC45F6A7BA9FB54715F108136FB05BA2D1C7B8A951CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				intOrPtr _t115;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x423eb0; // 0x6acdd0
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectA( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextA(_t128, "ModSource UI Addon Pack Setup", 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					_t115 =  *0x423ea8; // 0x0
					 *((intOrPtr*)(_t102 + 4)) = _t115;
				}
				return DefWindowProcA(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x00401019
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32 ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32 ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,?), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,ModSource UI Addon Pack Setup,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C
ModSource UI Addon Pack Setup, xrefs: 00401150

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$ModSource UI Addon Pack Setup
API String ID: 941294808-1880976551
Opcode ID: 1fa3053a276be56ef7da5d68adfba1d9971bfb9fa2beb597bf2db4fb963a824d
Instruction ID: 81477e3a2fde3fb3f26aa953fc06e347994717d76cab2c79682594c458f31f57
Opcode Fuzzy Hash: 1fa3053a276be56ef7da5d68adfba1d9971bfb9fa2beb597bf2db4fb963a824d
Instruction Fuzzy Hash: 8141BC71804249AFCB058FA4CD459BFBFB9FF44314F00802AF551AA1A0C378EA54DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405791 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 144
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00405791() {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t15;
				long _t16;
				intOrPtr _t18;
				int _t20;
				void* _t28;
				long _t29;
				intOrPtr* _t37;
				int _t43;
				void* _t44;
				long _t47;
				CHAR* _t49;
				void* _t51;
				void* _t53;
				intOrPtr* _t54;
				void* _t55;
				void* _t56;

				_t15 = E00405D61(1);
				_t49 =  *(_t55 + 0x18);
				if(_t15 != 0) {
					_t20 =  *_t15( *(_t55 + 0x1c), _t49, 5);
					if(_t20 != 0) {
						L16:
						 *0x423f30 =  *0x423f30 + 1;
						return _t20;
					}
				}
				 *0x422628 = 0x4c554e;
				if(_t49 == 0) {
					L5:
					_t16 = GetShortPathNameA( *(_t55 + 0x1c), 0x4220a0, 0x400);
					if(_t16 != 0 && _t16 <= 0x400) {
						_t43 = wsprintfA(0x421ca0, "%s=%s\r\n", 0x422628, 0x4220a0);
						_t18 =  *0x423eb0; // 0x6acdd0
						_t56 = _t55 + 0x10;
						E00405A65(_t43, 0x400, 0x4220a0, 0x4220a0,  *((intOrPtr*)(_t18 + 0x128)));
						_t20 = E0040571A(0x4220a0, 0xc0000000, 4);
						_t53 = _t20;
						 *(_t56 + 0x14) = _t53;
						if(_t53 == 0xffffffff) {
							goto L16;
						}
						_t47 = GetFileSize(_t53, 0);
						_t7 = _t43 + 0xa; // 0xa
						_t51 = GlobalAlloc(0x40, _t47 + _t7);
						if(_t51 == 0 || ReadFile(_t53, _t51, _t47, _t56 + 0x18, 0) == 0 || _t47 !=  *(_t56 + 0x18)) {
							L15:
							_t20 = CloseHandle(_t53);
							goto L16;
						} else {
							if(E0040568F(_t51, "[Rename]\r\n") != 0) {
								_t28 = E0040568F(_t26 + 0xa, 0x409348);
								if(_t28 == 0) {
									L13:
									_t29 = _t47;
									L14:
									E004056DB(_t51 + _t29, 0x421ca0, _t43);
									SetFilePointer(_t53, 0, 0, 0);
									WriteFile(_t53, _t51, _t47 + _t43, _t56 + 0x18, 0);
									GlobalFree(_t51);
									goto L15;
								}
								_t37 = _t28 + 1;
								_t44 = _t51 + _t47;
								_t54 = _t37;
								if(_t37 >= _t44) {
									L21:
									_t53 =  *(_t56 + 0x14);
									_t29 = _t37 - _t51;
									goto L14;
								} else {
									goto L20;
								}
								do {
									L20:
									 *((char*)(_t43 + _t54)) =  *_t54;
									_t54 = _t54 + 1;
								} while (_t54 < _t44);
								goto L21;
							}
							E00405A43(_t51 + _t47, "[Rename]\r\n");
							_t47 = _t47 + 0xa;
							goto L13;
						}
					}
				} else {
					CloseHandle(E0040571A(_t49, 0, 1));
					_t16 = GetShortPathNameA(_t49, 0x422628, 0x400);
					if(_t16 != 0 && _t16 <= 0x400) {
						goto L5;
					}
				}
				return _t16;
			}

0x00405797
0x0040579e
0x004057a2
0x004057ab
0x004057af
0x004058ee
0x004058ee
0x00000000
0x004058ee
0x004057af
0x004057bb
0x004057d1
0x004057f9
0x00405804
0x00405808
0x00405828
0x0040582a
0x0040582f
0x00405839
0x00405846
0x0040584b
0x00405850
0x00405854
0x00000000
0x00000000
0x00405863
0x00405865
0x00405872
0x00405876
0x004058e7
0x004058e8
0x00000000
0x00405892
0x0040589f
0x00405904
0x0040590b
0x004058b2
0x004058b2
0x004058b4
0x004058bd
0x004058c8
0x004058da
0x004058e1
0x00000000
0x004058e1
0x0040590d
0x0040590e
0x00405913
0x00405915
0x00405922
0x00405922
0x00405926
0x00000000
0x00000000
0x00000000
0x00000000
0x00405917
0x00405917
0x0040591a
0x0040591d
0x0040591e
0x00000000
0x00405917
0x004058aa
0x004058af
0x00000000
0x004058af
0x00405876
0x004057d3
0x004057de
0x004057e7
0x004057eb
0x00000000
0x00000000
0x004057eb
0x004058f8

APIs

Part of subcall function 00405D61: GetModuleHandleA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D73
Part of subcall function 00405D61: LoadLibraryA.KERNELBASE(?,?,00000000,00403268,00000008), ref: 00405D7E
Part of subcall function 00405D61: GetProcAddress.KERNEL32(00000000,?), ref: 00405D8F

CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000001,?,00000000,?,?,00405526,?,00000000,000000F1,?), ref: 004057DE
GetShortPathNameA.KERNEL32 ref: 004057E7
GetShortPathNameA.KERNEL32 ref: 00405804
wsprintfA.USER32 ref: 00405822
GetFileSize.KERNEL32(00000000,00000000,004220A0,C0000000,00000004,004220A0,?,?,?,00000000,000000F1,?), ref: 0040585D
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,00000000,000000F1,?), ref: 0040586C
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,000000F1,?), ref: 00405882
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00421CA0,00000000,-0000000A,00409348,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004058C8
WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,000000F1,?), ref: 004058DA
GlobalFree.KERNEL32 ref: 004058E1
CloseHandle.KERNEL32(00000000,?,?,00000000,000000F1,?), ref: 004058E8

Part of subcall function 0040568F: lstrlenA.KERNEL32(00000000,?,00000000,00000000,0040589D,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405696
Part of subcall function 0040568F: lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,0040589D,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004056C6

Strings

%s=%s, xrefs: 00405818
[Rename], xrefs: 00405892, 004058A4

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: File$Handle$CloseGlobalNamePathShortlstrlen$AddressAllocFreeLibraryLoadModulePointerProcReadSizeWritewsprintf
String ID: %s=%s$[Rename]
API String ID: 3772915668-1727408572
Opcode ID: 8364a06fe57735c93bba85b0ef92697d8b0dc93ccc8d972d9f980e1d903bc86f
Instruction ID: 908c7a545508c56be73361e54e1fb0a567cb98761eef0cd9d80c3d4c020753a9
Opcode Fuzzy Hash: 8364a06fe57735c93bba85b0ef92697d8b0dc93ccc8d972d9f980e1d903bc86f
Instruction Fuzzy Hash: E9412232A01B11BBE7217B619D49F6B3A6CEB44754F044037FD05F62D2EA78A8018EBD

Uniqueness

Uniqueness Score: -1.00%

Function 00405CA1 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405CA1(CHAR* _a4) {
				char _t5;
				char _t7;
				char* _t15;
				char* _t16;
				CHAR* _t17;

				_t17 = _a4;
				if( *_t17 == 0x5c && _t17[1] == 0x5c && _t17[2] == 0x3f && _t17[3] == 0x5c) {
					_t17 =  &(_t17[4]);
				}
				if( *_t17 != 0 && E004055A3(_t17) != 0) {
					_t17 =  &(_t17[2]);
				}
				_t5 =  *_t17;
				_t15 = _t17;
				_t16 = _t17;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((char*)(E00405561("*?|<>/\":", _t5))) == 0) {
							E004056DB(_t16, _t17, CharNextA(_t17) - _t17);
							_t16 = CharNextA(_t16);
						}
						_t17 = CharNextA(_t17);
						_t5 =  *_t17;
					} while (_t5 != 0);
				}
				 *_t16 =  *_t16 & 0x00000000;
				while(1) {
					_t16 = CharPrevA(_t15, _t16);
					_t7 =  *_t16;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t16 =  *_t16 & 0x00000000;
					if(_t15 < _t16) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x00405ca3
0x00405cab
0x00405cbf
0x00405cbf
0x00405cc5
0x00405cd2
0x00405cd2
0x00405cd3
0x00405cd5
0x00405cd9
0x00405cdb
0x00405ce4
0x00405ce6
0x00405d00
0x00405d08
0x00405d08
0x00405d0d
0x00405d0f
0x00405d11
0x00405d15
0x00405d16
0x00405d19
0x00405d21
0x00405d23
0x00405d27
0x00000000
0x00000000
0x00405d2d
0x00405d32
0x00000000
0x00000000
0x00000000
0x00405d32
0x00405d37

APIs

CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe",C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405CF9
CharNextA.USER32(?,?,?,00000000), ref: 00405D06
CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe",C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D0B
CharPrevA.USER32(?,?,"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe",C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D1B

Strings

"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe", xrefs: 00405CA7
C:\Users\user\AppData\Local\Temp\, xrefs: 00405CA2, 00405CDD
*?|<>/":, xrefs: 00405CE9

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-626998857
Opcode ID: 15bc7fd2d2b919ada39179901e21ad121c6f5132a4941cfff3b346af0b42011d
Instruction ID: a78f5161a49f52edcd2c6f9413428a1a4edfa6b41d59d307fcbc804f0dcdaaa7
Opcode Fuzzy Hash: 15bc7fd2d2b919ada39179901e21ad121c6f5132a4941cfff3b346af0b42011d
Instruction Fuzzy Hash: 13119055808F912AFB3216245C48BB77F99CF567A0F28847BE4C4632C2C67C5C429B6E

Uniqueness

Uniqueness Score: -1.00%

Function 00403E9E Relevance: 12.1, APIs: 8, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403E9E(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t35;
				long _t37;
				void* _t40;
				long* _t49;

				if(_a4 + 0xfffffecd > 5) {
					L15:
					return 0;
				}
				_t49 = GetWindowLongA(_a12, 0xffffffeb);
				if(_t49 == 0) {
					goto L15;
				}
				_t35 =  *_t49;
				if((_t49[5] & 0x00000002) != 0) {
					_t35 = GetSysColor(_t35);
				}
				if((_t49[5] & 0x00000001) != 0) {
					SetTextColor(_a8, _t35);
				}
				SetBkMode(_a8, _t49[4]);
				_t37 = _t49[1];
				_v16.lbColor = _t37;
				if((_t49[5] & 0x00000008) != 0) {
					_t37 = GetSysColor(_t37);
					_v16.lbColor = _t37;
				}
				if((_t49[5] & 0x00000004) != 0) {
					SetBkColor(_a8, _t37);
				}
				if((_t49[5] & 0x00000010) != 0) {
					_v16.lbStyle = _t49[2];
					_t40 = _t49[3];
					if(_t40 != 0) {
						DeleteObject(_t40);
					}
					_t49[3] = CreateBrushIndirect( &_v16);
				}
				return _t49[3];
			}

0x00403eb0
0x00403f44
0x00000000
0x00403f44
0x00403ec1
0x00403ec5
0x00000000
0x00000000
0x00403ecb
0x00403ed4
0x00403ed7
0x00403ed7
0x00403edd
0x00403ee3
0x00403ee3
0x00403eef
0x00403ef5
0x00403efc
0x00403eff
0x00403f02
0x00403f04
0x00403f04
0x00403f0c
0x00403f12
0x00403f12
0x00403f1c
0x00403f21
0x00403f24
0x00403f29
0x00403f2c
0x00403f2c
0x00403f3c
0x00403f3c
0x00000000

APIs

GetWindowLongA.USER32 ref: 00403EBB
GetSysColor.USER32(00000000), ref: 00403ED7
SetTextColor.GDI32(?,00000000), ref: 00403EE3
SetBkMode.GDI32(?,?), ref: 00403EEF
GetSysColor.USER32(?), ref: 00403F02
SetBkColor.GDI32(?,?), ref: 00403F12
DeleteObject.GDI32(?), ref: 00403F2C
CreateBrushIndirect.GDI32(?), ref: 00403F36

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
Instruction ID: 00f1469000c5a89127aeec98ef40b5380c975c6b17ce5fce2ee989e1a8c22914
Opcode Fuzzy Hash: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
Instruction Fuzzy Hash: D9216271904745ABCB219F68DD08B5BBFF8AF01715B048A69F895E22E1C738E9048B55

Uniqueness

Uniqueness Score: -1.00%

Function 0040266E Relevance: 10.6, APIs: 7, Instructions: 89
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040266E(struct _OVERLAPPED* __ebx) {
				void* _t27;
				long _t32;
				struct _OVERLAPPED* _t47;
				void* _t51;
				void* _t53;
				void* _t56;
				void* _t57;
				void* _t58;

				_t47 = __ebx;
				 *(_t58 - 8) = 0xfffffd66;
				_t52 = E004029E8(0xfffffff0);
				 *(_t58 - 0x44) = _t24;
				if(E004055A3(_t52) == 0) {
					E004029E8(0xffffffed);
				}
				E004056FB(_t52);
				_t27 = E0040571A(_t52, 0x40000000, 2);
				 *(_t58 + 8) = _t27;
				if(_t27 != 0xffffffff) {
					_t32 =  *0x423eb4; // 0x7e00
					 *(_t58 - 0x2c) = _t32;
					_t51 = GlobalAlloc(0x40, _t32);
					if(_t51 != _t47) {
						E004031DA(_t47);
						E004031A8(_t51,  *(_t58 - 0x2c));
						_t56 = GlobalAlloc(0x40,  *(_t58 - 0x1c));
						 *(_t58 - 0x30) = _t56;
						if(_t56 != _t47) {
							E00402F01(_t49,  *((intOrPtr*)(_t58 - 0x20)), _t47, _t56,  *(_t58 - 0x1c));
							while( *_t56 != _t47) {
								_t49 =  *_t56;
								_t57 = _t56 + 8;
								 *(_t58 - 0x38) =  *_t56;
								E004056DB( *((intOrPtr*)(_t56 + 4)) + _t51, _t57, _t49);
								_t56 = _t57 +  *(_t58 - 0x38);
							}
							GlobalFree( *(_t58 - 0x30));
						}
						WriteFile( *(_t58 + 8), _t51,  *(_t58 - 0x2c), _t58 - 8, _t47);
						GlobalFree(_t51);
						 *(_t58 - 8) = E00402F01(_t49, 0xffffffff,  *(_t58 + 8), _t47, _t47);
					}
					CloseHandle( *(_t58 + 8));
				}
				_t53 = 0xfffffff3;
				if( *(_t58 - 8) < _t47) {
					_t53 = 0xffffffef;
					DeleteFileA( *(_t58 - 0x44));
					 *((intOrPtr*)(_t58 - 4)) = 1;
				}
				_push(_t53);
				E00401423();
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t58 - 4));
				return 0;
			}

0x0040266e
0x00402670
0x0040267c
0x0040267f
0x00402689
0x0040268d
0x0040268d
0x00402693
0x004026a0
0x004026a8
0x004026ab
0x004026b1
0x004026bf
0x004026c4
0x004026c8
0x004026cb
0x004026d4
0x004026e0
0x004026e4
0x004026e7
0x004026f1
0x00402710
0x004026f8
0x004026fd
0x00402705
0x00402708
0x0040270d
0x0040270d
0x00402717
0x00402717
0x00402729
0x00402730
0x00402742
0x00402742
0x00402748
0x00402748
0x00402753
0x00402754
0x00402758
0x0040275c
0x00402762
0x00402762
0x00402769
0x00402156
0x00402880
0x0040288c

APIs

GlobalAlloc.KERNEL32(00000040,00007E00,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 004026C2
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,000000F0), ref: 004026DE
GlobalFree.KERNEL32 ref: 00402717
WriteFile.KERNEL32(FFFFFD66,00000000,?,FFFFFD66,?,?,?,?,000000F0), ref: 00402729
GlobalFree.KERNEL32 ref: 00402730
CloseHandle.KERNEL32(FFFFFD66,?,?,000000F0), ref: 00402748
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 0040275C

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: ecd5c6660de7d2acba1f0c99d102a05ed3870434b28625b791e299bfb5f74600
Instruction ID: 58ac39daff3b3af5160a623fe7db0da70309dad8486b29df09f94c3f90b2a703
Opcode Fuzzy Hash: ecd5c6660de7d2acba1f0c99d102a05ed3870434b28625b791e299bfb5f74600
Instruction Fuzzy Hash: 02319F71C00128BBDF116FA5CD89D9F7E79EF09324F10422AF914762E0C7795D419BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404DE1 Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404DE1(CHAR* _a4, CHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				CHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				CHAR* _t26;
				signed int _t27;
				CHAR* _t28;
				long _t29;
				signed int _t39;

				_t26 =  *0x423684; // 0x0
				_v8 = _t26;
				if(_t26 != 0) {
					_t27 =  *0x423f54; // 0x0
					_v12 = _t27;
					_t39 = _t27 & 0x00000001;
					if(_t39 == 0) {
						E00405A65(0, _t39, 0x41fc70, 0x41fc70, _a4);
					}
					_t26 = lstrlenA(0x41fc70);
					_a4 = _t26;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t26 = SetWindowTextA( *0x423668, 0x41fc70);
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x41fc70;
							_v52 = 1;
							_t29 = SendMessageA(_v8, 0x1004, 0, 0);
							_v44 = 0;
							_v48 = _t29 - _t39;
							SendMessageA(_v8, 0x1007 - _t39, 0,  &_v52);
							_t26 = SendMessageA(_v8, 0x1013, _v48, 0);
						}
						if(_t39 != 0) {
							_t28 = _a4;
							 *((char*)(_t28 + 0x41fc70)) = 0;
							return _t28;
						}
					} else {
						_t26 =  &(_a4[lstrlenA(_a8)]);
						if(_t26 < 0x800) {
							_t26 = lstrcatA(0x41fc70, _a8);
							goto L6;
						}
					}
				}
				return _t26;
			}

0x00404de7
0x00404df3
0x00404df6
0x00404dfc
0x00404e08
0x00404e0b
0x00404e0e
0x00404e14
0x00404e14
0x00404e1a
0x00404e22
0x00404e25
0x00404e42
0x00404e46
0x00404e4f
0x00404e4f
0x00404e59
0x00404e62
0x00404e6e
0x00404e75
0x00404e79
0x00404e7c
0x00404e8f
0x00404e9d
0x00404e9d
0x00404ea1
0x00404ea3
0x00404ea6
0x00000000
0x00404ea6
0x00404e27
0x00404e2f
0x00404e37
0x00404e3d
0x00000000
0x00404e3d
0x00404e37
0x00404e25
0x00404eb0

APIs

lstrlenA.KERNEL32(0041FC70,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E1A
lstrlenA.KERNEL32(00402C3C,0041FC70,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E2A
lstrcatA.KERNEL32(0041FC70,00402C3C,00402C3C,0041FC70,00000000,00000000,00000000), ref: 00404E3D
SetWindowTextA.USER32(0041FC70,0041FC70), ref: 00404E4F
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E75
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E8F
SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E9D

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 6af7de6fb12d37621311d767828a5214a6e37c73fc4d498048a22c56ae339c00
Instruction ID: 149710d9142c95b738f2ce1dbf38c2ff42c716f0b6f2aaa801f4c55ac3bf00d7
Opcode Fuzzy Hash: 6af7de6fb12d37621311d767828a5214a6e37c73fc4d498048a22c56ae339c00
Instruction Fuzzy Hash: D6217CB1A00108BECB119FA5CD84ADFBFB9FB44354F14807AFA04A6291C7388E458F98

Uniqueness

Uniqueness Score: -1.00%

Function 004046B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004046B0(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageA(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageA(_t28, 0x110c, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageA(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x004046be
0x004046cb
0x004046d1
0x0040470f
0x0040470f
0x0040471e
0x00404725
0x00000000
0x00404727
0x004046d3
0x004046e2
0x004046ea
0x004046ed
0x004046ff
0x00404705
0x0040470c
0x00000000
0x0040470c
0x00000000

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004046CB
GetMessagePos.USER32 ref: 004046D3
ScreenToClient.USER32 ref: 004046ED
SendMessageA.USER32(?,00001111,00000000,?), ref: 004046FF
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404725

Strings

f, xrefs: 00404701

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
Instruction ID: 0faaf10df4b3c5b013205b28b163586d08db614e614b64859ce527e54ea6c82f
Opcode Fuzzy Hash: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
Instruction Fuzzy Hash: 9D014071D00219BADB01DBA4DD45BEEBBB8AB55711F10412AFA10B71C0D7B469018B95

Uniqueness

Uniqueness Score: -1.00%

Function 00402B2D Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402B2D(struct HWND__* _a4, intOrPtr _a8) {
				char _v68;
				void* _t11;
				CHAR* _t19;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t11 = E00402BA9();
					_t19 = "unpacking data: %d%%";
					if( *0x423eb0 == 0) {
						_t19 = "verifying installer: %d%%";
					}
					wsprintfA( &_v68, _t19, _t11);
					SetWindowTextA(_a4,  &_v68);
					SetDlgItemTextA(_a4, 0x406,  &_v68);
				}
				return 0;
			}

0x00402b3a
0x00402b48
0x00402b4e
0x00402b4e
0x00402b5c
0x00402b5e
0x00402b6a
0x00402b6f
0x00402b71
0x00402b71
0x00402b7c
0x00402b8c
0x00402b9e
0x00402b9e
0x00402ba6

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B48
wsprintfA.USER32 ref: 00402B7C
SetWindowTextA.USER32(?,?), ref: 00402B8C
SetDlgItemTextA.USER32 ref: 00402B9E

Strings

unpacking data: %d%%, xrefs: 00402B6A, 00402B7A
verifying installer: %d%%, xrefs: 00402B71

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 322e588a1628b345668f722f619d61673abcd97ebd3c1989aa424dc3e6a31e3e
Instruction ID: b90043e9754d6d0c4b44fa85c4be984605eddfbda74f2dbe380e35ffd387d68b
Opcode Fuzzy Hash: 322e588a1628b345668f722f619d61673abcd97ebd3c1989aa424dc3e6a31e3e
Instruction Fuzzy Hash: 3CF01270500109ABEB219F50CD09BAA3779BB04345F00803AFA16A91D1D7B969559B99

Uniqueness

Uniqueness Score: -1.00%

Function 004022F5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E004022F5(void* __eax) {
				void* _t15;
				char* _t18;
				int _t19;
				char _t24;
				int _t27;
				signed int _t30;
				intOrPtr _t35;
				void* _t37;

				_t15 = E00402ADD(__eax);
				_t35 =  *((intOrPtr*)(_t37 - 0x14));
				 *(_t37 - 0x30) =  *(_t37 - 0x10);
				 *(_t37 - 0x44) = E004029E8(2);
				_t18 = E004029E8(0x11);
				_t30 =  *0x423f50; // 0x0
				_t31 = _t30 | 0x00000002;
				 *(_t37 - 4) = 1;
				_t19 = RegCreateKeyExA(_t15, _t18, _t27, _t27, _t27, _t30 | 0x00000002, _t27, _t37 + 8, _t27);
				if(_t19 == 0) {
					if(_t35 == 1) {
						E004029E8(0x23);
						_t19 = lstrlenA(0x409ba0) + 1;
					}
					if(_t35 == 4) {
						_t24 = E004029CB(3);
						 *0x409ba0 = _t24;
						_t19 = _t35;
					}
					if(_t35 == 3) {
						_t19 = E00402F01(_t31,  *((intOrPtr*)(_t37 - 0x18)), _t27, 0x409ba0, 0xc00);
					}
					if(RegSetValueExA( *(_t37 + 8),  *(_t37 - 0x44), _t27,  *(_t37 - 0x30), 0x409ba0, _t19) == 0) {
						 *(_t37 - 4) = _t27;
					}
					_push( *(_t37 + 8));
					RegCloseKey();
				}
				 *0x423f28 =  *0x423f28 +  *(_t37 - 4);
				return 0;
			}

0x004022f6
0x004022fb
0x00402305
0x0040230f
0x00402312
0x0040231c
0x00402322
0x0040232c
0x00402333
0x0040233b
0x00402349
0x0040234d
0x00402358
0x00402358
0x0040235c
0x00402360
0x00402366
0x0040236b
0x0040236b
0x0040236f
0x0040237b
0x0040237b
0x00402394
0x00402396
0x00402396
0x00402399
0x0040246f
0x0040246f
0x00402880
0x0040288c

APIs

RegCreateKeyExA.ADVAPI32(00000000,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402333
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsb13F9.tmp,00000023,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402353
RegSetValueExA.ADVAPI32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsb13F9.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040238C
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsb13F9.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040246F

Strings

C:\Users\user\AppData\Local\Temp\nsb13F9.tmp, xrefs: 00402344, 00402352, 00402366, 00402376, 00402381

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsb13F9.tmp
API String ID: 1356686001-2401223030
Opcode ID: 82f81fc46916c0705e62aac7a963ee57a1406d50f5cb7892ad7c697877dccabe
Instruction ID: 570de5e9f7c2b936ec187b605987d340e06286bd869a5e38a77a3de7bd58c22b
Opcode Fuzzy Hash: 82f81fc46916c0705e62aac7a963ee57a1406d50f5cb7892ad7c697877dccabe
Instruction Fuzzy Hash: 451160B1E00108BFEB10ABA1DE4AEAF7678EB00758F10443AF505B61D1D7B99D019A68

Uniqueness

Uniqueness Score: -1.00%

Function 00403897 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403897(void* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t6;
				intOrPtr _t11;
				signed int _t13;
				intOrPtr _t15;
				signed int _t16;
				signed short* _t18;
				signed int _t20;
				signed short* _t23;
				intOrPtr _t25;
				signed int _t26;
				intOrPtr* _t27;

				_t24 = "1033";
				_t13 = 0xffff;
				_t6 = E004059BA(__ecx, "1033");
				while(1) {
					_t26 =  *0x423ee4; // 0x1
					if(_t26 == 0) {
						goto L7;
					}
					_t15 =  *0x423eb0; // 0x6acdd0
					_t16 =  *(_t15 + 0x64);
					_t20 =  ~_t16;
					_t18 = _t16 * _t26 +  *0x423ee0;
					while(1) {
						_t18 = _t18 + _t20;
						_t26 = _t26 - 1;
						if((( *_t18 ^ _t6) & _t13) == 0) {
							break;
						}
						if(_t26 != 0) {
							continue;
						}
						goto L7;
					}
					 *0x423680 = _t18[1];
					 *0x423f48 = _t18[3];
					_t23 =  &(_t18[5]);
					if(_t23 != 0) {
						 *0x42367c = _t23;
						E004059A1(_t24,  *_t18 & 0x0000ffff);
						SetWindowTextA( *0x420470, E00405A65(_t13, _t24, _t26, "ModSource UI Addon Pack Setup", 0xfffffffe));
						_t11 =  *0x423ecc; // 0x1
						_t27 =  *0x423ec8; // 0x6acf7c
						if(_t11 == 0) {
							L15:
							return _t11;
						}
						_t25 = _t11;
						do {
							_t11 =  *_t27;
							if(_t11 != 0) {
								_t5 = _t27 + 0x18; // 0x6acf94
								_t11 = E00405A65(_t13, _t25, _t27, _t5, _t11);
							}
							_t27 = _t27 + 0x418;
							_t25 = _t25 - 1;
						} while (_t25 != 0);
						goto L15;
					}
					L7:
					if(_t13 != 0xffff) {
						_t13 = 0;
					} else {
						_t13 = 0x3ff;
					}
				}
			}

0x0040389b
0x004038a0
0x004038a6
0x004038ab
0x004038ab
0x004038b3
0x00000000
0x00000000
0x004038b5
0x004038bb
0x004038c3
0x004038c5
0x004038cb
0x004038cb
0x004038cd
0x004038d9
0x00000000
0x00000000
0x004038dd
0x00000000
0x00000000
0x00000000
0x004038df
0x004038e4
0x004038ed
0x004038f3
0x004038f8
0x0040390c
0x00403917
0x0040392f
0x00403935
0x0040393a
0x00403942
0x00403963
0x00403963
0x00403963
0x00403944
0x00403946
0x00403946
0x0040394a
0x0040394d
0x00403951
0x00403951
0x00403956
0x0040395c
0x0040395c
0x00000000
0x00403946
0x004038fa
0x004038ff
0x00403908
0x00403901
0x00403901
0x00403901
0x004038ff

APIs

SetWindowTextA.USER32(00000000,ModSource UI Addon Pack Setup), ref: 0040392F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403898
1033, xrefs: 0040389B, 004038A5, 00403916
ModSource UI Addon Pack Setup, xrefs: 0040391E
1j, xrefs: 0040390C

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: TextWindow
String ID: 1033$1j$C:\Users\user\AppData\Local\Temp\$ModSource UI Addon Pack Setup
API String ID: 530164218-1267405266
Opcode ID: a539481dc4a180f745331bc9860ce48ffeb1f8297ed7d67ee35d1a944f8b9c49
Instruction ID: b6bbef80cf4db276414da2a22f1c4bdb62210e7797b6490b376b442146a2dc11
Opcode Fuzzy Hash: a539481dc4a180f745331bc9860ce48ffeb1f8297ed7d67ee35d1a944f8b9c49
Instruction Fuzzy Hash: 9611C271B005119BC334AF15D880A673BBDEB84726369817BE901673D1C67D9E039A58

Uniqueness

Uniqueness Score: -1.00%

Function 00402BC5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402BC5(intOrPtr _a4) {
				char _v68;
				long _t6;
				struct HWND__* _t7;
				struct HWND__* _t14;

				if(_a4 != 0) {
					_t14 =  *0x417044; // 0x0
					if(_t14 != 0) {
						_t14 = DestroyWindow(_t14);
					}
					 *0x417044 = 0;
					return _t14;
				}
				__eflags =  *0x417044; // 0x0
				if(__eflags != 0) {
					return E00405D9A(0);
				}
				_t6 = GetTickCount();
				__eflags = _t6 -  *0x423eac;
				if(_t6 >  *0x423eac) {
					__eflags =  *0x423ea8; // 0x0
					if(__eflags == 0) {
						_t7 = CreateDialogParamA( *0x423ea0, 0x6f, 0, E00402B2D, 0);
						 *0x417044 = _t7;
						return _t7;
					}
					__eflags =  *0x423f54 & 0x00000001;
					if(( *0x423f54 & 0x00000001) != 0) {
						wsprintfA( &_v68, "... %d%%", E00402BA9());
						return E00404DE1(0,  &_v68);
					}
				}
				return _t6;
			}

0x00402bd1
0x00402bd3
0x00402bda
0x00402bdd
0x00402bdd
0x00402be3
0x00000000
0x00402be3
0x00402beb
0x00402bf1
0x00000000
0x00402bf4
0x00402bfb
0x00402c01
0x00402c07
0x00402c09
0x00402c0f
0x00402c4d
0x00402c53
0x00000000
0x00402c53
0x00402c11
0x00402c18
0x00402c29
0x00000000
0x00402c37
0x00402c18
0x00402c5a

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402BDD
GetTickCount.KERNEL32 ref: 00402BFB
CreateDialogParamA.USER32(0000006F,00000000,00402B2D,00000000), ref: 00402C4D

Part of subcall function 00402BA9: MulDiv.KERNEL32(00023202,00000064,000255D0), ref: 00402BBE

wsprintfA.USER32 ref: 00402C29

Part of subcall function 00404DE1: lstrlenA.KERNEL32(0041FC70,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E1A
Part of subcall function 00404DE1: lstrlenA.KERNEL32(00402C3C,0041FC70,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E2A
Part of subcall function 00404DE1: lstrcatA.KERNEL32(0041FC70,00402C3C,00402C3C,0041FC70,00000000,00000000,00000000), ref: 00404E3D
Part of subcall function 00404DE1: SetWindowTextA.USER32(0041FC70,0041FC70), ref: 00404E4F
Part of subcall function 00404DE1: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E75
Part of subcall function 00404DE1: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E8F
Part of subcall function 00404DE1: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E9D

Strings

... %d%%, xrefs: 00402C23

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$Windowlstrlen$CountCreateDestroyDialogParamTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 632923820-2449383134
Opcode ID: 5190f197fa7685c250af94dd05c57351dfa8e09c8eb49dcd551e394b7ae49199
Instruction ID: a286a7ec960182cd4c22ef15361b5c0a4849b6f55de65b38dadb26102185fd91
Opcode Fuzzy Hash: 5190f197fa7685c250af94dd05c57351dfa8e09c8eb49dcd551e394b7ae49199
Instruction Fuzzy Hash: AB019E70909264EBDB21AF60EE4C9AF7B78AB047017004137F402B12D1C6BCA986C6EE

Uniqueness

Uniqueness Score: -1.00%

Function 00402A28 Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402A28(void* _a4, char* _a8, long _a12) {
				void* _v8;
				char _v272;
				signed char _t16;
				long _t18;
				long _t25;
				intOrPtr* _t27;
				long _t28;

				_t16 =  *0x423f50; // 0x0
				_t18 = RegOpenKeyExA(_a4, _a8, 0, _t16 | 0x00000008,  &_v8);
				if(_t18 == 0) {
					while(RegEnumKeyA(_v8, 0,  &_v272, 0x105) == 0) {
						__eflags = _a12;
						if(_a12 != 0) {
							RegCloseKey(_v8);
							L8:
							__eflags = 1;
							return 1;
						}
						_t25 = E00402A28(_v8,  &_v272, 0);
						__eflags = _t25;
						if(_t25 != 0) {
							break;
						}
					}
					RegCloseKey(_v8);
					_t27 = E00405D61(2);
					if(_t27 == 0) {
						__eflags =  *0x423f50; // 0x0
						if(__eflags != 0) {
							goto L8;
						}
						_t28 = RegDeleteKeyA(_a4, _a8);
						__eflags = _t28;
						if(_t28 != 0) {
							goto L8;
						}
						return _t28;
					}
					return  *_t27(_a4, _a8,  *0x423f50, 0);
				}
				return _t18;
			}

0x00402a38
0x00402a49
0x00402a51
0x00402a79
0x00402a60
0x00402a63
0x00402ab3
0x00402ab9
0x00402abb
0x00000000
0x00402abb
0x00402a70
0x00402a75
0x00402a77
0x00000000
0x00000000
0x00402a77
0x00402a8e
0x00402a96
0x00402a9d
0x00402ac3
0x00402ac9
0x00000000
0x00000000
0x00402ad1
0x00402ad7
0x00402ad9
0x00000000
0x00000000
0x00000000
0x00402ad9
0x00000000
0x00402aac
0x00402ac0

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000000,?), ref: 00402A49
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402A85
RegCloseKey.ADVAPI32(?), ref: 00402A8E
RegCloseKey.ADVAPI32(?), ref: 00402AB3
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402AD1

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: a61128f766634d1b09b7f86fa8ddb2e0bbd886536e59b65217dedb63a7548a6d
Instruction ID: 394863395e6dccb867c0517941854db7f187baa007d88d6d2aa213ab3b23956e
Opcode Fuzzy Hash: a61128f766634d1b09b7f86fa8ddb2e0bbd886536e59b65217dedb63a7548a6d
Instruction Fuzzy Hash: D0115931A00109FFDF21AF90DE48DAB3B79EB44395B104536BA05A01A0DB749E51EE69

Uniqueness

Uniqueness Score: -1.00%

Function 00401CC1 Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401CC1(int __edx) {
				void* _t17;
				struct HINSTANCE__* _t21;
				struct HWND__* _t25;
				void* _t27;

				_t25 = GetDlgItem( *(_t27 - 0x34), __edx);
				GetClientRect(_t25, _t27 - 0x40);
				_t17 = SendMessageA(_t25, 0x172, _t21, LoadImageA(_t21, E004029E8(_t21), _t21,  *(_t27 - 0x38) *  *(_t27 - 0x1c),  *(_t27 - 0x34) *  *(_t27 - 0x1c), 0x10));
				if(_t17 != _t21) {
					DeleteObject(_t17);
				}
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t27 - 4));
				return 0;
			}

0x00401ccb
0x00401cd2
0x00401d01
0x00401d09
0x00401d10
0x00401d10
0x00402880
0x0040288c

APIs

GetDlgItem.USER32 ref: 00401CC5
GetClientRect.USER32 ref: 00401CD2
LoadImageA.USER32 ref: 00401CF3
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D01
DeleteObject.GDI32(00000000), ref: 00401D10

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 56af13664807fb509aa69cff6cfab67d1ec58e56b65ecf809c42e88673d99e9a
Instruction ID: ad5020e38ef11d08f371025551c7f23f007b957d45941c5b52acf933ea75ddf9
Opcode Fuzzy Hash: 56af13664807fb509aa69cff6cfab67d1ec58e56b65ecf809c42e88673d99e9a
Instruction Fuzzy Hash: 31F0F9B2A04105BFD700EBA4EE89DAFB7BDEB44341B104476F601F21A0C7789D018B29

Uniqueness

Uniqueness Score: -1.00%

Function 004055CA Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004055CA(char _a4) {
				CHAR* _t3;
				char* _t5;
				CHAR* _t7;
				CHAR* _t8;
				void* _t10;

				_t1 =  &_a4; // 0x40537c
				_t8 =  *_t1;
				_t7 = CharNextA(_t8);
				_t3 = CharNextA(_t7);
				if( *_t8 == 0 ||  *_t7 != 0x5c3a) {
					if( *_t8 != 0x5c5c) {
						L8:
						return 0;
					}
					_t10 = 2;
					while(1) {
						_t10 = _t10 - 1;
						_t5 = E00405561(_t3, 0x5c);
						if( *_t5 == 0) {
							goto L8;
						}
						_t3 = _t5 + 1;
						if(_t10 != 0) {
							continue;
						}
						return _t3;
					}
					goto L8;
				} else {
					return CharNextA(_t3);
				}
			}

0x004055d3
0x004055d3
0x004055da
0x004055dd
0x004055e2
0x004055f5
0x0040560f
0x00000000
0x0040560f
0x004055f9
0x004055fa
0x004055fd
0x004055fe
0x00405606
0x00000000
0x00000000
0x00405608
0x0040560b
0x00000000
0x00000000
0x00000000
0x0040560b
0x00000000
0x004055eb
0x00000000
0x004055ec

APIs

CharNextA.USER32(|S@,?,C:\,00000000,0040562E,C:\,C:\,?,?,7476F560,0040537C,?,"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe",7476F560), ref: 004055D8
CharNextA.USER32(00000000), ref: 004055DD
CharNextA.USER32(00000000), ref: 004055EC

Strings

|S@, xrefs: 004055D3, 004055D7
C:\, xrefs: 004055CB

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CharNext
String ID: C:\$|S@
API String ID: 3213498283-628904129
Opcode ID: 28ecaceb9e9ffd293fb97d6fe9204fba0278c1012160d9bc2691c12c1e9fd827
Instruction ID: 59c8476761b09c245942ad27e65994d154511812b78a9f1548afb2a8e03f2f93
Opcode Fuzzy Hash: 28ecaceb9e9ffd293fb97d6fe9204fba0278c1012160d9bc2691c12c1e9fd827
Instruction Fuzzy Hash: C6F02751904E2166E73262644C04B3B979CDB95310F080837E201B71D1C2B84C82DFAE

Uniqueness

Uniqueness Score: -1.00%

Function 004045CE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78
stringCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E004045CE(int _a4, intOrPtr _a8, unsigned int _a12) {
				char _v36;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t26;
				void* _t34;
				signed int _t36;
				signed int _t39;
				unsigned int _t46;

				_t46 = _a12;
				_push(0x14);
				_pop(0);
				_t34 = 0xffffffdc;
				if(_t46 < 0x100000) {
					_push(0xa);
					_pop(0);
					_t34 = 0xffffffdd;
				}
				if(_t46 < 0x400) {
					_t34 = 0xffffffde;
				}
				if(_t46 < 0xffff3333) {
					_t39 = 0x14;
					asm("cdq");
					_t46 = _t46 + 1 / _t39;
				}
				_push(E00405A65(_t34, 0, _t46,  &_v36, 0xffffffdf));
				_push(E00405A65(_t34, 0, _t46,  &_v68, _t34));
				_t21 = _t46 & 0x00ffffff;
				_t36 = 0xa;
				_push(((_t46 & 0x00ffffff) + _t21 * 4 + (_t46 & 0x00ffffff) + _t21 * 4 >> 0) % _t36);
				_push(_t46 >> 0);
				_t26 = E00405A65(_t34, 0, 0x420498, 0x420498, _a8);
				wsprintfA(_t26 + lstrlenA(0x420498), "%u.%u%s%s");
				return SetDlgItemTextA( *0x423678, _a4, 0x420498);
			}

0x004045d6
0x004045da
0x004045e2
0x004045e5
0x004045e6
0x004045e8
0x004045ea
0x004045ed
0x004045ed
0x004045f4
0x004045fa
0x004045fa
0x00404601
0x0040460c
0x0040460d
0x00404610
0x00404610
0x0040461d
0x00404628
0x0040462b
0x0040463d
0x00404644
0x00404645
0x00404654
0x00404664
0x00404680

APIs

lstrlenA.KERNEL32(00420498,00420498,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004044EE,000000DF,?,00000000,00000400), ref: 0040465C
wsprintfA.USER32 ref: 00404664
SetDlgItemTextA.USER32 ref: 00404677

Strings

%u.%u%s%s, xrefs: 00404646

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 0d225876fc7c1e1cd452057ce49f971f06b34d8ef97776d72de0db4947d811c0
Instruction ID: e1c4b7cd7fdf2ea5a1eba5c76152afdebbc6d0a4a91a7d78ea48e7aa8668d99a
Opcode Fuzzy Hash: 0d225876fc7c1e1cd452057ce49f971f06b34d8ef97776d72de0db4947d811c0
Instruction Fuzzy Hash: DB110473B001243BDB10A66D9C46EAF329DDBC6334F14423BF625F61D1E9788D1186A9

Uniqueness

Uniqueness Score: -1.00%

Function 00401BAD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00401BAD() {
				signed int _t28;
				CHAR* _t31;
				long _t32;
				int _t37;
				signed int _t38;
				int _t42;
				int _t48;
				struct HWND__* _t52;
				void* _t55;

				 *(_t55 - 0x34) = E004029CB(3);
				 *(_t55 + 8) = E004029CB(4);
				if(( *(_t55 - 0x10) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 0x34)) = E004029E8(0x33);
				}
				__eflags =  *(_t55 - 0x10) & 0x00000002;
				if(( *(_t55 - 0x10) & 0x00000002) != 0) {
					 *(_t55 + 8) = E004029E8(0x44);
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x28)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t50 = E004029E8();
					_t28 = E004029E8();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t31 =  ~( *_t27) & _t50;
					__eflags = _t31;
					_t32 = FindWindowExA( *(_t55 - 0x34),  *(_t55 + 8), _t31,  ~( *_t28) & _t28);
					goto L10;
				} else {
					_t52 = E004029CB();
					_t37 = E004029CB();
					_t48 =  *(_t55 - 0x10) >> 2;
					if(__eflags == 0) {
						_t32 = SendMessageA(_t52, _t37,  *(_t55 - 0x34),  *(_t55 + 8));
						L10:
						 *(_t55 - 8) = _t32;
					} else {
						_t38 = SendMessageTimeoutA(_t52, _t37,  *(_t55 - 0x34),  *(_t55 + 8), _t42, _t48, _t55 - 8);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t55 - 4)) =  ~_t38 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x24)) - _t42;
				if( *((intOrPtr*)(_t55 - 0x24)) >= _t42) {
					_push( *(_t55 - 8));
					E004059A1();
				}
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t55 - 4));
				return 0;
			}

0x00401bb6
0x00401bc2
0x00401bc5
0x00401bce
0x00401bce
0x00401bd1
0x00401bd5
0x00401bde
0x00401bde
0x00401be1
0x00401be5
0x00401be7
0x00401c34
0x00401c36
0x00401c3f
0x00401c47
0x00401c4a
0x00401c4a
0x00401c53
0x00000000
0x00401be9
0x00401bf0
0x00401bf2
0x00401bfa
0x00401bfd
0x00401c25
0x00401c59
0x00401c59
0x00401bff
0x00401c0d
0x00401c15
0x00401c18
0x00401c18
0x00401bfd
0x00401c5c
0x00401c5f
0x00401c65
0x00402825
0x00402825
0x00402880
0x0040288c

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C0D
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C25

Strings

!, xrefs: 00401BE1

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 334588288cfdb17ff4757290809a1857d889fbbcabb1089515c2e64beeb01a29
Instruction ID: c520659e647c29be31daea63823ecf32d675036654070bdfdaec67237a792274
Opcode Fuzzy Hash: 334588288cfdb17ff4757290809a1857d889fbbcabb1089515c2e64beeb01a29
Instruction Fuzzy Hash: 902183B1A44104BEDF01AFB5CE5BAAD7A75EF45704F14047AF501B61D1D6B88940D728

Uniqueness

Uniqueness Score: -1.00%

Function 00404D31 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404D31(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				long _t22;

				if(_a8 != 0x102) {
					if(_a8 != 0x200) {
						_t22 = _a16;
						L7:
						if(_a8 == 0x419 &&  *0x420480 != _t22) {
							 *0x420480 = _t22;
							E00405A43(0x420498, 0x424000);
							E004059A1(0x424000, _t22);
							E0040140B(6);
							E00405A43(0x424000, 0x420498);
						}
						L11:
						return CallWindowProcA( *0x420488, _a4, _a8, _a12, _t22);
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t22 = _a16;
						goto L11;
					}
					_t22 = E004046B0(_a4, 1);
					_a8 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E00403E83(0x413);
				return 0;
			}

0x00404d3d
0x00404d62
0x00404d82
0x00404d85
0x00404d88
0x00404d9f
0x00404da5
0x00404dac
0x00404db3
0x00404dba
0x00404dbf
0x00404dc5
0x00000000
0x00404dd5
0x00404d6f
0x00404dc2
0x00404dc2
0x00000000
0x00404dc2
0x00404d7b
0x00404d7d
0x00000000
0x00404d7d
0x00404d43
0x00000000
0x00000000
0x00404d4a
0x00000000

APIs

IsWindowVisible.USER32 ref: 00404D67
CallWindowProcA.USER32 ref: 00404DD5

Part of subcall function 00403E83: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00403E95

Strings

616, xrefs: 00404D93, 00404D9D, 00404DAB, 00404DB9
, xrefs: 00404D3F

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $616
API String ID: 3748168415-28502905
Opcode ID: 8c6becefd5606e84e0451c9f87a717d996e372184cb3ac391d1570451868ac8e
Instruction ID: 56c63efc0dfeedb1064743d61de07ac132654d46aac9d6c338980dc2e267a17f
Opcode Fuzzy Hash: 8c6becefd5606e84e0451c9f87a717d996e372184cb3ac391d1570451868ac8e
Instruction Fuzzy Hash: 1D116D71600219BBDF21AF51EC40A9B3A69AF84365F40853BFB04651A1C7788D919FA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405536 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405536(CHAR* _a4) {
				CHAR* _t7;

				_t7 = _a4;
				if( *(CharPrevA(_t7,  &(_t7[lstrlenA(_t7)]))) != 0x5c) {
					lstrcatA(_t7, 0x40900c);
				}
				return _t7;
			}

0x00405537
0x0040554e
0x00405556
0x00405556
0x0040555e

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040320F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 0040553C
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040320F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405545
lstrcatA.KERNEL32(?,0040900C), ref: 00405556

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405536

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: 103a7f091eca4e356757d037532255daa0bd9c7b09fb9152348cdcff170487b5
Instruction ID: a8815a40c5cf52564b0ee38fd83154c3193b14c3492e6d39585f1257e3d031c0
Opcode Fuzzy Hash: 103a7f091eca4e356757d037532255daa0bd9c7b09fb9152348cdcff170487b5
Instruction Fuzzy Hash: 82D0A9A2605A30BEE20232198C09E8B2A09CF02310B054422F200B62D2C2BC8E018FFE

Uniqueness

Uniqueness Score: -1.00%

Function 00401EC5 Relevance: 6.1, APIs: 4, Instructions: 54
memoryCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00401EC5(char __ebx, char* __edi, char* __esi) {
				char* _t18;
				int _t19;
				void* _t30;

				_t18 = E004029E8(0xffffffee);
				 *(_t30 - 0x2c) = _t18;
				_t19 = GetFileVersionInfoSizeA(_t18, _t30 - 0x30);
				 *__esi = __ebx;
				 *(_t30 - 8) = _t19;
				 *__edi = __ebx;
				 *((intOrPtr*)(_t30 - 4)) = 1;
				if(_t19 != __ebx) {
					__eax = GlobalAlloc(0x40, __eax);
					 *(__ebp + 8) = __eax;
					if(__eax != __ebx) {
						if(__eax != 0) {
							__ebp - 0x44 = __ebp - 0x34;
							if(VerQueryValueA( *(__ebp + 8), 0x40900c, __ebp - 0x34, __ebp - 0x44) != 0) {
								 *(__ebp - 0x34) = E004059A1(__esi,  *((intOrPtr*)( *(__ebp - 0x34) + 8)));
								 *(__ebp - 0x34) = E004059A1(__edi,  *((intOrPtr*)( *(__ebp - 0x34) + 0xc)));
								 *((intOrPtr*)(__ebp - 4)) = __ebx;
							}
						}
						_push( *(__ebp + 8));
						GlobalFree();
					}
				}
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t30 - 4));
				return 0;
			}

0x00401ec7
0x00401ecf
0x00401ed4
0x00401ed9
0x00401edd
0x00401ee0
0x00401ee2
0x00401ee9
0x00401ef2
0x00401efa
0x00401efd
0x00401f12
0x00401f18
0x00401f2b
0x00401f34
0x00401f40
0x00401f45
0x00401f45
0x00401f2b
0x00401f48
0x00401b75
0x00401b75
0x00401efd
0x00402880
0x0040288c

APIs

GetFileVersionInfoSizeA.VERSION(00000000,?,000000EE), ref: 00401ED4
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401EF2
GetFileVersionInfoA.VERSION(?,?,?,00000000), ref: 00401F0B
VerQueryValueA.VERSION(?,0040900C,?,?,?,?,?,00000000), ref: 00401F24

Part of subcall function 004059A1: wsprintfA.USER32 ref: 004059AE

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: 72b002e25d23746f55465e87ebc4891665adca6a8565e1daa1fca067951ffbc1
Instruction ID: 4c29c4488d16eb6d588cf0a37e271aba1ea36fdfc8d1aea13138bc9de0436761
Opcode Fuzzy Hash: 72b002e25d23746f55465e87ebc4891665adca6a8565e1daa1fca067951ffbc1
Instruction Fuzzy Hash: 3B1136B2900109BEDB01EFA5D981DAEBBB9AF04344B20803AF501F61E1D7388A55DB28

Uniqueness

Uniqueness Score: -1.00%

Function 00401D1B Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00401D1B() {
				void* __esi;
				int _t6;
				signed char _t11;
				struct HFONT__* _t14;
				void* _t18;
				void* _t24;
				void* _t26;
				void* _t28;

				_t6 = GetDeviceCaps(GetDC( *(_t28 - 0x34)), 0x5a);
				0x409360->lfHeight =  ~(MulDiv(E004029CB(2), _t6, 0x48));
				 *0x409370 = E004029CB(3);
				_t11 =  *((intOrPtr*)(_t28 - 0x14));
				 *0x409377 = 1;
				 *0x409374 = _t11 & 0x00000001;
				 *0x409375 = _t11 & 0x00000002;
				 *0x409376 = _t11 & 0x00000004;
				E00405A65(_t18, _t24, _t26, 0x40937c,  *((intOrPtr*)(_t28 - 0x20)));
				_t14 = CreateFontIndirectA(0x409360);
				_push(_t14);
				_push(_t26);
				E004059A1();
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t28 - 4));
				return 0;
			}

0x00401d29
0x00401d42
0x00401d4c
0x00401d51
0x00401d5c
0x00401d63
0x00401d75
0x00401d7b
0x00401d80
0x00401d8a
0x004024aa
0x00401561
0x00402825
0x00402880
0x0040288c

APIs

GetDC.USER32(?), ref: 00401D22
GetDeviceCaps.GDI32(00000000), ref: 00401D29
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D38
CreateFontIndirectA.GDI32(00409360), ref: 00401D8A

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirect
String ID:
API String ID: 3272661963-0
Opcode ID: 67e76046895c8a450e4a4da611bb1fb7297f86a119a4545cfc30b37a9c529654
Instruction ID: 726e2bb9bd89ce2300a463594e38ea09ef541e50853f711413bf27fbe0b36a1d
Opcode Fuzzy Hash: 67e76046895c8a450e4a4da611bb1fb7297f86a119a4545cfc30b37a9c529654
Instruction Fuzzy Hash: 36F0AFB0A48640AEE7019770AE1FF9A7B64A719305F104539F943BA1E3C6BC0800CF3E

Uniqueness

Uniqueness Score: -1.00%

Function 004024B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
filestringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004024B0(struct _OVERLAPPED* __ebx, intOrPtr* __esi) {
				int _t5;
				long _t7;
				struct _OVERLAPPED* _t11;
				intOrPtr* _t15;
				void* _t17;
				int _t21;

				_t15 = __esi;
				_t11 = __ebx;
				if( *((intOrPtr*)(_t17 - 0x1c)) == __ebx) {
					_t7 = lstrlenA(E004029E8(0x11));
				} else {
					E004029CB(1);
					 *0x4097a0 = __al;
				}
				if( *_t15 == _t11) {
					L8:
					 *((intOrPtr*)(_t17 - 4)) = 1;
				} else {
					_t5 = WriteFile(E004059BA(_t17 + 8, _t15), "C:\Users\jones\AppData\Local\Temp\nsb13F9.tmp\ZipDLL.dll", _t7, _t17 + 8, _t11);
					_t21 = _t5;
					if(_t21 == 0) {
						goto L8;
					}
				}
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t17 - 4));
				return 0;
			}

0x004024b0
0x004024b0
0x004024b3
0x004024ce
0x004024b5
0x004024b7
0x004024bc
0x004024c3
0x004024d5
0x0040264e
0x0040264e
0x004024db
0x004024ed
0x004015a6
0x004015a8
0x00000000
0x004015ae
0x004015a8
0x00402880
0x0040288c

APIs

lstrlenA.KERNEL32(00000000,00000011), ref: 004024CE
WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nsb13F9.tmp\ZipDLL.dll,00000000,?,?,00000000,00000011), ref: 004024ED

Strings

C:\Users\user\AppData\Local\Temp\nsb13F9.tmp\ZipDLL.dll, xrefs: 004024BC, 004024E1

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: FileWritelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsb13F9.tmp\ZipDLL.dll
API String ID: 427699356-1152333060
Opcode ID: c97a262422251ac2c5b0726cecf9a6ce5f2df5cb7fc6d5189b19373519bc9013
Instruction ID: 7b13497face05bac1b2fff9ac546fbc2a554cc17bcd567d78a6b34cf9aafac8e
Opcode Fuzzy Hash: c97a262422251ac2c5b0726cecf9a6ce5f2df5cb7fc6d5189b19373519bc9013
Instruction Fuzzy Hash: 27F0E9B2A14240FFD700EFE19E49AAB3668DB41305F10483BB142F60C2D6BD89418B2D

Uniqueness

Uniqueness Score: -1.00%

Function 0040557D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040557D(char* _a4) {
				char* _t3;
				char* _t5;

				_t5 = _a4;
				_t3 =  &(_t5[lstrlenA(_t5)]);
				while( *_t3 != 0x5c) {
					_t3 = CharPrevA(_t5, _t3);
					if(_t3 > _t5) {
						continue;
					}
					break;
				}
				 *_t3 =  *_t3 & 0x00000000;
				return  &(_t3[1]);
			}

0x0040557e
0x00405588
0x0040558a
0x00405591
0x00405599
0x00000000
0x00000000
0x00000000
0x00405599
0x0040559b
0x004055a0

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402CC7,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe,C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe,80000000,00000003), ref: 00405583
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402CC7,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe,C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe,80000000,00000003), ref: 00405591

Strings

C:\Users\user\Desktop, xrefs: 0040557D

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-224404859
Opcode ID: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction ID: a78a31216ab9b60c328ce82f5fccc260d5afe3ad280ceae17d90b4b54361c34b
Opcode Fuzzy Hash: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction Fuzzy Hash: 56D09E62509AA06EE30266549C04B9B6A49DB16710F195862E540A6195C2785D418EA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040568F Relevance: 5.0, APIs: 4, Instructions: 30
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040568F(CHAR* _a4, CHAR* _a8) {
				int _t10;
				int _t15;
				CHAR* _t16;

				_t15 = lstrlenA(_a8);
				_t16 = _a4;
				while(lstrlenA(_t16) >= _t15) {
					 *(_t15 + _t16) =  *(_t15 + _t16) & 0x00000000;
					_t10 = lstrcmpiA(_t16, _a8);
					if(_t10 == 0) {
						return _t16;
					}
					_t16 = CharNextA(_t16);
				}
				return 0;
			}

0x0040569b
0x0040569d
0x004056c5
0x004056aa
0x004056af
0x004056ba
0x00000000
0x004056d7
0x004056c3
0x004056c3
0x00000000

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,0040589D,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405696
lstrcmpiA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0040589D,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004056AF
CharNextA.USER32(00000000,?,?,00000000,000000F1,?), ref: 004056BD
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,0040589D,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004056C6

Memory Dump Source

Source File: 00000000.00000002.346081961.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.346076614.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346237076.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346243430.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.346436592.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
Instruction ID: f65b762de9c196bf4895d9b9c03b18621a66a0ffa1d04d6b890c27cf309056ad
Opcode Fuzzy Hash: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
Instruction Fuzzy Hash: 0EF0A736249D51DBC2025B655C04E7B7E94EF92354B640D7AF444F2240D33A98159FBF

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ModSource UI Addon Pack.exePID: 5900, Parent PID: 3500COMMON

Execution Graph

Execution Coverage:	33.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1241
Total number of Limit Nodes:	58

Executed Functions

Function 00403225 Relevance: 75.5, APIs: 24, Strings: 19, Instructions: 270
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			_entry_() {
				struct _SHFILEINFOA _v360;
				struct _SECURITY_ATTRIBUTES* _v376;
				char _v380;
				CHAR* _v384;
				char _v392;
				int _v396;
				int _v400;
				signed int _v404;
				CHAR* _v408;
				int _v412;
				struct _SECURITY_ATTRIBUTES* _v416;
				struct _SECURITY_ATTRIBUTES* _v424;
				void* _v432;
				int _t34;
				CHAR* _t39;
				char* _t42;
				signed int _t44;
				void* _t48;
				int _t50;
				signed int _t51;
				signed int _t54;
				int _t55;
				signed int _t59;
				intOrPtr _t70;
				intOrPtr _t76;
				void* _t78;
				void* _t88;
				void* _t90;
				char* _t95;
				signed int _t96;
				void* _t97;
				signed int _t98;
				signed int _t99;
				signed int _t102;
				CHAR* _t104;
				signed int _t105;
				intOrPtr _t112;
				char _t119;

				_v376 = 0;
				_v384 = "Error writing temporary file. Make sure your temp folder is valid.";
				_t98 = 0;
				_v380 = 0x20;
				__imp__#17();
				_t34 = SetErrorMode(0x8001); // executed
				__imp__OleInitialize(0); // executed
				 *0x423f58 = _t34;
				 *0x423ea4 = E00405D61(8);
				SHGetFileInfoA(0x41f450, 0,  &_v360, 0x160, 0); // executed
				E00405A43("ModSource UI Addon Pack Setup", "NSIS Error");
				_t39 = GetCommandLineA();
				_t95 = "\"C:\\Users\\jones\\AppData\\Local\\Temp\\ModSource UI Addon Pack\\ModSource UI Addon Pack.exe\"";
				E00405A43(_t95, _t39);
				 *0x423ea0 = GetModuleHandleA(0);
				_t42 = _t95;
				if("\"C:\\Users\\jones\\AppData\\Local\\Temp\\ModSource UI Addon Pack\\ModSource UI Addon Pack.exe\"" == 0x22) {
					_v404 = 0x22;
					_t42 =  &M00429001;
				}
				_t44 = CharNextA(E00405561(_t42, _v404));
				_v404 = _t44;
				while(1) {
					_t90 =  *_t44;
					_t108 = _t90;
					if(_t90 == 0) {
						break;
					}
					__eflags = _t90 - 0x20;
					if(_t90 != 0x20) {
						L5:
						__eflags =  *_t44 - 0x22;
						_v404 = 0x20;
						if( *_t44 == 0x22) {
							_t44 = _t44 + 1;
							__eflags = _t44;
							_v404 = 0x22;
						}
						__eflags =  *_t44 - 0x2f;
						if( *_t44 != 0x2f) {
							L15:
							_t44 = E00405561(_t44, _v404);
							__eflags =  *_t44 - 0x22;
							if(__eflags == 0) {
								_t44 = _t44 + 1;
								__eflags = _t44;
							}
							continue;
						} else {
							_t44 = _t44 + 1;
							__eflags =  *_t44 - 0x53;
							if( *_t44 == 0x53) {
								__eflags = ( *(_t44 + 1) | 0x00000020) - 0x20;
								if(( *(_t44 + 1) | 0x00000020) == 0x20) {
									_t98 = _t98 | 0x00000002;
									__eflags = _t98;
								}
							}
							__eflags =  *_t44 - 0x4352434e;
							if( *_t44 == 0x4352434e) {
								__eflags = ( *(_t44 + 4) | 0x00000020) - 0x20;
								if(( *(_t44 + 4) | 0x00000020) == 0x20) {
									_t98 = _t98 | 0x00000004;
									__eflags = _t98;
								}
							}
							__eflags =  *((intOrPtr*)(_t44 - 2)) - 0x3d442f20;
							if( *((intOrPtr*)(_t44 - 2)) == 0x3d442f20) {
								 *((intOrPtr*)(_t44 - 2)) = 0;
								_t45 = _t44 + 2;
								__eflags = _t44 + 2;
								E00405A43("C:\\Program Files\\StarWarsGalaxies", _t45);
								L20:
								_t104 = "C:\\Users\\jones\\AppData\\Local\\Temp\\";
								GetTempPathA(0x400, _t104); // executed
								_t48 = E004031F1(_t108);
								_t109 = _t48;
								if(_t48 != 0) {
									L22:
									DeleteFileA("1033"); // executed
									_t50 = E00402C5B(_t110, _t98); // executed
									_v412 = _t50;
									if(_t50 != 0) {
										L32:
										ExitProcess(); // executed
										__imp__OleUninitialize(); // executed
										if(_v404 == 0) {
											__eflags =  *0x423f34; // 0x0
											if(__eflags != 0) {
												_t105 = E00405D61(3);
												_t99 = E00405D61(4);
												_t54 = E00405D61(5);
												__eflags = _t105;
												_t96 = _t54;
												if(_t105 != 0) {
													__eflags = _t99;
													if(_t99 != 0) {
														__eflags = _t96;
														if(_t96 != 0) {
															_t59 =  *_t105(GetCurrentProcess(), 0x28,  &_v392);
															__eflags = _t59;
															if(_t59 != 0) {
																 *_t99(0, "SeShutdownPrivilege",  &_v396);
																_v412 = 1;
																_v400 = 2;
																 *_t96(_v416, 0,  &_v412, 0, 0, 0);
															}
														}
													}
												}
												_t55 = ExitWindowsEx(2, 0);
												__eflags = _t55;
												if(_t55 == 0) {
													E0040140B(9);
												}
											}
											_t51 =  *0x423f4c; // 0xffffffff
											__eflags = _t51 - 0xffffffff;
											if(_t51 != 0xffffffff) {
												_v396 = _t51;
											}
											ExitProcess(_v396);
										}
										E00405304(_v404, 0x200010);
										ExitProcess(2);
									}
									_t112 =  *0x423ebc; // 0x0
									if(_t112 == 0) {
										L31:
										 *0x423f4c =  *0x423f4c | 0xffffffff;
										_v400 = E004035E3();
										goto L32;
									}
									_t102 = E00405561(_t95, 0);
									while(_t102 >= _t95) {
										__eflags =  *_t102 - 0x3d3f5f20;
										if(__eflags == 0) {
											break;
										}
										_t102 = _t102 - 1;
										__eflags = _t102;
									}
									_t114 = _t102 - _t95;
									_v408 = "Error launching installer";
									if(_t102 < _t95) {
										lstrcatA(_t104, "~nsu.tmp");
										_t100 = "C:\\Users\\jones\\AppData\\Local\\Temp\\ModSource UI Addon Pack";
										if(lstrcmpiA(_t104, "C:\\Users\\jones\\AppData\\Local\\Temp\\ModSource UI Addon Pack") == 0) {
											goto L32;
										}
										CreateDirectoryA(_t104, 0);
										SetCurrentDirectoryA(_t104);
										_t119 = "C:\\Program Files\\StarWarsGalaxies"; // 0x43
										if(_t119 == 0) {
											E00405A43("C:\\Program Files\\StarWarsGalaxies", _t100);
										}
										E00405A43(0x424000, _v396);
										 *0x424400 = 0x41;
										_t97 = 0x1a;
										do {
											_t70 =  *0x423eb0; // 0x6dee30
											E00405A65(0, _t97, 0x41f050, 0x41f050,  *((intOrPtr*)(_t70 + 0x120)));
											DeleteFileA(0x41f050);
											if(_v416 != 0 && CopyFileA("C:\\Users\\jones\\AppData\\Local\\Temp\\ModSource UI Addon Pack\\ModSource UI Addon Pack.exe", 0x41f050, 1) != 0) {
												_push(0);
												_push(0x41f050);
												E00405791();
												_t76 =  *0x423eb0; // 0x6dee30
												E00405A65(0, _t97, 0x41f050, 0x41f050,  *((intOrPtr*)(_t76 + 0x124)));
												_t78 = E004052A3(0x41f050);
												if(_t78 != 0) {
													CloseHandle(_t78);
													_v416 = 0;
												}
											}
											 *0x424400 =  *0x424400 + 1;
											_t97 = _t97 - 1;
										} while (_t97 != 0);
										_push(0);
										_push(_t104);
										E00405791();
										goto L32;
									}
									 *_t102 = 0;
									_t103 = _t102 + 4;
									if(E00405617(_t114, _t102 + 4) == 0) {
										goto L32;
									}
									E00405A43("C:\\Program Files\\StarWarsGalaxies", _t103);
									E00405A43("C:\\Program Files\\StarWarsGalaxies\\Mods\\ModSource UI Addon Pack\\Icons", _t103);
									_v424 = 0;
									goto L31;
								}
								GetWindowsDirectoryA(_t104, 0x3fb);
								lstrcatA(_t104, "\\Temp");
								_t88 = E004031F1(_t109);
								_t110 = _t88;
								if(_t88 == 0) {
									goto L32;
								}
								goto L22;
							}
							goto L15;
						}
					} else {
						goto L4;
					}
					do {
						L4:
						_t44 = _t44 + 1;
						__eflags =  *_t44 - 0x20;
					} while ( *_t44 == 0x20);
					goto L5;
				}
				goto L20;
			}

APIs

#17.COMCTL32 ref: 00403244
SetErrorMode.KERNELBASE(00008001), ref: 0040324F
OleInitialize.OLE32(00000000), ref: 00403256

Part of subcall function 00405D61: GetModuleHandleA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D73
Part of subcall function 00405D61: LoadLibraryA.KERNELBASE(?,?,00000000,00403268,00000008), ref: 00405D7E
Part of subcall function 00405D61: GetProcAddress.KERNEL32(00000000,?), ref: 00405D8F

SHGetFileInfoA.SHELL32(0041F450,00000000,?,00000160,00000000,00000008), ref: 0040327E

Part of subcall function 00405A43: lstrcpynA.KERNEL32(?,?,00000400,00403293,ModSource UI Addon Pack Setup,NSIS Error), ref: 00405A50

GetCommandLineA.KERNEL32(ModSource UI Addon Pack Setup,NSIS Error), ref: 00403293
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe",00000000), ref: 004032A6
CharNextA.USER32(00000000,"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe",00000020), ref: 004032D1
GetTempPathA.KERNELBASE(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 00403364
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 00403379
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403385
DeleteFileA.KERNELBASE(1033), ref: 00403398
ExitProcess.KERNEL32(00000000), ref: 00403411
OleUninitialize.OLE32(00000000), ref: 00403416
ExitProcess.KERNEL32 ref: 00403436
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe",00000000,00000000), ref: 00403442
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack,C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe",00000000,00000000), ref: 0040344E
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040345A
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 00403461
DeleteFileA.KERNEL32(0041F050,0041F050,?,00424000,?), ref: 004034AB
CopyFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe,0041F050,00000001), ref: 004034BF
CloseHandle.KERNEL32(00000000,0041F050,0041F050,?,0041F050,00000000), ref: 004034EC
GetCurrentProcess.KERNEL32(00000028,?,00000005,00000004,00000003), ref: 00403541
ExitWindowsEx.USER32(00000002,00000000), ref: 0040357D
ExitProcess.KERNEL32 ref: 004035A0

Strings

\Temp, xrefs: 0040337F
SeShutdownPrivilege, xrefs: 00403553
"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe", xrefs: 00403299, 0040329F, 004033B5
C:\Program Files\StarWarsGalaxies, xrefs: 0040334F, 004033E8, 00403467, 00403470
NCRC, xrefs: 00403311
_?=, xrefs: 004033BF
C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe, xrefs: 004034BA
/D=, xrefs: 00403327
C:\Users\user\AppData\Local\Temp\, xrefs: 00403359, 0040335E, 00403378, 00403384, 00403441, 0040344D, 00403459, 00403460, 00403500
", xrefs: 004032F3
Error launching installer, xrefs: 004033CE
NSIS Error, xrefs: 00403284
C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Icons, xrefs: 004033F3
C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack, xrefs: 00403447, 0040344C, 0040346F
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403235
0m, xrefs: 00403499, 004034D0
1033, xrefs: 00403393
~nsu.tmp, xrefs: 0040343C
ModSource UI Addon Pack Setup, xrefs: 00403289

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: ExitFileProcess$DirectoryHandle$CurrentDeleteModuleWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$"$"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe"$0m$1033$C:\Program Files\StarWarsGalaxies$C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Icons$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack$C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$ModSource UI Addon Pack Setup$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
API String ID: 553446912-955577742
Opcode ID: 6e8dc10f760e451d815f7e78a583de429b13dc9852b0050b40f8771bd254e406
Instruction ID: 71fa282af5de1027f18dc485530d699f70574a0073b3e834d6f16d9d3991eef7
Opcode Fuzzy Hash: 6e8dc10f760e451d815f7e78a583de429b13dc9852b0050b40f8771bd254e406
Instruction Fuzzy Hash: 7791C370A08351BFDB216F619C89B1B7EACAB40306F44057BF541B61D2C77C9E458B6E

Uniqueness

Uniqueness Score: -1.00%

Function 00404730 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 478
windowmemoryCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00404730(struct HWND__* _a4, int _a8, unsigned int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				signed int _v16;
				intOrPtr _v20;
				void* _v24;
				long _v28;
				int _v32;
				signed int _v40;
				int _v44;
				signed int* _v56;
				intOrPtr _v60;
				signed int _v64;
				long _v68;
				void* _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t182;
				intOrPtr _t183;
				int _t189;
				int _t196;
				intOrPtr _t198;
				long _t202;
				signed int _t206;
				signed int _t217;
				void* _t220;
				void* _t221;
				int _t227;
				intOrPtr _t231;
				signed int _t232;
				signed int _t233;
				signed int _t240;
				signed int _t242;
				signed int _t245;
				signed int _t247;
				struct HBITMAP__* _t250;
				void* _t252;
				char* _t268;
				signed char _t269;
				long _t271;
				long _t274;
				int _t277;
				int _t280;
				signed int* _t281;
				int _t282;
				long _t283;
				signed int* _t284;
				int _t285;
				long _t286;
				signed int _t287;
				long _t288;
				signed int _t291;
				int _t294;
				signed int _t298;
				signed int _t300;
				signed int _t302;
				intOrPtr _t309;
				int* _t310;
				void* _t311;
				int _t315;
				int _t316;
				int _t317;
				signed int _t318;
				void* _t320;
				void* _t328;
				void* _t331;

				_v12 = GetDlgItem(_a4, 0x3f9);
				_t182 = GetDlgItem(_a4, 0x408);
				_t280 =  *0x423ec8; // 0x6df15c
				_t320 = SendMessageA;
				_v8 = _t182;
				_t183 =  *0x423eb0; // 0x6dee30
				_t315 = 0;
				_v32 = _t280;
				_v20 = _t183 + 0x94;
				if(_a8 != 0x110) {
					L23:
					__eflags = _a8 - 0x405;
					if(_a8 != 0x405) {
						_t289 = _a16;
					} else {
						_a12 = _t315;
						_t289 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					__eflags = _a8 - 0x4e;
					if(_a8 == 0x4e) {
						L28:
						__eflags = _a8 - 0x413;
						_v16 = _t289;
						if(_a8 == 0x413) {
							L30:
							__eflags =  *0x423eb9 & 0x00000002;
							if(( *0x423eb9 & 0x00000002) != 0) {
								L41:
								__eflags = _v16 - _t315;
								if(_v16 != _t315) {
									_t232 = _v16;
									__eflags =  *((intOrPtr*)(_t232 + 8)) - 0xfffffe6e;
									if( *((intOrPtr*)(_t232 + 8)) == 0xfffffe6e) {
										SendMessageA(_v8, 0x419, _t315,  *(_t232 + 0x5c));
									}
									_t233 = _v16;
									__eflags =  *((intOrPtr*)(_t233 + 8)) - 0xfffffe6a;
									if( *((intOrPtr*)(_t233 + 8)) == 0xfffffe6a) {
										__eflags =  *((intOrPtr*)(_t233 + 0xc)) - 2;
										if( *((intOrPtr*)(_t233 + 0xc)) != 2) {
											_t284 =  *(_t233 + 0x5c) * 0x418 + _t280 + 8;
											 *_t284 =  *_t284 & 0xffffffdf;
											__eflags =  *_t284;
										} else {
											 *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) =  *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							__eflags = _a8 - 0x413;
							if(_a8 == 0x413) {
								L33:
								__eflags = _a8 - 0x413;
								_t289 = 0 | _a8 != 0x00000413;
								_t240 = E004046B0(_v8, _a8 != 0x413);
								__eflags = _t240 - _t315;
								if(_t240 >= _t315) {
									_t93 = _t280 + 8; // 0x8
									_t310 = _t240 * 0x418 + _t93;
									_t289 =  *_t310;
									__eflags = _t289 & 0x00000010;
									if((_t289 & 0x00000010) == 0) {
										__eflags = _t289 & 0x00000040;
										if((_t289 & 0x00000040) == 0) {
											_t298 = _t289 ^ 0x00000001;
											__eflags = _t298;
										} else {
											_t300 = _t289 ^ 0x00000080;
											__eflags = _t300;
											if(_t300 >= 0) {
												_t298 = _t300 & 0xfffffffe;
											} else {
												_t298 = _t300 | 0x00000001;
											}
										}
										 *_t310 = _t298;
										E0040117D(_t240);
										_t242 =  *0x423eb8; // 0x80
										_t289 = 1;
										_a8 = 0x40f;
										_t245 =  !_t242 >> 0x00000008 & 1;
										__eflags = _t245;
										_a12 = 1;
										_a16 = _t245;
									}
								}
								goto L41;
							}
							_t289 = _a16;
							__eflags =  *((intOrPtr*)(_t289 + 8)) - 0xfffffffe;
							if( *((intOrPtr*)(_t289 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						}
						__eflags =  *((intOrPtr*)(_t289 + 4)) - 0x408;
						if( *((intOrPtr*)(_t289 + 4)) != 0x408) {
							goto L48;
						}
						goto L30;
					} else {
						__eflags = _a8 - 0x413;
						if(_a8 != 0x413) {
							L48:
							__eflags = _a8 - 0x111;
							if(_a8 != 0x111) {
								L56:
								__eflags = _a8 - 0x200;
								if(_a8 == 0x200) {
									SendMessageA(_v8, 0x200, _t315, _t315); // executed
								}
								__eflags = _a8 - 0x40b;
								if(_a8 == 0x40b) {
									_t220 =  *0x420474;
									__eflags = _t220 - _t315;
									if(_t220 != _t315) {
										ImageList_Destroy(_t220);
									}
									_t221 =  *0x42048c;
									__eflags = _t221 - _t315;
									if(_t221 != _t315) {
										GlobalFree(_t221);
									}
									 *0x420474 = _t315;
									 *0x42048c = _t315;
									 *0x423f00 = _t315;
								}
								__eflags = _a8 - 0x40f;
								if(_a8 != 0x40f) {
									L86:
									__eflags = _a8 - 0x420;
									if(_a8 == 0x420) {
										__eflags =  *0x423eb9 & 0x00000001;
										if(( *0x423eb9 & 0x00000001) != 0) {
											__eflags = _a16 - 0x20;
											_t189 = (0 | _a16 == 0x00000020) << 3;
											__eflags = _t189;
											_t316 = _t189;
											ShowWindow(_v8, _t316);
											ShowWindow(GetDlgItem(_a4, 0x3fe), _t316);
										}
									}
									goto L89;
								} else {
									E004011EF(_t289, _t315, _t315);
									__eflags = _a12 - _t315;
									if(_a12 != _t315) {
										E0040140B(8);
									}
									__eflags = _a16 - _t315;
									if(_a16 == _t315) {
										L73:
										E004011EF(_t289, _t315, _t315);
										__eflags =  *0x423ecc - _t315; // 0x5d
										_v32 =  *0x42048c;
										_t196 =  *0x423ec8; // 0x6df15c
										_v60 = 0xf030;
										_v16 = _t315;
										if(__eflags <= 0) {
											L84:
											InvalidateRect(_v8, _t315, 1);
											_t198 =  *0x42367c; // 0x710525
											__eflags =  *((intOrPtr*)(_t198 + 0x10)) - _t315;
											if( *((intOrPtr*)(_t198 + 0x10)) != _t315) {
												E004045CE(0x3ff, 0xfffffffb, E00404683(5)); // executed
											}
											goto L86;
										} else {
											_t142 = _t196 + 8; // 0x6df164
											_t281 = _t142;
											do {
												_t202 =  *((intOrPtr*)(_v32 + _v16 * 4));
												__eflags = _t202 - _t315;
												if(_t202 != _t315) {
													_t291 =  *_t281;
													_v68 = _t202;
													__eflags = _t291 & 0x00000001;
													_v72 = 8;
													if((_t291 & 0x00000001) != 0) {
														_t151 =  &(_t281[4]); // 0x6df174
														_v72 = 9;
														_v56 = _t151;
														_t154 =  &(_t281[0]);
														 *_t154 = _t281[0] & 0x000000fe;
														__eflags =  *_t154;
													}
													__eflags = _t291 & 0x00000040;
													if((_t291 & 0x00000040) == 0) {
														_t206 = (_t291 & 0x00000001) + 1;
														__eflags = _t291 & 0x00000010;
														if((_t291 & 0x00000010) != 0) {
															_t206 = _t206 + 3;
															__eflags = _t206;
														}
													} else {
														_t206 = 3;
													}
													_t294 = (_t291 >> 0x00000005 & 0x00000001) + 1;
													__eflags = _t294;
													_v64 = (_t206 << 0x0000000b | _t291 & 0x00000008) + (_t206 << 0x0000000b | _t291 & 0x00000008) | _t291 & 0x00000020;
													SendMessageA(_v8, 0x1102, _t294, _v68);
													SendMessageA(_v8, 0x110d, _t315,  &_v72); // executed
												}
												_v16 = _v16 + 1;
												_t281 =  &(_t281[0x106]);
												__eflags = _v16 -  *0x423ecc; // 0x5d
											} while (__eflags < 0);
											goto L84;
										}
									} else {
										_t282 = E004012E2( *0x42048c);
										E00401299(_t282);
										_t217 = 0;
										_t289 = 0;
										__eflags = _t282 - _t315;
										if(_t282 <= _t315) {
											L72:
											SendMessageA(_v12, 0x14e, _t289, _t315);
											_a16 = _t282;
											_a8 = 0x420;
											goto L73;
										} else {
											goto L69;
										}
										do {
											L69:
											_t309 = _v20;
											__eflags =  *((intOrPtr*)(_t309 + _t217 * 4)) - _t315;
											if( *((intOrPtr*)(_t309 + _t217 * 4)) != _t315) {
												_t289 = _t289 + 1;
												__eflags = _t289;
											}
											_t217 = _t217 + 1;
											__eflags = _t217 - _t282;
										} while (_t217 < _t282);
										goto L72;
									}
								}
							}
							__eflags = _a12 - 0x3f9;
							if(_a12 != 0x3f9) {
								goto L89;
							}
							__eflags = _a12 >> 0x10 - 1;
							if(_a12 >> 0x10 != 1) {
								goto L89;
							}
							_t227 = SendMessageA(_v12, 0x147, _t315, _t315);
							__eflags = _t227 - 0xffffffff;
							if(_t227 == 0xffffffff) {
								goto L89;
							}
							_t283 = SendMessageA(_v12, 0x150, _t227, _t315);
							__eflags = _t283 - 0xffffffff;
							if(_t283 == 0xffffffff) {
								L54:
								_t283 = 0x20;
								L55:
								E00401299(_t283);
								SendMessageA(_a4, 0x420, _t315, _t283);
								_a12 = 1;
								_a16 = _t315;
								_a8 = 0x40f;
								goto L56;
							}
							_t231 = _v20;
							__eflags =  *((intOrPtr*)(_t231 + _t283 * 4)) - _t315;
							if( *((intOrPtr*)(_t231 + _t283 * 4)) != _t315) {
								goto L55;
							}
							goto L54;
						}
						goto L28;
					}
				} else {
					 *0x423f00 = _a4;
					_t247 =  *0x423ecc; // 0x5d
					_t285 = 2;
					_v28 = 0;
					_v16 = _t285;
					 *0x42048c = GlobalAlloc(0x40, _t247 << 2);
					_t250 = LoadBitmapA( *0x423ea0, 0x6e);
					 *0x420480 =  *0x420480 | 0xffffffff;
					_v24 = _t250;
					 *0x420488 = SetWindowLongA(_v8, 0xfffffffc, E00404D31);
					_t252 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x420474 = _t252;
					ImageList_AddMasked(_t252, _v24, 0xff00ff);
					SendMessageA(_v8, 0x1109, _t285,  *0x420474);
					if(SendMessageA(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageA(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_v24);
					_t286 = 0;
					do {
						_t258 =  *((intOrPtr*)(_v20 + _t286 * 4));
						if( *((intOrPtr*)(_v20 + _t286 * 4)) != _t315) {
							if(_t286 != 0x20) {
								_v16 = _t315;
							}
							_t277 = SendMessageA(_v12, 0x143, _t315, E00405A65(_t286, _t315, _t320, _t315, _t258)); // executed
							SendMessageA(_v12, 0x151, _t277, _t286);
						}
						_t286 = _t286 + 1;
					} while (_t286 < 0x21);
					_t317 = _a16;
					_t287 = _v16;
					_push( *((intOrPtr*)(_t317 + 0x30 + _t287 * 4)));
					_push(0x15);
					E00403E37(_a4);
					_push( *((intOrPtr*)(_t317 + 0x34 + _t287 * 4)));
					_push(0x16);
					E00403E37(_a4);
					_t318 = 0;
					_t288 = 0;
					_t328 =  *0x423ecc - _t318; // 0x5d
					if(_t328 <= 0) {
						L19:
						SetWindowLongA(_v8, 0xfffffff0, GetWindowLongA(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t311 = _v32 + 8;
						_v24 = _t311;
						do {
							_t268 = _t311 + 0x10;
							if( *_t268 != 0) {
								_v60 = _t268;
								_t269 =  *_t311;
								_t302 = 0x20;
								_v84 = _t288;
								_v80 = 0xffff0002;
								_v76 = 0xd;
								_v64 = _t302;
								_v40 = _t318;
								_v68 = _t269 & _t302;
								if((_t269 & 0x00000002) == 0) {
									__eflags = _t269 & 0x00000004;
									if((_t269 & 0x00000004) == 0) {
										_t271 = SendMessageA(_v8, 0x1100, 0,  &_v84); // executed
										 *( *0x42048c + _t318 * 4) = _t271;
									} else {
										_t288 = SendMessageA(_v8, 0x110a, 3, _t288);
									}
								} else {
									_v76 = 0x4d;
									_v44 = 1;
									_t274 = SendMessageA(_v8, 0x1100, 0,  &_v84); // executed
									_v28 = 1;
									 *( *0x42048c + _t318 * 4) = _t274;
									_t288 =  *( *0x42048c + _t318 * 4);
								}
							}
							_t318 = _t318 + 1;
							_t311 = _v24 + 0x418;
							_t331 = _t318 -  *0x423ecc; // 0x5d
							_v24 = _t311;
						} while (_t331 < 0);
						if(_v28 != 0) {
							L20:
							if(_v16 != 0) {
								E00403E6C(_v8);
								_t280 = _v32;
								_t315 = 0;
								__eflags = 0;
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E00403E6C(_v12);
								L89:
								return E00403E9E(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x0040474e
0x00404754
0x00404756
0x0040475c
0x00404762
0x00404765
0x0040476f
0x00404778
0x0040477b
0x0040477e
0x004049a6
0x004049a6
0x004049ad
0x004049c1
0x004049af
0x004049b1
0x004049b4
0x004049b5
0x004049bc
0x004049bc
0x004049c4
0x004049cd
0x004049d8
0x004049d8
0x004049db
0x004049de
0x004049ed
0x004049ed
0x004049f4
0x00404a6c
0x00404a6c
0x00404a6f
0x00404a71
0x00404a74
0x00404a7b
0x00404a89
0x00404a89
0x00404a8b
0x00404a8e
0x00404a95
0x00404a97
0x00404a9b
0x00404ab8
0x00404abc
0x00404abc
0x00404a9d
0x00404aaa
0x00404aaa
0x00404a9b
0x00404a95
0x00000000
0x00404a6f
0x004049f6
0x004049f9
0x00404a04
0x00404a06
0x00404a09
0x00404a10
0x00404a15
0x00404a17
0x00404a21
0x00404a21
0x00404a25
0x00404a27
0x00404a2a
0x00404a2c
0x00404a2f
0x00404a45
0x00404a45
0x00404a31
0x00404a31
0x00404a37
0x00404a39
0x00404a40
0x00404a3b
0x00404a3b
0x00404a3b
0x00404a39
0x00404a49
0x00404a4b
0x00404a50
0x00404a59
0x00404a5a
0x00404a64
0x00404a64
0x00404a66
0x00404a69
0x00404a69
0x00404a2a
0x00000000
0x00404a17
0x004049fb
0x004049fe
0x00404a02
0x00000000
0x00000000
0x00000000
0x00404a02
0x004049e0
0x004049e7
0x00000000
0x00000000
0x00000000
0x004049cf
0x004049cf
0x004049d2
0x00404abf
0x00404abf
0x00404ac6
0x00404b3a
0x00404b3a
0x00404b41
0x00404b4d
0x00404b4d
0x00404b4f
0x00404b56
0x00404b58
0x00404b5d
0x00404b5f
0x00404b62
0x00404b62
0x00404b68
0x00404b6d
0x00404b6f
0x00404b72
0x00404b72
0x00404b78
0x00404b7e
0x00404b84
0x00404b84
0x00404b8a
0x00404b91
0x00404cde
0x00404cde
0x00404ce5
0x00404ce7
0x00404cee
0x00404cf2
0x00404cff
0x00404cff
0x00404d02
0x00404d08
0x00404d1a
0x00404d1a
0x00404cee
0x00000000
0x00404b97
0x00404b99
0x00404b9e
0x00404ba1
0x00404ba5
0x00404ba5
0x00404baa
0x00404bad
0x00404bee
0x00404bf0
0x00404bfa
0x00404c00
0x00404c03
0x00404c08
0x00404c0f
0x00404c12
0x00404cb4
0x00404cba
0x00404cc0
0x00404cc5
0x00404cc8
0x00404cd9
0x00404cd9
0x00000000
0x00404c18
0x00404c18
0x00404c18
0x00404c1b
0x00404c21
0x00404c24
0x00404c26
0x00404c28
0x00404c2a
0x00404c2d
0x00404c30
0x00404c37
0x00404c39
0x00404c3c
0x00404c43
0x00404c46
0x00404c46
0x00404c46
0x00404c46
0x00404c4a
0x00404c4d
0x00404c59
0x00404c5a
0x00404c5d
0x00404c5f
0x00404c5f
0x00404c5f
0x00404c4f
0x00404c51
0x00404c51
0x00404c7e
0x00404c7e
0x00404c7f
0x00404c8b
0x00404c9a
0x00404c9a
0x00404c9c
0x00404c9f
0x00404ca8
0x00404ca8
0x00000000
0x00404c1b
0x00404baf
0x00404bba
0x00404bbd
0x00404bc2
0x00404bc4
0x00404bc6
0x00404bc8
0x00404bd8
0x00404be2
0x00404be4
0x00404be7
0x00000000
0x00000000
0x00000000
0x00000000
0x00404bca
0x00404bca
0x00404bca
0x00404bcd
0x00404bd0
0x00404bd2
0x00404bd2
0x00404bd2
0x00404bd3
0x00404bd4
0x00404bd4
0x00000000
0x00404bca
0x00404bad
0x00404b91
0x00404ac8
0x00404ace
0x00000000
0x00000000
0x00404ada
0x00404ade
0x00000000
0x00000000
0x00404aee
0x00404af0
0x00404af3
0x00000000
0x00000000
0x00404b05
0x00404b07
0x00404b0a
0x00404b14
0x00404b16
0x00404b17
0x00404b18
0x00404b27
0x00404b29
0x00404b30
0x00404b33
0x00000000
0x00404b33
0x00404b0c
0x00404b0f
0x00404b12
0x00000000
0x00000000
0x00000000
0x00404b12
0x00000000
0x004049d2
0x00404784
0x00404789
0x0040478e
0x00404793
0x00404794
0x0040479d
0x004047a8
0x004047b3
0x004047b9
0x004047c7
0x004047dc
0x004047e1
0x004047ec
0x004047f5
0x0040480a
0x0040481b
0x00404828
0x00404828
0x0040482d
0x00404833
0x00404835
0x00404838
0x0040483d
0x00404842
0x00404844
0x00404844
0x00404858
0x00404864
0x00404864
0x00404866
0x00404867
0x0040486c
0x0040486f
0x00404872
0x00404876
0x0040487b
0x00404880
0x00404884
0x00404889
0x0040488e
0x00404890
0x00404892
0x00404898
0x00404962
0x00404975
0x00000000
0x0040489e
0x004048a1
0x004048a4
0x004048a7
0x004048a7
0x004048ad
0x004048b3
0x004048b6
0x004048bc
0x004048bd
0x004048c2
0x004048cb
0x004048d2
0x004048d5
0x004048d8
0x004048db
0x00404915
0x00404917
0x00404938
0x00404940
0x00404919
0x00404926
0x00404926
0x004048dd
0x004048e0
0x004048ef
0x004048f9
0x00404901
0x00404908
0x00404910
0x00404910
0x004048db
0x00404946
0x00404947
0x0040494d
0x00404953
0x00404953
0x00404960
0x0040497b
0x0040497f
0x0040499c
0x004049a1
0x004049a4
0x004049a4
0x00000000
0x00404981
0x00404986
0x0040498f
0x00404d1c
0x00404d2e
0x00404d2e
0x0040497f
0x00000000
0x00404960
0x00404898

APIs

GetDlgItem.USER32 ref: 00404747
GetDlgItem.USER32 ref: 00404754
GlobalAlloc.KERNEL32(00000040,0000005D), ref: 004047A0
LoadBitmapA.USER32 ref: 004047B3
SetWindowLongA.USER32 ref: 004047CD
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004047E1
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 004047F5
SendMessageA.USER32(?,00001109,00000002), ref: 0040480A
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404816
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404828
DeleteObject.GDI32(?), ref: 0040482D
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404858
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404864
SendMessageA.USER32(?,00001100,00000000,?), ref: 004048F9
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404924
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404938
GetWindowLongA.USER32 ref: 00404967
SetWindowLongA.USER32 ref: 00404975
ShowWindow.USER32(?,00000005), ref: 00404986
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404A89
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404AEE
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404B03
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404B27
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404B4D
ImageList_Destroy.COMCTL32(?), ref: 00404B62
GlobalFree.KERNEL32 ref: 00404B72
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404BE2
SendMessageA.USER32(?,00001102,00000410,?), ref: 00404C8B
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404C9A
InvalidateRect.USER32(?,00000000,00000001), ref: 00404CBA
ShowWindow.USER32(?,00000000), ref: 00404D08
GetDlgItem.USER32 ref: 00404D13
ShowWindow.USER32(00000000), ref: 00404D1A

Strings

, xrefs: 00404CF2
N, xrefs: 004049C4
M, xrefs: 004048E0
0m, xrefs: 00404765

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $0m$M$N
API String ID: 1638840714-4181282139
Opcode ID: 1b4e1401f0ac91efec2f272749b5436295f9ab12795ad6539697b31965aa17bf
Instruction ID: fb58c968ba9f4d14096cd3b519f9cb2dcf6b811396bab046f3000754b75b80e4
Opcode Fuzzy Hash: 1b4e1401f0ac91efec2f272749b5436295f9ab12795ad6539697b31965aa17bf
Instruction Fuzzy Hash: A5029EB0A00209AFDB21DF64CC45AAE7BB5FB84315F10817AF610BA2E1D7799A41CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00405368 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 156
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E00405368(void* __ebx, void* __eflags, void* _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				struct _WIN32_FIND_DATAA _v332;
				signed int _t37;
				char* _t49;
				signed int _t52;
				signed int _t55;
				signed int _t61;
				signed int _t63;
				void* _t65;
				signed int _t68;
				CHAR* _t70;
				CHAR* _t72;
				char* _t75;

				_t72 = _a4;
				_t37 = E00405617(__eflags, _t72);
				_v12 = _t37;
				if((_a8 & 0x00000008) != 0) {
					_t63 = DeleteFileA(_t72); // executed
					asm("sbb eax, eax");
					_t65 =  ~_t63 + 1;
					 *0x423f28 =  *0x423f28 + _t65;
					return _t65;
				}
				_t68 = _a8 & 0x00000001;
				__eflags = _t68;
				_v8 = _t68;
				if(_t68 == 0) {
					L5:
					E00405A43(0x4214a0, _t72);
					__eflags = _t68;
					if(_t68 == 0) {
						E0040557D(_t72);
					} else {
						lstrcatA(0x4214a0, "\*.*");
					}
					__eflags =  *_t72;
					if( *_t72 != 0) {
						L10:
						lstrcatA(_t72, 0x40900c);
						L11:
						_t70 =  &(_t72[lstrlenA(_t72)]); // executed
						_t37 = FindFirstFileA(0x4214a0,  &_v332); // executed
						__eflags = _t37 - 0xffffffff;
						_a4 = _t37;
						if(_t37 == 0xffffffff) {
							L29:
							__eflags = _v8;
							if(_v8 != 0) {
								_t31 = _t70 - 1;
								 *_t31 =  *(_t70 - 1) & 0x00000000;
								__eflags =  *_t31;
							}
							goto L31;
						} else {
							goto L12;
						}
						do {
							L12:
							_t75 =  &(_v332.cFileName);
							_t49 = E00405561( &(_v332.cFileName), 0x3f);
							__eflags =  *_t49;
							if( *_t49 != 0) {
								__eflags = _v332.cAlternateFileName;
								if(_v332.cAlternateFileName != 0) {
									_t75 =  &(_v332.cAlternateFileName);
								}
							}
							__eflags =  *_t75 - 0x2e;
							if( *_t75 != 0x2e) {
								L19:
								E00405A43(_t70, _t75);
								__eflags = _v332.dwFileAttributes & 0x00000010;
								if((_v332.dwFileAttributes & 0x00000010) == 0) {
									E004056FB(_t72);
									_t52 = DeleteFileA(_t72); // executed
									__eflags = _t52;
									if(_t52 != 0) {
										E00404DE1(0xfffffff2, _t72);
									} else {
										__eflags = _a8 & 0x00000004;
										if((_a8 & 0x00000004) == 0) {
											 *0x423f28 =  *0x423f28 + 1;
										} else {
											E00404DE1(0xfffffff1, _t72);
											_push(0);
											_push(_t72);
											E00405791();
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E00405368(_t70, __eflags, _t72, _a8);
									}
								}
								goto L27;
							}
							_t61 =  *((intOrPtr*)(_t75 + 1));
							__eflags = _t61;
							if(_t61 == 0) {
								goto L27;
							}
							__eflags = _t61 - 0x2e;
							if(_t61 != 0x2e) {
								goto L19;
							}
							__eflags =  *((char*)(_t75 + 2));
							if( *((char*)(_t75 + 2)) == 0) {
								goto L27;
							}
							goto L19;
							L27:
							_t55 = FindNextFileA(_a4,  &_v332); // executed
							__eflags = _t55;
						} while (_t55 != 0);
						_t37 = FindClose(_a4);
						goto L29;
					}
					__eflags =  *0x4214a0 - 0x5c;
					if( *0x4214a0 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t37;
					if(_t37 == 0) {
						L31:
						__eflags = _v8;
						if(_v8 == 0) {
							L39:
							return _t37;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t37 = E00405D3A(_t72);
							__eflags = _t37;
							if(_t37 == 0) {
								goto L39;
							}
							E00405536(_t72);
							E004056FB(_t72);
							_t37 = RemoveDirectoryA(_t72); // executed
							__eflags = _t37;
							if(_t37 != 0) {
								return E00404DE1(0xffffffe5, _t72);
							}
							__eflags = _a8 & 0x00000004;
							if((_a8 & 0x00000004) == 0) {
								goto L33;
							}
							E00404DE1(0xfffffff1, _t72);
							_push(0);
							_push(_t72);
							return E00405791();
						}
						L33:
						 *0x423f28 =  *0x423f28 + 1;
						return _t37;
					}
					__eflags = _a8 & 0x00000002;
					if((_a8 & 0x00000002) == 0) {
						goto L31;
					}
					goto L5;
				}
			}

APIs

DeleteFileA.KERNELBASE(?,?,"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe",7476F560), ref: 00405386
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\*.*,?,00000000,?,"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe",7476F560), ref: 004053D0
lstrcatA.KERNEL32(?,0040900C,?,C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\*.*,?,00000000,?,"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe",7476F560), ref: 004053F1
lstrlenA.KERNEL32(?,?,0040900C,?,C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\*.*,?,00000000,?,"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe",7476F560), ref: 004053F7
FindFirstFileA.KERNELBASE(C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\*.*,?,?,?,0040900C,?,C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\*.*,?,00000000,?,"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe",7476F560), ref: 00405408
FindNextFileA.KERNELBASE(?,00000010,000000F2,?), ref: 004054BA
FindClose.KERNEL32(?), ref: 004054CB

Strings

"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe", xrefs: 00405372
C:\Users\user\AppData\Local\Temp\, xrefs: 00405368
C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\*.*, xrefs: 004053BA, 004053C0, 004053CF, 00405405
\*.*, xrefs: 004053CA

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\*.*$\*.*
API String ID: 2035342205-3398114763
Opcode ID: 32f66f716327c7d2bf2fe4761be6696440251f29e6d635b7d18fd632a01ba0b1
Instruction ID: cf9c67bea706718e69cadff60f89af37b9bc960bba5c2c4ceea64f3e0b576ccc
Opcode Fuzzy Hash: 32f66f716327c7d2bf2fe4761be6696440251f29e6d635b7d18fd632a01ba0b1
Instruction Fuzzy Hash: F8510230904A447ADB216B628C89BFF3A78DF4271AF54807BF948711D2C77C5982DE6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405D3A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405D3A(CHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileA(_a4, 0x4224e8); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x4224e8;
			}

0x00405d45
0x00405d4e
0x00000000
0x00405d5b
0x00405d51
0x00000000

APIs

FindFirstFileA.KERNELBASE(?,004224E8,C:\,0040565A,C:\,C:\,00000000,C:\,C:\,?,?,7476F560,0040537C,?,"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe",7476F560), ref: 00405D45
FindClose.KERNEL32(00000000), ref: 00405D51

Strings

C:\, xrefs: 00405D3A
$B, xrefs: 00405D3B

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\$$B
API String ID: 2295610775-645530273
Opcode ID: faf9a5a1b02af36eb702065ba3c0ed1dca863e262e1f5f2ed0a66c6ec2a69bc9
Instruction ID: 5d39fc8c4b88dccabc2787e38e2f2122adfd1cb5ba995ef8605a3576d1a16c1a
Opcode Fuzzy Hash: faf9a5a1b02af36eb702065ba3c0ed1dca863e262e1f5f2ed0a66c6ec2a69bc9
Instruction Fuzzy Hash: 72D0C9319495206BD65037286D0C84B6A59DF15331750CA73B12AE22F0D27498518AB9

Uniqueness

Uniqueness Score: -1.00%

Function 0040600A Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E0040600A() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				void* _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t590;
				signed int* _t607;
				void* _t614;

				L0:
				while(1) {
					L0:
					if( *(_t614 - 0x40) != 0) {
						 *(_t614 - 0x34) = 1;
						 *(_t614 - 0x84) = 7;
						_t607 =  *(_t614 - 4) + 0x180 +  *(_t614 - 0x38) * 2;
						L132:
						 *(_t614 - 0x54) = _t607;
						L133:
						_t531 =  *_t607;
						_t590 = _t531 & 0x0000ffff;
						_t565 = ( *(_t614 - 0x10) >> 0xb) * _t590;
						if( *(_t614 - 0xc) >= _t565) {
							 *(_t614 - 0x10) =  *(_t614 - 0x10) - _t565;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) - _t565;
							 *(_t614 - 0x40) = 1;
							_t532 = _t531 - (_t531 >> 5);
							 *_t607 = _t532;
						} else {
							 *(_t614 - 0x10) = _t565;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
							 *_t607 = (0x800 - _t590 >> 5) + _t531;
						}
						if( *(_t614 - 0x10) >= 0x1000000) {
							L139:
							_t533 =  *(_t614 - 0x84);
							L140:
							 *(_t614 - 0x88) = _t533;
							goto L1;
						} else {
							L137:
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 5;
								goto L170;
							}
							 *(_t614 - 0x10) =  *(_t614 - 0x10) << 8;
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						__eax =  *(__ebp - 0x5c) & 0x000000ff;
						__esi =  *(__ebp - 0x60);
						__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
						__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
						__ecx =  *(__ebp - 0x3c);
						__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
						__ecx =  *(__ebp - 4);
						(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
						__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
						__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						if( *(__ebp - 0x38) >= 4) {
							if( *(__ebp - 0x38) >= 0xa) {
								_t97 = __ebp - 0x38;
								 *_t97 =  *(__ebp - 0x38) - 6;
							} else {
								 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
							}
						} else {
							 *(__ebp - 0x38) = 0;
						}
						if( *(__ebp - 0x34) == __edx) {
							__ebx = 0;
							__ebx = 1;
							L60:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t216 = __edx + 1; // 0x1
								__ebx = _t216;
								__cx = __ax >> 5;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L59:
								if(__ebx >= 0x100) {
									goto L54;
								}
								goto L60;
							} else {
								L57:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xf;
									goto L170;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t202 = __ebp - 0x70;
								 *_t202 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L59;
							}
						} else {
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
							}
							__ecx =  *(__ebp - 8);
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
							L40:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L38:
								__eax =  *(__ebp - 0x40);
								if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
									while(1) {
										if(__ebx >= 0x100) {
											break;
										}
										__eax =  *(__ebp - 0x58);
										__edx = __ebx + __ebx;
										__ecx =  *(__ebp - 0x10);
										__esi = __edx + __eax;
										__ecx =  *(__ebp - 0x10) >> 0xb;
										__ax =  *__esi;
										 *(__ebp - 0x54) = __esi;
										__edi = __ax & 0x0000ffff;
										__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
										if( *(__ebp - 0xc) >= __ecx) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
											__cx = __ax;
											_t169 = __edx + 1; // 0x1
											__ebx = _t169;
											__cx = __ax >> 5;
											 *__esi = __ax;
										} else {
											 *(__ebp - 0x10) = __ecx;
											0x800 = 0x800 - __edi;
											0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
											__ebx = __ebx + __ebx;
											 *__esi = __cx;
										}
										 *(__ebp - 0x44) = __ebx;
										if( *(__ebp - 0x10) < 0x1000000) {
											L45:
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t155 = __ebp - 0x70;
											 *_t155 =  *(__ebp - 0x70) + 1;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
										}
									}
									L53:
									_t172 = __ebp - 0x34;
									 *_t172 =  *(__ebp - 0x34) & 0x00000000;
									L54:
									__al =  *(__ebp - 0x44);
									 *(__ebp - 0x5c) =  *(__ebp - 0x44);
									L55:
									if( *(__ebp - 0x64) == 0) {
										 *(__ebp - 0x88) = 0x1a;
										goto L170;
									}
									__ecx =  *(__ebp - 0x68);
									__al =  *(__ebp - 0x5c);
									__edx =  *(__ebp - 8);
									 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
									 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
									 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
									 *( *(__ebp - 0x68)) = __al;
									__ecx =  *(__ebp - 0x14);
									 *(__ecx +  *(__ebp - 8)) = __al;
									__eax = __ecx + 1;
									__edx = 0;
									_t191 = __eax %  *(__ebp - 0x74);
									__eax = __eax /  *(__ebp - 0x74);
									__edx = _t191;
									L79:
									 *(__ebp - 0x14) = __edx;
									L80:
									 *(__ebp - 0x88) = 2;
									goto L1;
								}
								if(__ebx >= 0x100) {
									goto L53;
								}
								goto L40;
							} else {
								L36:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xd;
									L170:
									_t568 = 0x22;
									memcpy( *(_t614 - 0x90), _t614 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t121 = __ebp - 0x70;
								 *_t121 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L38;
							}
						}
					}
					L1:
					_t534 =  *(_t614 - 0x88);
					if(_t534 > 0x1c) {
						L171:
						_t535 = _t534 | 0xffffffff;
						goto L172;
					}
					switch( *((intOrPtr*)(_t534 * 4 +  &M004068AD))) {
						case 0:
							if( *(_t614 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t534 =  *( *(_t614 - 0x70));
							if(_t534 > 0xe1) {
								goto L171;
							}
							_t538 = _t534 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t610 = _t538 / _t570;
							_t540 = _t538 % _t570 & 0x000000ff;
							asm("cdq");
							_t605 = _t540 % _t571 & 0x000000ff;
							 *(_t614 - 0x3c) = _t605;
							 *(_t614 - 0x1c) = (1 << _t610) - 1;
							 *((intOrPtr*)(_t614 - 0x18)) = (1 << _t540 / _t571) - 1;
							_t613 = (0x300 << _t605 + _t610) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t614 - 0x78))) {
								L10:
								if(_t613 == 0) {
									L12:
									 *(_t614 - 0x48) =  *(_t614 - 0x48) & 0x00000000;
									 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t613 = _t613 - 1;
									 *((short*)( *(_t614 - 4) + _t613 * 2)) = 0x400;
								} while (_t613 != 0);
								goto L12;
							}
							if( *(_t614 - 4) != 0) {
								GlobalFree( *(_t614 - 4));
							}
							_t534 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t614 - 4) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t614 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 1;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) | ( *( *(_t614 - 0x70)) & 0x000000ff) <<  *(_t614 - 0x48) << 0x00000003;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t45 = _t614 - 0x48;
							 *_t45 =  *(_t614 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t614 - 0x48) < 4) {
								goto L13;
							}
							_t546 =  *(_t614 - 0x40);
							if(_t546 ==  *(_t614 - 0x74)) {
								L20:
								 *(_t614 - 0x48) = 5;
								 *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) =  *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t614 - 0x74) = _t546;
							if( *(_t614 - 8) != 0) {
								GlobalFree( *(_t614 - 8));
							}
							_t534 = GlobalAlloc(0x40,  *(_t614 - 0x40)); // executed
							 *(_t614 - 8) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t553 =  *(_t614 - 0x60) &  *(_t614 - 0x1c);
							 *(_t614 - 0x84) = 6;
							 *(_t614 - 0x4c) = _t553;
							_t607 =  *(_t614 - 4) + (( *(_t614 - 0x38) << 4) + _t553) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 3;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							_t67 = _t614 - 0x70;
							 *_t67 =  &(( *(_t614 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							L23:
							 *(_t614 - 0x48) =  *(_t614 - 0x48) - 1;
							if( *(_t614 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							goto L0;
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L68;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								goto L89;
							}
							__eflags =  *(__ebp - 0x60);
							if( *(__ebp - 0x60) == 0) {
								goto L171;
							}
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							_t258 =  *(__ebp - 0x38) - 7 >= 0;
							__eflags = _t258;
							0 | _t258 = _t258 + _t258 + 9;
							 *(__ebp - 0x38) = _t258 + _t258 + 9;
							goto L75;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							L89:
							__eax =  *(__ebp - 4);
							 *(__ebp - 0x80) = 0x15;
							__eax =  *(__ebp - 4) + 0xa68;
							 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
							goto L68;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							goto L36;
						case 0xe:
							goto L45;
						case 0xf:
							goto L57;
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							L68:
							__esi =  *(__ebp - 0x58);
							 *(__ebp - 0x84) = 0x12;
							goto L132;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							goto L55;
						case 0x1b:
							L75:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1b;
								goto L170;
							}
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							__eflags = __eax -  *(__ebp - 0x74);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
								__eflags = __eax;
							}
							__edx =  *(__ebp - 8);
							__cl =  *(__eax + __edx);
							__eax =  *(__ebp - 0x14);
							 *(__ebp - 0x5c) = __cl;
							 *(__eax + __edx) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t274 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t274;
							__eax =  *(__ebp - 0x68);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							_t283 = __ebp - 0x64;
							 *_t283 =  *(__ebp - 0x64) - 1;
							__eflags =  *_t283;
							 *( *(__ebp - 0x68)) = __cl;
							goto L79;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = __edx;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca48c4465a76fd19d6f3463da993c6ca3d09651b6bc0314a9d0f7ba33f731e04
Instruction ID: 4dd2872783d64c99001b1edb157d711bf7c17726e9b979133eda9d6147b50661
Opcode Fuzzy Hash: ca48c4465a76fd19d6f3463da993c6ca3d09651b6bc0314a9d0f7ba33f731e04
Instruction Fuzzy Hash: 8DF15671D00229CBDF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7785A86CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00404F1F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 278
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00404F1F(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t87;
				unsigned int _t92;
				unsigned int _t93;
				int _t94;
				int _t95;
				long _t98;
				void* _t101;
				intOrPtr _t112;
				void* _t120;
				intOrPtr _t123;
				struct HWND__* _t127;
				int _t149;
				int _t150;
				struct HWND__* _t154;
				struct HWND__* _t158;
				struct HMENU__* _t160;
				long _t162;
				void* _t163;
				short* _t164;

				_t154 =  *0x423684; // 0x203ce
				_t149 = 0;
				_v8 = _t154;
				if(_a8 != 0x110) {
					__eflags = _a8 - 0x405;
					if(_a8 == 0x405) {
						_t120 = CreateThread(0, 0, E00404EB3, GetDlgItem(_a4, 0x3ec), 0,  &_v12); // executed
						FindCloseChangeNotification(_t120); // executed
					}
					__eflags = _a8 - 0x111;
					if(_a8 != 0x111) {
						L17:
						__eflags = _a8 - 0x404;
						if(_a8 != 0x404) {
							L25:
							__eflags = _a8 - 0x7b;
							if(_a8 != 0x7b) {
								goto L20;
							}
							__eflags = _a12 - _t154;
							if(_a12 != _t154) {
								goto L20;
							}
							_t87 = SendMessageA(_t154, 0x1004, _t149, _t149);
							__eflags = _t87 - _t149;
							_a8 = _t87;
							if(_t87 <= _t149) {
								L37:
								return 0;
							}
							_t160 = CreatePopupMenu();
							AppendMenuA(_t160, _t149, 1, E00405A65(_t149, _t154, _t160, _t149, 0xffffffe1));
							_t92 = _a16;
							__eflags = _t92 - 0xffffffff;
							if(_t92 != 0xffffffff) {
								_t150 = _t92;
								_t93 = _t92 >> 0x10;
								__eflags = _t93;
								_t94 = _t93;
							} else {
								GetWindowRect(_t154,  &_v28);
								_t150 = _v28.left;
								_t94 = _v28.top;
							}
							_t95 = TrackPopupMenu(_t160, 0x180, _t150, _t94, _t149, _a4, _t149);
							_t162 = 1;
							__eflags = _t95 - 1;
							if(_t95 == 1) {
								_v60 = _t149;
								_v48 = 0x420498;
								_v44 = 0xfff;
								_a4 = _a8;
								do {
									_a4 = _a4 - 1;
									_t98 = SendMessageA(_v8, 0x102d, _a4,  &_v68);
									__eflags = _a4 - _t149;
									_t162 = _t162 + _t98 + 2;
								} while (_a4 != _t149);
								OpenClipboard(_t149);
								EmptyClipboard();
								_t101 = GlobalAlloc(0x42, _t162);
								_a4 = _t101;
								_t163 = GlobalLock(_t101);
								do {
									_v48 = _t163;
									_t164 = _t163 + SendMessageA(_v8, 0x102d, _t149,  &_v68);
									 *_t164 = 0xa0d;
									_t163 = _t164 + 2;
									_t149 = _t149 + 1;
									__eflags = _t149 - _a8;
								} while (_t149 < _a8);
								GlobalUnlock(_a4);
								SetClipboardData(1, _a4);
								CloseClipboard();
							}
							goto L37;
						}
						__eflags =  *0x42366c - _t149; // 0x0
						if(__eflags == 0) {
							ShowWindow( *0x423ea8, 8);
							__eflags =  *0x423f2c - _t149; // 0x0
							if(__eflags == 0) {
								_t112 =  *0x41fc68; // 0x6df09c
								E00404DE1( *((intOrPtr*)(_t112 + 0x34)), _t149); // executed
							}
							E00403E10(1);
							goto L25;
						}
						 *0x41f860 = 2;
						E00403E10(0x78);
						goto L20;
					} else {
						__eflags = _a12 - 0x403;
						if(_a12 != 0x403) {
							L20:
							return E00403E9E(_a8, _a12, _a16);
						}
						ShowWindow( *0x423670, _t149);
						ShowWindow(_t154, 8);
						E00403E6C(_t154);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_v60 = 2;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t123 =  *0x423eb0; // 0x6dee30
				_a8 =  *((intOrPtr*)(_t123 + 0x5c));
				_a12 =  *((intOrPtr*)(_t123 + 0x60));
				 *0x423670 = GetDlgItem(_a4, 0x403);
				 *0x423668 = GetDlgItem(_a4, 0x3ee);
				_t127 = GetDlgItem(_a4, 0x3f8);
				 *0x423684 = _t127;
				_v8 = _t127;
				E00403E6C( *0x423670);
				 *0x423674 = E00404683(4);
				 *0x42368c = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(0x15);
				SendMessageA(_v8, 0x101b, 0,  &_v60);
				SendMessageA(_v8, 0x1036, 0x4000, 0x4000); // executed
				if(_a8 >= 0) {
					SendMessageA(_v8, 0x1001, 0, _a8);
					SendMessageA(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t149) {
					SendMessageA(_v8, 0x1024, _t149, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E00403E37(_a4);
				if(( *0x423eb8 & 0x00000003) != 0) {
					ShowWindow( *0x423670, _t149);
					if(( *0x423eb8 & 0x00000002) != 0) {
						 *0x423670 = _t149;
					} else {
						ShowWindow(_v8, 8);
					}
					E00403E6C( *0x423668);
				}
				_t158 = GetDlgItem(_a4, 0x3ec);
				SendMessageA(_t158, 0x401, _t149, 0x75300000);
				if(( *0x423eb8 & 0x00000004) != 0) {
					SendMessageA(_t158, 0x409, _t149, _a12);
					SendMessageA(_t158, 0x2001, _t149, _a8);
				}
				goto L37;
			}

0x00404f28
0x00404f2e
0x00404f37
0x00404f3a
0x004050cb
0x004050d2
0x004050ef
0x004050f6
0x004050f6
0x004050fc
0x00405109
0x00405127
0x00405127
0x0040512e
0x00405185
0x00405185
0x00405189
0x00000000
0x00000000
0x0040518b
0x0040518e
0x00000000
0x00000000
0x00405198
0x0040519e
0x004051a0
0x004051a3
0x0040529c
0x00000000
0x0040529c
0x004051b2
0x004051be
0x004051c4
0x004051c7
0x004051ca
0x004051df
0x004051e2
0x004051e2
0x004051e5
0x004051cc
0x004051d1
0x004051d7
0x004051da
0x004051da
0x004051f5
0x004051fd
0x004051fe
0x00405200
0x00405209
0x0040520c
0x00405213
0x0040521a
0x00405222
0x00405222
0x00405230
0x00405236
0x00405239
0x00405239
0x00405240
0x00405246
0x0040524f
0x00405256
0x0040525f
0x00405261
0x00405264
0x00405273
0x00405275
0x0040527b
0x0040527c
0x0040527d
0x0040527d
0x00405285
0x00405290
0x00405296
0x00405296
0x00000000
0x00405200
0x00405130
0x00405136
0x00405166
0x00405168
0x0040516e
0x00405170
0x00405179
0x00405179
0x00405180
0x00000000
0x00405180
0x0040513a
0x00405144
0x00000000
0x0040510b
0x0040510b
0x00405111
0x00405149
0x00000000
0x00405152
0x0040511a
0x0040511f
0x00405122
0x00000000
0x00405122
0x00405109
0x00404f40
0x00404f44
0x00404f4d
0x00404f54
0x00404f57
0x00404f5a
0x00404f5d
0x00404f5e
0x00404f5f
0x00404f78
0x00404f7b
0x00404f85
0x00404f94
0x00404f9c
0x00404fa4
0x00404fa9
0x00404fac
0x00404fb8
0x00404fc1
0x00404fca
0x00404fed
0x00404ff3
0x00405004
0x00405009
0x00405017
0x00405025
0x00405025
0x0040502a
0x00405038
0x00405038
0x0040503d
0x00405040
0x00405045
0x00405051
0x0040505a
0x00405067
0x00405076
0x00405069
0x0040506e
0x0040506e
0x00405082
0x00405082
0x00405096
0x0040509f
0x004050a8
0x004050b8
0x004050c4
0x004050c4
0x00000000

APIs

GetDlgItem.USER32 ref: 00404F7E
GetDlgItem.USER32 ref: 00404F8D
GetClientRect.USER32 ref: 00404FCA
GetSystemMetrics.USER32 ref: 00404FD2
SendMessageA.USER32(?,0000101B,00000000,00000002), ref: 00404FF3
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405004
SendMessageA.USER32(?,00001001,00000000,00000110), ref: 00405017
SendMessageA.USER32(?,00001026,00000000,00000110), ref: 00405025
SendMessageA.USER32(?,00001024,00000000,?), ref: 00405038
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040505A
ShowWindow.USER32(?,00000008), ref: 0040506E
GetDlgItem.USER32 ref: 0040508F
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 0040509F
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004050B8
SendMessageA.USER32(00000000,00002001,00000000,00000110), ref: 004050C4
GetDlgItem.USER32 ref: 00404F9C

Part of subcall function 00403E6C: SendMessageA.USER32(00000028,?,00000001,00403C9D), ref: 00403E7A

GetDlgItem.USER32 ref: 004050E1
CreateThread.KERNELBASE ref: 004050EF
FindCloseChangeNotification.KERNELBASE(00000000), ref: 004050F6
ShowWindow.USER32(00000000), ref: 0040511A
ShowWindow.USER32(000203CE,00000008), ref: 0040511F
ShowWindow.USER32(00000008), ref: 00405166
SendMessageA.USER32(000203CE,00001004,00000000,00000000), ref: 00405198
CreatePopupMenu.USER32 ref: 004051A9
AppendMenuA.USER32 ref: 004051BE
GetWindowRect.USER32 ref: 004051D1
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004051F5
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405230
OpenClipboard.USER32(00000000), ref: 00405240
EmptyClipboard.USER32(?,?,00000000,?,00000000), ref: 00405246
GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 0040524F
GlobalLock.KERNEL32 ref: 00405259
SendMessageA.USER32(?,0000102D,00000000,?), ref: 0040526D
GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00405285
SetClipboardData.USER32 ref: 00405290
CloseClipboard.USER32 ref: 00405296

Strings

{, xrefs: 00405185
0m, xrefs: 00404F5F

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendChangeClientDataEmptyFindLockMetricsNotificationOpenSystemThreadTrackUnlock
String ID: 0m${
API String ID: 4154960007-3651324824
Opcode ID: fe42458a6f8fa4f437332706eaef4ab28f400b24d231d655e92ee9b4d266e9cb
Instruction ID: 84c9a86842734fbd8882db8e1e478190fd6364d20f7a0a8916aca3ed04ef35f5
Opcode Fuzzy Hash: fe42458a6f8fa4f437332706eaef4ab28f400b24d231d655e92ee9b4d266e9cb
Instruction Fuzzy Hash: 6EA13B70900208BFDB219F60DD89AAE7F79FB04355F00417AFA05BA2A0C7795E51DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00403964 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E00403964(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t37;
				signed int _t39;
				intOrPtr _t44;
				struct HWND__* _t49;
				signed int _t67;
				struct HWND__* _t73;
				signed int _t86;
				struct HWND__* _t91;
				signed int _t99;
				int _t103;
				signed int _t115;
				signed int _t116;
				int _t117;
				signed int _t122;
				struct HWND__* _t125;
				struct HWND__* _t126;
				int _t127;
				long _t130;
				int _t132;
				int _t133;
				void* _t134;
				void* _t141;
				void* _t142;

				_t115 = _a8;
				if(_t115 == 0x110 || _t115 == 0x408) {
					_t35 = _a12;
					_t125 = _a4;
					__eflags = _t115 - 0x110;
					 *0x42047c = _t35;
					if(_t115 == 0x110) {
						 *0x423ea8 = _t125;
						 *0x420490 = GetDlgItem(_t125, 1);
						_t91 = GetDlgItem(_t125, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x41f458 = _t91;
						E00403E37(_t125);
						SetClassLongA(_t125, 0xfffffff2,  *0x423688); // executed
						 *0x42366c = E0040140B(4);
						_t35 = 1;
						__eflags = 1;
						 *0x42047c = 1;
					}
					_t122 =  *0x4091bc; // 0x8
					_t133 = 0;
					_t130 = (_t122 << 6) +  *0x423ec0;
					__eflags = _t122;
					if(_t122 < 0) {
						L34:
						E00403E83(0x40b);
						while(1) {
							_t37 =  *0x42047c;
							 *0x4091bc =  *0x4091bc + _t37;
							_t130 = _t130 + (_t37 << 6);
							_t39 =  *0x4091bc; // 0x8
							__eflags = _t39 -  *0x423ec4; // 0x8
							if(__eflags == 0) {
								E0040140B(1);
							}
							__eflags =  *0x42366c - _t133; // 0x0
							if(__eflags != 0) {
								break;
							}
							_t44 =  *0x423ec4; // 0x8
							__eflags =  *0x4091bc - _t44; // 0x8
							if(__eflags >= 0) {
								break;
							}
							_t116 =  *(_t130 + 0x14);
							E00405A65(_t116, _t125, _t130, 0x42b800,  *((intOrPtr*)(_t130 + 0x24)));
							_push( *((intOrPtr*)(_t130 + 0x20)));
							_push(0xfffffc19);
							E00403E37(_t125);
							_push( *((intOrPtr*)(_t130 + 0x1c)));
							_push(0xfffffc1b);
							E00403E37(_t125);
							_push( *((intOrPtr*)(_t130 + 0x28)));
							_push(0xfffffc1a);
							E00403E37(_t125);
							_t49 = GetDlgItem(_t125, 3);
							__eflags =  *0x423f2c - _t133; // 0x0
							_v32 = _t49;
							if(__eflags != 0) {
								_t116 = _t116 & 0x0000fefd | 0x00000004;
								__eflags = _t116;
							}
							ShowWindow(_t49, _t116 & 0x00000008); // executed
							EnableWindow( *(_t134 + 0x30), _t116 & 0x00000100); // executed
							E00403E59(_t116 & 0x00000002);
							_t117 = _t116 & 0x00000004;
							EnableWindow( *0x41f458, _t117); // executed
							__eflags = _t117 - _t133;
							if(_t117 == _t133) {
								_push(1);
							} else {
								_push(_t133);
							}
							EnableMenuItem(GetSystemMenu(_t125, _t133), 0xf060, ??);
							SendMessageA( *(_t134 + 0x38), 0xf4, _t133, 1);
							__eflags =  *0x423f2c - _t133; // 0x0
							if(__eflags == 0) {
								_push( *0x420490);
							} else {
								SendMessageA(_t125, 0x401, 2, _t133);
								_push( *0x41f458);
							}
							E00403E6C();
							E00405A43(0x420498, "ModSource UI Addon Pack Setup");
							E00405A65(0x420498, _t125, _t130,  &(0x420498[lstrlenA(0x420498)]),  *((intOrPtr*)(_t130 + 0x18)));
							SetWindowTextA(_t125, 0x420498); // executed
							_push(_t133);
							_t67 = E00401389( *((intOrPtr*)(_t130 + 8)));
							__eflags = _t67;
							if(_t67 != 0) {
								continue;
							} else {
								__eflags =  *_t130 - _t133;
								if( *_t130 == _t133) {
									continue;
								}
								__eflags =  *(_t130 + 4) - 5;
								if( *(_t130 + 4) != 5) {
									DestroyWindow( *0x423678); // executed
									 *0x41fc68 = _t130;
									__eflags =  *_t130 - _t133;
									if( *_t130 <= _t133) {
										goto L58;
									}
									_t73 = CreateDialogParamA( *0x423ea0,  *_t130 +  *0x423680 & 0x0000ffff, _t125,  *(0x4091c0 +  *(_t130 + 4) * 4), _t130); // executed
									__eflags = _t73 - _t133;
									 *0x423678 = _t73;
									if(_t73 == _t133) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t130 + 0x2c)));
									_push(6);
									E00403E37(_t73);
									GetWindowRect(GetDlgItem(_t125, 0x3fa), _t134 + 0x10);
									ScreenToClient(_t125, _t134 + 0x10);
									SetWindowPos( *0x423678, _t133,  *(_t134 + 0x20),  *(_t134 + 0x20), _t133, _t133, 0x15);
									_push(_t133);
									E00401389( *((intOrPtr*)(_t130 + 0xc)));
									__eflags =  *0x42366c - _t133; // 0x0
									if(__eflags != 0) {
										goto L61;
									}
									ShowWindow( *0x423678, 8); // executed
									E00403E83(0x405);
									goto L58;
								}
								__eflags =  *0x423f2c - _t133; // 0x0
								if(__eflags != 0) {
									goto L61;
								}
								__eflags =  *0x423f20 - _t133; // 0x0
								if(__eflags != 0) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x423678); // executed
						 *0x423ea8 = _t133;
						EndDialog(_t125,  *0x41f860);
						goto L58;
					} else {
						__eflags = _t35 - 1;
						if(_t35 != 1) {
							L33:
							__eflags =  *_t130 - _t133;
							if( *_t130 == _t133) {
								goto L61;
							}
							goto L34;
						}
						_push(0);
						_t86 = E00401389( *((intOrPtr*)(_t130 + 0x10)));
						__eflags = _t86;
						if(_t86 == 0) {
							goto L33;
						}
						SendMessageA( *0x423678, 0x40f, 0, 1);
						__eflags =  *0x42366c - _t133; // 0x0
						return 0 | __eflags == 0x00000000;
					}
				} else {
					_t125 = _a4;
					_t133 = 0;
					if(_t115 == 0x47) {
						SetWindowPos( *0x420470, _t125, 0, 0, 0, 0, 0x13);
					}
					if(_t115 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x420470,  ~(_a12 - 1) & _t115);
					}
					if(_t115 != 0x40d) {
						__eflags = _t115 - 0x11;
						if(_t115 != 0x11) {
							__eflags = _t115 - 0x111;
							if(_t115 != 0x111) {
								L26:
								return E00403E9E(_t115, _a12, _a16);
							}
							_t132 = _a12 & 0x0000ffff;
							_t126 = GetDlgItem(_t125, _t132);
							__eflags = _t126 - _t133;
							if(_t126 == _t133) {
								L13:
								__eflags = _t132 - 1;
								if(_t132 != 1) {
									__eflags = _t132 - 3;
									if(_t132 != 3) {
										_t127 = 2;
										__eflags = _t132 - _t127;
										if(_t132 != _t127) {
											L25:
											SendMessageA( *0x423678, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x423f2c - _t133; // 0x0
										if(__eflags == 0) {
											_t99 = E0040140B(3);
											__eflags = _t99;
											if(_t99 != 0) {
												goto L26;
											}
											 *0x41f860 = 1;
											L21:
											_push(0x78);
											L22:
											E00403E10();
											goto L26;
										}
										E0040140B(_t127);
										 *0x41f860 = _t127;
										goto L21;
									}
									__eflags =  *0x4091bc - _t133; // 0x8
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t132);
								goto L22;
							}
							SendMessageA(_t126, 0xf3, _t133, _t133);
							_t103 = IsWindowEnabled(_t126);
							__eflags = _t103;
							if(_t103 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongA(_t125, _t133, _t133);
						return 1;
					} else {
						DestroyWindow( *0x423678); // executed
						 *0x423678 = _a12;
						L58:
						_t141 =  *0x421498 - _t133; // 0x1
						if(_t141 == 0) {
							_t142 =  *0x423678 - _t133; // 0x103fa
							if(_t142 != 0) {
								ShowWindow(_t125, 0xa); // executed
								 *0x421498 = 1;
							}
						}
						L61:
						return 0;
					}
				}
			}

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004039A0
ShowWindow.USER32(?), ref: 004039BD
KiUserCallbackDispatcher.NTDLL ref: 004039D1
SetWindowLongA.USER32 ref: 004039ED
GetDlgItem.USER32 ref: 00403A0E
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403A22
IsWindowEnabled.USER32(00000000), ref: 00403A29
GetDlgItem.USER32 ref: 00403AD7
GetDlgItem.USER32 ref: 00403AE1
KiUserCallbackDispatcher.NTDLL(?,000000F2,?,0000001C,000000FF), ref: 00403AFB
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403B4C
GetDlgItem.USER32 ref: 00403BF2
ShowWindow.USER32(00000000,?), ref: 00403C13
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403C25
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403C40
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403C56
EnableMenuItem.USER32 ref: 00403C5D
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403C75
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403C88
lstrlenA.KERNEL32(00420498,?,00420498,ModSource UI Addon Pack Setup), ref: 00403CB1
SetWindowTextA.USER32(?,00420498), ref: 00403CC0
ShowWindow.USER32(?,0000000A), ref: 00403DF4

Strings

ModSource UI Addon Pack Setup, xrefs: 00403CA2

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: Window$Item$CallbackDispatcherMessageSendUser$Show$Menu$EnableEnabledLongSystemTextlstrlen
String ID: ModSource UI Addon Pack Setup
API String ID: 3696009075-726907697
Opcode ID: 6e382fc7acd0d7b2be43fcda375eae1545251f1417e950f84815b12809e697db
Instruction ID: 51696fdb46be689e531b8a1be0e487da60f951fcccfd6c6acce19ac6ba18c0db
Opcode Fuzzy Hash: 6e382fc7acd0d7b2be43fcda375eae1545251f1417e950f84815b12809e697db
Instruction Fuzzy Hash: CCC1B071A04204BBDB206F21ED85E2B7E7CEB05706F40453EF641B12E1C779AA429F6E

Uniqueness

Uniqueness Score: -1.00%

Function 004035E3 Relevance: 52.7, APIs: 15, Strings: 15, Instructions: 213
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E004035E3() {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				int _v16;
				char _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t20;
				signed int _t24;
				void* _t28;
				void* _t30;
				int _t31;
				void* _t34;
				struct HINSTANCE__* _t37;
				int _t38;
				intOrPtr _t39;
				int _t42;
				intOrPtr _t59;
				char _t61;
				CHAR* _t63;
				signed char _t67;
				struct HINSTANCE__* _t75;
				CHAR* _t78;
				intOrPtr _t80;
				CHAR* _t85;

				_t80 =  *0x423eb0; // 0x6dee30
				_t20 = E00405D61(6);
				_t87 = _t20;
				if(_t20 == 0) {
					_t78 = 0x420498;
					"1033" = 0x7830;
					E0040592A(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x420498, 0);
					__eflags =  *0x420498;
					if(__eflags == 0) {
						E0040592A(0x80000003, ".DEFAULT\\Control Panel\\International",  &M00407302, 0x420498, 0);
					}
					lstrcatA("1033", _t78);
				} else {
					E004059A1("1033",  *_t20() & 0x0000ffff);
				}
				E00403897(_t75, _t87);
				_t24 =  *0x423eb8; // 0x80
				_t84 = "C:\\Program Files\\StarWarsGalaxies";
				 *0x423f20 = _t24 & 0x00000020;
				if(E00405617(_t87, "C:\\Program Files\\StarWarsGalaxies") != 0) {
					L16:
					if(E00405617(_t95, _t84) == 0) {
						E00405A65(0, _t78, _t80, _t84,  *((intOrPtr*)(_t80 + 0x118)));
					}
					_t28 = LoadImageA( *0x423ea0, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x423688 = _t28;
					if( *((intOrPtr*)(_t80 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t30 = E00403897(_t75, __eflags);
							__eflags =  *0x423f40; // 0x0
							if(__eflags != 0) {
								_t31 = E00404EB3(_t30, 0);
								__eflags = _t31;
								if(_t31 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x42366c; // 0x0
								if(__eflags == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x420470, 5); // executed
							_t37 = LoadLibraryA("RichEd20"); // executed
							__eflags = _t37;
							if(_t37 == 0) {
								LoadLibraryA("RichEd32");
							}
							_t85 = "RichEdit20A";
							_t38 = GetClassInfoA(0, _t85, 0x423640);
							__eflags = _t38;
							if(_t38 == 0) {
								GetClassInfoA(0, "RichEdit", 0x423640);
								 *0x423664 = _t85;
								RegisterClassA(0x423640);
							}
							_t39 =  *0x423680; // 0x0
							_t42 = DialogBoxParamA( *0x423ea0, _t39 + 0x00000069 & 0x0000ffff, 0, E00403964, 0); // executed
							E0040140B(5);
							return _t42;
						}
						L22:
						_t34 = 2;
						return _t34;
					} else {
						_t75 =  *0x423ea0; // 0x400000
						 *0x423654 = _t28;
						_v20 = 0x624e5f;
						 *0x423644 = E00401000;
						 *0x423650 = _t75;
						 *0x423664 =  &_v20;
						if(RegisterClassA(0x423640) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						_t12 =  &_v16; // 0x624e5f
						SystemParametersInfoA(0x30, 0, _t12, 0);
						 *0x420470 = CreateWindowExA(0x80,  &_v20, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x423ea0, 0);
						goto L21;
					}
				} else {
					_t75 =  *(_t80 + 0x48);
					if(_t75 == 0) {
						goto L16;
					}
					_t59 =  *0x423ed8; // 0x705cbc
					_t78 = 0x422e40;
					E0040592A( *((intOrPtr*)(_t80 + 0x44)), _t75,  *((intOrPtr*)(_t80 + 0x4c)) + _t59, 0x422e40, 0);
					_t61 =  *0x422e40; // 0x52
					if(_t61 == 0) {
						goto L16;
					}
					if(_t61 == 0x22) {
						_t78 = 0x422e41;
						 *((char*)(E00405561(0x422e41, 0x22))) = 0;
					}
					_t63 = lstrlenA(_t78) + _t78 - 4;
					if(_t63 <= _t78 || lstrcmpiA(_t63, ?str?) != 0) {
						L15:
						E00405A43(_t84, E00405536(_t78));
						goto L16;
					} else {
						_t67 = GetFileAttributesA(_t78);
						if(_t67 == 0xffffffff) {
							L14:
							E0040557D(_t78);
							goto L15;
						}
						_t95 = _t67 & 0x00000010;
						if((_t67 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x004035e9
0x004035f2
0x004035f9
0x004035fb
0x0040360f
0x00403621
0x0040362b
0x00403630
0x00403636
0x00403649
0x00403649
0x00403654
0x004035fd
0x00403608
0x00403608
0x00403659
0x0040365e
0x00403663
0x0040366c
0x00403678
0x004036ff
0x00403707
0x00403710
0x00403710
0x00403726
0x0040372c
0x0040373a
0x004037c9
0x004037d1
0x004037db
0x004037e0
0x004037e6
0x00403865
0x0040386a
0x0040386c
0x00403888
0x00000000
0x00403888
0x0040386e
0x00403874
0x0040387c
0x0040387c
0x00000000
0x00403874
0x004037f0
0x00403801
0x00403803
0x00403805
0x0040380c
0x0040380c
0x00403814
0x0040381c
0x0040381e
0x00403820
0x00403829
0x0040382c
0x00403832
0x00403832
0x00403838
0x00403851
0x0040385b
0x00000000
0x00403860
0x004037d3
0x004037d5
0x00000000
0x00403740
0x00403740
0x00403746
0x00403750
0x00403758
0x00403762
0x00403768
0x00403776
0x0040388d
0x0040388d
0x00000000
0x0040388d
0x0040377c
0x00403785
0x004037c4
0x00000000
0x004037c4
0x0040367e
0x0040367e
0x00403683
0x00000000
0x00000000
0x00403688
0x0040368d
0x0040369d
0x004036a2
0x004036a9
0x00000000
0x00000000
0x004036ad
0x004036af
0x004036bc
0x004036bc
0x004036c4
0x004036ca
0x004036f2
0x004036fa
0x00000000
0x004036dc
0x004036dd
0x004036e6
0x004036ec
0x004036ed
0x00000000
0x004036ed
0x004036e8
0x004036ea
0x00000000
0x00000000
0x00000000
0x004036ea
0x004036ca

APIs

Part of subcall function 00405D61: GetModuleHandleA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D73
Part of subcall function 00405D61: LoadLibraryA.KERNELBASE(?,?,00000000,00403268,00000008), ref: 00405D7E
Part of subcall function 00405D61: GetProcAddress.KERNEL32(00000000,?), ref: 00405D8F

lstrcatA.KERNEL32(1033,00420498,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420498,00000000,00000006,"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe",00000000,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403654
lstrlenA.KERNEL32(Remove folder: ,?,?,?,Remove folder: ,00000000,C:\Program Files\StarWarsGalaxies,1033,00420498,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420498,00000000,00000006,"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe"), ref: 004036BF
lstrcmpiA.KERNEL32(?,.exe,Remove folder: ,?,?,?,Remove folder: ,00000000,C:\Program Files\StarWarsGalaxies,1033,00420498,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420498,00000000), ref: 004036D2
GetFileAttributesA.KERNEL32(Remove folder: ), ref: 004036DD
LoadImageA.USER32 ref: 00403726

Part of subcall function 004059A1: wsprintfA.USER32 ref: 004059AE

RegisterClassA.USER32 ref: 0040376D
SystemParametersInfoA.USER32(00000030,00000000,_Nb,00000000), ref: 00403785
CreateWindowExA.USER32 ref: 004037BE
ShowWindow.USER32(00000005,00000000), ref: 004037F0
LoadLibraryA.KERNELBASE(RichEd20), ref: 00403801
LoadLibraryA.KERNEL32(RichEd32), ref: 0040380C
GetClassInfoA.USER32 ref: 0040381C
GetClassInfoA.USER32 ref: 00403829
RegisterClassA.USER32 ref: 00403832
DialogBoxParamA.USER32 ref: 00403851

Strings

.DEFAULT\Control Panel\International, xrefs: 0040363F
"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe", xrefs: 004035EF
Control Panel\Desktop\ResourceLocale, xrefs: 00403617
RichEdit20A, xrefs: 00403814, 0040381A
C:\Program Files\StarWarsGalaxies, xrefs: 00403663, 0040366B, 004036F9, 004036FF, 0040370F
C:\Users\user\AppData\Local\Temp\, xrefs: 004035E7
.exe, xrefs: 004036CC
Remove folder: , xrefs: 0040368D, 00403695, 004036A2, 004036EC, 004036F2
RichEd20, xrefs: 004037FC
RichEdit, xrefs: 00403823
@6B, xrefs: 00403735
_Nb, xrefs: 0040377C, 00403781
0m, xrefs: 004035E9
1033, xrefs: 00403603, 0040364F
RichEd32, xrefs: 00403807

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe"$.DEFAULT\Control Panel\International$.exe$0m$1033$@6B$C:\Program Files\StarWarsGalaxies$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$Remove folder: $RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 914957316-748721994
Opcode ID: 392d5f4cb81c3402596a7babc02d33f42a3aea42342ae29b68c12f694b71961b
Instruction ID: 45f7e6f6298fecf4380e03b8fea472ff54197446901a6653a97fd0bb622000e8
Opcode Fuzzy Hash: 392d5f4cb81c3402596a7babc02d33f42a3aea42342ae29b68c12f694b71961b
Instruction Fuzzy Hash: 0161B2B1604200BED6307F65AC45E2B3AADEB4474AF44447FF900B22E1D77DAE05CA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00403F7F Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 204
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00403F7F(struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, int _a16) {
				char _v8;
				signed int _v12;
				void* _v16;
				struct HWND__* _t52;
				intOrPtr _t71;
				intOrPtr _t85;
				long _t86;
				int _t98;
				struct HWND__* _t99;
				signed int _t100;
				intOrPtr _t103;
				intOrPtr _t107;
				intOrPtr _t109;
				int _t110;
				signed int* _t112;
				signed int _t113;
				char* _t114;
				CHAR* _t115;

				if(_a8 != 0x110) {
					if(_a8 != 0x111) {
						L11:
						if(_a8 != 0x4e) {
							if(_a8 == 0x40b) {
								 *0x420478 =  *0x420478 + 1;
							}
							L25:
							_t110 = _a16;
							L26:
							return E00403E9E(_a8, _a12, _t110);
						}
						_t52 = GetDlgItem(_a4, 0x3e8);
						_t110 = _a16;
						if( *((intOrPtr*)(_t110 + 8)) == 0x70b &&  *((intOrPtr*)(_t110 + 0xc)) == 0x201) {
							_t100 =  *((intOrPtr*)(_t110 + 0x1c));
							_t109 =  *((intOrPtr*)(_t110 + 0x18));
							_v12 = _t100;
							_v16 = _t109;
							_v8 = 0x422e40;
							if(_t100 - _t109 < 0x800) {
								SendMessageA(_t52, 0x44b, 0,  &_v16);
								SetCursor(LoadCursorA(0, 0x7f02));
								_t40 =  &_v8; // 0x422e40
								ShellExecuteA(_a4, "open",  *_t40, 0, 0, 1);
								SetCursor(LoadCursorA(0, 0x7f00));
								_t110 = _a16;
							}
						}
						if( *((intOrPtr*)(_t110 + 8)) != 0x700 ||  *((intOrPtr*)(_t110 + 0xc)) != 0x100) {
							goto L26;
						} else {
							if( *((intOrPtr*)(_t110 + 0x10)) == 0xd) {
								SendMessageA( *0x423ea8, 0x111, 1, 0);
							}
							if( *((intOrPtr*)(_t110 + 0x10)) == 0x1b) {
								SendMessageA( *0x423ea8, 0x10, 0, 0);
							}
							return 1;
						}
					}
					if(_a12 >> 0x10 != 0 ||  *0x420478 != 0) {
						goto L25;
					} else {
						_t103 =  *0x41fc68; // 0x6df09c
						_t25 = _t103 + 0x14; // 0x6df0b0
						_t112 = _t25;
						if(( *_t112 & 0x00000020) == 0) {
							goto L25;
						}
						 *_t112 =  *_t112 & 0xfffffffe | SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
						E00403E59(SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
						E0040420A();
						goto L11;
					}
				}
				_t98 = _a16;
				_t113 =  *(_t98 + 0x30);
				if(_t113 < 0) {
					_t107 =  *0x42367c; // 0x710525
					_t113 =  *(_t107 - 4 + _t113 * 4);
				}
				_t71 =  *0x423ed8; // 0x705cbc
				_push( *((intOrPtr*)(_t98 + 0x34)));
				_t114 = _t113 + _t71;
				_push(0x22);
				_a16 =  *_t114;
				_v12 = _v12 & 0x00000000;
				_t115 = _t114 + 1;
				_v16 = _t115;
				_v8 = E00403F4B;
				E00403E37(_a4);
				_push( *((intOrPtr*)(_t98 + 0x38)));
				_push(0x23);
				E00403E37(_a4);
				CheckDlgButton(_a4, (0 | ( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
				E00403E59( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001);
				_t99 = GetDlgItem(_a4, 0x3e8);
				E00403E6C(_t99);
				SendMessageA(_t99, 0x45b, 1, 0);
				_t85 =  *0x423eb0; // 0x6dee30
				_t86 =  *(_t85 + 0x68);
				if(_t86 < 0) {
					_t86 = GetSysColor( ~_t86);
				}
				SendMessageA(_t99, 0x443, 0, _t86);
				SendMessageA(_t99, 0x445, 0, 0x4010000);
				 *0x41f45c =  *0x41f45c & 0x00000000;
				SendMessageA(_t99, 0x435, 0, lstrlenA(_t115));
				SendMessageA(_t99, 0x449, _a16,  &_v16); // executed
				 *0x420478 =  *0x420478 & 0x00000000;
				return 0;
			}

0x00403f8f
0x004040b5
0x00404111
0x00404115
0x004041ec
0x004041ee
0x004041ee
0x004041f4
0x004041f4
0x004041f7
0x00000000
0x004041fe
0x00404123
0x00404125
0x0040412f
0x0040413a
0x0040413d
0x00404140
0x0040414b
0x0040414e
0x00404155
0x00404163
0x0040417b
0x00404183
0x0040418e
0x0040419e
0x004041a0
0x004041a0
0x00404155
0x004041aa
0x00000000
0x004041b5
0x004041b9
0x004041ca
0x004041ca
0x004041d0
0x004041de
0x004041de
0x00000000
0x004041e2
0x004041aa
0x004040c0
0x00000000
0x004040d4
0x004040d4
0x004040da
0x004040da
0x004040e0
0x00000000
0x00000000
0x00404105
0x00404107
0x0040410c
0x00000000
0x0040410c
0x004040c0
0x00403f95
0x00403f98
0x00403f9d
0x00403f9f
0x00403fae
0x00403fae
0x00403fb0
0x00403fb5
0x00403fb8
0x00403fba
0x00403fbf
0x00403fc8
0x00403fce
0x00403fda
0x00403fdd
0x00403fe6
0x00403feb
0x00403fee
0x00403ff3
0x0040400a
0x00404011
0x00404024
0x00404027
0x0040403c
0x0040403e
0x00404043
0x00404048
0x0040404d
0x0040404d
0x0040405c
0x0040406b
0x0040406d
0x00404083
0x00404092
0x00404094
0x00000000

APIs

CheckDlgButton.USER32 ref: 0040400A
GetDlgItem.USER32 ref: 0040401E
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 0040403C
GetSysColor.USER32(?), ref: 0040404D
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 0040405C
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 0040406B
lstrlenA.KERNEL32(?), ref: 00404075
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404083
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404092
GetDlgItem.USER32 ref: 004040F5
SendMessageA.USER32(00000000), ref: 004040F8
GetDlgItem.USER32 ref: 00404123
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404163
LoadCursorA.USER32 ref: 00404172
SetCursor.USER32(00000000), ref: 0040417B
ShellExecuteA.SHELL32(0000070B,open,@.B,00000000,00000000,00000001), ref: 0040418E
LoadCursorA.USER32 ref: 0040419B
SetCursor.USER32(00000000), ref: 0040419E
SendMessageA.USER32(00000111,00000001,00000000), ref: 004041CA
SendMessageA.USER32(00000010,00000000,00000000), ref: 004041DE

Strings

N, xrefs: 00404111
open, xrefs: 00404186
@.B, xrefs: 00404183
0m, xrefs: 0040403E

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: 0m$@.B$N$open
API String ID: 3615053054-1539335880
Opcode ID: 086c9584272f405e5d23a234cb3672cb38a546f38c26fc4f0f37582571ec5c76
Instruction ID: 37c7ef6c6620c2b7dda319eb73433029e403bd6f7b5c42189f778147e1498c59
Opcode Fuzzy Hash: 086c9584272f405e5d23a234cb3672cb38a546f38c26fc4f0f37582571ec5c76
Instruction Fuzzy Hash: CE61C4B1A40209BFEB109F60CC45F6A7BA9FB54715F108136FB05BA2D1C7B8A951CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00404275 Relevance: 30.0, APIs: 12, Strings: 5, Instructions: 242
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E00404275(struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				union _ULARGE_INTEGER _v24;
				long _v28;
				union _ULARGE_INTEGER _v32;
				intOrPtr _v36;
				long _v40;
				union _ULARGE_INTEGER _v44;
				CHAR* _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				CHAR* _v68;
				void _v72;
				char _v76;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t75;
				signed char* _t80;
				int _t86;
				int _t88;
				int _t100;
				int _t102;
				signed int _t105;
				char* _t110;
				intOrPtr _t112;
				intOrPtr _t135;
				signed int _t139;
				signed int _t144;
				CHAR* _t150;

				_t75 =  *0x41fc68; // 0x6df09c
				_v36 = _t75;
				_t150 = ( *(_t75 + 0x3c) << 0xa) + 0x424000;
				_v12 =  *((intOrPtr*)(_t75 + 0x38));
				if(_a8 == 0x40b) {
					E004052E8(0x3fb, _t150);
					E00405CA1(_t150);
				}
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							_t144 = _t143 | 0xffffffff;
							E004052E8(0x3fb, _t150);
							if(E00405617(_t169, _t150) == 0) {
								_v8 = 1;
							}
							E00405A43(0x41f460, _t150);
							_t80 = E004055CA(0x41f460);
							if(_t80 != 0) {
								 *_t80 =  *_t80 & 0x00000000;
							}
							if(E00405D61(0) == 0) {
								L29:
								_t86 = GetDiskFreeSpaceA(0x41f460,  &_v20,  &_v28,  &_v16,  &_v40);
								__eflags = _t86;
								if(_t86 == 0) {
									goto L32;
								}
								_t100 = _v20 * _v28;
								__eflags = _t100;
								_t144 = MulDiv(_t100, _v16, 0x400);
								goto L31;
							} else {
								_t102 = GetDiskFreeSpaceExA(0x41f460,  &_v44,  &_v24,  &_v32); // executed
								if(_t102 == 0) {
									goto L29;
								}
								_t144 = (_v40 << 0x00000020 | _v44.LowPart) >> 0xa;
								L31:
								_v12 = 1;
								L32:
								if(_t144 < E00404683(5)) {
									_v8 = 2;
								}
								_t135 =  *0x42367c; // 0x710525
								if( *((intOrPtr*)(_t135 + 0x10)) != 0) {
									E004045CE(0x3ff, 0xfffffffb, _t87); // executed
									if(_v12 == 0) {
										SetDlgItemTextA(_a4, 0x400, 0x41f450);
									} else {
										E004045CE(0x400, 0xfffffffc, _t144); // executed
									}
								}
								_t88 = _v8;
								 *0x423f44 = _t88;
								if(_t88 == 0) {
									_v8 = E0040140B(7);
								}
								if(( *(_v36 + 0x14) & 0x00000400) != 0) {
									_v8 = 0;
								}
								E00403E59(0 | _v8 == 0x00000000);
								if(_v8 == 0 &&  *0x420484 == 0) {
									E0040420A();
								}
								 *0x420484 = 0;
								goto L46;
							}
						}
						_t169 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L46;
						}
						goto L22;
					}
					_t105 = _a12 & 0x0000ffff;
					if(_t105 != 0x3fb) {
						L12:
						if(_t105 == 0x3e9) {
							_t139 = 7;
							memset( &_v72, 0, _t139 << 2);
							_t143 = 0x420498;
							_v76 = _a4;
							_v68 = 0x420498;
							_v56 = E00404568;
							_v52 = _t150;
							_v64 = E00405A65(0x3fb, 0x420498, _t150, 0x41f868, _v12);
							_t110 =  &_v76;
							_v60 = 0x41;
							__imp__SHBrowseForFolderA(_t110);
							if(_t110 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t110);
								E00405536(_t150);
								_t112 =  *0x423eb0; // 0x6dee30
								_t113 =  *((intOrPtr*)(_t112 + 0x11c));
								if( *((intOrPtr*)(_t112 + 0x11c)) != 0 && _t150 == "C:\\Program Files\\StarWarsGalaxies") {
									E00405A65(0x3fb, 0x420498, _t150, 0, _t113);
									_t143 = 0x422e40;
									if(lstrcmpiA(0x422e40, 0x420498) != 0) {
										lstrcatA(_t150, 0x422e40);
									}
								}
								 *0x420484 =  *0x420484 + 1;
								SetDlgItemTextA(_a4, 0x3fb, _t150);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L46;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t143 = GetDlgItem(_a4, 0x3fb);
					if(E004055A3(_t150) != 0 && E004055CA(_t150) == 0) {
						E00405536(_t150);
					}
					 *0x423678 = _a4; // executed
					SetWindowTextA(_t143, _t150); // executed
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E00403E37(_a4);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E00403E37(_a4);
					E00403E6C(_t143);
					if(E00405D61(7) == 0) {
						L46:
						return E00403E9E(_a8, _a12, _a16);
					}
					SHAutoComplete(_t143, 1); // executed
					goto L8;
				}
			}

0x0040427b
0x00404282
0x0040428e
0x0040429c
0x004042a4
0x004042a8
0x004042ae
0x004042ae
0x004042ba
0x0040432c
0x00404333
0x00404408
0x0040440f
0x0040441e
0x0040441e
0x00404422
0x00404428
0x0040442b
0x00404438
0x0040443a
0x0040443a
0x00404448
0x0040444e
0x00404455
0x00404457
0x00404457
0x00404468
0x0040448c
0x0040449d
0x004044a3
0x004044a5
0x00000000
0x00000000
0x004044ab
0x004044ab
0x004044b9
0x00000000
0x0040446a
0x00404477
0x0040447b
0x00000000
0x00000000
0x00404483
0x004044bb
0x004044bb
0x004044c2
0x004044cb
0x004044cd
0x004044cd
0x004044d4
0x004044df
0x004044e9
0x004044f1
0x00404507
0x004044f3
0x004044f7
0x004044f7
0x004044f1
0x0040450c
0x00404511
0x00404516
0x0040451f
0x0040451f
0x00404528
0x0040452a
0x0040452a
0x00404536
0x0040453e
0x00404548
0x00404548
0x0040454d
0x00000000
0x0040454d
0x00404468
0x00404411
0x00404418
0x00000000
0x00000000
0x00000000
0x00404418
0x00404339
0x0040433f
0x00404359
0x0040435e
0x00404368
0x0040436f
0x00404374
0x0040437e
0x00404381
0x00404384
0x0040438b
0x00404393
0x00404396
0x0040439a
0x004043a1
0x004043a9
0x00404401
0x004043ab
0x004043ac
0x004043b3
0x004043b8
0x004043bd
0x004043c5
0x004043d2
0x004043d8
0x004043e6
0x004043ea
0x004043ea
0x004043e6
0x004043ef
0x004043fa
0x004043fa
0x004043a9
0x00000000
0x0040435e
0x0040434c
0x00000000
0x00000000
0x00404352
0x00000000
0x004042bc
0x004042c7
0x004042d0
0x004042dd
0x004042dd
0x004042e7
0x004042ec
0x004042f5
0x004042f8
0x004042fd
0x00404305
0x00404308
0x0040430d
0x00404313
0x00404321
0x00404553
0x00404565
0x00404565
0x0040432a
0x00000000
0x0040432a

APIs

GetDlgItem.USER32 ref: 004042C0
SetWindowTextA.USER32(00000000,?), ref: 004042EC
SHAutoComplete.SHLWAPI(00000000,00000001,00000007,00000000,?,00000014,?,?,00000001,?), ref: 0040432A
SHBrowseForFolderA.SHELL32(?,0041F868,?), ref: 004043A1
CoTaskMemFree.OLE32(00000000), ref: 004043AC
lstrcmpiA.KERNEL32(Remove folder: ,00420498,00000000,?,?), ref: 004043DE
lstrcatA.KERNEL32(?,Remove folder: ), ref: 004043EA
SetDlgItemTextA.USER32 ref: 004043FA

Part of subcall function 004052E8: GetDlgItemTextA.USER32 ref: 004052FB

Part of subcall function 00405CA1: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe",C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405CF9
Part of subcall function 00405CA1: CharNextA.USER32(?,?,?,00000000), ref: 00405D06
Part of subcall function 00405CA1: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe",C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D0B
Part of subcall function 00405CA1: CharPrevA.USER32(?,?,"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe",C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D1B

GetDiskFreeSpaceExA.KERNELBASE(C:\,?,?,?,00000000,C:\,C:\,?,?,000003FB,?), ref: 00404477
GetDiskFreeSpaceA.KERNEL32(C:\,?,?,0000040F,?,00000000,C:\,C:\,?,?,000003FB,?), ref: 0040449D
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004044B3
SetDlgItemTextA.USER32 ref: 00404507

Strings

C:\, xrefs: 00404442, 00404447, 0040444D, 00404476, 0040449C
C:\Program Files\StarWarsGalaxies, xrefs: 004043C7
Remove folder: , xrefs: 004043D8, 004043DD, 004043E8
A, xrefs: 0040439A
0m, xrefs: 004043B8

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: CharItemText$FreeNext$DiskSpace$AutoBrowseCompleteFolderPrevTaskWindowlstrcatlstrcmpi
String ID: 0m$A$C:\$C:\Program Files\StarWarsGalaxies$Remove folder:
API String ID: 936030579-1220575058
Opcode ID: eff0c5b22a8bb45787235654fe53dd97d234a1fae078a0c3c04903df2530cea1
Instruction ID: bf73891eaa7ceb25cd2d176da2664e738739afe01e185979f8a0921e91be6a6b
Opcode Fuzzy Hash: eff0c5b22a8bb45787235654fe53dd97d234a1fae078a0c3c04903df2530cea1
Instruction Fuzzy Hash: 7E816BB1A00218BBDB11AFA5CD45B9F7BA8EF44314F50817BFB04B62D1C7789A41CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00402C5B Relevance: 30.0, APIs: 5, Strings: 12, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00402C5B(void* __eflags, signed int _a4) {
				long _v8;
				long _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _v40;
				char _v300;
				signed int _t54;
				void* _t57;
				void* _t62;
				signed int _t63;
				intOrPtr _t65;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr _t71;
				signed int _t77;
				signed int _t79;
				signed int _t82;
				signed int _t83;
				signed int _t89;
				intOrPtr _t92;
				signed int _t101;
				signed int _t103;
				void* _t105;
				signed int _t106;
				signed int _t109;
				void* _t110;

				_v8 = 0;
				_v12 = 0;
				 *0x423eac = GetTickCount() + 0x3e8;
				GetModuleFileNameA(0, "C:\\Users\\jones\\AppData\\Local\\Temp\\ModSource UI Addon Pack\\ModSource UI Addon Pack.exe", 0x400);
				_t105 = E0040571A("C:\\Users\\jones\\AppData\\Local\\Temp\\ModSource UI Addon Pack\\ModSource UI Addon Pack.exe", 0x80000000, 3);
				 *0x409010 = _t105;
				if(_t105 == 0xffffffff) {
					return "Error launching installer";
				}
				E00405A43("C:\\Users\\jones\\AppData\\Local\\Temp\\ModSource UI Addon Pack", "C:\\Users\\jones\\AppData\\Local\\Temp\\ModSource UI Addon Pack\\ModSource UI Addon Pack.exe");
				E00405A43(0x42b000, E0040557D("C:\\Users\\jones\\AppData\\Local\\Temp\\ModSource UI Addon Pack"));
				_t54 = GetFileSize(_t105, 0);
				__eflags = _t54;
				 *0x41f048 = _t54;
				_t109 = _t54;
				if(_t54 <= 0) {
					L22:
					E00402BC5(1);
					__eflags =  *0x423eb4; // 0xec00
					if(__eflags == 0) {
						goto L30;
					}
					__eflags = _v12;
					if(_v12 == 0) {
						L26:
						_t57 = GlobalAlloc(0x40, _v20); // executed
						_t110 = _t57;
						E00405E3B(0x40afb0);
						E00405749( &_v300, "C:\\Users\\jones\\AppData\\Local\\Temp\\"); // executed
						_t62 = CreateFileA( &_v300, 0xc0000000, 0, 0, 2, 0x4000100, 0); // executed
						__eflags = _t62 - 0xffffffff;
						 *0x409014 = _t62;
						if(_t62 != 0xffffffff) {
							_t63 =  *0x423eb4; // 0xec00
							_t65 = E004031DA(_t63 + 0x1c);
							 *0x41f04c = _t65;
							 *0x417040 = _t65 - ( !_v40 & 0x00000004) + _v16 - 0x1c; // executed
							_t68 = E00402F01(_v16, 0xffffffff, 0, _t110, _v20); // executed
							__eflags = _t68 - _v20;
							if(_t68 == _v20) {
								__eflags = _v40 & 0x00000001;
								 *0x423eb0 = _t110;
								 *0x423eb8 =  *_t110;
								if((_v40 & 0x00000001) != 0) {
									 *0x423ebc =  *0x423ebc + 1;
									__eflags =  *0x423ebc;
								}
								_t45 = _t110 + 0x44; // 0x44
								_t70 = _t45;
								_t101 = 8;
								do {
									_t70 = _t70 - 8;
									 *_t70 =  *_t70 + _t110;
									_t101 = _t101 - 1;
									__eflags = _t101;
								} while (_t101 != 0);
								_t71 =  *0x41703c; // 0x5ad5d1
								 *((intOrPtr*)(_t110 + 0x3c)) = _t71;
								E004056DB("\\xef\xbf\xbdm", _t110 + 4								__eflags = 0;
								return 0;
							}
							goto L30;
						}
						return "Error writing temporary file. Make sure your temp folder is valid.";
					}
					E004031DA( *0x417038);
					_t77 = E004031A8( &_a4, 4); // executed
					__eflags = _t77;
					if(_t77 == 0) {
						goto L30;
					}
					__eflags = _v8 - _a4;
					if(_v8 != _a4) {
						goto L30;
					}
					goto L26;
				} else {
					do {
						_t79 =  *0x423eb4; // 0xec00
						_t106 = _t109;
						asm("sbb eax, eax");
						_t82 = ( ~_t79 & 0x00007e00) + 0x200;
						__eflags = _t109 - _t82;
						if(_t109 >= _t82) {
							_t106 = _t82;
						}
						_t83 = E004031A8(0x417048, _t106); // executed
						__eflags = _t83;
						if(_t83 == 0) {
							E00402BC5(1);
							L30:
							return "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						__eflags =  *0x423eb4; // 0xec00
						if(__eflags != 0) {
							__eflags = _a4 & 0x00000002;
							if((_a4 & 0x00000002) == 0) {
								E00402BC5(0);
							}
							goto L19;
						}
						E004056DB( &_v40, 0x417048, 0x1c);
						_t89 = _v40;
						__eflags = _t89 & 0xfffffff0;
						if((_t89 & 0xfffffff0) != 0) {
							goto L19;
						}
						__eflags = _v36 - 0xdeadbeef;
						if(_v36 != 0xdeadbeef) {
							goto L19;
						}
						__eflags = _v24 - 0x74736e49;
						if(_v24 != 0x74736e49) {
							goto L19;
						}
						__eflags = _v28 - 0x74666f73;
						if(_v28 != 0x74666f73) {
							goto L19;
						}
						__eflags = _v32 - 0x6c6c754e;
						if(_v32 != 0x6c6c754e) {
							goto L19;
						}
						_a4 = _a4 | _t89;
						_t103 =  *0x417038; // 0x0
						 *0x423f40 =  *0x423f40 | _a4 & 0x00000002;
						_t92 = _v16;
						__eflags = _t92 - _t109;
						 *0x423eb4 = _t103;
						if(_t92 > _t109) {
							goto L30;
						}
						__eflags = _a4 & 0x00000008;
						if((_a4 & 0x00000008) != 0) {
							L15:
							_v12 = _v12 + 1;
							_t109 = _t92 - 4;
							__eflags = _t106 - _t109;
							if(_t106 > _t109) {
								_t106 = _t109;
							}
							goto L19;
						}
						__eflags = _a4 & 0x00000004;
						if((_a4 & 0x00000004) != 0) {
							goto L22;
						}
						goto L15;
						L19:
						__eflags = _t109 -  *0x41f048; // 0x36f
						if(__eflags < 0) {
							_v8 = E00405DCD(_v8, 0x417048, _t106);
						}
						 *0x417038 =  *0x417038 + _t106;
						_t109 = _t109 - _t106;
						__eflags = _t109;
					} while (_t109 > 0);
					goto L22;
				}
			}

APIs

GetTickCount.KERNEL32 ref: 00402C6F
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe,00000400), ref: 00402C8B

Part of subcall function 0040571A: GetFileAttributesA.KERNELBASE(00000003,00402C9E,C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe,80000000,00000003), ref: 0040571E
Part of subcall function 0040571A: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405740

GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack,C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack,C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe,C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe,80000000,00000003), ref: 00402CD4
GlobalAlloc.KERNELBASE(00000040,00409128), ref: 00402E1B

Strings

Error launching installer, xrefs: 00402CAB
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402EB2
"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe", xrefs: 00402C68
soft, xrefs: 00402D4B
\m, xrefs: 00402EEE
Inst, xrefs: 00402D42
Null, xrefs: 00402D54
C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack, xrefs: 00402CB6, 00402CBB, 00402CC1
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402E64
C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe, xrefs: 00402C75, 00402C84, 00402C98, 00402CB5
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C5B, 00402E33
0m, xrefs: 00402EBD

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe"$0m$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack$C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$\m$soft
API String ID: 2803837635-262210884
Opcode ID: 5a3244cca4cab7a33e22ce81ae8146d10a443c0383f3252900150380413eb612
Instruction ID: 828b4c4c124608c6ece817eb75cbb5c4208d087c7274c687d5ed474e8a635a34
Opcode Fuzzy Hash: 5a3244cca4cab7a33e22ce81ae8146d10a443c0383f3252900150380413eb612
Instruction Fuzzy Hash: 7961E331A40204ABDB21DF64DE89B9A7BB4AF04315F10417BF505B62D1D7BC9E858B9C

Uniqueness

Uniqueness Score: -1.00%

Function 00405A65 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 195
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E00405A65(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				struct _ITEMIDLIST* _v12;
				signed int _v16;
				signed char _v20;
				signed char _v24;
				signed int _v28;
				signed int _t36;
				CHAR* _t37;
				signed char _t39;
				signed int _t40;
				int _t41;
				char _t51;
				char _t52;
				char _t54;
				char _t56;
				void* _t64;
				signed int _t68;
				intOrPtr _t72;
				signed int _t73;
				signed char _t74;
				intOrPtr _t77;
				char _t81;
				void* _t83;
				CHAR* _t84;
				void* _t86;
				signed int _t93;
				signed int _t95;
				void* _t96;

				_t86 = __esi;
				_t83 = __edi;
				_t64 = __ebx;
				_t36 = _a8;
				if(_t36 < 0) {
					_t77 =  *0x42367c; // 0x710525
					_t36 =  *(_t77 - 4 + _t36 * 4);
				}
				_t72 =  *0x423ed8; // 0x705cbc
				_t73 = _t72 + _t36;
				_t37 = 0x422e40;
				_push(_t64);
				_push(_t86);
				_push(_t83);
				_t84 = 0x422e40;
				if(_a4 - 0x422e40 < 0x800) {
					_t84 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t81 =  *_t73;
					if(_t81 == 0) {
						break;
					}
					__eflags = _t84 - _t37 - 0x400;
					if(_t84 - _t37 >= 0x400) {
						break;
					}
					_t73 = _t73 + 1;
					__eflags = _t81 - 0xfc;
					_a8 = _t73;
					if(__eflags <= 0) {
						if(__eflags != 0) {
							 *_t84 = _t81;
							_t84 =  &(_t84[1]);
							__eflags = _t84;
						} else {
							 *_t84 =  *_t73;
							_t84 =  &(_t84[1]);
							_t73 = _t73 + 1;
						}
						continue;
					}
					_t39 =  *(_t73 + 1);
					_t74 =  *_t73;
					_a8 = _a8 + 2;
					_v20 = _t39;
					_t93 = (_t39 & 0x0000007f) << 0x00000007 | _t74 & 0x0000007f;
					_t68 = _t74;
					_t40 = _t39 | 0x00000080;
					__eflags = _t81 - 0xfe;
					_v28 = _t68;
					_v24 = _t74 | 0x00000080;
					_v16 = _t40;
					if(_t81 != 0xfe) {
						__eflags = _t81 - 0xfd;
						if(_t81 != 0xfd) {
							__eflags = _t81 - 0xff;
							if(_t81 == 0xff) {
								__eflags = (_t40 | 0xffffffff) - _t93;
								E00405A65(_t68, _t84, _t93, _t84, (_t40 | 0xffffffff) - _t93);
							}
							L41:
							_t41 = lstrlenA(_t84);
							_t73 = _a8;
							_t84 =  &(_t84[_t41]);
							_t37 = 0x422e40;
							continue;
						}
						__eflags = _t93 - 0x1d;
						if(_t93 != 0x1d) {
							__eflags = (_t93 << 0xa) + 0x424000;
							E00405A43(_t84, (_t93 << 0xa) + 0x424000);
						} else {
							E004059A1(_t84,  *0x423ea8);
						}
						__eflags = _t93 + 0xffffffeb - 7;
						if(_t93 + 0xffffffeb < 7) {
							L32:
							E00405CA1(_t84);
						}
						goto L41;
					}
					_t95 = 2;
					_t51 = GetVersion();
					__eflags = _t51;
					if(_t51 >= 0) {
						L12:
						_v8 = 1;
						L13:
						__eflags =  *0x423f24;
						if( *0x423f24 != 0) {
							_t95 = 4;
						}
						__eflags = _t68;
						if(_t68 >= 0) {
							__eflags = _t68 - 0x25;
							if(_t68 != 0x25) {
								__eflags = _t68 - 0x24;
								if(_t68 == 0x24) {
									GetWindowsDirectoryA(_t84, 0x400);
									_t95 = 0;
								}
								while(1) {
									__eflags = _t95;
									if(_t95 == 0) {
										goto L29;
									}
									_t52 =  *0x423ea4; // 0x73d51340
									_t95 = _t95 - 1;
									__eflags = _t52;
									if(_t52 == 0) {
										L25:
										_t54 = SHGetSpecialFolderLocation( *0x423ea8,  *(_t96 + _t95 * 4 - 0x18),  &_v12);
										__eflags = _t54;
										if(_t54 != 0) {
											L27:
											 *_t84 =  *_t84 & 0x00000000;
											__eflags =  *_t84;
											continue;
										}
										__imp__SHGetPathFromIDListA(_v12, _t84);
										__imp__CoTaskMemFree(_v12);
										__eflags = _t54;
										if(_t54 != 0) {
											goto L29;
										}
										goto L27;
									}
									__eflags = _v8;
									if(_v8 == 0) {
										goto L25;
									}
									_t56 =  *_t52( *0x423ea8,  *(_t96 + _t95 * 4 - 0x18), 0, 0, _t84); // executed
									__eflags = _t56;
									if(_t56 == 0) {
										goto L29;
									}
									goto L25;
								}
								goto L29;
							}
							GetSystemDirectoryA(_t84, 0x400);
							goto L29;
						} else {
							_t71 = (_t68 & 0x0000003f) +  *0x423ed8;
							E0040592A(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion", (_t68 & 0x0000003f) +  *0x423ed8, _t84, _t68 & 0x00000040);
							__eflags =  *_t84;
							if( *_t84 != 0) {
								L30:
								__eflags = _v20 - 0x1a;
								if(_v20 == 0x1a) {
									lstrcatA(_t84, "\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L32;
							}
							E00405A65(_t71, _t84, _t95, _t84, _v20);
							L29:
							__eflags =  *_t84;
							if( *_t84 == 0) {
								goto L32;
							}
							goto L30;
						}
					}
					__eflags = _t51 - 0x5a04;
					if(_t51 == 0x5a04) {
						goto L12;
					}
					__eflags = _v20 - 0x23;
					if(_v20 == 0x23) {
						goto L12;
					}
					__eflags = _v20 - 0x2e;
					if(_v20 == 0x2e) {
						goto L12;
					} else {
						_v8 = _v8 & 0x00000000;
						goto L13;
					}
				}
				 *_t84 =  *_t84 & 0x00000000;
				if(_a4 == 0) {
					return _t37;
				}
				return E00405A43(_a4, _t37);
			}

APIs

GetVersion.KERNEL32(00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\,00000000,00404E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\,00000000), ref: 00405B09
GetSystemDirectoryA.KERNEL32 ref: 00405B84
GetWindowsDirectoryA.KERNEL32(Remove folder: ,00000400), ref: 00405B97
SHGetSpecialFolderLocation.SHELL32(?,00000000), ref: 00405BD3
SHGetPathFromIDListA.SHELL32(00000000,Remove folder: ), ref: 00405BE1
CoTaskMemFree.OLE32(00000000), ref: 00405BEC
lstrcatA.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 00405C0E
lstrlenA.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\,00000000,00404E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\,00000000), ref: 00405C60

Strings

Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\, xrefs: 00405A96
Remove folder: , xrefs: 00405A8E, 00405B51, 00405B6E, 00405B83, 00405B96, 00405BB2, 00405BDD, 00405C0D, 00405C13, 00405C2B, 00405C3E, 00405C59, 00405C5F, 00405C6A, 00405C94
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405C08
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405B53

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Remove folder: $Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-3802947592
Opcode ID: 6039383e331827236c7e7f38b4fee931289fac887b2714ea3c97b7a67a2168d7
Instruction ID: 7ee21fb2fc3cc9820636396ad5dfe7f88664caf88b33913cf2431378ed05aae4
Opcode Fuzzy Hash: 6039383e331827236c7e7f38b4fee931289fac887b2714ea3c97b7a67a2168d7
Instruction Fuzzy Hash: 25510571A04A05AAEB216F64DC84B7F3BB4EB11714F14023BE911B62E1D37C6982DF5E

Uniqueness

Uniqueness Score: -1.00%

Function 00401734 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00401734(FILETIME* __ebx, void* __eflags) {
				void* _t33;
				void* _t41;
				void* _t43;
				FILETIME* _t49;
				FILETIME* _t62;
				void* _t64;
				signed int _t70;
				FILETIME* _t71;
				FILETIME* _t75;
				signed int _t77;
				void* _t80;
				CHAR* _t82;
				void* _t85;

				_t75 = __ebx;
				_t82 = E004029E8(0x31);
				 *(_t85 - 8) = _t82;
				 *(_t85 + 8) =  *(_t85 - 0x24) & 0x00000007;
				_t33 = E004055A3(_t82);
				_push(_t82);
				if(_t33 == 0) {
					lstrcatA(E00405536(E00405A43(0x4093a0, "C:\\Program Files\\StarWarsGalaxies\\Mods\\ModSource UI Addon Pack\\Icons")), ??);
				} else {
					_push(0x4093a0);
					E00405A43();
				}
				E00405CA1(0x4093a0);
				while(1) {
					__eflags =  *(_t85 + 8) - 3;
					if( *(_t85 + 8) >= 3) {
						_t64 = E00405D3A(0x4093a0);
						_t77 = 0;
						__eflags = _t64 - _t75;
						if(_t64 != _t75) {
							_t71 = _t64 + 0x14;
							__eflags = _t71;
							_t77 = CompareFileTime(_t71, _t85 - 0x18);
						}
						asm("sbb eax, eax");
						_t70 =  ~(( *(_t85 + 8) + 0xfffffffd | 0x80000000) & _t77) + 1;
						__eflags = _t70;
						 *(_t85 + 8) = _t70;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) == _t75) {
						E004056FB(0x4093a0);
					}
					__eflags =  *(_t85 + 8) - 1;
					_t41 = E0040571A(0x4093a0, 0x40000000, (0 |  *(_t85 + 8) != 0x00000001) + 1);
					__eflags = _t41 - 0xffffffff;
					 *(_t85 - 0x34) = _t41;
					if(_t41 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) != _t75) {
						E00404DE1(0xffffffe2,  *(_t85 - 8));
						__eflags =  *(_t85 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t85 - 4)) = 1;
						}
						L31:
						 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t85 - 4));
						__eflags =  *0x423f28;
						goto L32;
					} else {
						E00405A43(0x409ba0, 0x424000);
						E00405A43(0x424000, 0x4093a0);
						E00405A65(_t75, 0x409ba0, 0x4093a0, "C:\Users\jones\AppData\Local\Temp\nsk44DC.tmp\System.dll",  *((intOrPtr*)(_t85 - 0x10)));
						E00405A43(0x424000, 0x409ba0);
						_t62 = E00405304("C:\Users\jones\AppData\Local\Temp\nsk44DC.tmp\System.dll",  *(_t85 - 0x24) >> 3) - 4;
						__eflags = _t62;
						if(_t62 == 0) {
							continue;
						} else {
							__eflags = _t62 == 1;
							if(_t62 == 1) {
								 *0x423f28 =  &( *0x423f28->dwLowDateTime);
								L32:
								_t49 = 0;
								__eflags = 0;
							} else {
								_push(0x4093a0);
								_push(0xfffffffa);
								E00404DE1();
								L29:
								_t49 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t49;
				}
				E00404DE1(0xffffffea,  *(_t85 - 8)); // executed
				 *0x423f54 =  *0x423f54 + 1;
				_t43 = E00402F01(_t77,  *((intOrPtr*)(_t85 - 0x1c)),  *(_t85 - 0x34), _t75, _t75); // executed
				 *0x423f54 =  *0x423f54 - 1;
				__eflags =  *(_t85 - 0x18) - 0xffffffff;
				_t80 = _t43;
				if( *(_t85 - 0x18) != 0xffffffff) {
					L22:
					SetFileTime( *(_t85 - 0x34), _t85 - 0x18, _t75, _t85 - 0x18); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t85 - 0x14)) - 0xffffffff;
					if( *((intOrPtr*)(_t85 - 0x14)) != 0xffffffff) {
						goto L22;
					}
				}
				FindCloseChangeNotification( *(_t85 - 0x34)); // executed
				__eflags = _t80 - _t75;
				if(_t80 >= _t75) {
					goto L31;
				} else {
					__eflags = _t80 - 0xfffffffe;
					if(_t80 != 0xfffffffe) {
						E00405A65(_t75, _t80, 0x4093a0, 0x4093a0, 0xffffffee);
					} else {
						E00405A65(_t75, _t80, 0x4093a0, 0x4093a0, 0xffffffe9);
						lstrcatA(0x4093a0,  *(_t85 - 8));
					}
					_push(0x200010);
					_push(0x4093a0);
					E00405304();
					goto L29;
				}
				goto L33;
			}

0x00401734
0x0040173b
0x00401744
0x00401747
0x0040174a
0x0040174f
0x00401757
0x00401773
0x00401759
0x00401759
0x0040175a
0x0040175a
0x00401779
0x00401783
0x00401783
0x00401787
0x0040178a
0x0040178f
0x00401791
0x00401793
0x00401798
0x00401798
0x004017a3
0x004017a3
0x004017b4
0x004017b6
0x004017b6
0x004017b7
0x004017b7
0x004017ba
0x004017bd
0x004017c0
0x004017c0
0x004017c7
0x004017d6
0x004017db
0x004017de
0x004017e1
0x00000000
0x00000000
0x004017e3
0x004017e6
0x00401840
0x00401845
0x004015a8
0x0040264e
0x0040264e
0x0040287d
0x00402880
0x00402880
0x00000000
0x004017e8
0x004017ee
0x004017f9
0x00401806
0x00401811
0x00401827
0x00401827
0x0040182a
0x00000000
0x00401830
0x00401830
0x00401831
0x0040184e
0x00402886
0x00402886
0x00402886
0x00401833
0x00401833
0x00401834
0x00401492
0x00402200
0x00402200
0x00402200
0x00401831
0x0040182a
0x00402888
0x0040288c
0x0040288c
0x0040185e
0x00401863
0x00401871
0x00401876
0x0040187c
0x00401880
0x00401882
0x0040188a
0x00401896
0x00401884
0x00401884
0x00401888
0x00000000
0x00000000
0x00401888
0x0040189f
0x004018a5
0x004018a7
0x00000000
0x004018ad
0x004018ad
0x004018b0
0x004018c8
0x004018b2
0x004018b5
0x004018be
0x004018be
0x004018cd
0x004018d2
0x004021fb
0x00000000
0x004021fb
0x00000000

APIs

lstrcatA.KERNEL32(00000000,00000000,Call,C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Icons,00000000,00000000,00000031), ref: 00401773
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Icons,00000000,00000000,00000031), ref: 0040179D

Part of subcall function 00405A43: lstrcpynA.KERNEL32(?,?,00000400,00403293,ModSource UI Addon Pack Setup,NSIS Error), ref: 00405A50

Part of subcall function 00404DE1: lstrlenA.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E1A
Part of subcall function 00404DE1: lstrlenA.KERNEL32(00402C3C,Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E2A
Part of subcall function 00404DE1: lstrcatA.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\,00402C3C,00402C3C,Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\,00000000,00000000,00000000), ref: 00404E3D
Part of subcall function 00404DE1: SetWindowTextA.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\), ref: 00404E4F
Part of subcall function 00404DE1: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E75
Part of subcall function 00404DE1: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E8F
Part of subcall function 00404DE1: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E9D

Strings

C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\System.dll, xrefs: 00401801, 0040181D
C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Icons, xrefs: 00401761
C:\Users\user\AppData\Local\Temp\nsk44DC.tmp, xrefs: 0040177E, 004017ED, 0040180B
Call, xrefs: 00401750, 00401759, 00401766, 00401778, 00401789, 004017BF, 004017D5, 004017F3, 00401833, 004018B4, 004018BD, 004018C7, 004018D2

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Icons$C:\Users\user\AppData\Local\Temp\nsk44DC.tmp$C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\System.dll$Call
API String ID: 1941528284-3767878558
Opcode ID: 1d060d85976b2bf48db34439d9e974b290c1e54db430ed3d6fc1c873b450db27
Instruction ID: 2b12cca6981bf47a5925f40f6a2934e76afa92bf474aa0434c862d9453808f70
Opcode Fuzzy Hash: 1d060d85976b2bf48db34439d9e974b290c1e54db430ed3d6fc1c873b450db27
Instruction Fuzzy Hash: 2A41C031A00514BACF10BBB5DD86DAF3A69EF45368B60433BF511B21E1D67C8B418E6D

Uniqueness

Uniqueness Score: -1.00%

Function 00404DE1 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00404DE1(CHAR* _a4, CHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				CHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				CHAR* _t26;
				signed int _t27;
				CHAR* _t28;
				long _t29;
				signed int _t39;

				_t26 =  *0x423684; // 0x203ce
				_v8 = _t26;
				if(_t26 != 0) {
					_t27 =  *0x423f54; // 0x0
					_v12 = _t27;
					_t39 = _t27 & 0x00000001;
					if(_t39 == 0) {
						E00405A65(0, _t39, 0x41fc70, 0x41fc70, _a4);
					}
					_t26 = lstrlenA(0x41fc70);
					_a4 = _t26;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t26 = SetWindowTextA( *0x423668, 0x41fc70); // executed
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x41fc70;
							_v52 = 1;
							_t29 = SendMessageA(_v8, 0x1004, 0, 0); // executed
							_v44 = 0;
							_v48 = _t29 - _t39;
							SendMessageA(_v8, 0x1007 - _t39, 0,  &_v52); // executed
							_t26 = SendMessageA(_v8, 0x1013, _v48, 0); // executed
						}
						if(_t39 != 0) {
							_t28 = _a4;
							 *((char*)(_t28 + 0x41fc70)) = 0;
							return _t28;
						}
					} else {
						_t26 =  &(_a4[lstrlenA(_a8)]);
						if(_t26 < 0x800) {
							_t26 = lstrcatA(0x41fc70, _a8);
							goto L6;
						}
					}
				}
				return _t26;
			}

APIs

lstrlenA.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E1A
lstrlenA.KERNEL32(00402C3C,Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E2A
lstrcatA.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\,00402C3C,00402C3C,Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\,00000000,00000000,00000000), ref: 00404E3D
SetWindowTextA.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\), ref: 00404E4F
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E75
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E8F
SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E9D

Strings

Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\, xrefs: 00404E01, 00404E13, 00404E19, 00404E3C, 00404E48

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\
API String ID: 2531174081-701452840
Opcode ID: 0032f5401a7e6206032ec5ee6fd2b2efbe9c078fa2d632926915bd279bc14ffb
Instruction ID: 149710d9142c95b738f2ce1dbf38c2ff42c716f0b6f2aaa801f4c55ac3bf00d7
Opcode Fuzzy Hash: 0032f5401a7e6206032ec5ee6fd2b2efbe9c078fa2d632926915bd279bc14ffb
Instruction Fuzzy Hash: D6217CB1A00108BECB119FA5CD84ADFBFB9FB44354F14807AFA04A6291C7388E458F98

Uniqueness

Uniqueness Score: -1.00%

Function 00402F01 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 109
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00402F01(void* __ecx, void _a4, void* _a8, void* _a12, long _a16) {
				long _v8;
				intOrPtr _v12;
				void _t31;
				intOrPtr _t32;
				int _t35;
				long _t36;
				int _t37;
				long _t38;
				int _t40;
				int _t42;
				long _t43;
				long _t44;
				intOrPtr _t51;
				long _t55;
				long _t57;

				_t31 = _a4;
				if(_t31 >= 0) {
					_t51 =  *0x423ef8; // 0x319bd
					_t44 = _t31 + _t51;
					 *0x41703c = _t44;
					SetFilePointer( *0x409014, _t44, 0, 0); // executed
				}
				_t57 = 4;
				_t32 = E0040302C(_t57);
				if(_t32 >= 0) {
					_t35 = ReadFile( *0x409014,  &_a4, _t57,  &_v8, 0); // executed
					if(_t35 == 0 || _v8 != _t57) {
						L23:
						_push(0xfffffffd);
						goto L24;
					} else {
						 *0x41703c =  *0x41703c + _t57;
						_t32 = E0040302C(_a4);
						_v12 = _t32;
						if(_t32 >= 0) {
							if(_a12 != 0) {
								_t36 = _a4;
								if(_t36 >= _a16) {
									_t36 = _a16;
								}
								_t37 = ReadFile( *0x409014, _a12, _t36,  &_v8, 0); // executed
								if(_t37 == 0) {
									goto L23;
								} else {
									_t38 = _v8;
									 *0x41703c =  *0x41703c + _t38;
									_v12 = _t38;
									goto L22;
								}
							} else {
								if(_a4 <= 0) {
									L22:
									_t32 = _v12;
								} else {
									while(1) {
										_t55 = 0x4000;
										if(_a4 < 0x4000) {
											_t55 = _a4;
										}
										_t40 = ReadFile( *0x409014, 0x413038, _t55,  &_v8, 0); // executed
										if(_t40 == 0 || _t55 != _v8) {
											goto L23;
										}
										_t42 = WriteFile(_a8, 0x413038, _v8,  &_a16, 0); // executed
										if(_t42 == 0 || _a16 != _t55) {
											_push(0xfffffffe);
											L24:
											_pop(_t32);
										} else {
											_t43 = _v8;
											_v12 = _v12 + _t43;
											_a4 = _a4 - _t43;
											 *0x41703c =  *0x41703c + _t43;
											if(_a4 > 0) {
												continue;
											} else {
												goto L22;
											}
										}
										goto L25;
									}
									goto L23;
								}
							}
						}
					}
				}
				L25:
				return _t32;
			}

APIs

SetFilePointer.KERNELBASE(00409128,00000000,00000000,00000000,00000000,00000000,?,?,?,00402EAD,000000FF,00000000,00000000,00409128,0000EBE4), ref: 00402F28
ReadFile.KERNELBASE(00409128,00000004,0000EBE4,00000000,00000004,00000000,00000000,00000000,?,?,?,00402EAD,000000FF,00000000,00000000,00409128), ref: 00402F55
ReadFile.KERNELBASE(00413038,00004000,0000EBE4,00000000,00409128,?,00402EAD,000000FF,00000000,00000000,00409128,0000EBE4), ref: 00402FAF
WriteFile.KERNELBASE(00000000,00413038,0000EBE4,000000FF,00000000,?,00402EAD,000000FF,00000000,00000000,00409128,0000EBE4), ref: 00402FC7

Strings

80A, xrefs: 00402F8F

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: File$Read$PointerWrite
String ID: 80A
API String ID: 2113905535-195308239
Opcode ID: 1d0c5bb9ecfe910818843e6bf7809c02e5eaef0b1ff428f1de7b4674f3045140
Instruction ID: 41b23491bffeaa1753be022b97a7ffae9df7beca0cc47644b0b6bde15745b2e9
Opcode Fuzzy Hash: 1d0c5bb9ecfe910818843e6bf7809c02e5eaef0b1ff428f1de7b4674f3045140
Instruction Fuzzy Hash: 91310B31901209EFDF21CF55DE84DAE7BB8EB453A5F20403AF504E61E0D2749E41EB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040302C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E0040302C(intOrPtr _a4) {
				long _v4;
				void* __ecx;
				intOrPtr _t12;
				intOrPtr _t13;
				signed int _t14;
				void* _t16;
				void* _t17;
				long _t18;
				int _t21;
				intOrPtr _t22;
				intOrPtr _t34;
				long _t35;
				intOrPtr _t37;
				void* _t39;
				long _t40;
				intOrPtr _t46;
				intOrPtr _t47;
				intOrPtr _t53;

				_t35 =  *0x41703c; // 0x5ad5d1
				_t37 = _t35 -  *0x40afa8 + _a4;
				 *0x423eac = GetTickCount() + 0x1f4;
				if(_t37 <= 0) {
					L23:
					E00402BC5(1);
					return 0;
				}
				E004031DA( *0x41f04c);
				SetFilePointer( *0x409014,  *0x40afa8, 0, 0); // executed
				 *0x41f048 = _t37;
				 *0x417038 = 0;
				while(1) {
					L2:
					_t12 =  *0x417040; // 0x118383
					_t34 = 0x4000;
					_t13 = _t12 -  *0x41f04c;
					if(_t13 <= 0x4000) {
						_t34 = _t13;
					}
					_t14 = E004031A8(0x413038, _t34); // executed
					if(_t14 == 0) {
						break;
					}
					 *0x41f04c =  *0x41f04c + _t34;
					 *0x40afc8 = 0x413038;
					 *0x40afcc = _t34;
					while(1) {
						_t46 =  *0x423eb0; // 0x6dee30
						if(_t46 != 0) {
							_t47 =  *0x423f40; // 0x0
							if(_t47 == 0) {
								_t22 =  *0x41f048; // 0x36f
								 *0x417038 = _t22 -  *0x41703c - _a4 +  *0x40afa8;
								E00402BC5(0);
							}
						}
						 *0x40afd0 = 0x40b038;
						 *0x40afd4 = 0x8000; // executed
						_t16 = E00405E5B(0x40afb0); // executed
						if(_t16 < 0) {
							break;
						}
						_t39 =  *0x40afd0; // 0x40c926
						_t40 = _t39 - 0x40b038;
						if(_t40 == 0) {
							__eflags =  *0x40afcc; // 0x0
							if(__eflags != 0) {
								break;
							}
							__eflags = _t34;
							if(_t34 == 0) {
								break;
							}
							L17:
							_t18 =  *0x41703c; // 0x5ad5d1
							if(_t18 -  *0x40afa8 + _a4 > 0) {
								goto L2;
							}
							SetFilePointer( *0x409014, _t18, 0, 0); // executed
							goto L23;
						}
						_t21 = WriteFile( *0x409014, 0x40b038, _t40,  &_v4, 0); // executed
						if(_t21 == 0 || _t40 != _v4) {
							_push(0xfffffffe);
							L22:
							_pop(_t17);
							return _t17;
						} else {
							 *0x40afa8 =  *0x40afa8 + _t40;
							_t53 =  *0x40afcc; // 0x0
							if(_t53 != 0) {
								continue;
							}
							goto L17;
						}
					}
					_push(0xfffffffd);
					goto L22;
				}
				return _t14 | 0xffffffff;
			}

APIs

GetTickCount.KERNEL32 ref: 00403041

Part of subcall function 004031DA: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402E86,0000EBE4), ref: 004031E8

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,?,00402F37,00000004,00000000,00000000,00000000,?,?,?,00402EAD,000000FF,00000000), ref: 00403074
WriteFile.KERNELBASE(0040B038,0040C926,00000000,00000000,00413038,00004000,?,00000000,?,00402F37,00000004,00000000,00000000,00000000,?,?), ref: 0040312E
SetFilePointer.KERNELBASE(005AD5D1,00000000,00000000,00413038,00004000,?,00000000,?,00402F37,00000004,00000000,00000000,00000000,?,?), ref: 00403180

Strings

80A, xrefs: 004030A1
0m, xrefs: 004030C7

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: File$Pointer$CountTickWrite
String ID: 0m$80A
API String ID: 2146148272-1488364571
Opcode ID: 290737b29134b1d866d87f66c8ee3cf3351113b6f2888c53bf796c8e79fb08a8
Instruction ID: 72ef22bd29afdbd351de75f464c4cdd90f0b93df6537b0aaac70e9b4709237b8
Opcode Fuzzy Hash: 290737b29134b1d866d87f66c8ee3cf3351113b6f2888c53bf796c8e79fb08a8
Instruction Fuzzy Hash: 81417FB2504302AFD7109F19EE8496A3FBCF748396710813BE501B72F1C7386A559BAE

Uniqueness

Uniqueness Score: -1.00%

Function 0040266E Relevance: 10.6, APIs: 7, Instructions: 89
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E0040266E(struct _OVERLAPPED* __ebx) {
				void* _t27;
				long _t32;
				void* _t33;
				void* _t37;
				long _t41;
				struct _OVERLAPPED* _t47;
				void* _t51;
				void* _t53;
				void* _t56;
				void* _t57;
				void* _t58;

				_t47 = __ebx;
				 *(_t58 - 8) = 0xfffffd66;
				_t52 = E004029E8(0xfffffff0);
				 *(_t58 - 0x44) = _t24;
				if(E004055A3(_t52) == 0) {
					E004029E8(0xffffffed);
				}
				E004056FB(_t52);
				_t27 = E0040571A(_t52, 0x40000000, 2);
				 *(_t58 + 8) = _t27;
				if(_t27 != 0xffffffff) {
					_t32 =  *0x423eb4; // 0xec00
					 *(_t58 - 0x2c) = _t32;
					_t33 = GlobalAlloc(0x40, _t32); // executed
					_t51 = _t33;
					if(_t51 != _t47) {
						E004031DA(_t47);
						E004031A8(_t51,  *(_t58 - 0x2c)); // executed
						_t37 = GlobalAlloc(0x40,  *(_t58 - 0x1c)); // executed
						_t56 = _t37;
						 *(_t58 - 0x30) = _t56;
						if(_t56 != _t47) {
							E00402F01(_t49,  *((intOrPtr*)(_t58 - 0x20)), _t47, _t56,  *(_t58 - 0x1c)); // executed
							while( *_t56 != _t47) {
								_t49 =  *_t56;
								_t57 = _t56 + 8;
								 *(_t58 - 0x38) =  *_t56;
								E004056DB( *((intOrPtr*)(_t56 + 4)) + _t51, _t57, _t49);
								_t56 = _t57 +  *(_t58 - 0x38);
							}
							GlobalFree( *(_t58 - 0x30));
						}
						WriteFile( *(_t58 + 8), _t51,  *(_t58 - 0x2c), _t58 - 8, _t47); // executed
						GlobalFree(_t51);
						_t41 = E00402F01(_t49, 0xffffffff,  *(_t58 + 8), _t47, _t47); // executed
						 *(_t58 - 8) = _t41;
					}
					CloseHandle( *(_t58 + 8));
				}
				_t53 = 0xfffffff3;
				if( *(_t58 - 8) < _t47) {
					_t53 = 0xffffffef;
					DeleteFileA( *(_t58 - 0x44));
					 *((intOrPtr*)(_t58 - 4)) = 1;
				}
				_push(_t53);
				E00401423();
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t58 - 4));
				return 0;
			}

0x0040266e
0x00402670
0x0040267c
0x0040267f
0x00402689
0x0040268d
0x0040268d
0x00402693
0x004026a0
0x004026a8
0x004026ab
0x004026b1
0x004026bf
0x004026c2
0x004026c4
0x004026c8
0x004026cb
0x004026d4
0x004026de
0x004026e0
0x004026e4
0x004026e7
0x004026f1
0x00402710
0x004026f8
0x004026fd
0x00402705
0x00402708
0x0040270d
0x0040270d
0x00402717
0x00402717
0x00402729
0x00402730
0x0040273d
0x00402742
0x00402742
0x00402748
0x00402748
0x00402753
0x00402754
0x00402758
0x0040275c
0x00402762
0x00402762
0x00402769
0x00402156
0x00402880
0x0040288c

APIs

GlobalAlloc.KERNELBASE(00000040,0000EC00,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 004026C2
GlobalAlloc.KERNELBASE(00000040,?,00000000,?,?,?,?,000000F0), ref: 004026DE
GlobalFree.KERNEL32 ref: 00402717
WriteFile.KERNELBASE(FFFFFD66,00000000,?,FFFFFD66,?,?,?,?,000000F0), ref: 00402729
GlobalFree.KERNEL32 ref: 00402730
CloseHandle.KERNEL32(FFFFFD66,?,?,000000F0), ref: 00402748
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 0040275C

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 01d91263ba83b25269ede6583eece52eebfcfd0e04a568e1b6f685c74a59530f
Instruction ID: 58ac39daff3b3af5160a623fe7db0da70309dad8486b29df09f94c3f90b2a703
Opcode Fuzzy Hash: 01d91263ba83b25269ede6583eece52eebfcfd0e04a568e1b6f685c74a59530f
Instruction Fuzzy Hash: 02319F71C00128BBDF116FA5CD89D9F7E79EF09324F10422AF914762E0C7795D419BA8

Uniqueness

Uniqueness Score: -1.00%

Function 004022F5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E004022F5(void* __eax) {
				void* _t15;
				char* _t18;
				int _t19;
				long _t22;
				char _t24;
				int _t27;
				signed int _t30;
				intOrPtr _t35;
				void* _t37;

				_t15 = E00402ADD(__eax);
				_t35 =  *((intOrPtr*)(_t37 - 0x14));
				 *(_t37 - 0x30) =  *(_t37 - 0x10);
				 *(_t37 - 0x44) = E004029E8(2);
				_t18 = E004029E8(0x11);
				_t30 =  *0x423f50; // 0x0
				_t31 = _t30 | 0x00000002;
				 *(_t37 - 4) = 1;
				_t19 = RegCreateKeyExA(_t15, _t18, _t27, _t27, _t27, _t30 | 0x00000002, _t27, _t37 + 8, _t27); // executed
				if(_t19 == 0) {
					if(_t35 == 1) {
						E004029E8(0x23);
						_t19 = lstrlenA(0x409ba0) + 1;
					}
					if(_t35 == 4) {
						_t24 = E004029CB(3);
						 *0x409ba0 = _t24;
						_t19 = _t35;
					}
					if(_t35 == 3) {
						_t19 = E00402F01(_t31,  *((intOrPtr*)(_t37 - 0x18)), _t27, 0x409ba0, 0xc00);
					}
					_t22 = RegSetValueExA( *(_t37 + 8),  *(_t37 - 0x44), _t27,  *(_t37 - 0x30), 0x409ba0, _t19); // executed
					if(_t22 == 0) {
						 *(_t37 - 4) = _t27;
					}
					_push( *(_t37 + 8));
					RegCloseKey();
				}
				 *0x423f28 =  *0x423f28 +  *(_t37 - 4);
				return 0;
			}

0x004022f6
0x004022fb
0x00402305
0x0040230f
0x00402312
0x0040231c
0x00402322
0x0040232c
0x00402333
0x0040233b
0x00402349
0x0040234d
0x00402358
0x00402358
0x0040235c
0x00402360
0x00402366
0x0040236b
0x0040236b
0x0040236f
0x0040237b
0x0040237b
0x0040238c
0x00402394
0x00402396
0x00402396
0x00402399
0x0040246f
0x0040246f
0x00402880
0x0040288c

APIs

RegCreateKeyExA.KERNELBASE(00000000,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402333
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsk44DC.tmp,00000023,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402353
RegSetValueExA.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsk44DC.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040238C
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsk44DC.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040246F

Strings

C:\Users\user\AppData\Local\Temp\nsk44DC.tmp, xrefs: 00402344, 00402352, 00402366, 00402376, 00402381

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp
API String ID: 1356686001-1347493538
Opcode ID: 95c2ae9105e599d9cc67a29b8d66256b039c8cc677bb4f053509ac9641bfb6b9
Instruction ID: 570de5e9f7c2b936ec187b605987d340e06286bd869a5e38a77a3de7bd58c22b
Opcode Fuzzy Hash: 95c2ae9105e599d9cc67a29b8d66256b039c8cc677bb4f053509ac9641bfb6b9
Instruction Fuzzy Hash: 451160B1E00108BFEB10ABA1DE4AEAF7678EB00758F10443AF505B61D1D7B99D019A68

Uniqueness

Uniqueness Score: -1.00%

Function 00401F51 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E00401F51(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t18;
				struct HINSTANCE__* _t25;
				void* _t26;
				struct HINSTANCE__* _t29;
				CHAR* _t31;
				intOrPtr* _t32;
				void* _t33;

				_t26 = __ebx;
				asm("sbb eax, 0x423f58");
				 *(_t33 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L14:
					E00401423();
					L15:
					 *0x423f28 =  *0x423f28 +  *(_t33 - 4);
					return 0;
				}
				_t31 = E004029E8(0xfffffff0);
				 *(_t33 + 8) = E004029E8(1);
				if( *((intOrPtr*)(_t33 - 0x14)) == __ebx) {
					L3:
					_t18 = LoadLibraryExA(_t31, _t26, 8); // executed
					_t29 = _t18;
					if(_t29 == _t26) {
						_push(0xfffffff6);
						goto L14;
					}
					L4:
					_t32 = GetProcAddress(_t29,  *(_t33 + 8));
					if(_t32 == _t26) {
						E00404DE1(0xfffffff7,  *(_t33 + 8));
					} else {
						 *(_t33 - 4) = _t26;
						if( *((intOrPtr*)(_t33 - 0x1c)) == _t26) {
							 *_t32( *((intOrPtr*)(_t33 - 0x34)), 0x400, 0x424000, 0x40afa0, " ?B"); // executed
						} else {
							E00401423( *((intOrPtr*)(_t33 - 0x1c)));
							if( *_t32() != 0) {
								 *(_t33 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t33 - 0x18)) == _t26) {
						FreeLibrary(_t29); // executed
					}
					goto L15;
				}
				_t25 = GetModuleHandleA(_t31); // executed
				_t29 = _t25;
				if(_t29 != __ebx) {
					goto L4;
				}
				goto L3;
			}

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 00401F7C

Part of subcall function 00404DE1: lstrlenA.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E1A
Part of subcall function 00404DE1: lstrlenA.KERNEL32(00402C3C,Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E2A
Part of subcall function 00404DE1: lstrcatA.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\,00402C3C,00402C3C,Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\,00000000,00000000,00000000), ref: 00404E3D
Part of subcall function 00404DE1: SetWindowTextA.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\), ref: 00404E4F
Part of subcall function 00404DE1: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E75
Part of subcall function 00404DE1: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E8F
Part of subcall function 00404DE1: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E9D

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00401F8C
GetProcAddress.KERNEL32(00000000,?), ref: 00401F9C
FreeLibrary.KERNELBASE(00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00401FF9

Strings

?B, xrefs: 00401FC7

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID: ?B
API String ID: 2987980305-117478770
Opcode ID: a4b8c875026ca67131aaa614e06409f5c955715589a1c91564e449afa2a72309
Instruction ID: be6dc4b3cdaf7f9b98e7fdb42c2a9d2cba13b94bfdb64dea6ad1c22ab91f0007
Opcode Fuzzy Hash: a4b8c875026ca67131aaa614e06409f5c955715589a1c91564e449afa2a72309
Instruction Fuzzy Hash: BA11D572D04216EBCF107FA4DE89EAE76B0AB44359F204237F611B62E0C77C89419A5E

Uniqueness

Uniqueness Score: -1.00%

Function 004015B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E004015B3(struct _SECURITY_ATTRIBUTES* __ebx) {
				struct _SECURITY_ATTRIBUTES** _t10;
				int _t19;
				struct _SECURITY_ATTRIBUTES* _t20;
				signed char _t22;
				struct _SECURITY_ATTRIBUTES* _t23;
				CHAR* _t25;
				struct _SECURITY_ATTRIBUTES** _t29;
				void* _t30;

				_t23 = __ebx;
				_t25 = E004029E8(0xfffffff0);
				_t10 = E004055CA(_t25);
				_t27 = _t10;
				if(_t10 != __ebx) {
					do {
						_t29 = E00405561(_t27, 0x5c);
						 *_t29 = _t23;
						 *((char*)(_t30 + 0xb)) =  *_t29;
						_t19 = CreateDirectoryA(_t25, _t23); // executed
						if(_t19 == 0) {
							if(GetLastError() != 0xb7) {
								L4:
								 *((intOrPtr*)(_t30 - 4)) =  *((intOrPtr*)(_t30 - 4)) + 1;
							} else {
								_t22 = GetFileAttributesA(_t25); // executed
								if((_t22 & 0x00000010) == 0) {
									goto L4;
								}
							}
						}
						_t20 =  *((intOrPtr*)(_t30 + 0xb));
						 *_t29 = _t20;
						_t27 =  &(_t29[0]);
					} while (_t20 != _t23);
				}
				if( *((intOrPtr*)(_t30 - 0x20)) == _t23) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E00405A43("C:\\Program Files\\StarWarsGalaxies\\Mods\\ModSource UI Addon Pack\\Icons", _t25);
					SetCurrentDirectoryA(_t25); // executed
				}
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t30 - 4));
				return 0;
			}

APIs

Part of subcall function 004055CA: CharNextA.USER32(|S@,?,C:\,00000000,0040562E,C:\,C:\,?,?,7476F560,0040537C,?,"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe",7476F560), ref: 004055D8
Part of subcall function 004055CA: CharNextA.USER32(00000000), ref: 004055DD
Part of subcall function 004055CA: CharNextA.USER32(00000000), ref: 004055EC

CreateDirectoryA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015DB
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015E5
GetFileAttributesA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015F3
SetCurrentDirectoryA.KERNELBASE(00000000,C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Icons,00000000,00000000,000000F0), ref: 00401622

Strings

C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Icons, xrefs: 00401617

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Icons
API String ID: 3751793516-509314220
Opcode ID: 10f9c5279c919932a1ffd546a592a207e990aad626af8b9db9cceba0019483d4
Instruction ID: 500e971df782f7e0228770013ad7a8f0c6fc77df75080e4b1de2a425256b3434
Opcode Fuzzy Hash: 10f9c5279c919932a1ffd546a592a207e990aad626af8b9db9cceba0019483d4
Instruction Fuzzy Hash: 81010431908150ABDB116FB55D44D7F6BB0EA56365728063BF491B22E2C63C8942D62E

Uniqueness

Uniqueness Score: -1.00%

Function 00405749 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405749(char _a4, intOrPtr _a6, CHAR* _a8) {
				signed int _t11;
				int _t14;
				signed int _t16;
				void* _t19;
				CHAR* _t20;

				_t20 = _a4;
				_t19 = 0x64;
				while(1) {
					_t19 = _t19 - 1;
					_a4 = 0x61736e;
					_t11 = GetTickCount();
					_t16 = 0x1a;
					_a6 = _a6 + _t11 % _t16;
					_t14 = GetTempFileNameA(_a8,  &_a4, 0, _t20); // executed
					if(_t14 != 0) {
						break;
					}
					if(_t19 != 0) {
						continue;
					}
					 *_t20 =  *_t20 & 0x00000000;
					return _t14;
				}
				return _t20;
			}

APIs

GetTickCount.KERNEL32 ref: 0040575C
GetTempFileNameA.KERNELBASE(?,0061736E,00000000,?), ref: 00405776

Strings

"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe", xrefs: 00405750
C:\Users\user\AppData\Local\Temp\, xrefs: 00405749, 0040574C
nsa, xrefs: 00405755

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1167266972
Opcode ID: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction ID: 034d2fd5f9dd90bdc64dfe9fa05123f4a2a2f766a0f29b75e345e617da869bcc
Opcode Fuzzy Hash: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction Fuzzy Hash: 9CF0A736348204BADB104F55DC04B9B7F59DF91750F14C027FE449B1C0D6B1995897A5

Uniqueness

Uniqueness Score: -1.00%

Function 00402012 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 134
comCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00402012() {
				void* _t44;
				intOrPtr* _t48;
				intOrPtr* _t50;
				intOrPtr* _t52;
				intOrPtr* _t54;
				signed int _t58;
				intOrPtr* _t59;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t69;
				intOrPtr* _t71;
				int _t75;
				signed int _t81;
				intOrPtr* _t88;
				void* _t95;
				void* _t96;
				void* _t100;

				 *(_t100 - 0x30) = E004029E8(0xfffffff0);
				_t96 = E004029E8(0xffffffdf);
				 *((intOrPtr*)(_t100 - 0x2c)) = E004029E8(2);
				 *((intOrPtr*)(_t100 - 8)) = E004029E8(0xffffffcd);
				 *((intOrPtr*)(_t100 - 0x44)) = E004029E8(0x45);
				if(E004055A3(_t96) == 0) {
					E004029E8(0x21);
				}
				_t44 = _t100 + 8;
				__imp__CoCreateInstance(0x407384, _t75, 1, 0x407374, _t44); // executed
				if(_t44 < _t75) {
					L13:
					 *((intOrPtr*)(_t100 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t48 =  *((intOrPtr*)(_t100 + 8));
					_t95 =  *((intOrPtr*)( *_t48))(_t48, 0x407394, _t100 - 0x34);
					if(_t95 >= _t75) {
						_t52 =  *((intOrPtr*)(_t100 + 8));
						_t95 =  *((intOrPtr*)( *_t52 + 0x50))(_t52, _t96);
						_t54 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t54 + 0x24))(_t54, "C:\\Program Files\\StarWarsGalaxies\\Mods\\ModSource UI Addon Pack\\Icons");
						_t81 =  *(_t100 - 0x14);
						_t58 = _t81 >> 0x00000008 & 0x000000ff;
						if(_t58 != 0) {
							_t88 =  *((intOrPtr*)(_t100 + 8));
							 *((intOrPtr*)( *_t88 + 0x3c))(_t88, _t58);
							_t81 =  *(_t100 - 0x14);
						}
						_t59 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t59 + 0x34))(_t59, _t81 >> 0x10);
						if( *((intOrPtr*)( *((intOrPtr*)(_t100 - 8)))) != _t75) {
							_t71 =  *((intOrPtr*)(_t100 + 8));
							 *((intOrPtr*)( *_t71 + 0x44))(_t71,  *((intOrPtr*)(_t100 - 8)),  *(_t100 - 0x14) & 0x000000ff);
						}
						_t62 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t62 + 0x2c))(_t62,  *((intOrPtr*)(_t100 - 0x2c)));
						_t64 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t64 + 0x1c))(_t64,  *((intOrPtr*)(_t100 - 0x44)));
						if(_t95 >= _t75) {
							_t95 = 0x80004005;
							if(MultiByteToWideChar(_t75, _t75,  *(_t100 - 0x30), 0xffffffff, 0x40a7a0, 0x400) != 0) {
								_t69 =  *((intOrPtr*)(_t100 - 0x34));
								_t95 =  *((intOrPtr*)( *_t69 + 0x18))(_t69, 0x40a7a0, 1);
							}
						}
						_t66 =  *((intOrPtr*)(_t100 - 0x34));
						 *((intOrPtr*)( *_t66 + 8))(_t66);
					}
					_t50 =  *((intOrPtr*)(_t100 + 8));
					 *((intOrPtr*)( *_t50 + 8))(_t50);
					if(_t95 >= _t75) {
						_push(0xfffffff4);
					} else {
						goto L13;
					}
				}
				E00401423();
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t100 - 4));
				return 0;
			}

APIs

CoCreateInstance.OLE32(00407384,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402065
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ModSource UI Addon Pack\Pre-NGE UI Changelog.lnk,00000400,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040211F

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ModSource UI Addon Pack\Pre-NGE UI Changelog.lnk, xrefs: 00402108, 00402112, 0040212E
C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Icons, xrefs: 0040209D

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Icons$C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ModSource UI Addon Pack\Pre-NGE UI Changelog.lnk
API String ID: 123533781-324498092
Opcode ID: b786e3c29dd18596d9353b868a83ebb5ef22388cd9c25f6985db35e6dbed46c5
Instruction ID: f80ce63f98a2f882e3be49352075ba1f2772856d238ef38af8f522e875768035
Opcode Fuzzy Hash: b786e3c29dd18596d9353b868a83ebb5ef22388cd9c25f6985db35e6dbed46c5
Instruction Fuzzy Hash: 70416FB5A00104AFDB00DFA4CD89E9E7BB9AF49314B20456AF905EB2D1CA79DD41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004045CE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E004045CE(int _a4, intOrPtr _a8, unsigned int _a12) {
				char _v36;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t26;
				int _t29;
				void* _t34;
				signed int _t36;
				signed int _t39;
				unsigned int _t46;

				_t46 = _a12;
				_push(0x14);
				_pop(0);
				_t34 = 0xffffffdc;
				if(_t46 < 0x100000) {
					_push(0xa);
					_pop(0);
					_t34 = 0xffffffdd;
				}
				if(_t46 < 0x400) {
					_t34 = 0xffffffde;
				}
				if(_t46 < 0xffff3333) {
					_t39 = 0x14;
					asm("cdq");
					_t46 = _t46 + 1 / _t39;
				}
				_push(E00405A65(_t34, 0, _t46,  &_v36, 0xffffffdf));
				_push(E00405A65(_t34, 0, _t46,  &_v68, _t34));
				_t21 = _t46 & 0x00ffffff;
				_t36 = 0xa;
				_push(((_t46 & 0x00ffffff) + _t21 * 4 + (_t46 & 0x00ffffff) + _t21 * 4 >> 0) % _t36);
				_push(_t46 >> 0);
				_t26 = E00405A65(_t34, 0, 0x420498, 0x420498, _a8);
				wsprintfA(_t26 + lstrlenA(0x420498), "%u.%u%s%s");
				_t29 = SetDlgItemTextA( *0x423678, _a4, 0x420498); // executed
				return _t29;
			}

APIs

lstrlenA.KERNEL32(00420498,00420498,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004044EE,000000DF,?,00000000,00000400), ref: 0040465C
wsprintfA.USER32 ref: 00404664
SetDlgItemTextA.USER32 ref: 00404677

Strings

%u.%u%s%s, xrefs: 00404646

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: b76db3de5ac4007368b1056f8f00fa267d4d38fe8ac49ed54a6ee2725831d9a2
Instruction ID: e1c4b7cd7fdf2ea5a1eba5c76152afdebbc6d0a4a91a7d78ea48e7aa8668d99a
Opcode Fuzzy Hash: b76db3de5ac4007368b1056f8f00fa267d4d38fe8ac49ed54a6ee2725831d9a2
Instruction Fuzzy Hash: DB110473B001243BDB10A66D9C46EAF329DDBC6334F14423BF625F61D1E9788D1186A9

Uniqueness

Uniqueness Score: -1.00%

Function 00401BAD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00401BAD() {
				signed int _t28;
				CHAR* _t31;
				long _t32;
				int _t37;
				signed int _t38;
				int _t42;
				int _t48;
				struct HWND__* _t52;
				void* _t55;

				 *(_t55 - 0x34) = E004029CB(3);
				 *(_t55 + 8) = E004029CB(4);
				if(( *(_t55 - 0x10) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 0x34)) = E004029E8(0x33);
				}
				__eflags =  *(_t55 - 0x10) & 0x00000002;
				if(( *(_t55 - 0x10) & 0x00000002) != 0) {
					 *(_t55 + 8) = E004029E8(0x44);
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x28)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t50 = E004029E8();
					_t28 = E004029E8();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t31 =  ~( *_t27) & _t50;
					__eflags = _t31;
					_t32 = FindWindowExA( *(_t55 - 0x34),  *(_t55 + 8), _t31,  ~( *_t28) & _t28); // executed
					goto L10;
				} else {
					_t52 = E004029CB();
					_t37 = E004029CB();
					_t48 =  *(_t55 - 0x10) >> 2;
					if(__eflags == 0) {
						_t32 = SendMessageA(_t52, _t37,  *(_t55 - 0x34),  *(_t55 + 8)); // executed
						L10:
						 *(_t55 - 8) = _t32;
					} else {
						_t38 = SendMessageTimeoutA(_t52, _t37,  *(_t55 - 0x34),  *(_t55 + 8), _t42, _t48, _t55 - 8);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t55 - 4)) =  ~_t38 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x24)) - _t42;
				if( *((intOrPtr*)(_t55 - 0x24)) >= _t42) {
					_push( *(_t55 - 8));
					E004059A1();
				}
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t55 - 4));
				return 0;
			}

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C0D
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C25

Strings

!, xrefs: 00401BE1

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 334588288cfdb17ff4757290809a1857d889fbbcabb1089515c2e64beeb01a29
Instruction ID: c520659e647c29be31daea63823ecf32d675036654070bdfdaec67237a792274
Opcode Fuzzy Hash: 334588288cfdb17ff4757290809a1857d889fbbcabb1089515c2e64beeb01a29
Instruction Fuzzy Hash: 902183B1A44104BEDF01AFB5CE5BAAD7A75EF45704F14047AF501B61D1D6B88940D728

Uniqueness

Uniqueness Score: -1.00%

Function 00404D31 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404D31(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				long _t13;
				long _t22;

				if(_a8 != 0x102) {
					if(_a8 != 0x200) {
						_t22 = _a16;
						L7:
						if(_a8 == 0x419 &&  *0x420480 != _t22) {
							 *0x420480 = _t22;
							E00405A43(0x420498, 0x424000);
							E004059A1(0x424000, _t22);
							E0040140B(6);
							E00405A43(0x424000, 0x420498);
						}
						L11:
						_t13 = CallWindowProcA( *0x420488, _a4, _a8, _a12, _t22); // executed
						return _t13;
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t22 = _a16;
						goto L11;
					}
					_t22 = E004046B0(_a4, 1);
					_a8 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E00403E83(0x413);
				return 0;
			}

0x00404d3d
0x00404d62
0x00404d82
0x00404d85
0x00404d88
0x00404d9f
0x00404da5
0x00404dac
0x00404db3
0x00404dba
0x00404dbf
0x00404dc5
0x00404dd5
0x00000000
0x00404dd5
0x00404d6f
0x00404dc2
0x00404dc2
0x00000000
0x00404dc2
0x00404d7b
0x00404d7d
0x00000000
0x00404d7d
0x00404d43
0x00000000
0x00000000
0x00404d4a
0x00000000

APIs

IsWindowVisible.USER32 ref: 00404D67
CallWindowProcA.USER32 ref: 00404DD5

Part of subcall function 00403E83: SendMessageA.USER32(000103FA,00000000,00000000,00000000), ref: 00403E95

Strings

, xrefs: 00404D3F

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 8c6becefd5606e84e0451c9f87a717d996e372184cb3ac391d1570451868ac8e
Instruction ID: 56c63efc0dfeedb1064743d61de07ac132654d46aac9d6c338980dc2e267a17f
Opcode Fuzzy Hash: 8c6becefd5606e84e0451c9f87a717d996e372184cb3ac391d1570451868ac8e
Instruction Fuzzy Hash: 1D116D71600219BBDF21AF51EC40A9B3A69AF84365F40853BFB04651A1C7788D919FA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405617 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00405617(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				long _t16;
				intOrPtr _t18;
				intOrPtr* _t21;
				void* _t22;

				E00405A43(0x4218a0, _a4);
				_t21 = E004055CA(0x4218a0);
				if(_t21 != 0) {
					E00405CA1(_t21);
					if(( *0x423eb8 & 0x00000080) == 0) {
						L5:
						_t22 = _t21 - 0x4218a0;
						while(1) {
							_t11 = lstrlenA(0x4218a0);
							_push(0x4218a0);
							if(_t11 <= _t22) {
								break;
							}
							_t12 = E00405D3A();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E0040557D(0x4218a0);
								continue;
							} else {
								goto L1;
							}
						}
						E00405536();
						_t16 = GetFileAttributesA(??); // executed
						return 0 | _t16 != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}

APIs

Part of subcall function 00405A43: lstrcpynA.KERNEL32(?,?,00000400,00403293,ModSource UI Addon Pack Setup,NSIS Error), ref: 00405A50

Part of subcall function 004055CA: CharNextA.USER32(|S@,?,C:\,00000000,0040562E,C:\,C:\,?,?,7476F560,0040537C,?,"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe",7476F560), ref: 004055D8
Part of subcall function 004055CA: CharNextA.USER32(00000000), ref: 004055DD
Part of subcall function 004055CA: CharNextA.USER32(00000000), ref: 004055EC

lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,?,?,7476F560,0040537C,?,"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe",7476F560), ref: 0040566A
GetFileAttributesA.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,?,?,7476F560,0040537C,?,"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe",7476F560), ref: 0040567A

Strings

C:\, xrefs: 0040561D, 00405622, 00405628, 00405663, 00405669, 00405671, 00405679

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\
API String ID: 3248276644-3404278061
Opcode ID: 092cd18329d5dfc6f9a71267f0953547a198154f688d0c3f002119218c3bba5f
Instruction ID: 88644df969cb8f40c77f35f2ca7db10f6ec49a52a40565d12c5c53c9f11e70c6
Opcode Fuzzy Hash: 092cd18329d5dfc6f9a71267f0953547a198154f688d0c3f002119218c3bba5f
Instruction Fuzzy Hash: 64F0F921205D5026C72232351C49AAF0A55CE6232879D0E3FF858B12D1CA3D8943DC6D

Uniqueness

Uniqueness Score: -1.00%

Function 004024B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
filestringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004024B0(struct _OVERLAPPED* __ebx, intOrPtr* __esi) {
				int _t5;
				long _t7;
				struct _OVERLAPPED* _t11;
				intOrPtr* _t15;
				void* _t17;
				int _t21;

				_t15 = __esi;
				_t11 = __ebx;
				if( *((intOrPtr*)(_t17 - 0x1c)) == __ebx) {
					_t7 = lstrlenA(E004029E8(0x11));
				} else {
					E004029CB(1);
					 *0x4097a0 = __al;
				}
				if( *_t15 == _t11) {
					L8:
					 *((intOrPtr*)(_t17 - 4)) = 1;
				} else {
					_t5 = WriteFile(E004059BA(_t17 + 8, _t15), "C:\Users\jones\AppData\Local\Temp\nsk44DC.tmp\System.dll", _t7, _t17 + 8, _t11); // executed
					_t21 = _t5;
					if(_t21 == 0) {
						goto L8;
					}
				}
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t17 - 4));
				return 0;
			}

APIs

lstrlenA.KERNEL32(00000000,00000011), ref: 004024CE
WriteFile.KERNELBASE(00000000,?,C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\System.dll,00000000,?,?,00000000,00000011), ref: 004024ED

Strings

C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\System.dll, xrefs: 004024BC, 004024E1

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: FileWritelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\System.dll
API String ID: 427699356-912613276
Opcode ID: a594ed5f0b7fed9ccbc7fe1ed5f363682f1313584c5faf437150312620cb1c8e
Instruction ID: 7b13497face05bac1b2fff9ac546fbc2a554cc17bcd567d78a6b34cf9aafac8e
Opcode Fuzzy Hash: a594ed5f0b7fed9ccbc7fe1ed5f363682f1313584c5faf437150312620cb1c8e
Instruction Fuzzy Hash: 27F0E9B2A14240FFD700EFE19E49AAB3668DB41305F10483BB142F60C2D6BD89418B2D

Uniqueness

Uniqueness Score: -1.00%

Function 004031F1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E004031F1(void* __eflags) {
				void* _t2;
				void* _t5;
				CHAR* _t6;

				_t6 = "C:\\Users\\jones\\AppData\\Local\\Temp\\";
				E00405CA1(_t6);
				_t2 = E004055A3(_t6);
				if(_t2 != 0) {
					E00405536(_t6);
					CreateDirectoryA(_t6, 0); // executed
					_t5 = E00405749("1033", _t6); // executed
					return _t5;
				} else {
					return _t2;
				}
			}

0x004031f2
0x004031f8
0x004031fe
0x00403205
0x0040320a
0x00403212
0x0040321e
0x00403224
0x00403208
0x00403208
0x00403208

APIs

Part of subcall function 00405CA1: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe",C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405CF9
Part of subcall function 00405CA1: CharNextA.USER32(?,?,?,00000000), ref: 00405D06
Part of subcall function 00405CA1: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe",C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D0B
Part of subcall function 00405CA1: CharPrevA.USER32(?,?,"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe",C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D1B

CreateDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00403212

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004031F2, 004031F7, 004031FD, 00403209, 00403211, 00403218
1033, xrefs: 00403219

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-517883005
Opcode ID: 6d9c69d8dece2bddb05ca95613e1d6fe124b38e8b49121791a09e34daebbdd31
Instruction ID: 8509fc719cfacdd3e0f19311c8db3474c91ee7b64774067ccbe91e129429c82f
Opcode Fuzzy Hash: 6d9c69d8dece2bddb05ca95613e1d6fe124b38e8b49121791a09e34daebbdd31
Instruction Fuzzy Hash: 75D0A92160AD3036CA613B273C0AFCF090C8F0232DF2500BBF804B00C68B6C5A8218EF

Uniqueness

Uniqueness Score: -1.00%

Function 0040643F Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E0040643F() {
				signed int _t530;
				void _t537;
				signed int _t538;
				signed int _t539;
				unsigned short _t569;
				signed int _t579;
				signed int _t607;
				void* _t627;
				signed int _t628;
				signed int _t635;
				signed int* _t643;
				void* _t644;

				L0:
				while(1) {
					L0:
					_t530 =  *(_t644 - 0x30);
					if(_t530 >= 4) {
					}
					 *(_t644 - 0x40) = 6;
					 *(_t644 - 0x7c) = 0x19;
					 *((intOrPtr*)(_t644 - 0x58)) = (_t530 << 7) +  *(_t644 - 4) + 0x360;
					while(1) {
						L145:
						 *(_t644 - 0x50) = 1;
						 *(_t644 - 0x48) =  *(_t644 - 0x40);
						while(1) {
							L149:
							if( *(_t644 - 0x48) <= 0) {
								goto L155;
							}
							L150:
							_t627 =  *(_t644 - 0x50) +  *(_t644 - 0x50);
							_t643 = _t627 +  *((intOrPtr*)(_t644 - 0x58));
							 *(_t644 - 0x54) = _t643;
							_t569 =  *_t643;
							_t635 = _t569 & 0x0000ffff;
							_t607 = ( *(_t644 - 0x10) >> 0xb) * _t635;
							if( *(_t644 - 0xc) >= _t607) {
								 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t607;
								 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t607;
								_t628 = _t627 + 1;
								 *_t643 = _t569 - (_t569 >> 5);
								 *(_t644 - 0x50) = _t628;
							} else {
								 *(_t644 - 0x10) = _t607;
								 *(_t644 - 0x50) =  *(_t644 - 0x50) << 1;
								 *_t643 = (0x800 - _t635 >> 5) + _t569;
							}
							if( *(_t644 - 0x10) >= 0x1000000) {
								L148:
								_t487 = _t644 - 0x48;
								 *_t487 =  *(_t644 - 0x48) - 1;
								L149:
								if( *(_t644 - 0x48) <= 0) {
									goto L155;
								}
								goto L150;
							} else {
								L154:
								L146:
								if( *(_t644 - 0x6c) == 0) {
									L169:
									 *(_t644 - 0x88) = 0x18;
									L170:
									_t579 = 0x22;
									memcpy( *(_t644 - 0x90), _t644 - 0x88, _t579 << 2);
									_t539 = 0;
									L172:
									return _t539;
								}
								L147:
								 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
								 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
								_t484 = _t644 - 0x70;
								 *_t484 =  &(( *(_t644 - 0x70))[1]);
								 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
								goto L148;
							}
							L155:
							_t537 =  *(_t644 - 0x7c);
							 *((intOrPtr*)(_t644 - 0x44)) =  *(_t644 - 0x50) - (1 <<  *(_t644 - 0x40));
							while(1) {
								L140:
								 *(_t644 - 0x88) = _t537;
								while(1) {
									L1:
									_t538 =  *(_t644 - 0x88);
									if(_t538 > 0x1c) {
										break;
									}
									L2:
									switch( *((intOrPtr*)(_t538 * 4 +  &M004068AD))) {
										case 0:
											L3:
											if( *(_t644 - 0x6c) == 0) {
												goto L170;
											}
											L4:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t538 =  *( *(_t644 - 0x70));
											if(_t538 > 0xe1) {
												goto L171;
											}
											L5:
											_t542 = _t538 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t581);
											_push(9);
											_pop(_t582);
											_t638 = _t542 / _t581;
											_t544 = _t542 % _t581 & 0x000000ff;
											asm("cdq");
											_t633 = _t544 % _t582 & 0x000000ff;
											 *(_t644 - 0x3c) = _t633;
											 *(_t644 - 0x1c) = (1 << _t638) - 1;
											 *((intOrPtr*)(_t644 - 0x18)) = (1 << _t544 / _t582) - 1;
											_t641 = (0x300 << _t633 + _t638) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t644 - 0x78))) {
												L10:
												if(_t641 == 0) {
													L12:
													 *(_t644 - 0x48) =  *(_t644 - 0x48) & 0x00000000;
													 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t641 = _t641 - 1;
													 *((short*)( *(_t644 - 4) + _t641 * 2)) = 0x400;
												} while (_t641 != 0);
												goto L12;
											}
											L6:
											if( *(_t644 - 4) != 0) {
												GlobalFree( *(_t644 - 4));
											}
											_t538 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t644 - 4) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t644 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L157:
												 *(_t644 - 0x88) = 1;
												goto L170;
											}
											L14:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x40) =  *(_t644 - 0x40) | ( *( *(_t644 - 0x70)) & 0x000000ff) <<  *(_t644 - 0x48) << 0x00000003;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t45 = _t644 - 0x48;
											 *_t45 =  *(_t644 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t644 - 0x48) < 4) {
												goto L13;
											}
											L16:
											_t550 =  *(_t644 - 0x40);
											if(_t550 ==  *(_t644 - 0x74)) {
												L20:
												 *(_t644 - 0x48) = 5;
												 *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) =  *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											L17:
											 *(_t644 - 0x74) = _t550;
											if( *(_t644 - 8) != 0) {
												GlobalFree( *(_t644 - 8));
											}
											_t538 = GlobalAlloc(0x40,  *(_t644 - 0x40)); // executed
											 *(_t644 - 8) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t557 =  *(_t644 - 0x60) &  *(_t644 - 0x1c);
											 *(_t644 - 0x84) = 6;
											 *(_t644 - 0x4c) = _t557;
											_t642 =  *(_t644 - 4) + (( *(_t644 - 0x38) << 4) + _t557) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L158:
												 *(_t644 - 0x88) = 3;
												goto L170;
											}
											L22:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											_t67 = _t644 - 0x70;
											 *_t67 =  &(( *(_t644 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L23:
											 *(_t644 - 0x48) =  *(_t644 - 0x48) - 1;
											if( *(_t644 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t559 =  *_t642;
											_t626 = _t559 & 0x0000ffff;
											_t596 = ( *(_t644 - 0x10) >> 0xb) * _t626;
											if( *(_t644 - 0xc) >= _t596) {
												 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t596;
												 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t596;
												 *(_t644 - 0x40) = 1;
												_t560 = _t559 - (_t559 >> 5);
												__eflags = _t560;
												 *_t642 = _t560;
											} else {
												 *(_t644 - 0x10) = _t596;
												 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
												 *_t642 = (0x800 - _t626 >> 5) + _t559;
											}
											if( *(_t644 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t644 - 0x6c) == 0) {
												L168:
												 *(_t644 - 0x88) = 5;
												goto L170;
											}
											L138:
											 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L139:
											_t537 =  *(_t644 - 0x84);
											L140:
											 *(_t644 - 0x88) = _t537;
											goto L1;
										case 6:
											L25:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L36:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L26:
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												L35:
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												L32:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											L66:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												L68:
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											L67:
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											L70:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											L73:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											L74:
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											L75:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											L82:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L84:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L83:
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											L85:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L164:
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											L100:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L159:
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											L38:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											L40:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												L45:
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L160:
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											L47:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												L49:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													L53:
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L161:
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											L59:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												L65:
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L165:
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											L110:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											goto L132;
										case 0x12:
											L128:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L131:
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												L132:
												 *(_t644 - 0x54) = _t642;
												goto L133;
											}
											L129:
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											L141:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L143:
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *((intOrPtr*)(__ebp - 0x7c)) = 0x14;
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
											L142:
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											L156:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											while(1) {
												L140:
												 *(_t644 - 0x88) = _t537;
												goto L1;
											}
										case 0x15:
											L91:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											goto L0;
										case 0x17:
											while(1) {
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
										case 0x18:
											goto L146;
										case 0x19:
											L94:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												L98:
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													L166:
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												L121:
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												L122:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											L95:
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												L97:
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													L107:
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														L118:
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													L113:
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														L117:
														goto L109;
													}
												}
												L103:
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													L106:
													goto L99;
												}
											}
											L96:
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L162:
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											L57:
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L163:
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											L77:
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												L124:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L127:
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											L167:
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t539 = _t538 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2ec5e691eefeb7895a1ac387bd927eff239bfafd377499becc957e94103ad58
Instruction ID: 46f5cb6b99077c8a932221f6f95319a4d003604abf7c8fe4deea8dd62122f91f
Opcode Fuzzy Hash: e2ec5e691eefeb7895a1ac387bd927eff239bfafd377499becc957e94103ad58
Instruction Fuzzy Hash: 1EA13371D00229CBEF28CFA8C8547ADBBB1FF44309F15856AD816BB281D7785A86DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406640 Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406640() {
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int* _t605;
				void* _t612;

				L0:
				while(1) {
					L0:
					if( *(_t612 - 0x40) != 0) {
						 *(_t612 - 0x84) = 0x13;
						_t605 =  *((intOrPtr*)(_t612 - 0x58)) + 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x4c);
						 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
						__ecx =  *(__ebp - 0x58);
						__eax =  *(__ebp - 0x4c) << 4;
						__eax =  *(__ebp - 0x58) + __eax + 4;
						L130:
						 *(__ebp - 0x58) = __eax;
						 *(__ebp - 0x40) = 3;
						L144:
						 *(__ebp - 0x7c) = 0x14;
						L145:
						__eax =  *(__ebp - 0x40);
						 *(__ebp - 0x50) = 1;
						 *(__ebp - 0x48) =  *(__ebp - 0x40);
						L149:
						if( *(__ebp - 0x48) <= 0) {
							__ecx =  *(__ebp - 0x40);
							__ebx =  *(__ebp - 0x50);
							0 = 1;
							__eax = 1 << __cl;
							__ebx =  *(__ebp - 0x50) - (1 << __cl);
							__eax =  *(__ebp - 0x7c);
							 *(__ebp - 0x44) = __ebx;
							while(1) {
								L140:
								 *(_t612 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t612 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M004068AD))) {
										case 0:
											if( *(_t612 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t534 =  *( *(_t612 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t569);
											_push(9);
											_pop(_t570);
											_t608 = _t538 / _t569;
											_t540 = _t538 % _t569 & 0x000000ff;
											asm("cdq");
											_t603 = _t540 % _t570 & 0x000000ff;
											 *(_t612 - 0x3c) = _t603;
											 *(_t612 - 0x1c) = (1 << _t608) - 1;
											 *((intOrPtr*)(_t612 - 0x18)) = (1 << _t540 / _t570) - 1;
											_t611 = (0x300 << _t603 + _t608) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t612 - 0x78))) {
												L10:
												if(_t611 == 0) {
													L12:
													 *(_t612 - 0x48) =  *(_t612 - 0x48) & 0x00000000;
													 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t611 = _t611 - 1;
													 *((short*)( *(_t612 - 4) + _t611 * 2)) = 0x400;
												} while (_t611 != 0);
												goto L12;
											}
											if( *(_t612 - 4) != 0) {
												GlobalFree( *(_t612 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t612 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t612 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 1;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x40) =  *(_t612 - 0x40) | ( *( *(_t612 - 0x70)) & 0x000000ff) <<  *(_t612 - 0x48) << 0x00000003;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t45 = _t612 - 0x48;
											 *_t45 =  *(_t612 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t612 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t612 - 0x40);
											if(_t546 ==  *(_t612 - 0x74)) {
												L20:
												 *(_t612 - 0x48) = 5;
												 *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) =  *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t612 - 0x74) = _t546;
											if( *(_t612 - 8) != 0) {
												GlobalFree( *(_t612 - 8));
											}
											_t534 = GlobalAlloc(0x40,  *(_t612 - 0x40)); // executed
											 *(_t612 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t612 - 0x60) &  *(_t612 - 0x1c);
											 *(_t612 - 0x84) = 6;
											 *(_t612 - 0x4c) = _t553;
											_t605 =  *(_t612 - 4) + (( *(_t612 - 0x38) << 4) + _t553) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 3;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											_t67 = _t612 - 0x70;
											 *_t67 =  &(( *(_t612 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L23:
											 *(_t612 - 0x48) =  *(_t612 - 0x48) - 1;
											if( *(_t612 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t605;
											_t588 = _t531 & 0x0000ffff;
											_t564 = ( *(_t612 - 0x10) >> 0xb) * _t588;
											if( *(_t612 - 0xc) >= _t564) {
												 *(_t612 - 0x10) =  *(_t612 - 0x10) - _t564;
												 *(_t612 - 0xc) =  *(_t612 - 0xc) - _t564;
												 *(_t612 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												__eflags = _t532;
												 *_t605 = _t532;
											} else {
												 *(_t612 - 0x10) = _t564;
												 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
												 *_t605 = (0x800 - _t588 >> 5) + _t531;
											}
											if( *(_t612 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 5;
												goto L170;
											}
											 *(_t612 - 0x10) =  *(_t612 - 0x10) << 8;
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L139:
											_t533 =  *(_t612 - 0x84);
											goto L140;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L100:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t335 = __ebp - 0x70;
											 *_t335 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t335;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L102;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L110:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t366 = __ebp - 0x70;
											 *_t366 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t366;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L112;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											L132:
											 *(_t612 - 0x54) = _t605;
											goto L133;
										case 0x12:
											goto L0;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												goto L144;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											goto L130;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											L140:
											 *(_t612 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L121;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											goto L145;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											goto L149;
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L120:
												_t394 = __ebp - 0x2c;
												 *_t394 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t394;
												L121:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t401 = __ebp - 0x60;
												 *_t401 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t401;
												goto L124;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L103:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L109:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L113:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t392 = __ebp - 0x2c;
														 *_t392 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t392;
														goto L120;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L112:
														_t369 = __ebp - 0x48;
														 *_t369 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t369;
														goto L113;
													} else {
														goto L110;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L102:
													_t339 = __ebp - 0x48;
													 *_t339 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t339;
													goto L103;
												} else {
													goto L100;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L109;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L124:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t415 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t415;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t415;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											L170:
											_push(0x22);
											_pop(_t567);
											memcpy( *(_t612 - 0x90), _t612 - 0x88, _t567 << 2);
											_t535 = 0;
											L172:
											return _t535;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
						__eax =  *(__ebp - 0x50);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
						__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
						__eax =  *(__ebp - 0x58);
						__esi = __edx + __eax;
						 *(__ebp - 0x54) = __esi;
						__ax =  *__esi;
						__edi = __ax & 0x0000ffff;
						__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
						if( *(__ebp - 0xc) >= __ecx) {
							 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
							__cx = __ax;
							__cx = __ax >> 5;
							__eax = __eax - __ecx;
							__edx = __edx + 1;
							 *__esi = __ax;
							 *(__ebp - 0x50) = __edx;
						} else {
							 *(__ebp - 0x10) = __ecx;
							0x800 = 0x800 - __edi;
							0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
							 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
							 *__esi = __cx;
						}
						if( *(__ebp - 0x10) >= 0x1000000) {
							goto L148;
						} else {
							goto L146;
						}
					}
					goto L1;
				}
			}

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec64765bbfe4fe864a44f2a148697461047da27e0e17663b57c602867936ff4
Instruction ID: b6d6ccc853a16e4f483ba8b04077c6698ffe39116f32d6ac079e48ce0b9a1d5b
Opcode Fuzzy Hash: 0ec64765bbfe4fe864a44f2a148697461047da27e0e17663b57c602867936ff4
Instruction Fuzzy Hash: 9C912071D00229CBEF28CF98C844BADBBB1FF44305F15816AD816BB291D7789A86DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406356 Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406356() {
				unsigned short _t532;
				signed int _t533;
				void _t534;
				void* _t535;
				signed int _t536;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						L89:
						 *((intOrPtr*)(_t613 - 0x80)) = 0x15;
						 *(_t613 - 0x58) =  *(_t613 - 4) + 0xa68;
						L69:
						_t606 =  *(_t613 - 0x58);
						 *(_t613 - 0x84) = 0x12;
						L132:
						 *(_t613 - 0x54) = _t606;
						L133:
						_t532 =  *_t606;
						_t589 = _t532 & 0x0000ffff;
						_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
						if( *(_t613 - 0xc) >= _t565) {
							 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
							 *(_t613 - 0x40) = 1;
							_t533 = _t532 - (_t532 >> 5);
							 *_t606 = _t533;
						} else {
							 *(_t613 - 0x10) = _t565;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
							 *_t606 = (0x800 - _t589 >> 5) + _t532;
						}
						if( *(_t613 - 0x10) >= 0x1000000) {
							L139:
							_t534 =  *(_t613 - 0x84);
							L140:
							 *(_t613 - 0x88) = _t534;
							goto L1;
						} else {
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								goto L170;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						if( *(__ebp - 0x60) == 0) {
							L171:
							_t536 = _t535 | 0xffffffff;
							L172:
							return _t536;
						}
						__eax = 0;
						_t258 =  *(__ebp - 0x38) - 7 >= 0;
						0 | _t258 = _t258 + _t258 + 9;
						 *(__ebp - 0x38) = _t258 + _t258 + 9;
						L75:
						if( *(__ebp - 0x64) == 0) {
							 *(__ebp - 0x88) = 0x1b;
							L170:
							_t568 = 0x22;
							memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
							_t536 = 0;
							goto L172;
						}
						__eax =  *(__ebp - 0x14);
						__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
						if(__eax >=  *(__ebp - 0x74)) {
							__eax = __eax +  *(__ebp - 0x74);
						}
						__edx =  *(__ebp - 8);
						__cl =  *(__eax + __edx);
						__eax =  *(__ebp - 0x14);
						 *(__ebp - 0x5c) = __cl;
						 *(__eax + __edx) = __cl;
						__eax = __eax + 1;
						__edx = 0;
						_t274 = __eax %  *(__ebp - 0x74);
						__eax = __eax /  *(__ebp - 0x74);
						__edx = _t274;
						__eax =  *(__ebp - 0x68);
						 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
						 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
						_t283 = __ebp - 0x64;
						 *_t283 =  *(__ebp - 0x64) - 1;
						 *( *(__ebp - 0x68)) = __cl;
						L79:
						 *(__ebp - 0x14) = __edx;
						L80:
						 *(__ebp - 0x88) = 2;
					}
					L1:
					_t535 =  *(_t613 - 0x88);
					if(_t535 > 0x1c) {
						goto L171;
					}
					switch( *((intOrPtr*)(_t535 * 4 +  &M004068AD))) {
						case 0:
							if( *(_t613 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t535 =  *( *(_t613 - 0x70));
							if(_t535 > 0xe1) {
								goto L171;
							}
							_t539 = _t535 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t609 = _t539 / _t570;
							_t541 = _t539 % _t570 & 0x000000ff;
							asm("cdq");
							_t604 = _t541 % _t571 & 0x000000ff;
							 *(_t613 - 0x3c) = _t604;
							 *(_t613 - 0x1c) = (1 << _t609) - 1;
							 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t541 / _t571) - 1;
							_t612 = (0x300 << _t604 + _t609) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
								L10:
								if(_t612 == 0) {
									L12:
									 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t612 = _t612 - 1;
									 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
								} while (_t612 != 0);
								goto L12;
							}
							if( *(_t613 - 4) != 0) {
								GlobalFree( *(_t613 - 4));
							}
							_t535 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t613 - 4) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 1;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t45 = _t613 - 0x48;
							 *_t45 =  *(_t613 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t613 - 0x48) < 4) {
								goto L13;
							}
							_t547 =  *(_t613 - 0x40);
							if(_t547 ==  *(_t613 - 0x74)) {
								L20:
								 *(_t613 - 0x48) = 5;
								 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t613 - 0x74) = _t547;
							if( *(_t613 - 8) != 0) {
								GlobalFree( *(_t613 - 8));
							}
							_t535 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
							 *(_t613 - 8) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t554 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
							 *(_t613 - 0x84) = 6;
							 *(_t613 - 0x4c) = _t554;
							_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t554) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 3;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							_t67 = _t613 - 0x70;
							 *_t67 =  &(( *(_t613 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L23:
							 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
							if( *(_t613 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							__edx = 0;
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x34) = 1;
								 *(__ebp - 0x84) = 7;
								__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x5c) & 0x000000ff;
							__esi =  *(__ebp - 0x60);
							__cl = 8;
							__cl = 8 -  *(__ebp - 0x3c);
							__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
							__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
							__ecx =  *(__ebp - 0x3c);
							__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
							__ecx =  *(__ebp - 4);
							(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
							__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
							__eflags =  *(__ebp - 0x38) - 4;
							__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							if( *(__ebp - 0x38) >= 4) {
								__eflags =  *(__ebp - 0x38) - 0xa;
								if( *(__ebp - 0x38) >= 0xa) {
									_t98 = __ebp - 0x38;
									 *_t98 =  *(__ebp - 0x38) - 6;
									__eflags =  *_t98;
								} else {
									 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
								}
							} else {
								 *(__ebp - 0x38) = 0;
							}
							__eflags =  *(__ebp - 0x34) - __edx;
							if( *(__ebp - 0x34) == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L61;
							} else {
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__ecx =  *(__ebp - 8);
								__ebx = 0;
								__ebx = 1;
								__al =  *((intOrPtr*)(__eax + __ecx));
								 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
								goto L41;
							}
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L69;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							goto L0;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							goto L89;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							L37:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xd;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t122 = __ebp - 0x70;
							 *_t122 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t122;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L39:
							__eax =  *(__ebp - 0x40);
							__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
							if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
								goto L48;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L54;
							}
							L41:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L39;
							} else {
								goto L37;
							}
						case 0xe:
							L46:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xe;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t156 = __ebp - 0x70;
							 *_t156 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t156;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							while(1) {
								L48:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax =  *(__ebp - 0x58);
								__edx = __ebx + __ebx;
								__ecx =  *(__ebp - 0x10);
								__esi = __edx + __eax;
								__ecx =  *(__ebp - 0x10) >> 0xb;
								__ax =  *__esi;
								 *(__ebp - 0x54) = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
								__eflags =  *(__ebp - 0xc) - __ecx;
								if( *(__ebp - 0xc) >= __ecx) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
									 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
									__cx = __ax;
									_t170 = __edx + 1; // 0x1
									__ebx = _t170;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									 *(__ebp - 0x10) = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0x10) >= 0x1000000) {
									continue;
								} else {
									goto L46;
								}
							}
							L54:
							_t173 = __ebp - 0x34;
							 *_t173 =  *(__ebp - 0x34) & 0x00000000;
							__eflags =  *_t173;
							goto L55;
						case 0xf:
							L58:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xf;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t203 = __ebp - 0x70;
							 *_t203 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t203;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L60:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L55:
								__al =  *(__ebp - 0x44);
								 *(__ebp - 0x5c) =  *(__ebp - 0x44);
								goto L56;
							}
							L61:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t217 = __edx + 1; // 0x1
								__ebx = _t217;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L60;
							} else {
								goto L58;
							}
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							goto L69;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							L56:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1a;
								goto L170;
							}
							__ecx =  *(__ebp - 0x68);
							__al =  *(__ebp - 0x5c);
							__edx =  *(__ebp - 8);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
							 *( *(__ebp - 0x68)) = __al;
							__ecx =  *(__ebp - 0x14);
							 *(__ecx +  *(__ebp - 8)) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t192 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t192;
							goto L79;
						case 0x1b:
							goto L75;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = _t414;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eb68f714ae239f9d96536ddefa0b0130c78a53d72885ed6635004d34bb0e1c3
Instruction ID: 9f2062d8dd3c72469bab0aaa0c4d472ca99449d25692711e554c959146fb5a05
Opcode Fuzzy Hash: 7eb68f714ae239f9d96536ddefa0b0130c78a53d72885ed6635004d34bb0e1c3
Instruction Fuzzy Hash: 5F812471D00229CFEF24CFA9C8447AEBBB1FB44305F25816AD816BB281C7789985DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00405E5B Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00405E5B(void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v95;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				void _v140;
				void* _v148;
				signed int _t537;
				signed int _t538;
				signed int _t572;

				_t572 = 0x22;
				_v148 = __ecx;
				memcpy( &_v140, __ecx, _t572 << 2);
				if(_v52 == 0xffffffff) {
					return 1;
				}
				while(1) {
					L3:
					_t537 = _v140;
					if(_t537 > 0x1c) {
						break;
					}
					switch( *((intOrPtr*)(_t537 * 4 +  &M004068AD))) {
						case 0:
							__eflags = _v112;
							if(_v112 == 0) {
								goto L173;
							}
							_v112 = _v112 - 1;
							_v116 = _v116 + 1;
							_t537 =  *_v116;
							__eflags = _t537 - 0xe1;
							if(_t537 > 0xe1) {
								goto L174;
							}
							_t542 = _t537 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t576);
							_push(9);
							_pop(_t577);
							_t622 = _t542 / _t576;
							_t544 = _t542 % _t576 & 0x000000ff;
							asm("cdq");
							_t617 = _t544 % _t577 & 0x000000ff;
							_v64 = _t617;
							_v32 = (1 << _t622) - 1;
							_v28 = (1 << _t544 / _t577) - 1;
							_t625 = (0x300 << _t617 + _t622) + 0x736;
							__eflags = 0x600 - _v124;
							if(0x600 == _v124) {
								L12:
								__eflags = _t625;
								if(_t625 == 0) {
									L14:
									_v76 = _v76 & 0x00000000;
									_v68 = _v68 & 0x00000000;
									goto L17;
								} else {
									goto L13;
								}
								do {
									L13:
									_t625 = _t625 - 1;
									__eflags = _t625;
									 *((short*)(_v8 + _t625 * 2)) = 0x400;
								} while (_t625 != 0);
								goto L14;
							}
							__eflags = _v8;
							if(_v8 != 0) {
								GlobalFree(_v8);
							}
							_t537 = GlobalAlloc(0x40, 0x600); // executed
							__eflags = _t537;
							_v8 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								_v124 = 0x600;
								goto L12;
							}
						case 1:
							L15:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 1;
								goto L173;
							}
							_v112 = _v112 - 1;
							_v68 = _v68 | ( *_v116 & 0x000000ff) << _v76 << 0x00000003;
							_v116 = _v116 + 1;
							_t50 =  &_v76;
							 *_t50 = _v76 + 1;
							__eflags =  *_t50;
							L17:
							__eflags = _v76 - 4;
							if(_v76 < 4) {
								goto L15;
							}
							_t550 = _v68;
							__eflags = _t550 - _v120;
							if(_t550 == _v120) {
								L22:
								_v76 = 5;
								 *(_v12 + _v120 - 1) =  *(_v12 + _v120 - 1) & 0x00000000;
								goto L25;
							}
							__eflags = _v12;
							_v120 = _t550;
							if(_v12 != 0) {
								GlobalFree(_v12);
							}
							_t537 = GlobalAlloc(0x40, _v68); // executed
							__eflags = _t537;
							_v12 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								goto L22;
							}
						case 2:
							L26:
							_t557 = _v100 & _v32;
							_v136 = 6;
							_v80 = _t557;
							_t626 = _v8 + ((_v60 << 4) + _t557) * 2;
							goto L135;
						case 3:
							L23:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 3;
								goto L173;
							}
							_v112 = _v112 - 1;
							_t72 =  &_v116;
							 *_t72 = _v116 + 1;
							__eflags =  *_t72;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L25:
							_v76 = _v76 - 1;
							__eflags = _v76;
							if(_v76 != 0) {
								goto L23;
							}
							goto L26;
						case 4:
							L136:
							_t559 =  *_t626;
							_t610 = _t559 & 0x0000ffff;
							_t591 = (_v20 >> 0xb) * _t610;
							__eflags = _v16 - _t591;
							if(_v16 >= _t591) {
								_v20 = _v20 - _t591;
								_v16 = _v16 - _t591;
								_v68 = 1;
								_t560 = _t559 - (_t559 >> 5);
								__eflags = _t560;
								 *_t626 = _t560;
							} else {
								_v20 = _t591;
								_v68 = _v68 & 0x00000000;
								 *_t626 = (0x800 - _t610 >> 5) + _t559;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L142;
							} else {
								goto L140;
							}
						case 5:
							L140:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 5;
								goto L173;
							}
							_v20 = _v20 << 8;
							_v112 = _v112 - 1;
							_t464 =  &_v116;
							 *_t464 = _v116 + 1;
							__eflags =  *_t464;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L142:
							_t561 = _v136;
							goto L143;
						case 6:
							__edx = 0;
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v56 = 1;
								_v136 = 7;
								__esi = _v8 + 0x180 + _v60 * 2;
								goto L135;
							}
							__eax = _v96 & 0x000000ff;
							__esi = _v100;
							__cl = 8;
							__cl = 8 - _v64;
							__esi = _v100 & _v28;
							__eax = (_v96 & 0x000000ff) >> 8;
							__ecx = _v64;
							__esi = (_v100 & _v28) << 8;
							__ecx = _v8;
							((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2;
							__eax = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9;
							__eflags = _v60 - 4;
							__eax = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							_v92 = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							if(_v60 >= 4) {
								__eflags = _v60 - 0xa;
								if(_v60 >= 0xa) {
									_t103 =  &_v60;
									 *_t103 = _v60 - 6;
									__eflags =  *_t103;
								} else {
									_v60 = _v60 - 3;
								}
							} else {
								_v60 = 0;
							}
							__eflags = _v56 - __edx;
							if(_v56 == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L63;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__ecx = _v12;
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							_v95 =  *((intOrPtr*)(__eax + __ecx));
							goto L43;
						case 7:
							__eflags = _v68 - 1;
							if(_v68 != 1) {
								__eax = _v40;
								_v132 = 0x16;
								_v36 = _v40;
								__eax = _v44;
								_v40 = _v44;
								__eax = _v48;
								_v44 = _v48;
								__eax = 0;
								__eflags = _v60 - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								_v60 = (__eflags >= 0) - 1 + 0xa;
								__eax = _v8;
								__eax = _v8 + 0x664;
								__eflags = __eax;
								_v92 = __eax;
								goto L71;
							}
							__eax = _v8;
							__ecx = _v60;
							_v136 = 8;
							__esi = _v8 + 0x198 + _v60 * 2;
							goto L135;
						case 8:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xa;
								__esi = _v8 + 0x1b0 + _v60 * 2;
							} else {
								__eax = _v60;
								__ecx = _v8;
								__eax = _v60 + 0xf;
								_v136 = 9;
								_v60 + 0xf << 4 = (_v60 + 0xf << 4) + _v80;
								__esi = _v8 + ((_v60 + 0xf << 4) + _v80) * 2;
							}
							goto L135;
						case 9:
							__eflags = _v68;
							if(_v68 != 0) {
								goto L92;
							}
							__eflags = _v100;
							if(_v100 == 0) {
								goto L174;
							}
							__eax = 0;
							__eflags = _v60 - 7;
							_t264 = _v60 - 7 >= 0;
							__eflags = _t264;
							0 | _t264 = _t264 + _t264 + 9;
							_v60 = _t264 + _t264 + 9;
							goto L78;
						case 0xa:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xb;
								__esi = _v8 + 0x1c8 + _v60 * 2;
								goto L135;
							}
							__eax = _v44;
							goto L91;
						case 0xb:
							__eflags = _v68;
							if(_v68 != 0) {
								__ecx = _v40;
								__eax = _v36;
								_v36 = _v40;
							} else {
								__eax = _v40;
							}
							__ecx = _v44;
							_v40 = _v44;
							L91:
							__ecx = _v48;
							_v48 = __eax;
							_v44 = _v48;
							L92:
							__eax = _v8;
							_v132 = 0x15;
							__eax = _v8 + 0xa68;
							_v92 = _v8 + 0xa68;
							goto L71;
						case 0xc:
							L102:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xc;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t340 =  &_v116;
							 *_t340 = _v116 + 1;
							__eflags =  *_t340;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							__eax = _v48;
							goto L104;
						case 0xd:
							L39:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xd;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t127 =  &_v116;
							 *_t127 = _v116 + 1;
							__eflags =  *_t127;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L41:
							__eax = _v68;
							__eflags = _v76 - _v68;
							if(_v76 != _v68) {
								goto L50;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L56;
							}
							L43:
							__eax = _v95 & 0x000000ff;
							_v95 = _v95 << 1;
							__ecx = _v92;
							__eax = (_v95 & 0x000000ff) >> 7;
							_v76 = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi = _v92 + __eax * 2;
							_v20 = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edx;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_v68 = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								_v68 = _v68 & 0x00000000;
								_v20 = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L41;
							} else {
								goto L39;
							}
						case 0xe:
							L48:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xe;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t161 =  &_v116;
							 *_t161 = _v116 + 1;
							__eflags =  *_t161;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							while(1) {
								L50:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax = _v92;
								__edx = __ebx + __ebx;
								__ecx = _v20;
								__esi = __edx + __eax;
								__ecx = _v20 >> 0xb;
								__ax =  *__esi;
								_v88 = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = (_v20 >> 0xb) * __edi;
								__eflags = _v16 - __ecx;
								if(_v16 >= __ecx) {
									_v20 = _v20 - __ecx;
									_v16 = _v16 - __ecx;
									__cx = __ax;
									_t175 = __edx + 1; // 0x1
									__ebx = _t175;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									_v20 = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags = _v20 - 0x1000000;
								_v72 = __ebx;
								if(_v20 >= 0x1000000) {
									continue;
								} else {
									goto L48;
								}
							}
							L56:
							_t178 =  &_v56;
							 *_t178 = _v56 & 0x00000000;
							__eflags =  *_t178;
							goto L57;
						case 0xf:
							L60:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xf;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t208 =  &_v116;
							 *_t208 = _v116 + 1;
							__eflags =  *_t208;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L62:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L57:
								__al = _v72;
								_v96 = _v72;
								goto L58;
							}
							L63:
							__eax = _v92;
							__edx = __ebx + __ebx;
							__ecx = _v20;
							__esi = __edx + __eax;
							__ecx = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_t222 = __edx + 1; // 0x1
								__ebx = _t222;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L62;
							} else {
								goto L60;
							}
						case 0x10:
							L112:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x10;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t371 =  &_v116;
							 *_t371 = _v116 + 1;
							__eflags =  *_t371;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							goto L114;
						case 0x11:
							L71:
							__esi = _v92;
							_v136 = 0x12;
							goto L135;
						case 0x12:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v92;
								_v136 = 0x13;
								__esi = _v92 + 2;
								L135:
								_v88 = _t626;
								goto L136;
							}
							__eax = _v80;
							_v52 = _v52 & 0x00000000;
							__ecx = _v92;
							__eax = _v80 << 4;
							__eflags = __eax;
							__eax = _v92 + __eax + 4;
							goto L133;
						case 0x13:
							__eflags = _v68;
							if(_v68 != 0) {
								_t475 =  &_v92;
								 *_t475 = _v92 + 0x204;
								__eflags =  *_t475;
								_v52 = 0x10;
								_v68 = 8;
								L147:
								_v128 = 0x14;
								goto L148;
							}
							__eax = _v80;
							__ecx = _v92;
							__eax = _v80 << 4;
							_v52 = 8;
							__eax = _v92 + (_v80 << 4) + 0x104;
							L133:
							_v92 = __eax;
							_v68 = 3;
							goto L147;
						case 0x14:
							_v52 = _v52 + __ebx;
							__eax = _v132;
							goto L143;
						case 0x15:
							__eax = 0;
							__eflags = _v60 - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							_v60 = (__eflags >= 0) - 1 + 0xb;
							goto L123;
						case 0x16:
							__eax = _v52;
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx = _v8;
							_v68 = 6;
							__eax = __eax << 7;
							_v128 = 0x19;
							_v92 = __eax;
							goto L148;
						case 0x17:
							L148:
							__eax = _v68;
							_v84 = 1;
							_v76 = _v68;
							goto L152;
						case 0x18:
							L149:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x18;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t490 =  &_v116;
							 *_t490 = _v116 + 1;
							__eflags =  *_t490;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L151:
							_t493 =  &_v76;
							 *_t493 = _v76 - 1;
							__eflags =  *_t493;
							L152:
							__eflags = _v76;
							if(_v76 <= 0) {
								__ecx = _v68;
								__ebx = _v84;
								0 = 1;
								__eax = 1 << __cl;
								__ebx = _v84 - (1 << __cl);
								__eax = _v128;
								_v72 = __ebx;
								L143:
								_v140 = _t561;
								goto L3;
							}
							__eax = _v84;
							_v20 = _v20 >> 0xb;
							__edx = _v84 + _v84;
							__eax = _v92;
							__esi = __edx + __eax;
							_v88 = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								_v84 = __edx;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								_v84 = _v84 << 1;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L151;
							} else {
								goto L149;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								_v48 = __ebx;
								L122:
								_t399 =  &_v48;
								 *_t399 = _v48 + 1;
								__eflags =  *_t399;
								L123:
								__eax = _v48;
								__eflags = __eax;
								if(__eax == 0) {
									_v52 = _v52 | 0xffffffff;
									goto L173;
								}
								__eflags = __eax - _v100;
								if(__eax > _v100) {
									goto L174;
								}
								_v52 = _v52 + 2;
								__eax = _v52;
								_t406 =  &_v100;
								 *_t406 = _v100 + _v52;
								__eflags =  *_t406;
								goto L126;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							_v48 = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								_v76 = __ecx;
								L105:
								__eflags = _v76;
								if(_v76 <= 0) {
									__eax = __eax + __ebx;
									_v68 = 4;
									_v48 = __eax;
									__eax = _v8;
									__eax = _v8 + 0x644;
									__eflags = __eax;
									L111:
									__ebx = 0;
									_v92 = __eax;
									_v84 = 1;
									_v72 = 0;
									_v76 = 0;
									L115:
									__eax = _v68;
									__eflags = _v76 - _v68;
									if(_v76 >= _v68) {
										_t397 =  &_v48;
										 *_t397 = _v48 + __ebx;
										__eflags =  *_t397;
										goto L122;
									}
									__eax = _v84;
									_v20 = _v20 >> 0xb;
									__edi = _v84 + _v84;
									__eax = _v92;
									__esi = __edi + __eax;
									_v88 = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = (_v20 >> 0xb) * __ecx;
									__eflags = _v16 - __edx;
									if(_v16 >= __edx) {
										__ecx = 0;
										_v20 = _v20 - __edx;
										__ecx = 1;
										_v16 = _v16 - __edx;
										__ebx = 1;
										__ecx = _v76;
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx = _v72;
										__ebx = _v72 | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										_v72 = __ebx;
										 *__esi = __ax;
										_v84 = __edi;
									} else {
										_v20 = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										_v84 = _v84 << 1;
										 *__esi = __dx;
									}
									__eflags = _v20 - 0x1000000;
									if(_v20 >= 0x1000000) {
										L114:
										_t374 =  &_v76;
										 *_t374 = _v76 + 1;
										__eflags =  *_t374;
										goto L115;
									} else {
										goto L112;
									}
								}
								__ecx = _v16;
								__ebx = __ebx + __ebx;
								_v20 = _v20 >> 1;
								__eflags = _v16 - _v20;
								_v72 = __ebx;
								if(_v16 >= _v20) {
									__ecx = _v20;
									_v16 = _v16 - _v20;
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									_v72 = __ebx;
								}
								__eflags = _v20 - 0x1000000;
								if(_v20 >= 0x1000000) {
									L104:
									_t344 =  &_v76;
									 *_t344 = _v76 - 1;
									__eflags =  *_t344;
									goto L105;
								} else {
									goto L102;
								}
							}
							__edx = _v8;
							__eax = __eax - __ebx;
							_v68 = __ecx;
							__eax = _v8 + 0x55e + __eax * 2;
							goto L111;
						case 0x1a:
							L58:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1a;
								goto L173;
							}
							__ecx = _v108;
							__al = _v96;
							__edx = _v12;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_v104 = _v104 - 1;
							 *_v108 = __al;
							__ecx = _v24;
							 *(_v12 + __ecx) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t197 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t197;
							goto L82;
						case 0x1b:
							L78:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1b;
								goto L173;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__edx = _v12;
							__cl =  *(__edx + __eax);
							__eax = _v24;
							_v96 = __cl;
							 *(__edx + __eax) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t280 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t280;
							__eax = _v108;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_t289 =  &_v104;
							 *_t289 = _v104 - 1;
							__eflags =  *_t289;
							 *_v108 = __cl;
							L82:
							_v24 = __edx;
							goto L83;
						case 0x1c:
							while(1) {
								L126:
								__eflags = _v104;
								if(_v104 == 0) {
									break;
								}
								__eax = _v24;
								__eax = _v24 - _v48;
								__eflags = __eax - _v120;
								if(__eax >= _v120) {
									__eax = __eax + _v120;
									__eflags = __eax;
								}
								__edx = _v12;
								__cl =  *(__edx + __eax);
								__eax = _v24;
								_v96 = __cl;
								 *(__edx + __eax) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t420 = __eax % _v120;
								__eax = __eax / _v120;
								__edx = _t420;
								__eax = _v108;
								_v108 = _v108 + 1;
								_v104 = _v104 - 1;
								_v52 = _v52 - 1;
								__eflags = _v52;
								 *_v108 = __cl;
								_v24 = _t420;
								if(_v52 > 0) {
									continue;
								} else {
									L83:
									_v140 = 2;
									goto L3;
								}
							}
							_v140 = 0x1c;
							L173:
							_push(0x22);
							_pop(_t574);
							memcpy(_v148,  &_v140, _t574 << 2);
							return 0;
					}
				}
				L174:
				_t538 = _t537 | 0xffffffff;
				return _t538;
			}

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2482ce101b79804f74797cf326f25a845d592d71d58d7df2a3bf49f74afb3583
Instruction ID: 84f98c36384fe8ee64262c0bd4aeca6ab0d9deaaf6f503267966aff3759d9c01
Opcode Fuzzy Hash: 2482ce101b79804f74797cf326f25a845d592d71d58d7df2a3bf49f74afb3583
Instruction Fuzzy Hash: DB816672D04229CBEF24CFA9C8447AEBBB0FF44305F25816AD856B7281C7785A86DF54

Uniqueness

Uniqueness Score: -1.00%

Function 004062A9 Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004062A9() {
				signed int _t539;
				unsigned short _t540;
				signed int _t541;
				void _t542;
				signed int _t543;
				signed int _t544;
				signed int _t573;
				signed int _t576;
				signed int _t597;
				signed int* _t614;
				void* _t621;

				L0:
				while(1) {
					L0:
					if( *(_t621 - 0x40) != 1) {
						 *((intOrPtr*)(_t621 - 0x80)) = 0x16;
						 *((intOrPtr*)(_t621 - 0x20)) =  *((intOrPtr*)(_t621 - 0x24));
						 *((intOrPtr*)(_t621 - 0x24)) =  *((intOrPtr*)(_t621 - 0x28));
						 *((intOrPtr*)(_t621 - 0x28)) =  *((intOrPtr*)(_t621 - 0x2c));
						 *(_t621 - 0x38) = ((0 |  *(_t621 - 0x38) - 0x00000007 >= 0x00000000) - 0x00000001 & 0x000000fd) + 0xa;
						_t539 =  *(_t621 - 4) + 0x664;
						 *(_t621 - 0x58) = _t539;
						goto L68;
					} else {
						 *(__ebp - 0x84) = 8;
						while(1) {
							L132:
							 *(_t621 - 0x54) = _t614;
							while(1) {
								L133:
								_t540 =  *_t614;
								_t597 = _t540 & 0x0000ffff;
								_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
								if( *(_t621 - 0xc) >= _t573) {
									 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
									 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
									 *(_t621 - 0x40) = 1;
									_t541 = _t540 - (_t540 >> 5);
									 *_t614 = _t541;
								} else {
									 *(_t621 - 0x10) = _t573;
									 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
									 *_t614 = (0x800 - _t597 >> 5) + _t540;
								}
								if( *(_t621 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t621 - 0x6c) == 0) {
									 *(_t621 - 0x88) = 5;
									L170:
									_t576 = 0x22;
									memcpy( *(_t621 - 0x90), _t621 - 0x88, _t576 << 2);
									_t544 = 0;
									L172:
									return _t544;
								}
								 *(_t621 - 0x10) =  *(_t621 - 0x10) << 8;
								 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
								 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
								 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
								L139:
								_t542 =  *(_t621 - 0x84);
								while(1) {
									 *(_t621 - 0x88) = _t542;
									while(1) {
										L1:
										_t543 =  *(_t621 - 0x88);
										if(_t543 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t543 * 4 +  &M004068AD))) {
											case 0:
												if( *(_t621 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t543 =  *( *(_t621 - 0x70));
												if(_t543 > 0xe1) {
													goto L171;
												}
												_t547 = _t543 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t578);
												_push(9);
												_pop(_t579);
												_t617 = _t547 / _t578;
												_t549 = _t547 % _t578 & 0x000000ff;
												asm("cdq");
												_t612 = _t549 % _t579 & 0x000000ff;
												 *(_t621 - 0x3c) = _t612;
												 *(_t621 - 0x1c) = (1 << _t617) - 1;
												 *((intOrPtr*)(_t621 - 0x18)) = (1 << _t549 / _t579) - 1;
												_t620 = (0x300 << _t612 + _t617) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t621 - 0x78))) {
													L10:
													if(_t620 == 0) {
														L12:
														 *(_t621 - 0x48) =  *(_t621 - 0x48) & 0x00000000;
														 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t620 = _t620 - 1;
														 *((short*)( *(_t621 - 4) + _t620 * 2)) = 0x400;
													} while (_t620 != 0);
													goto L12;
												}
												if( *(_t621 - 4) != 0) {
													GlobalFree( *(_t621 - 4));
												}
												_t543 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t621 - 4) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t621 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 1;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x40) =  *(_t621 - 0x40) | ( *( *(_t621 - 0x70)) & 0x000000ff) <<  *(_t621 - 0x48) << 0x00000003;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t45 = _t621 - 0x48;
												 *_t45 =  *(_t621 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t621 - 0x48) < 4) {
													goto L13;
												}
												_t555 =  *(_t621 - 0x40);
												if(_t555 ==  *(_t621 - 0x74)) {
													L20:
													 *(_t621 - 0x48) = 5;
													 *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) =  *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t621 - 0x74) = _t555;
												if( *(_t621 - 8) != 0) {
													GlobalFree( *(_t621 - 8));
												}
												_t543 = GlobalAlloc(0x40,  *(_t621 - 0x40)); // executed
												 *(_t621 - 8) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t562 =  *(_t621 - 0x60) &  *(_t621 - 0x1c);
												 *(_t621 - 0x84) = 6;
												 *(_t621 - 0x4c) = _t562;
												_t614 =  *(_t621 - 4) + (( *(_t621 - 0x38) << 4) + _t562) * 2;
												goto L132;
											case 3:
												L21:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 3;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												_t67 = _t621 - 0x70;
												 *_t67 =  &(( *(_t621 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
												L23:
												 *(_t621 - 0x48) =  *(_t621 - 0x48) - 1;
												if( *(_t621 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t540 =  *_t614;
												_t597 = _t540 & 0x0000ffff;
												_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
												if( *(_t621 - 0xc) >= _t573) {
													 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
													 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
													 *(_t621 - 0x40) = 1;
													_t541 = _t540 - (_t540 >> 5);
													 *_t614 = _t541;
												} else {
													 *(_t621 - 0x10) = _t573;
													 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
													 *_t614 = (0x800 - _t597 >> 5) + _t540;
												}
												if( *(_t621 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												goto L0;
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t258 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t258;
												0 | _t258 = _t258 + _t258 + 9;
												 *(__ebp - 0x38) = _t258 + _t258 + 9;
												goto L75;
											case 0xa:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xb;
													__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x28);
												goto L88;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												L88:
												__ecx =  *(__ebp - 0x2c);
												 *(__ebp - 0x2c) = __eax;
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												L89:
												__eax =  *(__ebp - 4);
												 *(__ebp - 0x80) = 0x15;
												__eax =  *(__ebp - 4) + 0xa68;
												 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
												goto L68;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												L68:
												_t614 =  *(_t621 - 0x58);
												 *(_t621 - 0x84) = 0x12;
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t621 - 0x88) = _t542;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t621 - 0x88) = _t542;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L79;
											case 0x1b:
												L75:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t274 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t274;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t283 = __ebp - 0x64;
												 *_t283 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t283;
												 *( *(__ebp - 0x68)) = __cl;
												L79:
												 *(__ebp - 0x14) = __edx;
												goto L80;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L80:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t544 = _t543 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e377961aab5915f676f277977e9088cd48e73eb1c2f96f4c26015d5a799a0d8
Instruction ID: 87842c1f76f394e9967038b09935c6923b6a3569bddc7a9db877803d8644aafd
Opcode Fuzzy Hash: 2e377961aab5915f676f277977e9088cd48e73eb1c2f96f4c26015d5a799a0d8
Instruction Fuzzy Hash: BE711171D00229CFEF28CF98C844BADBBB1FB48305F15806AD816B7281D7789996DF54

Uniqueness

Uniqueness Score: -1.00%

Function 004063C7 Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004063C7() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xb;
						_t606 =  *(_t613 - 4) + 0x1c8 +  *(_t613 - 0x38) * 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x28);
						L88:
						 *(__ebp - 0x2c) = __eax;
						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
						L89:
						__eax =  *(__ebp - 4);
						 *(__ebp - 0x80) = 0x15;
						__eax =  *(__ebp - 4) + 0xa68;
						 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
						L69:
						 *(__ebp - 0x84) = 0x12;
						while(1) {
							L132:
							 *(_t613 - 0x54) = _t606;
							while(1) {
								L133:
								_t531 =  *_t606;
								_t589 = _t531 & 0x0000ffff;
								_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
								if( *(_t613 - 0xc) >= _t565) {
									 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
									 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
									 *(_t613 - 0x40) = 1;
									_t532 = _t531 - (_t531 >> 5);
									 *_t606 = _t532;
								} else {
									 *(_t613 - 0x10) = _t565;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									 *_t606 = (0x800 - _t589 >> 5) + _t531;
								}
								if( *(_t613 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t613 - 0x6c) == 0) {
									 *(_t613 - 0x88) = 5;
									L170:
									_t568 = 0x22;
									memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
								 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
								 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
								 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
								L139:
								_t533 =  *(_t613 - 0x84);
								while(1) {
									 *(_t613 - 0x88) = _t533;
									while(1) {
										L1:
										_t534 =  *(_t613 - 0x88);
										if(_t534 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t534 * 4 +  &M004068AD))) {
											case 0:
												if( *(_t613 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t534 =  *( *(_t613 - 0x70));
												if(_t534 > 0xe1) {
													goto L171;
												}
												_t538 = _t534 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t570);
												_push(9);
												_pop(_t571);
												_t609 = _t538 / _t570;
												_t540 = _t538 % _t570 & 0x000000ff;
												asm("cdq");
												_t604 = _t540 % _t571 & 0x000000ff;
												 *(_t613 - 0x3c) = _t604;
												 *(_t613 - 0x1c) = (1 << _t609) - 1;
												 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
												_t612 = (0x300 << _t604 + _t609) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
													L10:
													if(_t612 == 0) {
														L12:
														 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
														 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t612 = _t612 - 1;
														 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
													} while (_t612 != 0);
													goto L12;
												}
												if( *(_t613 - 4) != 0) {
													GlobalFree( *(_t613 - 4));
												}
												_t534 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t613 - 4) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 1;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t45 = _t613 - 0x48;
												 *_t45 =  *(_t613 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t613 - 0x48) < 4) {
													goto L13;
												}
												_t546 =  *(_t613 - 0x40);
												if(_t546 ==  *(_t613 - 0x74)) {
													L20:
													 *(_t613 - 0x48) = 5;
													 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t613 - 0x74) = _t546;
												if( *(_t613 - 8) != 0) {
													GlobalFree( *(_t613 - 8));
												}
												_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
												 *(_t613 - 8) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
												 *(_t613 - 0x84) = 6;
												 *(_t613 - 0x4c) = _t553;
												_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
												L132:
												 *(_t613 - 0x54) = _t606;
												goto L133;
											case 3:
												L21:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 3;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												_t67 = _t613 - 0x70;
												 *_t67 =  &(( *(_t613 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
												L23:
												 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
												if( *(_t613 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t531 =  *_t606;
												_t589 = _t531 & 0x0000ffff;
												_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
												if( *(_t613 - 0xc) >= _t565) {
													 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
													 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
													 *(_t613 - 0x40) = 1;
													_t532 = _t531 - (_t531 >> 5);
													 *_t606 = _t532;
												} else {
													 *(_t613 - 0x10) = _t565;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													 *_t606 = (0x800 - _t589 >> 5) + _t531;
												}
												if( *(_t613 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												__eflags =  *(__ebp - 0x40) - 1;
												if( *(__ebp - 0x40) != 1) {
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x80) = 0x16;
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x28);
													 *(__ebp - 0x24) =  *(__ebp - 0x28);
													__eax =  *(__ebp - 0x2c);
													 *(__ebp - 0x28) =  *(__ebp - 0x2c);
													__eax = 0;
													__eflags =  *(__ebp - 0x38) - 7;
													0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
													__al = __al & 0x000000fd;
													__eax = (__eflags >= 0) - 1 + 0xa;
													 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x664;
													__eflags = __eax;
													 *(__ebp - 0x58) = __eax;
													goto L69;
												}
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 8;
												__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t259 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t259;
												0 | _t259 = _t259 + _t259 + 9;
												 *(__ebp - 0x38) = _t259 + _t259 + 9;
												goto L76;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												goto L88;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												goto L69;
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t613 - 0x88) = _t533;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t613 - 0x88) = _t533;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L80;
											case 0x1b:
												L76:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t275 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t275;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t284 = __ebp - 0x64;
												 *_t284 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t284;
												 *( *(__ebp - 0x68)) = __cl;
												L80:
												 *(__ebp - 0x14) = __edx;
												goto L81;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L81:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t535 = _t534 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce8f1a48a343de5ee94cf1d77394f6fa9a4da1696e9cf57581d11998677c295c
Instruction ID: f29c7650ca7732be42b715054819f9ef2f9a8d26a50ddb16a6e1c9f426a403c7
Opcode Fuzzy Hash: ce8f1a48a343de5ee94cf1d77394f6fa9a4da1696e9cf57581d11998677c295c
Instruction Fuzzy Hash: C6712271E00229CBEF28CF99C844BAEBBB1FB44305F15806AD816B7281C7789996DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00406313 Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406313() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xa;
						_t606 =  *(_t613 - 4) + 0x1b0 +  *(_t613 - 0x38) * 2;
					} else {
						 *(__ebp - 0x84) = 9;
						 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
					}
					while(1) {
						 *(_t613 - 0x54) = _t606;
						while(1) {
							L133:
							_t531 =  *_t606;
							_t589 = _t531 & 0x0000ffff;
							_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
							if( *(_t613 - 0xc) >= _t565) {
								 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
								 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
								 *(_t613 - 0x40) = 1;
								_t532 = _t531 - (_t531 >> 5);
								 *_t606 = _t532;
							} else {
								 *(_t613 - 0x10) = _t565;
								 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
								 *_t606 = (0x800 - _t589 >> 5) + _t531;
							}
							if( *(_t613 - 0x10) >= 0x1000000) {
								goto L139;
							}
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								L170:
								_t568 = 0x22;
								memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
								_t535 = 0;
								L172:
								return _t535;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L139:
							_t533 =  *(_t613 - 0x84);
							while(1) {
								 *(_t613 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t613 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M004068AD))) {
										case 0:
											if( *(_t613 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t534 =  *( *(_t613 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t570);
											_push(9);
											_pop(_t571);
											_t609 = _t538 / _t570;
											_t540 = _t538 % _t570 & 0x000000ff;
											asm("cdq");
											_t604 = _t540 % _t571 & 0x000000ff;
											 *(_t613 - 0x3c) = _t604;
											 *(_t613 - 0x1c) = (1 << _t609) - 1;
											 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
											_t612 = (0x300 << _t604 + _t609) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
												L10:
												if(_t612 == 0) {
													L12:
													 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t612 = _t612 - 1;
													 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
												} while (_t612 != 0);
												goto L12;
											}
											if( *(_t613 - 4) != 0) {
												GlobalFree( *(_t613 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t613 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 1;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t45 = _t613 - 0x48;
											 *_t45 =  *(_t613 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t613 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t613 - 0x40);
											if(_t546 ==  *(_t613 - 0x74)) {
												L20:
												 *(_t613 - 0x48) = 5;
												 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t613 - 0x74) = _t546;
											if( *(_t613 - 8) != 0) {
												GlobalFree( *(_t613 - 8));
											}
											_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
											 *(_t613 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
											 *(_t613 - 0x84) = 6;
											 *(_t613 - 0x4c) = _t553;
											_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
											 *(_t613 - 0x54) = _t606;
											goto L133;
										case 3:
											L21:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 3;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											_t67 = _t613 - 0x70;
											 *_t67 =  &(( *(_t613 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
											L23:
											 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
											if( *(_t613 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t606;
											_t589 = _t531 & 0x0000ffff;
											_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
											if( *(_t613 - 0xc) >= _t565) {
												 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
												 *(_t613 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												 *_t606 = _t532;
											} else {
												 *(_t613 - 0x10) = _t565;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
												 *_t606 = (0x800 - _t589 >> 5) + _t531;
											}
											if( *(_t613 - 0x10) >= 0x1000000) {
												goto L139;
											}
										case 5:
											goto L137;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 8:
											goto L0;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L89;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t258 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t258;
											0 | _t258 = _t258 + _t258 + 9;
											 *(__ebp - 0x38) = _t258 + _t258 + 9;
											goto L75;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x28);
											goto L88;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L88:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L89:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 0x12:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *(__ebp - 0x7c) = 0x14;
												goto L145;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											 *(_t613 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											L145:
											__eax =  *(__ebp - 0x40);
											 *(__ebp - 0x50) = 1;
											 *(__ebp - 0x48) =  *(__ebp - 0x40);
											goto L149;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											L149:
											__eflags =  *(__ebp - 0x48);
											if( *(__ebp - 0x48) <= 0) {
												__ecx =  *(__ebp - 0x40);
												__ebx =  *(__ebp - 0x50);
												0 = 1;
												__eax = 1 << __cl;
												__ebx =  *(__ebp - 0x50) - (1 << __cl);
												__eax =  *(__ebp - 0x7c);
												 *(__ebp - 0x44) = __ebx;
												while(1) {
													 *(_t613 - 0x88) = _t533;
													goto L1;
												}
											}
											__eax =  *(__ebp - 0x50);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
											__eax =  *(__ebp - 0x58);
											__esi = __edx + __eax;
											 *(__ebp - 0x54) = __esi;
											__ax =  *__esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__cx = __ax >> 5;
												__eax = __eax - __ecx;
												__edx = __edx + 1;
												__eflags = __edx;
												 *__esi = __ax;
												 *(__ebp - 0x50) = __edx;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L148;
											} else {
												goto L146;
											}
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														goto L109;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													goto L99;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L79;
										case 0x1b:
											L75:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t274 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t274;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t283 = __ebp - 0x64;
											 *_t283 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t283;
											 *( *(__ebp - 0x68)) = __cl;
											L79:
											 *(__ebp - 0x14) = __edx;
											goto L80;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L80:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd3b2ec3f5e172a28ac146294ee31ecb58d2767ae15e01e397df032d3a520fc
Instruction ID: 150ce1bc09a2c7df66eb9a1793004520446428f7a11f196e4037732027db8909
Opcode Fuzzy Hash: cfd3b2ec3f5e172a28ac146294ee31ecb58d2767ae15e01e397df032d3a520fc
Instruction Fuzzy Hash: 31712371D00229CBEF28CF98C844BAEBBB1FF44305F15806AD816B7291C7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00401B06 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72
memoryCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401B06(void* __ebx, void* __edx) {
				intOrPtr _t7;
				void* _t8;
				void _t11;
				void* _t13;
				void* _t21;
				void* _t24;
				void* _t30;
				void* _t33;
				void* _t34;
				void* _t37;

				_t27 = __ebx;
				_t7 =  *((intOrPtr*)(_t37 - 0x1c));
				_t30 =  *0x40afa0; // 0x0
				if(_t7 == __ebx) {
					if(__edx == __ebx) {
						_t8 = GlobalAlloc(0x40, 0x404); // executed
						_t34 = _t8;
						_t4 = _t34 + 4; // 0x4
						E00405A65(__ebx, _t30, _t34, _t4,  *((intOrPtr*)(_t37 - 0x24)));
						_t11 =  *0x40afa0; // 0x0
						 *_t34 = _t11;
						 *0x40afa0 = _t34;
					} else {
						if(_t30 == __ebx) {
							 *((intOrPtr*)(_t37 - 4)) = 1;
						} else {
							_t2 = _t30 + 4; // 0x4
							E00405A43(_t33, _t2);
							_push(_t30);
							 *0x40afa0 =  *_t30;
							GlobalFree();
						}
					}
					goto L15;
				} else {
					while(1) {
						_t7 = _t7 - 1;
						if(_t30 == _t27) {
							break;
						}
						_t30 =  *_t30;
						if(_t7 != _t27) {
							continue;
						} else {
							if(_t30 == _t27) {
								break;
							} else {
								_t32 = _t30 + 4;
								E00405A43(0x4093a0, _t30 + 4);
								_t21 =  *0x40afa0; // 0x0
								E00405A43(_t32, _t21 + 4);
								_t24 =  *0x40afa0; // 0x0
								_push(0x4093a0);
								_push(_t24 + 4);
								E00405A43();
								L15:
								 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t37 - 4));
								_t13 = 0;
							}
						}
						goto L17;
					}
					_push(0x200010);
					_push(E00405A65(_t27, _t30, _t33, _t27, 0xffffffe8));
					E00405304();
					_t13 = 0x7fffffff;
				}
				L17:
				return _t13;
			}

0x00401b06
0x00401b06
0x00401b09
0x00401b11
0x00401b59
0x00401b87
0x00401b90
0x00401b92
0x00401b96
0x00401b9b
0x00401ba0
0x00401ba2
0x00401b5b
0x00401b5d
0x0040264e
0x00401b63
0x00401b63
0x00401b68
0x00401b6f
0x00401b70
0x00401b75
0x00401b75
0x00401b5d
0x00000000
0x00401b13
0x00401b13
0x00401b13
0x00401b16
0x00000000
0x00000000
0x00401b1c
0x00401b20
0x00000000
0x00401b22
0x00401b24
0x00000000
0x00401b2a
0x00401b2a
0x00401b34
0x00401b39
0x00401b43
0x00401b48
0x00401b4d
0x00401b51
0x004027a3
0x0040287d
0x00402880
0x00402886
0x00402886
0x00401b24
0x00000000
0x00401b20
0x004021ed
0x004021fa
0x004021fb
0x00402200
0x00402200
0x00402888
0x0040288c

APIs

GlobalFree.KERNEL32 ref: 00401B75
GlobalAlloc.KERNELBASE(00000040,00000404), ref: 00401B87

Strings

Call, xrefs: 00401B2D, 00401B33, 00401B4D

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: c023b3ecba59191b7b9014bc85490e5e1ecb04f149815024fec7b308a3299648
Instruction ID: 2d05f520ed59040050a45420fbd22dd9be4bd6926205b7367146f9b72b257bb2
Opcode Fuzzy Hash: c023b3ecba59191b7b9014bc85490e5e1ecb04f149815024fec7b308a3299648
Instruction Fuzzy Hash: 3C2181B6A041019BCB10EBA49E85E5F73A8EB84314754463BF101B72D1DB7CE9518F5E

Uniqueness

Uniqueness Score: -1.00%

Function 0040592A Relevance: 4.5, APIs: 3, Instructions: 45
registryCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040592A(void* _a4, int _a8, char* _a12, int _a16, void* _a20) {
				long _t20;
				char* _t26;

				asm("sbb eax, eax");
				_t26 = _a16;
				 *_t26 = 0;
				_t20 = RegOpenKeyExA(_a4, _a8, 0,  ~_a20 & 0x00000100 | 0x00020019,  &_a20); // executed
				if(_t20 == 0) {
					_a8 = 0x400;
					if(RegQueryValueExA(_a20, _a12, 0,  &_a16, _t26,  &_a8) != 0 || _a16 != 1 && _a16 != 2) {
						 *_t26 = 0;
					}
					_t26[0x3ff] = 0;
					return RegCloseKey(_a20);
				}
				return _t20;
			}

0x0040593a
0x0040593c
0x00405949
0x00405953
0x0040595b
0x00405960
0x0040597c
0x0040598a
0x0040598a
0x0040598f
0x00000000
0x00405995
0x0040599e

APIs

RegOpenKeyExA.KERNELBASE(80000002,00405B62,00000000,00000002,?,00000002,002E1DE5,?,00405B62,80000002,Software\Microsoft\Windows\CurrentVersion,002E1DE5,Remove folder: ,00705CBD), ref: 00405953
RegQueryValueExA.ADVAPI32(002E1DE5,?,00000000,00405B62,002E1DE5,00405B62), ref: 00405974
RegCloseKey.ADVAPI32(?), ref: 00405995

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 20ca1dc64cf80f35bde4a5a459f169022cfe0f17446037da1f5ac97088a586f8
Instruction ID: 36589d6fa93a219f8bc047707fd62eb4045adffcbf025e375e54fe90c3c214b0
Opcode Fuzzy Hash: 20ca1dc64cf80f35bde4a5a459f169022cfe0f17446037da1f5ac97088a586f8
Instruction Fuzzy Hash: 100148B104020AEFDB128F65EC44AEB7FACEF143A4F004426FD44A6160D235D964DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405D61 Relevance: 4.5, APIs: 3, Instructions: 20
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405D61(signed int _a4) {
				struct HINSTANCE__* _t5;
				CHAR* _t7;
				signed int _t9;

				_t9 = _a4 << 3;
				_t7 =  *(_t9 + 0x409218);
				_t5 = GetModuleHandleA(_t7);
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t9 + 0x40921c));
				}
				_t5 = LoadLibraryA(_t7); // executed
				if(_t5 != 0) {
					goto L2;
				}
				return _t5;
			}

0x00405d69
0x00405d6c
0x00405d73
0x00405d7b
0x00405d88
0x00000000
0x00405d8f
0x00405d7e
0x00405d86
0x00000000
0x00000000
0x00405d97

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D73
LoadLibraryA.KERNELBASE(?,?,00000000,00403268,00000008), ref: 00405D7E
GetProcAddress.KERNEL32(00000000,?), ref: 00405D8F

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: dcb02677a219034efdab4e35853fb1e5d97da29e7b116a2417b6d6f34bb30324
Instruction ID: 0b95471442b872ff96c45ebb8895c134e2226d70096e33e0af11a9781a9533ef
Opcode Fuzzy Hash: dcb02677a219034efdab4e35853fb1e5d97da29e7b116a2417b6d6f34bb30324
Instruction Fuzzy Hash: 4CE0CD329045106BC6114B709D4C97773ACDFE5741304493EF505F6150D734AC119FFA

Uniqueness

Uniqueness Score: -1.00%

Function 004035A6 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004035A6() {
				void* _t1;
				void* _t2;
				void* _t3;
				void* _t6;
				signed int _t11;

				_t1 =  *0x409010; // 0xffffffff
				if(_t1 != 0xffffffff) {
					CloseHandle(_t1);
					 *0x409010 =  *0x409010 | 0xffffffff;
				}
				_t2 =  *0x409014; // 0xffffffff
				if(_t2 != 0xffffffff) {
					CloseHandle(_t2);
					 *0x409014 =  *0x409014 | 0xffffffff;
					_t11 =  *0x409014;
				}
				_t3 = E00405368(_t6, _t11, "C:\\Users\\jones\\AppData\\Local\\Temp\\nsk44DC.tmp\\", 7); // executed
				return _t3;
			}

0x004035a6
0x004035b5
0x004035b8
0x004035ba
0x004035ba
0x004035c1
0x004035c9
0x004035cc
0x004035ce
0x004035ce
0x004035ce
0x004035dc
0x004035e2

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,00403416,00000000), ref: 004035B8
CloseHandle.KERNEL32(FFFFFFFF,00000000,00403416,00000000), ref: 004035CC

Strings

C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\, xrefs: 004035D7

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\
API String ID: 2962429428-2287427976
Opcode ID: e791c43d3f2c15357cd5853a26efddeddf9909534bf99fde0ed9ff0c6461a485
Instruction ID: f9564199049be1f32d817ae5fae54506e28515e34a5cdd4db7d8b8eaa5d9f10b
Opcode Fuzzy Hash: e791c43d3f2c15357cd5853a26efddeddf9909534bf99fde0ed9ff0c6461a485
Instruction Fuzzy Hash: 6EE0C230904A10A6C630AF3CBE499063A6C6B413317244B26F174F21F1C778AE428AA9

Uniqueness

Uniqueness Score: -1.00%

Function 00401DC1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00401DC1() {
				char* _t6;
				void* _t16;
				void* _t19;
				void* _t26;

				_t24 = E004029E8(_t19);
				_t6 = E004029E8(0x31);
				_t22 = E004029E8(0x22);
				E004029E8(0x15);
				E00401423(0xffffffec);
				asm("sbb eax, eax");
				asm("sbb eax, eax");
				_t16 = ShellExecuteA( *(_t26 - 0x34),  ~( *_t5) & _t24, _t6,  ~( *_t7) & _t22, "C:\\Program Files\\StarWarsGalaxies\\Mods\\ModSource UI Addon Pack\\Icons",  *(_t26 - 0x18)); // executed
				if(_t16 < 0x21) {
					 *((intOrPtr*)(_t26 - 4)) = 1;
				}
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t26 - 4));
				return 0;
			}

0x00401dc9
0x00401dcb
0x00401ddb
0x00401ddd
0x00401de4
0x00401df0
0x00401dfe
0x00401e07
0x00401e10
0x0040264e
0x0040264e
0x00402880
0x0040288c

APIs

ShellExecuteA.SHELL32(?,00000000,00000000,00000000,C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Icons,?), ref: 00401E07

Strings

C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Icons, xrefs: 00401DF2

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: ExecuteShell
String ID: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Icons
API String ID: 587946157-509314220
Opcode ID: 671cb6f1b25441a3dbf9d97be038341451b7212b7b18c2fb7c683ff49faa5b41
Instruction ID: 801460eca16f60421b3a0b16909c08bbb0204e0179df3ededf74b2257153406f
Opcode Fuzzy Hash: 671cb6f1b25441a3dbf9d97be038341451b7212b7b18c2fb7c683ff49faa5b41
Instruction Fuzzy Hash: A9F0C272B44200ABCB11AFF59D4BE5E2AA4AB11319F20053BF000F61E2D6BDCC419618

Uniqueness

Uniqueness Score: -1.00%

Function 00403E10 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403E10(int _a4) {
				long _t3;

				if(_a4 == 0x78) {
					 *0x42366c =  *0x42366c + 1;
				}
				_t3 = SendMessageA( *0x423ea8, 0x408, _a4, 0); // executed
				return _t3;
			}

0x00403e15
0x00403e17
0x00403e17
0x00403e2e
0x00403e34

APIs

SendMessageA.USER32(00000408,?,00000000,00403A72), ref: 00403E2E

Strings

x, xrefs: 00403E10

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: MessageSend
String ID: x
API String ID: 3850602802-2363233923
Opcode ID: 46d605fedc9b17ed3aa99e624faff798016ffe450984ce7ce2feb54509c3447d
Instruction ID: bce536b892f696ae1651e60f059bf7b80650ebd1e9398ed1803d9b0217867372
Opcode Fuzzy Hash: 46d605fedc9b17ed3aa99e624faff798016ffe450984ce7ce2feb54509c3447d
Instruction Fuzzy Hash: D2C012B2684200BACB205F00DE00F167A31F7A0703F10843AF344200B082B85A22DF0D

Uniqueness

Uniqueness Score: -1.00%

Function 004023A1 Relevance: 3.1, APIs: 2, Instructions: 57
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E004023A1(int* __ebx, char* __esi) {
				void* _t18;
				char* _t19;
				void* _t35;
				void* _t39;
				void* _t42;

				_t37 = __esi;
				_t29 = __ebx;
				_t18 = E00402AF2(_t42, 0x20019); // executed
				_t35 = _t18;
				_t19 = E004029E8(0x33);
				 *__esi = __ebx;
				if(_t35 == __ebx) {
					 *(_t39 - 4) = 1;
				} else {
					 *(_t39 - 8) = 0x3ff;
					if(RegQueryValueExA(_t35, _t19, __ebx, _t39 + 8, __esi, _t39 - 8) != 0) {
						L7:
						 *_t37 = _t29;
						 *(_t39 - 4) = 1;
					} else {
						if( *(_t39 + 8) == 4) {
							__eflags =  *(_t39 - 0x14) - __ebx;
							 *(_t39 - 4) = 0 |  *(_t39 - 0x14) == __ebx;
							E004059A1(__esi,  *__esi);
						} else {
							if( *(_t39 + 8) == 1 ||  *(_t39 + 8) == 2) {
								 *(_t39 - 4) =  *(_t39 - 0x14);
								_t37[ *(_t39 - 8)] = _t29;
							} else {
								goto L7;
							}
						}
					}
					_push(_t35);
					RegCloseKey();
				}
				 *0x423f28 =  *0x423f28 +  *(_t39 - 4);
				return 0;
			}

APIs

Part of subcall function 00402AF2: RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B1A

RegQueryValueExA.ADVAPI32(00000000,00000000,?,000003FF,?,?,?,?,00000033), ref: 004023D1
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsk44DC.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040246F

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: bdc24c0815726b7f2b9a7e1a9f85a5685b2b62bb5d63a9241942baf6c0927b0a
Instruction ID: 717a199c2dc7dc59bf44b4d86f9df1ca50c5fb7cf967777bee29523d37b730e4
Opcode Fuzzy Hash: bdc24c0815726b7f2b9a7e1a9f85a5685b2b62bb5d63a9241942baf6c0927b0a
Instruction Fuzzy Hash: 3E118271A05205EFDB15CFA4CA4C9AE7BB4EF10354F20807FE441B72C0D6B88A45EB26

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				intOrPtr _t15;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t15 =  *0x423ed0; // 0x6f6e14
					_t6 = _t17 * 0x1c + _t15;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x42368c =  *0x42368c + _t12;
						SendMessageA( *(_t18 + 0x18), 0x402, MulDiv( *0x42368c, 0x7530,  *0x423674), 0); // executed
					}
				}
				return 0;
			}

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 7b8e9ba5108b55dad21e1cb19ef7846daac3b048e1c883625bc8c045044f289d
Instruction ID: b71ad761f0ea07ecc4e6183a90c0cd8288537aab3e92bb5761005deb6e4a9b1f
Opcode Fuzzy Hash: 7b8e9ba5108b55dad21e1cb19ef7846daac3b048e1c883625bc8c045044f289d
Instruction Fuzzy Hash: 20014431B24210ABE7291B388D08B2A32ADE714315F10423FF801F32F0D678DC028B4C

Uniqueness

Uniqueness Score: -1.00%

Function 00404EB3 Relevance: 3.0, APIs: 2, Instructions: 32
comCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E00404EB3(signed int __eax) {
				intOrPtr _v0;
				intOrPtr _t8;
				intOrPtr _t10;
				intOrPtr _t11;
				intOrPtr* _t12;

				_t11 =  *0x423ec8; // 0x6df15c
				_t10 =  *0x423ecc; // 0x5d
				__imp__OleInitialize(0);
				 *0x423f58 =  *0x423f58 | __eax;
				E00403E83(0);
				if(_t10 != 0) {
					_t12 = _t11 + 0xc;
					while(1) {
						_t10 = _t10 - 1;
						if(( *(_t12 - 4) & 0x00000001) != 0 && E00401389( *_t12, _v0) != 0) {
							break;
						}
						_t12 = _t12 + 0x418;
						if(_t10 != 0) {
							continue;
						} else {
						}
						goto L7;
					}
					 *0x423f2c =  *0x423f2c + 1;
				}
				L7:
				E00403E83(0x404); // executed
				__imp__OleUninitialize();
				_t8 =  *0x423f2c; // 0x0
				return _t8;
			}

0x00404eb4
0x00404ebb
0x00404ec3
0x00404ec9
0x00404ed1
0x00404ed8
0x00404eda
0x00404edd
0x00404edd
0x00404ee2
0x00000000
0x00000000
0x00404ef3
0x00404efb
0x00000000
0x00000000
0x00404efd
0x00000000
0x00404efb
0x00404eff
0x00404eff
0x00404f05
0x00404f0a
0x00404f0f
0x00404f15
0x00404f1c

APIs

OleInitialize.OLE32(00000000), ref: 00404EC3

Part of subcall function 00403E83: SendMessageA.USER32(000103FA,00000000,00000000,00000000), ref: 00403E95

OleUninitialize.OLE32(00000404,00000000), ref: 00404F0F

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: InitializeMessageSendUninitialize
String ID:
API String ID: 2896919175-0
Opcode ID: fe635c40e0a3ce5fdd9a6fd4f78031530626640be21b6c4bf6cc9e213dd98cda
Instruction ID: a00b44e4301deb9e498e4a6c6aaf3353d831d49d2d83c9c89d01f1ae0c1127da
Opcode Fuzzy Hash: fe635c40e0a3ce5fdd9a6fd4f78031530626640be21b6c4bf6cc9e213dd98cda
Instruction Fuzzy Hash: E4F0BBB7A041019BD3115F54ED01B167774ABD4756F06443FEF44B22E0D77D8942876D

Uniqueness

Uniqueness Score: -1.00%

Function 00402858 Relevance: 3.0, APIs: 2, Instructions: 21
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402858(signed int __eax) {
				RECT* _t10;
				signed int _t12;
				void* _t16;

				_t12 =  *0x421498; // 0x1
				SendMessageA( *(_t16 - 0x34), 0xb, _t12 & __eax, _t10); // executed
				if( *((intOrPtr*)(_t16 - 0x24)) != _t10) {
					InvalidateRect( *(_t16 - 0x34), _t10, _t10);
				}
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t16 - 4));
				return 0;
			}

0x00402858
0x00402867
0x00402870
0x00402877
0x00402877
0x00402880
0x0040288c

APIs

SendMessageA.USER32(?,0000000B,00000001), ref: 00402867
InvalidateRect.USER32(?), ref: 00402877

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: InvalidateMessageRectSend
String ID:
API String ID: 909852535-0
Opcode ID: ffe0577e6c8fc7b528b2f146cf9271b40c79fdb70a9871405927ec7d149bb087
Instruction ID: 47d265bab4c7489263fac7e35293b864a8b68ad0a18c756fc26c12a006359435
Opcode Fuzzy Hash: ffe0577e6c8fc7b528b2f146cf9271b40c79fdb70a9871405927ec7d149bb087
Instruction Fuzzy Hash: B4E0EC72B50108FFDB11DFA4FE85DAE77BAEB44355B10007AF201B10A0D7755D50DA28

Uniqueness

Uniqueness Score: -1.00%

Function 00401D95 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DAB
KiUserCallbackDispatcher.NTDLL(00000000,00000000), ref: 00401DB6

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: CallbackDispatcherShowUserWindow
String ID:
API String ID: 82835404-0
Opcode ID: 896d9aa6a528489eb3d1de80b6da32d6adff090c3d3f8e88cb72edcec62ac4df
Instruction ID: 87c716b605e144f69a9c287c72035feb457677dd11737dea0cbbac412080d302
Opcode Fuzzy Hash: 896d9aa6a528489eb3d1de80b6da32d6adff090c3d3f8e88cb72edcec62ac4df
Instruction Fuzzy Hash: 44E08672E04100DBC710EBB56A89D5D3274DF00369B204437F102F10D1C678DC40866E

Uniqueness

Uniqueness Score: -1.00%

Function 0040571A Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040571A(CHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesA(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileA(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x0040571e
0x0040572b
0x00405740
0x00405746

APIs

GetFileAttributesA.KERNELBASE(00000003,00402C9E,C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe,80000000,00000003), ref: 0040571E
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405740

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6d56aff3fab625e069b8f0f4beb3d6c68df7a2746e2dd21b0a72e0224e52029a
Instruction ID: 90a47e22fdd321f70bf06df01bfdefa11f3e73682391c7296034eb3a8fe04f39
Opcode Fuzzy Hash: 6d56aff3fab625e069b8f0f4beb3d6c68df7a2746e2dd21b0a72e0224e52029a
Instruction Fuzzy Hash: 8CD09E31658301AFEF098F20DD1AF2E7AA2EB84B00F10562CB646940E0D6715815DB16

Uniqueness

Uniqueness Score: -1.00%

Function 004056FB Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004056FB(CHAR* _a4) {
				signed char _t3;
				int _t5;

				_t3 = GetFileAttributesA(_a4); // executed
				if(_t3 != 0xffffffff) {
					_t5 = SetFileAttributesA(_a4, _t3 & 0x000000fe); // executed
					return _t5;
				}
				return _t3;
			}

0x004056ff
0x00405708
0x00405711
0x00000000
0x00405711
0x00405717

APIs

GetFileAttributesA.KERNELBASE(?,00405506,?,?,?), ref: 004056FF
SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405711

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
Instruction ID: 1a0f39e157c28011d0f8c1384ae394ffa0e61bdf00c6ebf87dc07efa44195b5a
Opcode Fuzzy Hash: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
Instruction Fuzzy Hash: 16C04CB1818506ABD6056B24DF0D81F7B66EF90321B108B35F569E00F0C7355C66EE1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402AF2 Relevance: 1.5, APIs: 1, Instructions: 22
registryCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00402AF2(void* __eflags, void* _a4) {
				signed int _t6;
				char* _t8;
				intOrPtr _t9;
				signed int _t11;

				_t6 =  *0x423f50; // 0x0
				_t8 = E004029E8(0x22);
				_t9 =  *0x40939c; // 0x19f418
				_t11 = RegOpenKeyExA(E00402ADD( *((intOrPtr*)(_t9 + 4))), _t8, 0, _t6 | _a4,  &_a4); // executed
				asm("sbb eax, eax");
				return  !( ~_t11) & _a4;
			}

0x00402af9
0x00402b06
0x00402b0c
0x00402b1a
0x00402b22
0x00402b2a

APIs

RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B1A

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 74efa9882ef272ee74e6f4fc3f156a8e5b49cd2219cd822f1e810691b5770b64
Instruction ID: a39c04b8538598ea337aaf08c586a8415de061dfd9d17289158aa853abfe76c1
Opcode Fuzzy Hash: 74efa9882ef272ee74e6f4fc3f156a8e5b49cd2219cd822f1e810691b5770b64
Instruction Fuzzy Hash: 88E04F76250108AFDB00DFA4ED47F9537ECA704341F008421B50CD7091C674E9408B58

Uniqueness

Uniqueness Score: -1.00%

Function 004031A8 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004031A8(void* _a4, long _a8) {
				int _t6;
				long _t10;

				_t10 = _a8;
				_t6 = ReadFile( *0x409010, _a4, _t10,  &_a8, 0); // executed
				if(_t6 == 0 || _a8 != _t10) {
					return 0;
				} else {
					return 1;
				}
			}

0x004031ac
0x004031bf
0x004031c7
0x00000000
0x004031ce
0x00000000
0x004031d0

APIs

ReadFile.KERNELBASE(00409128,00000000,00000000,00000000,00413038,0040B038,004030AD,00413038,00004000,?,00000000,?,00402F37,00000004,00000000,00000000), ref: 004031BF

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: b55c46bdf794a51955d6c22ef273c930d40ecd644cbb4da6e13cbea0766faea3
Instruction ID: b8f1ad64850fa721b7c3123cc302f733781f6218d307da9d2aa6486ecc23217a
Opcode Fuzzy Hash: b55c46bdf794a51955d6c22ef273c930d40ecd644cbb4da6e13cbea0766faea3
Instruction Fuzzy Hash: 4BE08632254119BBCF105E619C00AD73F5CEB0A3A2F008432FD55E9190D230EA11DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00401595 Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401595() {
				int _t5;
				void* _t11;
				int _t14;

				_t5 = SetFileAttributesA(E004029E8(0xfffffff0),  *(_t11 - 0x20)); // executed
				_t14 = _t5;
				if(_t14 == 0) {
					 *((intOrPtr*)(_t11 - 4)) = 1;
				}
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t11 - 4));
				return 0;
			}

0x004015a0
0x004015a6
0x004015a8
0x0040264e
0x0040264e
0x00402880
0x0040288c

APIs

SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A0

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a26b5af8c04b61aa129abfa9028f1dc4a7961c4f0817f0959fd8af5294cfe657
Instruction ID: 9eff7a73b94bef241fdb27fb32fbed064fa3eb5af4cdf1c25ea781f92b105456
Opcode Fuzzy Hash: a26b5af8c04b61aa129abfa9028f1dc4a7961c4f0817f0959fd8af5294cfe657
Instruction Fuzzy Hash: 09D01273B04100D7CB10DFE5AE08A9D7274AB10365B204637D111F11E0D6BDC541561D

Uniqueness

Uniqueness Score: -1.00%

Function 00403E37 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403E37(intOrPtr _a12) {
				intOrPtr _v0;
				struct HWND__* _v4;
				int _t7;
				void* _t8;
				void* _t9;
				void* _t10;

				_t7 = SetDlgItemTextA(_v4, _v0 + 0x3e8, E00405A65(_t8, _t9, _t10, 0, _a12)); // executed
				return _t7;
			}

0x00403e51
0x00403e56

APIs

SetDlgItemTextA.USER32 ref: 00403E51

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: 10611673ba436bc4f6479b3080b0c9d543d7a28eb90490a80d5bb1b9184510a6
Instruction ID: 4cb3e75d10c0f78c378d5622c380c6f1ce37bca011beaecb3981475eea086f33
Opcode Fuzzy Hash: 10611673ba436bc4f6479b3080b0c9d543d7a28eb90490a80d5bb1b9184510a6
Instruction Fuzzy Hash: A5C08C35108200BFD241A714CC42F0FB39CEF94315F00C52EB05CA00D1C63484208E2A

Uniqueness

Uniqueness Score: -1.00%

Function 00403E83 Relevance: 1.5, APIs: 1, Instructions: 9
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403E83(int _a4) {
				struct HWND__* _t2;
				long _t3;

				_t2 =  *0x423678; // 0x103fa
				if(_t2 != 0) {
					_t3 = SendMessageA(_t2, _a4, 0, 0); // executed
					return _t3;
				}
				return _t2;
			}

0x00403e83
0x00403e8a
0x00403e95
0x00000000
0x00403e95
0x00403e9b

APIs

SendMessageA.USER32(000103FA,00000000,00000000,00000000), ref: 00403E95

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 74a19277012f6d931596f598d2f6ffa2ec736fc7041dbb57cfa43a045af561dc
Instruction ID: a690e73a459cda7dc45cd6bfd63986cbe49d30762b834a4efc5073ebf10b1f23
Opcode Fuzzy Hash: 74a19277012f6d931596f598d2f6ffa2ec736fc7041dbb57cfa43a045af561dc
Instruction Fuzzy Hash: 4AC04C717443027AEA309F619D49F177768A750701F5444657204A51D0C674E510D61D

Uniqueness

Uniqueness Score: -1.00%

Function 00403E6C Relevance: 1.5, APIs: 1, Instructions: 6
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403E6C(int _a4) {
				long _t2;

				_t2 = SendMessageA( *0x423ea8, 0x28, _a4, 1); // executed
				return _t2;
			}

0x00403e7a
0x00403e80

APIs

SendMessageA.USER32(00000028,?,00000001,00403C9D), ref: 00403E7A

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5380ca26047a56ac044db27ec5452a3d407db4c462228856e9187df95d64c5b6
Instruction ID: 0662716cb4741bc9db58cdf5bc89cb1196afa115b106f7c4ea820954fb206898
Opcode Fuzzy Hash: 5380ca26047a56ac044db27ec5452a3d407db4c462228856e9187df95d64c5b6
Instruction Fuzzy Hash: 17B09276685201BADA215B10DE09F457E62E764702F018064B204240B0C6B200A5DB09

Uniqueness

Uniqueness Score: -1.00%

Function 004031DA Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004031DA(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x409010, _a4, 0, 0); // executed
				return _t2;
			}

0x004031e8
0x004031ee

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402E86,0000EBE4), ref: 004031E8

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: a4f108b6483d59a247dd719aa3338c70368b303c79d310cc125f674897935547
Instruction ID: 0cdacc43d416a0c3c320ce55ce8d4373a9ea66752a7e2c64ddc4eeaf6ba3fa4d
Opcode Fuzzy Hash: a4f108b6483d59a247dd719aa3338c70368b303c79d310cc125f674897935547
Instruction Fuzzy Hash: 49B01271644200BFDA214F00DF05F057B31B790700F108430B394380F082712420EB0D

Uniqueness

Uniqueness Score: -1.00%

Function 004052E8 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004052E8(int _a4, CHAR* _a8) {
				int _t3;

				_t3 = GetDlgItemTextA( *0x423678, _a4, _a8, 0x400); // executed
				return _t3;
			}

0x004052fb
0x00405301

APIs

GetDlgItemTextA.USER32 ref: 004052FB

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: 2a3cf452a9340375e7ea9e4d6319565003b19af3fd8fe49c2e8af92dd2f11c39
Instruction ID: 30df335a9567130ec804c6d1d151e6d7b01c17dcb48a9d335dbed8569bbd2918
Opcode Fuzzy Hash: 2a3cf452a9340375e7ea9e4d6319565003b19af3fd8fe49c2e8af92dd2f11c39
Instruction Fuzzy Hash: FBB09276608200BFDA125F50DE05E0ABB72FB94312F40C465BB98241B082325822EF0A

Uniqueness

Uniqueness Score: -1.00%

Function 00403E59 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403E59(int _a4) {
				int _t2;

				_t2 = EnableWindow( *0x420490, _a4); // executed
				return _t2;
			}

0x00403e63
0x00403e69

APIs

KiUserCallbackDispatcher.NTDLL(?,00403C36), ref: 00403E63

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: e403f0ca2ac8db45cee2d53ed42ba508999154e311dc39193cc68a7be12fe6b8
Instruction ID: 53812e58dd903fa0e390f444196fc74dc2a222acb2eae657edebaf1cb9a8c705
Opcode Fuzzy Hash: e403f0ca2ac8db45cee2d53ed42ba508999154e311dc39193cc68a7be12fe6b8
Instruction Fuzzy Hash: 23A00176919104AFCA12AB50EE0880ABAA2BBA4705B41C479B2496057587326861EB6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405561 Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405561(CHAR* _a4, intOrPtr _a8) {
				CHAR* _t3;
				char _t4;

				_t3 = _a4;
				while(1) {
					_t4 =  *_t3;
					if(_t4 == 0) {
						break;
					}
					if(_t4 != _a8) {
						_t3 = CharNextA(_t3); // executed
						continue;
					}
					break;
				}
				return _t3;
			}

0x00405561
0x00405574
0x00405574
0x00405578
0x00000000
0x00000000
0x0040556b
0x0040556e
0x00000000
0x0040556e
0x00000000
0x0040556b
0x0040557a

APIs

CharNextA.USER32(?,004032D0,"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe",00000020), ref: 0040556E

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: 10cd4d19b72e12b0d646a530e1cb92258a05f85d45f981c2b986421ba67828a8
Instruction ID: db5ef075456721b90aa4e0f542554a171b524b6474e1f96e6382a0f96a03b25b
Opcode Fuzzy Hash: 10cd4d19b72e12b0d646a530e1cb92258a05f85d45f981c2b986421ba67828a8
Instruction Fuzzy Hash: D1C0806480C58477C91047309C24D6BBFE1FB61341F188457F4C163154C13469408F3E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00401000 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				intOrPtr _t115;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x423eb0; // 0x6dee30
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectA( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextA(_t128, "ModSource UI Addon Pack Setup", 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					_t115 =  *0x423ea8; // 0x0
					 *((intOrPtr*)(_t102 + 4)) = _t115;
				}
				return DefWindowProcA(_a4, _a8, _a12, _t102);
			}

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32 ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32 ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,?), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,ModSource UI Addon Pack Setup,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C
0m, xrefs: 00401039
ModSource UI Addon Pack Setup, xrefs: 00401150

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: 0m$F$ModSource UI Addon Pack Setup
API String ID: 941294808-1396064566
Opcode ID: 1fa3053a276be56ef7da5d68adfba1d9971bfb9fa2beb597bf2db4fb963a824d
Instruction ID: 81477e3a2fde3fb3f26aa953fc06e347994717d76cab2c79682594c458f31f57
Opcode Fuzzy Hash: 1fa3053a276be56ef7da5d68adfba1d9971bfb9fa2beb597bf2db4fb963a824d
Instruction Fuzzy Hash: 8141BC71804249AFCB058FA4CD459BFBFB9FF44314F00802AF551AA1A0C378EA54DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405791 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 144
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00405791() {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t15;
				long _t16;
				intOrPtr _t18;
				int _t20;
				void* _t28;
				long _t29;
				intOrPtr* _t37;
				int _t43;
				void* _t44;
				long _t47;
				CHAR* _t49;
				void* _t51;
				void* _t53;
				intOrPtr* _t54;
				void* _t55;
				void* _t56;

				_t15 = E00405D61(1);
				_t49 =  *(_t55 + 0x18);
				if(_t15 != 0) {
					_t20 =  *_t15( *(_t55 + 0x1c), _t49, 5);
					if(_t20 != 0) {
						L16:
						 *0x423f30 =  *0x423f30 + 1;
						return _t20;
					}
				}
				 *0x422628 = 0x4c554e;
				if(_t49 == 0) {
					L5:
					_t16 = GetShortPathNameA( *(_t55 + 0x1c), 0x4220a0, 0x400);
					if(_t16 != 0 && _t16 <= 0x400) {
						_t43 = wsprintfA(0x421ca0, "%s=%s\r\n", 0x422628, 0x4220a0);
						_t18 =  *0x423eb0; // 0x6dee30
						_t56 = _t55 + 0x10;
						E00405A65(_t43, 0x400, 0x4220a0, 0x4220a0,  *((intOrPtr*)(_t18 + 0x128)));
						_t20 = E0040571A(0x4220a0, 0xc0000000, 4);
						_t53 = _t20;
						 *(_t56 + 0x14) = _t53;
						if(_t53 == 0xffffffff) {
							goto L16;
						}
						_t47 = GetFileSize(_t53, 0);
						_t7 = _t43 + 0xa; // 0xa
						_t51 = GlobalAlloc(0x40, _t47 + _t7);
						if(_t51 == 0 || ReadFile(_t53, _t51, _t47, _t56 + 0x18, 0) == 0 || _t47 !=  *(_t56 + 0x18)) {
							L15:
							_t20 = CloseHandle(_t53);
							goto L16;
						} else {
							if(E0040568F(_t51, "[Rename]\r\n") != 0) {
								_t28 = E0040568F(_t26 + 0xa, 0x409348);
								if(_t28 == 0) {
									L13:
									_t29 = _t47;
									L14:
									E004056DB(_t51 + _t29, 0x421ca0, _t43);
									SetFilePointer(_t53, 0, 0, 0);
									WriteFile(_t53, _t51, _t47 + _t43, _t56 + 0x18, 0);
									GlobalFree(_t51);
									goto L15;
								}
								_t37 = _t28 + 1;
								_t44 = _t51 + _t47;
								_t54 = _t37;
								if(_t37 >= _t44) {
									L21:
									_t53 =  *(_t56 + 0x14);
									_t29 = _t37 - _t51;
									goto L14;
								} else {
									goto L20;
								}
								do {
									L20:
									 *((char*)(_t43 + _t54)) =  *_t54;
									_t54 = _t54 + 1;
								} while (_t54 < _t44);
								goto L21;
							}
							E00405A43(_t51 + _t47, "[Rename]\r\n");
							_t47 = _t47 + 0xa;
							goto L13;
						}
					}
				} else {
					CloseHandle(E0040571A(_t49, 0, 1));
					_t16 = GetShortPathNameA(_t49, 0x422628, 0x400);
					if(_t16 != 0 && _t16 <= 0x400) {
						goto L5;
					}
				}
				return _t16;
			}

APIs

Part of subcall function 00405D61: GetModuleHandleA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D73
Part of subcall function 00405D61: LoadLibraryA.KERNELBASE(?,?,00000000,00403268,00000008), ref: 00405D7E
Part of subcall function 00405D61: GetProcAddress.KERNEL32(00000000,?), ref: 00405D8F

CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000001,?,00000000,?,?,00405526,?,00000000,000000F1,?), ref: 004057DE
GetShortPathNameA.KERNEL32 ref: 004057E7
GetShortPathNameA.KERNEL32 ref: 00405804
wsprintfA.USER32 ref: 00405822
GetFileSize.KERNEL32(00000000,00000000,004220A0,C0000000,00000004,004220A0,?,?,?,00000000,000000F1,?), ref: 0040585D
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,00000000,000000F1,?), ref: 0040586C
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,000000F1,?), ref: 00405882
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00421CA0,00000000,-0000000A,00409348,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004058C8
WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,000000F1,?), ref: 004058DA
GlobalFree.KERNEL32 ref: 004058E1
CloseHandle.KERNEL32(00000000,?,?,00000000,000000F1,?), ref: 004058E8

Part of subcall function 0040568F: lstrlenA.KERNEL32(00000000,?,00000000,00000000,0040589D,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405696
Part of subcall function 0040568F: lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,0040589D,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004056C6

Strings

%s=%s, xrefs: 00405818
(&B, xrefs: 004057CC
[Rename], xrefs: 00405892, 004058A4
0m, xrefs: 0040582A

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: File$Handle$CloseGlobalNamePathShortlstrlen$AddressAllocFreeLibraryLoadModulePointerProcReadSizeWritewsprintf
String ID: %s=%s$(&B$0m$[Rename]
API String ID: 3772915668-3487498229
Opcode ID: 17ed98c844adf507730d0f9ddd61fa41f6776590722b114549cde9ea258fe239
Instruction ID: 908c7a545508c56be73361e54e1fb0a567cb98761eef0cd9d80c3d4c020753a9
Opcode Fuzzy Hash: 17ed98c844adf507730d0f9ddd61fa41f6776590722b114549cde9ea258fe239
Instruction Fuzzy Hash: E9412232A01B11BBE7217B619D49F6B3A6CEB44754F044037FD05F62D2EA78A8018EBD

Uniqueness

Uniqueness Score: -1.00%

Function 00405CA1 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405CA1(CHAR* _a4) {
				char _t5;
				char _t7;
				char* _t15;
				char* _t16;
				CHAR* _t17;

				_t17 = _a4;
				if( *_t17 == 0x5c && _t17[1] == 0x5c && _t17[2] == 0x3f && _t17[3] == 0x5c) {
					_t17 =  &(_t17[4]);
				}
				if( *_t17 != 0 && E004055A3(_t17) != 0) {
					_t17 =  &(_t17[2]);
				}
				_t5 =  *_t17;
				_t15 = _t17;
				_t16 = _t17;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((char*)(E00405561("*?|<>/\":", _t5))) == 0) {
							E004056DB(_t16, _t17, CharNextA(_t17) - _t17);
							_t16 = CharNextA(_t16);
						}
						_t17 = CharNextA(_t17);
						_t5 =  *_t17;
					} while (_t5 != 0);
				}
				 *_t16 =  *_t16 & 0x00000000;
				while(1) {
					_t16 = CharPrevA(_t15, _t16);
					_t7 =  *_t16;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t16 =  *_t16 & 0x00000000;
					if(_t15 < _t16) {
						continue;
					}
					break;
				}
				return _t7;
			}

APIs

CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe",C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405CF9
CharNextA.USER32(?,?,?,00000000), ref: 00405D06
CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe",C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D0B
CharPrevA.USER32(?,?,"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe",C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D1B

Strings

*?|<>/":, xrefs: 00405CE9
"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe", xrefs: 00405CA7
C:\Users\user\AppData\Local\Temp\, xrefs: 00405CA2, 00405CDD

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2395083377
Opcode ID: 15bc7fd2d2b919ada39179901e21ad121c6f5132a4941cfff3b346af0b42011d
Instruction ID: a78f5161a49f52edcd2c6f9413428a1a4edfa6b41d59d307fcbc804f0dcdaaa7
Opcode Fuzzy Hash: 15bc7fd2d2b919ada39179901e21ad121c6f5132a4941cfff3b346af0b42011d
Instruction Fuzzy Hash: 13119055808F912AFB3216245C48BB77F99CF567A0F28847BE4C4632C2C67C5C429B6E

Uniqueness

Uniqueness Score: -1.00%

Function 00402B2D Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 36
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402B2D(struct HWND__* _a4, intOrPtr _a8) {
				char _v68;
				void* _t11;
				CHAR* _t19;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t11 = E00402BA9();
					_t19 = "unpacking data: %d%%";
					if( *0x423eb0 == 0) {
						_t19 = "verifying installer: %d%%";
					}
					wsprintfA( &_v68, _t19, _t11);
					SetWindowTextA(_a4,  &_v68);
					SetDlgItemTextA(_a4, 0x406,  &_v68);
				}
				return 0;
			}

0x00402b3a
0x00402b48
0x00402b4e
0x00402b4e
0x00402b5c
0x00402b5e
0x00402b6a
0x00402b6f
0x00402b71
0x00402b71
0x00402b7c
0x00402b8c
0x00402b9e
0x00402b9e
0x00402ba6

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B48
wsprintfA.USER32 ref: 00402B7C
SetWindowTextA.USER32(?,?), ref: 00402B8C
SetDlgItemTextA.USER32 ref: 00402B9E

Strings

verifying installer: %d%%, xrefs: 00402B71
unpacking data: %d%%, xrefs: 00402B6A, 00402B7A
0m, xrefs: 00402B63

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: 0m$unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-3079143489
Opcode ID: 40a56b2efe0e63d17619f6af21ed40025e58b1cfdcddd68dcd31756625696e51
Instruction ID: b90043e9754d6d0c4b44fa85c4be984605eddfbda74f2dbe380e35ffd387d68b
Opcode Fuzzy Hash: 40a56b2efe0e63d17619f6af21ed40025e58b1cfdcddd68dcd31756625696e51
Instruction Fuzzy Hash: 3CF01270500109ABEB219F50CD09BAA3779BB04345F00803AFA16A91D1D7B969559B99

Uniqueness

Uniqueness Score: -1.00%

Function 00403E9E Relevance: 12.1, APIs: 8, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403E9E(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t35;
				long _t37;
				void* _t40;
				long* _t49;

				if(_a4 + 0xfffffecd > 5) {
					L15:
					return 0;
				}
				_t49 = GetWindowLongA(_a12, 0xffffffeb);
				if(_t49 == 0) {
					goto L15;
				}
				_t35 =  *_t49;
				if((_t49[5] & 0x00000002) != 0) {
					_t35 = GetSysColor(_t35);
				}
				if((_t49[5] & 0x00000001) != 0) {
					SetTextColor(_a8, _t35);
				}
				SetBkMode(_a8, _t49[4]);
				_t37 = _t49[1];
				_v16.lbColor = _t37;
				if((_t49[5] & 0x00000008) != 0) {
					_t37 = GetSysColor(_t37);
					_v16.lbColor = _t37;
				}
				if((_t49[5] & 0x00000004) != 0) {
					SetBkColor(_a8, _t37);
				}
				if((_t49[5] & 0x00000010) != 0) {
					_v16.lbStyle = _t49[2];
					_t40 = _t49[3];
					if(_t40 != 0) {
						DeleteObject(_t40);
					}
					_t49[3] = CreateBrushIndirect( &_v16);
				}
				return _t49[3];
			}

APIs

GetWindowLongA.USER32 ref: 00403EBB
GetSysColor.USER32(00000000), ref: 00403ED7
SetTextColor.GDI32(?,00000000), ref: 00403EE3
SetBkMode.GDI32(?,?), ref: 00403EEF
GetSysColor.USER32(?), ref: 00403F02
SetBkColor.GDI32(?,?), ref: 00403F12
DeleteObject.GDI32(?), ref: 00403F2C
CreateBrushIndirect.GDI32(?), ref: 00403F36

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
Instruction ID: 00f1469000c5a89127aeec98ef40b5380c975c6b17ce5fce2ee989e1a8c22914
Opcode Fuzzy Hash: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
Instruction Fuzzy Hash: D9216271904745ABCB219F68DD08B5BBFF8AF01715B048A69F895E22E1C738E9048B55

Uniqueness

Uniqueness Score: -1.00%

Function 004046B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004046B0(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageA(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageA(_t28, 0x110c, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageA(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004046CB
GetMessagePos.USER32 ref: 004046D3
ScreenToClient.USER32 ref: 004046ED
SendMessageA.USER32(?,00001111,00000000,?), ref: 004046FF
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404725

Strings

f, xrefs: 00404701

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
Instruction ID: 0faaf10df4b3c5b013205b28b163586d08db614e614b64859ce527e54ea6c82f
Opcode Fuzzy Hash: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
Instruction Fuzzy Hash: 9D014071D00219BADB01DBA4DD45BEEBBB8AB55711F10412AFA10B71C0D7B469018B95

Uniqueness

Uniqueness Score: -1.00%

Function 00403897 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403897(void* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t6;
				intOrPtr _t11;
				signed int _t13;
				intOrPtr _t15;
				signed int _t16;
				signed short* _t18;
				signed int _t20;
				signed short* _t23;
				intOrPtr _t25;
				signed int _t26;
				intOrPtr* _t27;

				_t24 = "1033";
				_t13 = 0xffff;
				_t6 = E004059BA(__ecx, "1033");
				while(1) {
					_t26 =  *0x423ee4; // 0x1
					if(_t26 == 0) {
						goto L7;
					}
					_t15 =  *0x423eb0; // 0x6dee30
					_t16 =  *(_t15 + 0x64);
					_t20 =  ~_t16;
					_t18 = _t16 * _t26 +  *0x423ee0;
					while(1) {
						_t18 = _t18 + _t20;
						_t26 = _t26 - 1;
						if((( *_t18 ^ _t6) & _t13) == 0) {
							break;
						}
						if(_t26 != 0) {
							continue;
						}
						goto L7;
					}
					 *0x423680 = _t18[1];
					 *0x423f48 = _t18[3];
					_t23 =  &(_t18[5]);
					if(_t23 != 0) {
						 *0x42367c = _t23;
						E004059A1(_t24,  *_t18 & 0x0000ffff);
						SetWindowTextA( *0x420470, E00405A65(_t13, _t24, _t26, "ModSource UI Addon Pack Setup", 0xfffffffe));
						_t11 =  *0x423ecc; // 0x5d
						_t27 =  *0x423ec8; // 0x6df15c
						if(_t11 == 0) {
							L15:
							return _t11;
						}
						_t25 = _t11;
						do {
							_t11 =  *_t27;
							if(_t11 != 0) {
								_t5 = _t27 + 0x18; // 0x6df174
								_t11 = E00405A65(_t13, _t25, _t27, _t5, _t11);
							}
							_t27 = _t27 + 0x418;
							_t25 = _t25 - 1;
						} while (_t25 != 0);
						goto L15;
					}
					L7:
					if(_t13 != 0xffff) {
						_t13 = 0;
					} else {
						_t13 = 0x3ff;
					}
				}
			}

APIs

SetWindowTextA.USER32(00000000,ModSource UI Addon Pack Setup), ref: 0040392F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403898
0m, xrefs: 004038B5
1033, xrefs: 0040389B, 004038A5, 00403916
ModSource UI Addon Pack Setup, xrefs: 0040391E

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: TextWindow
String ID: 0m$1033$C:\Users\user\AppData\Local\Temp\$ModSource UI Addon Pack Setup
API String ID: 530164218-2476120170
Opcode ID: 0590c8d8e9b7027777a574217597fbbe2b02848195db0d61bb799256cfaae17f
Instruction ID: b6bbef80cf4db276414da2a22f1c4bdb62210e7797b6490b376b442146a2dc11
Opcode Fuzzy Hash: 0590c8d8e9b7027777a574217597fbbe2b02848195db0d61bb799256cfaae17f
Instruction Fuzzy Hash: 9611C271B005119BC334AF15D880A673BBDEB84726369817BE901673D1C67D9E039A58

Uniqueness

Uniqueness Score: -1.00%

Function 00402BC5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402BC5(intOrPtr _a4) {
				char _v68;
				long _t6;
				struct HWND__* _t7;
				struct HWND__* _t14;

				if(_a4 != 0) {
					_t14 =  *0x417044; // 0x0
					if(_t14 != 0) {
						_t14 = DestroyWindow(_t14);
					}
					 *0x417044 = 0;
					return _t14;
				}
				__eflags =  *0x417044; // 0x0
				if(__eflags != 0) {
					return E00405D9A(0);
				}
				_t6 = GetTickCount();
				__eflags = _t6 -  *0x423eac;
				if(_t6 >  *0x423eac) {
					__eflags =  *0x423ea8; // 0x0
					if(__eflags == 0) {
						_t7 = CreateDialogParamA( *0x423ea0, 0x6f, 0, E00402B2D, 0);
						 *0x417044 = _t7;
						return _t7;
					}
					__eflags =  *0x423f54 & 0x00000001;
					if(( *0x423f54 & 0x00000001) != 0) {
						wsprintfA( &_v68, "... %d%%", E00402BA9());
						return E00404DE1(0,  &_v68);
					}
				}
				return _t6;
			}

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402BDD
GetTickCount.KERNEL32 ref: 00402BFB
CreateDialogParamA.USER32(0000006F,00000000,00402B2D,00000000), ref: 00402C4D

Part of subcall function 00402BA9: MulDiv.KERNEL32(00000000,00000064,0000036F), ref: 00402BBE

wsprintfA.USER32 ref: 00402C29

Part of subcall function 00404DE1: lstrlenA.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E1A
Part of subcall function 00404DE1: lstrlenA.KERNEL32(00402C3C,Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E2A
Part of subcall function 00404DE1: lstrcatA.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\,00402C3C,00402C3C,Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\,00000000,00000000,00000000), ref: 00404E3D
Part of subcall function 00404DE1: SetWindowTextA.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsk44DC.tmp\), ref: 00404E4F
Part of subcall function 00404DE1: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E75
Part of subcall function 00404DE1: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E8F
Part of subcall function 00404DE1: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E9D

Strings

... %d%%, xrefs: 00402C23

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: MessageSend$Windowlstrlen$CountCreateDestroyDialogParamTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 632923820-2449383134
Opcode ID: b7f37fca7e9ecb57b9c26b289821bb7ad8d1b39154def1efa3c7b0626f8cb532
Instruction ID: a286a7ec960182cd4c22ef15361b5c0a4849b6f55de65b38dadb26102185fd91
Opcode Fuzzy Hash: b7f37fca7e9ecb57b9c26b289821bb7ad8d1b39154def1efa3c7b0626f8cb532
Instruction Fuzzy Hash: AB019E70909264EBDB21AF60EE4C9AF7B78AB047017004137F402B12D1C6BCA986C6EE

Uniqueness

Uniqueness Score: -1.00%

Function 00401D1B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00401D1B() {
				void* __esi;
				int _t6;
				signed char _t11;
				struct HFONT__* _t14;
				void* _t18;
				void* _t24;
				void* _t26;
				void* _t28;

				_t6 = GetDeviceCaps(GetDC( *(_t28 - 0x34)), 0x5a);
				0x409360->lfHeight =  ~(MulDiv(E004029CB(2), _t6, 0x48));
				 *0x409370 = E004029CB(3);
				_t11 =  *((intOrPtr*)(_t28 - 0x14));
				 *0x409377 = 1;
				 *0x409374 = _t11 & 0x00000001;
				 *0x409375 = _t11 & 0x00000002;
				 *0x409376 = _t11 & 0x00000004;
				E00405A65(_t18, _t24, _t26, "MS Shell Dlg",  *((intOrPtr*)(_t28 - 0x20)));
				_t14 = CreateFontIndirectA(0x409360);
				_push(_t14);
				_push(_t26);
				E004059A1();
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t28 - 4));
				return 0;
			}

0x00401d29
0x00401d42
0x00401d4c
0x00401d51
0x00401d5c
0x00401d63
0x00401d75
0x00401d7b
0x00401d80
0x00401d8a
0x004024aa
0x00401561
0x00402825
0x00402880
0x0040288c

APIs

GetDC.USER32(?), ref: 00401D22
GetDeviceCaps.GDI32(00000000), ref: 00401D29
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D38
CreateFontIndirectA.GDI32(00409360), ref: 00401D8A

Strings

MS Shell Dlg, xrefs: 00401D70

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirect
String ID: MS Shell Dlg
API String ID: 3272661963-76309092
Opcode ID: d25d5760df5b0df43be3d8ae703b30a45896724f35112cb07b7d2458aea421c2
Instruction ID: 726e2bb9bd89ce2300a463594e38ea09ef541e50853f711413bf27fbe0b36a1d
Opcode Fuzzy Hash: d25d5760df5b0df43be3d8ae703b30a45896724f35112cb07b7d2458aea421c2
Instruction Fuzzy Hash: 36F0AFB0A48640AEE7019770AE1FF9A7B64A719305F104539F943BA1E3C6BC0800CF3E

Uniqueness

Uniqueness Score: -1.00%

Function 00402A28 Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402A28(void* _a4, char* _a8, long _a12) {
				void* _v8;
				char _v272;
				signed char _t16;
				long _t18;
				long _t25;
				intOrPtr* _t27;
				long _t28;

				_t16 =  *0x423f50; // 0x0
				_t18 = RegOpenKeyExA(_a4, _a8, 0, _t16 | 0x00000008,  &_v8);
				if(_t18 == 0) {
					while(RegEnumKeyA(_v8, 0,  &_v272, 0x105) == 0) {
						__eflags = _a12;
						if(_a12 != 0) {
							RegCloseKey(_v8);
							L8:
							__eflags = 1;
							return 1;
						}
						_t25 = E00402A28(_v8,  &_v272, 0);
						__eflags = _t25;
						if(_t25 != 0) {
							break;
						}
					}
					RegCloseKey(_v8);
					_t27 = E00405D61(2);
					if(_t27 == 0) {
						__eflags =  *0x423f50; // 0x0
						if(__eflags != 0) {
							goto L8;
						}
						_t28 = RegDeleteKeyA(_a4, _a8);
						__eflags = _t28;
						if(_t28 != 0) {
							goto L8;
						}
						return _t28;
					}
					return  *_t27(_a4, _a8,  *0x423f50, 0);
				}
				return _t18;
			}

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000000,?), ref: 00402A49
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402A85
RegCloseKey.ADVAPI32(?), ref: 00402A8E
RegCloseKey.ADVAPI32(?), ref: 00402AB3
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402AD1

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: a61128f766634d1b09b7f86fa8ddb2e0bbd886536e59b65217dedb63a7548a6d
Instruction ID: 394863395e6dccb867c0517941854db7f187baa007d88d6d2aa213ab3b23956e
Opcode Fuzzy Hash: a61128f766634d1b09b7f86fa8ddb2e0bbd886536e59b65217dedb63a7548a6d
Instruction Fuzzy Hash: D0115931A00109FFDF21AF90DE48DAB3B79EB44395B104536BA05A01A0DB749E51EE69

Uniqueness

Uniqueness Score: -1.00%

Function 00401CC1 Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401CC1(int __edx) {
				void* _t17;
				struct HINSTANCE__* _t21;
				struct HWND__* _t25;
				void* _t27;

				_t25 = GetDlgItem( *(_t27 - 0x34), __edx);
				GetClientRect(_t25, _t27 - 0x40);
				_t17 = SendMessageA(_t25, 0x172, _t21, LoadImageA(_t21, E004029E8(_t21), _t21,  *(_t27 - 0x38) *  *(_t27 - 0x1c),  *(_t27 - 0x34) *  *(_t27 - 0x1c), 0x10));
				if(_t17 != _t21) {
					DeleteObject(_t17);
				}
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t27 - 4));
				return 0;
			}

0x00401ccb
0x00401cd2
0x00401d01
0x00401d09
0x00401d10
0x00401d10
0x00402880
0x0040288c

APIs

GetDlgItem.USER32 ref: 00401CC5
GetClientRect.USER32 ref: 00401CD2
LoadImageA.USER32 ref: 00401CF3
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D01
DeleteObject.GDI32(00000000), ref: 00401D10

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 93d2110668d3094e167584d1b1b6540c5cd1076fe79007bc13e6d0e6a309afb7
Instruction ID: ad5020e38ef11d08f371025551c7f23f007b957d45941c5b52acf933ea75ddf9
Opcode Fuzzy Hash: 93d2110668d3094e167584d1b1b6540c5cd1076fe79007bc13e6d0e6a309afb7
Instruction Fuzzy Hash: 31F0F9B2A04105BFD700EBA4EE89DAFB7BDEB44341B104476F601F21A0C7789D018B29

Uniqueness

Uniqueness Score: -1.00%

Function 004055CA Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004055CA(char _a4) {
				CHAR* _t3;
				char* _t5;
				CHAR* _t7;
				CHAR* _t8;
				void* _t10;

				_t1 =  &_a4; // 0x40537c
				_t8 =  *_t1;
				_t7 = CharNextA(_t8);
				_t3 = CharNextA(_t7);
				if( *_t8 == 0 ||  *_t7 != 0x5c3a) {
					if( *_t8 != 0x5c5c) {
						L8:
						return 0;
					}
					_t10 = 2;
					while(1) {
						_t10 = _t10 - 1;
						_t5 = E00405561(_t3, 0x5c);
						if( *_t5 == 0) {
							goto L8;
						}
						_t3 = _t5 + 1;
						if(_t10 != 0) {
							continue;
						}
						return _t3;
					}
					goto L8;
				} else {
					return CharNextA(_t3);
				}
			}

APIs

CharNextA.USER32(|S@,?,C:\,00000000,0040562E,C:\,C:\,?,?,7476F560,0040537C,?,"C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe",7476F560), ref: 004055D8
CharNextA.USER32(00000000), ref: 004055DD
CharNextA.USER32(00000000), ref: 004055EC

Strings

C:\, xrefs: 004055CB
|S@, xrefs: 004055D3, 004055D7

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: CharNext
String ID: C:\$|S@
API String ID: 3213498283-628904129
Opcode ID: 28ecaceb9e9ffd293fb97d6fe9204fba0278c1012160d9bc2691c12c1e9fd827
Instruction ID: 59c8476761b09c245942ad27e65994d154511812b78a9f1548afb2a8e03f2f93
Opcode Fuzzy Hash: 28ecaceb9e9ffd293fb97d6fe9204fba0278c1012160d9bc2691c12c1e9fd827
Instruction Fuzzy Hash: C6F02751904E2166E73262644C04B3B979CDB95310F080837E201B71D1C2B84C82DFAE

Uniqueness

Uniqueness Score: -1.00%

Function 004052A3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004052A3(CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x4224a0->cb = 0x44;
				_t7 = CreateProcessA(0, _a4, 0, 0, 0, 0, 0, 0, 0x4224a0,  &_v20);
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x004052ac
0x004052c8
0x004052d0
0x004052d5
0x00000000
0x004052db
0x004052df

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004224A0,Error launching installer), ref: 004052C8
CloseHandle.KERNEL32(?), ref: 004052D5

Strings

Error launching installer, xrefs: 004052B6
C:\Users\user\AppData\Local\Temp\, xrefs: 004052A3

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: C:\Users\user\AppData\Local\Temp\$Error launching installer
API String ID: 3712363035-1785902839
Opcode ID: 6b6a0bc2a3a2861d1b4fb8cb28cdb7ee12dd8b27d4ddea3b465ed8bf02dd5c13
Instruction ID: a902a948de4d47caae69ccc844ec3c4844eb40df907f1985e70e83d94773ad0e
Opcode Fuzzy Hash: 6b6a0bc2a3a2861d1b4fb8cb28cdb7ee12dd8b27d4ddea3b465ed8bf02dd5c13
Instruction Fuzzy Hash: 9CE0ECB4A00209BFDB00AF64ED09A6B7BBDFB04308F808522A911E2190D774E8108A79

Uniqueness

Uniqueness Score: -1.00%

Function 00405536 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405536(CHAR* _a4) {
				CHAR* _t7;

				_t7 = _a4;
				if( *(CharPrevA(_t7,  &(_t7[lstrlenA(_t7)]))) != 0x5c) {
					lstrcatA(_t7, 0x40900c);
				}
				return _t7;
			}

0x00405537
0x0040554e
0x00405556
0x00405556
0x0040555e

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040320F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 0040553C
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040320F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405545
lstrcatA.KERNEL32(?,0040900C), ref: 00405556

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405536

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: 103a7f091eca4e356757d037532255daa0bd9c7b09fb9152348cdcff170487b5
Instruction ID: a8815a40c5cf52564b0ee38fd83154c3193b14c3492e6d39585f1257e3d031c0
Opcode Fuzzy Hash: 103a7f091eca4e356757d037532255daa0bd9c7b09fb9152348cdcff170487b5
Instruction Fuzzy Hash: 82D0A9A2605A30BEE20232198C09E8B2A09CF02310B054422F200B62D2C2BC8E018FFE

Uniqueness

Uniqueness Score: -1.00%

Function 00401EC5 Relevance: 6.1, APIs: 4, Instructions: 54
memoryCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00401EC5(char __ebx, char* __edi, char* __esi) {
				char* _t18;
				int _t19;
				void* _t30;

				_t18 = E004029E8(0xffffffee);
				 *(_t30 - 0x2c) = _t18;
				_t19 = GetFileVersionInfoSizeA(_t18, _t30 - 0x30);
				 *__esi = __ebx;
				 *(_t30 - 8) = _t19;
				 *__edi = __ebx;
				 *((intOrPtr*)(_t30 - 4)) = 1;
				if(_t19 != __ebx) {
					__eax = GlobalAlloc(0x40, __eax);
					 *(__ebp + 8) = __eax;
					if(__eax != __ebx) {
						if(__eax != 0) {
							__ebp - 0x44 = __ebp - 0x34;
							if(VerQueryValueA( *(__ebp + 8), 0x40900c, __ebp - 0x34, __ebp - 0x44) != 0) {
								 *(__ebp - 0x34) = E004059A1(__esi,  *((intOrPtr*)( *(__ebp - 0x34) + 8)));
								 *(__ebp - 0x34) = E004059A1(__edi,  *((intOrPtr*)( *(__ebp - 0x34) + 0xc)));
								 *((intOrPtr*)(__ebp - 4)) = __ebx;
							}
						}
						_push( *(__ebp + 8));
						GlobalFree();
					}
				}
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t30 - 4));
				return 0;
			}

APIs

GetFileVersionInfoSizeA.VERSION(00000000,?,000000EE), ref: 00401ED4
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401EF2
GetFileVersionInfoA.VERSION(?,?,?,00000000), ref: 00401F0B
VerQueryValueA.VERSION(?,0040900C,?,?,?,?,?,00000000), ref: 00401F24

Part of subcall function 004059A1: wsprintfA.USER32 ref: 004059AE

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: 72b002e25d23746f55465e87ebc4891665adca6a8565e1daa1fca067951ffbc1
Instruction ID: 4c29c4488d16eb6d588cf0a37e271aba1ea36fdfc8d1aea13138bc9de0436761
Opcode Fuzzy Hash: 72b002e25d23746f55465e87ebc4891665adca6a8565e1daa1fca067951ffbc1
Instruction Fuzzy Hash: 3B1136B2900109BEDB01EFA5D981DAEBBB9AF04344B20803AF501F61E1D7388A55DB28

Uniqueness

Uniqueness Score: -1.00%

Function 0040557D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040557D(char* _a4) {
				char* _t3;
				char* _t5;

				_t5 = _a4;
				_t3 =  &(_t5[lstrlenA(_t5)]);
				while( *_t3 != 0x5c) {
					_t3 = CharPrevA(_t5, _t3);
					if(_t3 > _t5) {
						continue;
					}
					break;
				}
				 *_t3 =  *_t3 & 0x00000000;
				return  &(_t3[1]);
			}

0x0040557e
0x00405588
0x0040558a
0x00405591
0x00405599
0x00000000
0x00000000
0x00000000
0x00405599
0x0040559b
0x004055a0

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack,00402CC7,C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack,C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack,C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe,C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe,80000000,00000003), ref: 00405583
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack,00402CC7,C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack,C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack,C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe,C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe,80000000,00000003), ref: 00405591

Strings

C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack, xrefs: 0040557D

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack
API String ID: 2709904686-1322520264
Opcode ID: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction ID: a78a31216ab9b60c328ce82f5fccc260d5afe3ad280ceae17d90b4b54361c34b
Opcode Fuzzy Hash: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction Fuzzy Hash: 56D09E62509AA06EE30266549C04B9B6A49DB16710F195862E540A6195C2785D418EA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040568F Relevance: 5.0, APIs: 4, Instructions: 30
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040568F(CHAR* _a4, CHAR* _a8) {
				int _t10;
				int _t15;
				CHAR* _t16;

				_t15 = lstrlenA(_a8);
				_t16 = _a4;
				while(lstrlenA(_t16) >= _t15) {
					 *(_t15 + _t16) =  *(_t15 + _t16) & 0x00000000;
					_t10 = lstrcmpiA(_t16, _a8);
					if(_t10 == 0) {
						return _t16;
					}
					_t16 = CharNextA(_t16);
				}
				return 0;
			}

0x0040569b
0x0040569d
0x004056c5
0x004056aa
0x004056af
0x004056ba
0x00000000
0x004056d7
0x004056c3
0x004056c3
0x00000000

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,0040589D,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405696
lstrcmpiA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0040589D,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004056AF
CharNextA.USER32(00000000,?,?,00000000,000000F1,?), ref: 004056BD
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,0040589D,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004056C6

Memory Dump Source

Source File: 00000001.00000002.421421040.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.421415846.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421431397.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000426000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421438450.0000000000433000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.421499046.000000000043D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ModSource UI Addon Pack.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
Instruction ID: f65b762de9c196bf4895d9b9c03b18621a66a0ffa1d04d6b890c27cf309056ad
Opcode Fuzzy Hash: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
Instruction Fuzzy Hash: 0EF0A736249D51DBC2025B655C04E7B7E94EF92354B640D7AF444F2240D33A98159FBF

Uniqueness

Uniqueness Score: -1.00%

Source: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Updater\ModSource UI Addon Pack Auto Updater Silent.exe	ReversingLabs: Detection: 23%
Source: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Updater\ModSource UI Addon Pack Auto Updater.exe	ReversingLabs: Detection: 17%
Source: C:\Users\user\AppData\Local\Temp\ModSource UI Addon Pack\ModSource UI Addon Pack.exe	ReversingLabs: Detection: 14%

Source: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Updater\ModSource UI Addon Pack Auto Updater.exe	Joe Sandbox ML: detected
Source: C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Updater\ModSource UI Addon Pack Auto Updater Silent.exe	Joe Sandbox ML: detected

Source: 1.2.ModSource UI Addon Pack.exe.2c18226.6.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.2.ModSource UI Addon Pack.exe.2bed809.4.unpack	Avira: Label: TR/Patched.Ren.Gen

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 07 Feb 2023 18:59:10 GMTServer: ApacheX-BP-NSA-REQID: (null) n.12UID=1146X-Content-Type-Options: nosniffUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 29 May 2018 23:27:39 GMTETag: "1b63-56d60947c10c0"Accept-Ranges: bytesContent-Length: 7011Vary: Accept-EncodingContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 2d 68 6f 72 22 20 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 6d 69 72 6f 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 76 69 73 69 74 2d 61 66 74 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 33 20 64 61 79 73 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 20 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 4e 4f 49 4e 44 45 58 2c 20 46 4f 4c 4c 4f 57 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 68 65 69 67 68 74 3d 64 65 76 69 63 65 2d 68 65 69 67 68 74 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 38 30 78 31 38 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2e 70 6e 67 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 66 61 76 69 63 6f 6e 2d 33 32 78 33 32 2e 70 6e 67 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 07 Feb 2023 18:59:10 GMTServer: ApacheX-BP-NSA-REQID: (null) n.12UID=1562X-Content-Type-Options: nosniffUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 29 May 2018 23:27:39 GMTETag: "1b63-56d60947c10c0"Accept-Ranges: bytesContent-Length: 7011Vary: Accept-EncodingContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 2d 68 6f 72 22 20 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 6d 69 72 6f 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 76 69 73 69 74 2d 61 66 74 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 33 20 64 61 79 73 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 20 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 4e 4f 49 4e 44 45 58 2c 20 46 4f 4c 4c 4f 57 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 68 65 69 67 68 74 3d 64 65 76 69 63 65 2d 68 65 69 67 68 74 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 38 30 78 31 38 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2e 70 6e 67 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 66 61 76 69 63 6f 6e 2d 33 32 78 33 32 2e 70 6e 67 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 07 Feb 2023 18:59:15 GMTServer: ApacheX-BP-NSA-REQID: (null) n.12UID=1888X-Content-Type-Options: nosniffUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 29 May 2018 23:27:39 GMTETag: "1b63-56d60947c10c0"Accept-Ranges: bytesContent-Length: 7011Vary: Accept-EncodingContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 2d 68 6f 72 22 20 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 6d 69 72 6f 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 76 69 73 69 74 2d 61 66 74 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 33 20 64 61 79 73 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 20 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 4e 4f 49 4e 44 45 58 2c 20 46 4f 4c 4c 4f 57 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 68 65 69 67 68 74 3d 64 65 76 69 63 65 2d 68 65 69 67 68 74 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 38 30 78 31 38 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2e 70 6e 67 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 66 61 76 69 63 6f 6e 2d 33 32 78 33 32 2e 70 6e 67 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 07 Feb 2023 18:59:15 GMTServer: ApacheX-BP-NSA-REQID: (null) n.12UID=827X-Content-Type-Options: nosniffUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 29 May 2018 23:27:39 GMTETag: "1b63-56d60947c10c0"Accept-Ranges: bytesContent-Length: 7011Vary: Accept-EncodingContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 2d 68 6f 72 22 20 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 6d 69 72 6f 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 76 69 73 69 74 2d 61 66 74 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 33 20 64 61 79 73 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 20 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 4e 4f 49 4e 44 45 58 2c 20 46 4f 4c 4c 4f 57 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 68 65 69 67 68 74 3d 64 65 76 69 63 65 2d 68 65 69 67 68 74 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 38 30 78 31 38 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2e 70 6e 67 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 66 61 76 69 63 6f 6e 2d 33 32 78 33 32 2e 70 6e 67 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 70 6c 61 63 65 64 2e 6e 65 74 2f 66

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\StarWarsGalaxies\ModSource UI Addon Pack Uninstall.log

C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Documentation\Changelog_PreNGE_UI.txt

C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Documentation\Readme ModSource UI Addon Pack.html

C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Documentation\Readme_Anachs_PreNGE_UI.txt

C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Documentation\readme_BattleBackground.txt

C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Documentation\reticle_readme.txt

C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Icons\Readme.ico

C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Icons\Uninstall.ico

C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Icons\Update.ico

C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Icons\Web.ico

C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Uninstall the ModSource UI Addon Pack.exe

C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Updater\ModSource UI Addon Pack Auto Updater Silent.exe

C:\Program Files\StarWarsGalaxies\Mods\ModSource UI Addon Pack\Updater\ModSource UI Addon Pack Auto Updater.exe

C:\Program Files\StarWarsGalaxies\Sample\item_close_metal_can_cntner.wav

C:\Program Files\StarWarsGalaxies\Sample\item_fusioncutter_end.wav

C:\Program Files\StarWarsGalaxies\Sample\item_open_metal_can_cntner.wav

C:\Program Files\StarWarsGalaxies\Sample\ui_button_arrow_back.wav

C:\Program Files\StarWarsGalaxies\Sample\ui_button_arrow_forward.wav

Windows Analysis Report
SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146.exe